OpenCode Hacked: User credentials leaked

[OP] pranshuchittora | 4 hours ago

From OpenCode Team

---

Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.

We’re sorry this happened and will follow up with any updates.

sebastiansm7 | 3 hours ago

We were planning to fix our vibecoded mess.

TZubiri | 2 hours ago

it’s funny how no one ever announces their critical vulns with “we have been hacked, you should uninstall our software and use something else”, at some point in the severity of the vuln that should be the conclusion, but no one ever says it

qlte | 57 minutes ago

> uninstall our software

This was a leak of keys added in a web UI

bewareofscams | 4 hours ago

I told you so: https://news.ycombinator.com/item?id=49243119

Me, 68 days ago:

> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.

> https://github.com/anomalyco/opencode/issues/10416

lousken | 3 hours ago

If i dont use any of their models nor i am signed in, is that a problem? i dont see anything in wireshark except for models.opencode.ai

neya | 3 hours ago

Damn, that sucks. I didn't know OpenCode was this bad when it came to privacy.

tadasv | 2 hours ago

This is one of the reasons I don't trust opencode. It looked very nice on paper when it first came out and there were no alternatives. However, today I'd probably stick with simple pi setup (not sure how much better than opencode, but it looks like they don't have all this cloud stuff) or just use one of the big tech agents and call it a day.

lukewarm707 | 2 hours ago

"when challenged about sending data to openrouter without listing it as a 3rd party processor they offered a dismissive response. the same with running prompts through cloudflare. seems trivial, but signifies general disinterest in security."

I did have an account but moved off for security reasons.

fleshers | 4 hours ago

I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?

odo1242 | 3 hours ago

Yes

[OP] pranshuchittora | 3 hours ago

It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.

ipsum2 | 3 hours ago

"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.

vdfs | 3 hours ago

Obviously they don't want to share details because it's ongoing

DavCreator | 4 hours ago

https://xxcancel.com/opencode

vinni2 | 4 hours ago

But isn’t OpenCode open source why does it need credentials.

progval | 3 hours ago

For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.

dist-epoch | 3 hours ago

Maybe they support cloud agents.

himata4113 | 3 hours ago

They function similar to openrouter BYOK.

trollbridge | 2 hours ago

Because people cut and pasted them in.

kelvinjps10 | 3 hours ago

opencode go and zen?

preommr | 3 hours ago

Why are the comments pointing out there were warning signs early on being downvoted/flagged?

I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?

jchw | 3 hours ago

I think it may just be bad automated flagging. I vouch'd them since they don't really seem to violate any rules/guidelines (right?)

himata4113 | 3 hours ago

Indeed. I've seen it happen before and it appears that they have automatic downvoting based on some criteria, possibly just some classifier. I've attributed it to some bot attack before, but it's a bit too common now.

dylan604 | 3 hours ago

Why does it being common downplay the bot attack to you? As time goes on, I'd assume bots activity to increase. I do not see it ever going away.

himata4113 | 3 hours ago

bots get caught and downvoting requires reputation.

c-hendricks | an hour ago

All the comments I've seen about warning signs point to opencode the cli, where this is about one of opencode's hosted services.

InsideOutSanta | an hour ago

Because they're unrelated to this incident.

jchw | 3 hours ago

I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.

hahajk | 3 hours ago

This appears to affect users of Opencode Console, which appears to be an Openrouter-type thing?

https://dev.opencode.ai/console/

It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI

From https://opencode.ai/v2/docs#connect :

> If you’d like easy access to all the best coding models you can try out OpenCode Console.

neya | 3 hours ago

Turns out even if you used credentials locally, you could've have been impacted as the .env files were also consumed by the agents. This is from some comments on Reddit / Google, so take it with a grain of salt.

[OP] pranshuchittora | 3 hours ago

I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many. I never ask for upvotes, but would be great if you can upvote it. Thanks!

ShowalkKama | 3 hours ago

The title should say "OpenCode Console" not "OpenCode".

yorwba | 3 hours ago

How did you determine that it has been "flagged by many"?

