OpenCode Hacked: User credentials leaked

https://twitter.com/opencode/status/2111516673953935833

75•pranshuchittora•57m ago

Comments

pranshuchittora•56m ago

From OpenCode Team

---

Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.

We’re sorry this happened and will follow up with any updates.

bewareofscams•35m ago

I told you so: https://news.ycombinator.com/item?id=49243119

Me, 68 days ago:

> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.

> https://github.com/anomalyco/opencode/issues/10416

lousken•7m ago

If i dont use any of their models nor i am signed in, is that a problem? i dont see anything in wireshark except for models.opencode.ai

fleshers•34m ago

I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?

odo1242•25m ago

Yes

pranshuchittora•8m ago

It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.

DavCreator•33m ago

https://xxcancel.com/opencode

vinni2•29m ago

But isn’t OpenCode open source why does it need credentials.

progval•27m ago

For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.

dist-epoch•20m ago

Maybe they support cloud agents.

himata4113•17m ago

They function similar to openrouter BYOK.

preommr•23m ago

Why are the comments pointing out there were warning signs early on being downvoted/flagged?

I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?

jchw•21m ago

I think it may just be bad automated flagging. I vouch'd them since they don't really seem to violate any rules/guidelines (right?)

himata4113•19m ago

Indeed. I've seen it happen before and it appears that they have automatic downvoting based on some criteria, possibly just some classifier. I've attributed it to some bot attack before, but it's a bit too common now.

dylan604•5m ago

Why does it being common downplay the bot attack to you? As time goes on, I'd assume bots activity to increase. I do not see it ever going away.

jchw•22m ago

I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.

pranshuchittora•13m ago

I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many. I never ask for upvotes, but would be great if you can upvote it. Thanks!

verbo_villain•11m ago

So are people going to wake up and see their Anthropic, openAI, etc accounts drained?

oldfuture•10m ago

https://news.ycombinator.com/item?id=50108261

that's why virustotal was flagging it then

Ciantic•6m ago

I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.

Tiberium•4m ago

It actually is a thing, although indirectly in a hacky way! If you push keys from GitHub secret scanning partners to a public repo or a gist, they get sent to the partner who (usually) instantly revoke them. So if you want to help someone, just make a public gist with the key and delete it like 15 seconds later, it'll be enough.

Development statistics for the 7.2 kernel

Qwen3.8-27B on the iPhone 18 Neural Engine at 15–70 tok/s (1.5 bpw)

The Commodore 64 hardware simulator: break chips and pins, see the results

Making chicken transparent using Dorito dust

Furifont, a Japanese font that shows furigana

DeepSeek-v4.1-Flash-1017

Solar surpasses nuclear power globally for first time

tsc-ts: TypeScript written in TypeScript

Dam removals are bringing fish back across the northeastern United States

Artie (YC S23) Is Hiring Enterprise AES and Senior Engineers

Rendering pretty sky in Around The World game

Vintage Cassettes: 1963-2010

Pele – Mermaid diagrams as themeable SVG

Bleached corals thrive within days when touching healthy neighbour

OpenCode Hacked: User credentials leaked

OpenAI discloses four more rogue incidents

Gold is now the top U.S. export

You could have invented transformers from memory

Ultramarine 1 Flash

Source code of the Estonian online voting system

Show HN: Esp32sim – Run ESP32 firmware in the browser

Show HN: Parin – A 2D game engine between raylib and Godot, written in Dlang

A Tudor life in the time of plague (2020)

Show HN: High-quality duck audio synthesizer

A skeptic's first contact with Kubernetes (2024)

The First Candid

Show HN: Llmspeed – feel how fast a local LLM runs before you buy the hardware

Espresso machine can run Doom

Show HN: Things to Do API

The future of programming (1982)

OpenCode Hacked: User credentials leaked

Comments

Development statistics for the 7.2 kernel

Qwen3.8-27B on the iPhone 18 Neural Engine at 15–70 tok/s (1.5 bpw)

The Commodore 64 hardware simulator: break chips and pins, see the results

Making chicken transparent using Dorito dust

Furifont, a Japanese font that shows furigana

DeepSeek-v4.1-Flash-1017

Solar surpasses nuclear power globally for first time

tsc-ts: TypeScript written in TypeScript

Dam removals are bringing fish back across the northeastern United States

Artie (YC S23) Is Hiring Enterprise AES and Senior Engineers

Rendering pretty sky in Around The World game

Vintage Cassettes: 1963-2010

Pele – Mermaid diagrams as themeable SVG

Bleached corals thrive within days when touching healthy neighbour

OpenCode Hacked: User credentials leaked

OpenAI discloses four more rogue incidents

Gold is now the top U.S. export

You could have invented transformers from memory

Ultramarine 1 Flash

Source code of the Estonian online voting system

Show HN: Esp32sim – Run ESP32 firmware in the browser

Show HN: Parin – A 2D game engine between raylib and Godot, written in Dlang

A Tudor life in the time of plague (2020)

Show HN: High-quality duck audio synthesizer

A skeptic's first contact with Kubernetes (2024)

The First Candid

Show HN: Llmspeed – feel how fast a local LLM runs before you buy the hardware

Espresso machine can run Doom

Show HN: Things to Do API

The future of programming (1982)