The disclosure timeline is concerning.

Reported 2025-11-17, and multiple "no responses" after repeated attempts to contact the maintainers... not a good look.

hey maintainer here

we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues

we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done

I'd be curious to know what features need opencode.ai to be an allowed origin for the local server.

Huh, I thought opencode was a volunteer project but it looks like it's a business with major backing from major players. Was opencode always set up like this? I could have sworn there was some project with a better governance model, guess not.

They keep adding features without maintaining the core. I stopped using it when they started selling plans. The main reason for Opencode was to use multiple models but it turns out context sharing across models is PIA and impractical right now. I went back to using Claude Code and Codex side by side.

Having said that, there is definitely a need for open platform to utilize multiple vendors and models. I just don’t think the big three (Anthropic, OAI and Google) will cede that control over with so much money on the line.

> Silent fix

So did they fix it silently, without responding to the researcher, or they fixed the silent part where now user is made a aware that a website is trying to execute code on their machine.

Seems `session/:id/shell` was also `session/:id/bash` and originally `session/:id/command` in some commits.

Maybe I'm using GitHub code search wrongly, but it appears this was just never part of even a pull request - the practice of just having someone pushing to `dev` (default branch) which then will be tagged should perhaps also be revisited.

(Several more commits under `wip: bash` and `feat: bash commands`)

https://github.com/anomalyco/opencode/commit/7505fa61b9caa17...

https://github.com/anomalyco/opencode/commit/93b71477e665600...

WTF, they not just made unauthenticated RCE http endpoint, they also helpfully added CORS bypass for it... all in CLI tool? That silently starts http server??

How's that plastic utensils at Anthropic's buffet analogy going now?

This is pretty egregious. And outside the fact the server is now disabled by default, once it's running it is still egregious:

> When server is enabled, any web page served from localhost/127.0.0.1 can execute code

> When server is enabled, any local process can execute code without authentication

> No indication when server is running (users may be unaware of exposure)

I'm sorry this is horrible. I really want there to be a good actual open cross-provider agentic coding tool, but this seems to me to be abusive of people's trust of TUI apps - part of the reason we trust them is they typically DON'T do stuff like this.

On the one hand, with 1800 open issues and 800 open PRs (most of it probably AI generated slop) makes it a bit understandable for the maintainers to be slow to reply. On the other hand, the vulnerability is so baffling that I'll make sure to stay as far away as possible from this project.

Isn't it insane that any web page can run a port scan in the first place? Who wants that?

Meanwhile, running opencode in a podman container seems to stop this particular, err, feature.

This is such an egregious lack of respect for users, you can't trust this organisation again, and the lack of responsiveness just signals that they don't consider it a problem. Users must signal to companies that this attitude is unacceptable by dumping them.

If you aren't blocking your browser from allowing sites to call to local services, you should:

> Network Boundary Shield

> The Network Boundary Shield (NBS) is a protection against attacks from an external network (the Internet) to an internal network - especially against a reconnaissance attack where a web browser is abused as a proxy.

> The main goal of NBS is to prevent attacks where a public website requests a resource from the internal network (e.g. the logo of the manufacturer of the local router); NBS will detect that a web page hosted on the public Internet is trying to connect to a local IP address. NBS only blocks HTTP requests from a web page hosted on a public IP address to a private network resource; the user can allow specific web pages to access local resources (e.g. when using Intranet services).

https://jshelter.org/nbs/

It feels that today security is secondary to growth. As long as your growing, a few incidents here and there aren't going to make a difference.