[OP] pranshuchittora | 3 hours ago

The post was visible when I am logged in. But when I opened the /newest page on incognito the post wasn't there.

senordevnyc | 3 hours ago

It’s #14 on homepage when not logged in, same as when logged in.

[OP] pranshuchittora | 2 hours ago

Now it is

xendo | 2 hours ago

It's clearly heavily down voted, just look at when it was added, how many points it has and its relative position.

throwoutway | 54 minutes ago

You cant downvote HN posts (comments you can)

_fw | 42 minutes ago

Afaik flagging acts like a super-downvote as far as the algorithm is concerned

an0malous | 42 minutes ago

They presumably meant that it’s been downranked relative to what you’d expect from a post with that many upvotes in that short of a time frame. Hundreds of upvotes in a few hours is usually a top 5 post

Barbing | 10 minutes ago

Interesting, #1 raw rank yet never made it past ~#10 - haven’t seen that specifically: https://news.social-protocols.org/stats?id=50133401

trollbridge | 2 hours ago

Then next time do a less clickbait-y title: OpenCode had a leak of API keys for their service that is similar to OpenRouter; this does not affect most users.

tekacs | an hour ago

It's a little more than that. It seems that keys for OpenAI / Anthropic APIs that were STORED on OpenCode's OpenRouter-like backend got leaked – which additionally means that OpenCode has no ability to refund people for their losses.

an0malous | 46 minutes ago

Oh they’re a YC company: https://www.ycombinator.com/companies/opencode

verbo_villain | 3 hours ago

So are people going to wake up and see their Anthropic, openAI, etc accounts drained?

[OP] pranshuchittora | 2 hours ago

Yes

jprokay13 | 2 hours ago

I saw the email this morning from OpenCode about my key being compromised alongside an email from Anthropic stating that I used up my $20 in API credits for the month. I hope they built something cool with those tokens!

oldfuture | 3 hours ago

https://news.ycombinator.com/item?id=50108261

that's why virustotal was flagging it then

ameliaquining | 3 hours ago

It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.

Ciantic | 3 hours ago

I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.

Tiberium | 3 hours ago

It actually is a thing, although indirectly in a hacky way! If you push keys from GitHub secret scanning partners to a public repo or a gist, they get sent to the partner who (usually) instantly revoke them. So if you want to help someone, just make a public gist with the key and delete it like 15 seconds later, it'll be enough.

https://docs.github.com/en/code-security/reference/secret-se... has a table with the active partners

Ciantic | 3 hours ago

Only responsible thing in this case would have been for OpenCode people to invalidate all keys. But I guess it is not that straightforward if Anthropic/OpenAI etc don't have endpoint for it.

ameliaquining | 3 hours ago

There's no self-serve endpoint, but OpenCode could send the inference providers the leaked keys and ask for them to be revoked, which is a thing the inference providers can do. It's possible that this'll happen, apparently remediation is still in progress.

orf | an hour ago

That just turns a credential leak into a denial of service - one that can be triggered from anywhere.

flaunf221 | an hour ago

Not any more than any other public endpoint service exposes. This revocation endpoint can be protected by auth too. Use API key that you're revoking in auth.

orf | an hour ago

How does that make any sense?

flaunf221 | an hour ago

I see now from another comment you thought about denial of service for service that leaked key. And I thought about mass leak resulting in DDOS onto API provider. Wrong guess from me.

max__dev | an hour ago

Yes. Is this a bad thing?

orf | an hour ago

Of course it is? A key for some weather API getting leaked isn’t the end of the world, but having it revoked and breaking your weather app is.

shepherdjerred | an hour ago

In this case you'd probably prefer your key to be disabled rather than spending $$$ on tokens for everyone else

orf | an hour ago

Think that through - the person who stole the key has the decision to use it or revoke it through this hypothetical system.

If they are acting maliciously, they will take the choice that most hurts you and/or benefits them.

If the key is useless to them and revoking it hurts you, then they would do that.

If the key wasn’t useless to them, then… they would just use it and not revoke it?

djchen | 3 hours ago

Is my understanding correct that this only affected some OpenCode Zen users who stored their (BYOK) API keys from Anthropic/Google/OpenAI?

In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.

nightpool | 3 hours ago

That's the only known impact so far. But we don't know the details of how these keys were exposed, so it's not entirely clear why or how "only keys" might have been affected

MisterMunchkin | 3 hours ago

It’s fascinating that tokens are so valuable that people are spending so much time and effort hacking to obtain API keys.

nacs | 3 hours ago

They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.

[OP] pranshuchittora | 2 hours ago

The tokens of frontier are valuable...

qlte | 53 minutes ago

API keys have been routinely stolen in mass automated attacks for malicious usage long before LLMs even existed

computerex | 3 hours ago

Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?

[OP] pranshuchittora | 3 hours ago

They need to explain this, by releasing a detailed RCA.

ameliaquining | 3 hours ago

If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.

InsideOutSanta | 2 hours ago

The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.

rvz | 3 hours ago

Looking forward to the post-mortem of this incident.

[OP] pranshuchittora | 2 hours ago

Yes, I am interested in how a distillation attack can leak credentials...

monster_truck | 3 hours ago

Wait, is the openchode hack the cause of all the people complaining about their OAI usage getting drained/vanishing at alarming rates? That's pretty funny ngl.

The way some of this place's employees post and act online, can't say I feel all that bad.

searealist | 3 hours ago

> security breach

> related to a large scale distillation attack

I'm not sure how this adds up. I could understand if this impacted their uptime, but not security.

Are they actually saying a bunch of credentials were stolen and are being used for distillation?

[OP] pranshuchittora | 2 hours ago

Yes, they think we are foooool

thway15269037 | 2 hours ago

Was it opencode who bragged about their vibecoding tokenmaxxing attitude or I'm mixing them with someone else?

bakugo | 2 hours ago

Honestly, who isn't bragging about their vibecoding tokenmaxxing attitude nowadays?

9021007 | 2 hours ago

https://nitter.click/opencode/status/2111516673953935833

yipinwong | 2 hours ago

wtf was I getting many use OpenCode on OpenCode cloud emails last few days. Were they set up so that hackers can get more info?

[OP] pranshuchittora | 2 hours ago

Awaiting for detailed breakdown of the incident. I am more interested in knowing , how can a distillation attack leak / expose credentials.

TZubiri | 2 hours ago

4 days ago red flags were raised

https://news.ycombinator.com/item?id=50075319

https://news.ycombinator.com/item?id=50060694

what’s interesting is that all those efforts that go into sandboxing through virtualization wouldn’t have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.

of course any sensible engineer that uninstalled this 6 months ago and used codex and claude code directly also avoided this, gg

nrmitchi | an hour ago

What the the purpose of this comment? Neither of those "red flags" you linked to are related (one is about config loading precedence, and the other is about Codex CLI, which is completely a completely different product and development team.

Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.

Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.

latchkey | 2 hours ago

the ux is kind of crazy.

you login to their website, and you are presented with a list of providers where you can click and add your provider api key.

how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.

from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.

someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.

https://github.com/anomalyco/opencode/issues/10416#issuecomm...

InsideOutSanta | an hour ago

FWIW, OpenRouter has the exact same feature.

latchkey | an hour ago

and their TOS/Privacy policies are equally light on details.

rozenmd | an hour ago

@dang this title needs updating: "OpenCode Console hacked: User credentials leaked"

The opencode CLI has no impact.

Rapzid | an hour ago

It doesn't say the CLI was hacked does it?

qlte | an hour ago

OpenCode = OpenCode CLI to most people (as seen in the dozens of comments making that assumption in this thread)

hypfer | 59 minutes ago

They have shown so so so many times that their culture is not aligned with trustworthy software. Yet people keep using it.

It's not like there wouldn't be any other harnesses either. Just switch to literally anything else please.

ssernikk | 55 minutes ago

Can you elaborate on that?

zephiel7 | 9 minutes ago

They had it coming for too long. Playing the "open and free" card while keeping your API token on server (among so much else)