Yet another Hacker News

OpenCode Hacked: User credentials leaked

255 points pranshuchittora 1 hour ago 49 comments

pranshuchittora 1 hour ago | parent

From OpenCode Team

---

Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.

We’re sorry this happened and will follow up with any updates.

sebastiansm7 30 minutes ago | parent

We were planning to fix our vibecoded mess.

bewareofscams 1 hour ago | parent

I told you so: https://news.ycombinator.com/item?id=49243119

Me, 68 days ago:

> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.

> https://github.com/anomalyco/opencode/issues/10416

lousken 1 hour ago | parent

If i dont use any of their models nor i am signed in, is that a problem? i dont see anything in wireshark except for models.opencode.ai

neya 57 minutes ago | parent

Damn, that sucks. I didn't know OpenCode was this bad when it came to privacy.

fleshers 1 hour ago | parent

I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?

odo1242 1 hour ago | parent

Yes

pranshuchittora 1 hour ago | parent

It triggers me when these companies think that users are fool. I would have appreciated them, if they have disclosed things more transparently.

ipsum2 58 minutes ago | parent

"mass distillation campaign" there's no public evidence of this. I wonder what OpenCode/Anomaly has, would be an interesting postmortem.

vdfs 35 minutes ago | parent

Obviously they don't want to share details because it's ongoing

DavCreator 1 hour ago | parent

https://xxcancel.com/opencode

vinni2 1 hour ago | parent

But isn’t OpenCode open source why does it need credentials.

progval 1 hour ago | parent

For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.

dist-epoch 1 hour ago | parent

Maybe they support cloud agents.

himata4113 1 hour ago | parent

They function similar to openrouter BYOK.

kelvinjps10 49 minutes ago | parent

opencode go and zen?

preommr 1 hour ago | parent

Why are the comments pointing out there were warning signs early on being downvoted/flagged?

I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?

jchw 1 hour ago | parent

I think it may just be bad automated flagging. I vouch'd them since they don't really seem to violate any rules/guidelines (right?)

himata4113 1 hour ago | parent

Indeed. I've seen it happen before and it appears that they have automatic downvoting based on some criteria, possibly just some classifier. I've attributed it to some bot attack before, but it's a bit too common now.

dylan604 1 hour ago | parent

Why does it being common downplay the bot attack to you? As time goes on, I'd assume bots activity to increase. I do not see it ever going away.

himata4113 45 minutes ago | parent

bots get caught and downvoting requires reputation.

jchw 1 hour ago | parent

I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.

hahajk 51 minutes ago | parent

This appears to affect users of Opencode Console, which appears to be an Openrouter-type thing?

https://dev.opencode.ai/console/

It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI

From https://opencode.ai/v2/docs#connect :

> If you’d like easy access to all the best coding models you can try out OpenCode Console.

neya 41 minutes ago | parent

Turns out even if you used credentials locally, you could've have been impacted as the .env files were also consumed by the agents. This is from some comments on Reddit / Google, so take it with a grain of salt.

pranshuchittora 1 hour ago | parent

I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many. I never ask for upvotes, but would be great if you can upvote it. Thanks!

ShowalkKama 58 minutes ago | parent

The title should say "OpenCode Console" not "OpenCode".

yorwba 47 minutes ago | parent

How did you determine that it has been "flagged by many"?

pranshuchittora 40 minutes ago | parent

The post was visible when I am logged in. But when I opened the /newest page on incognito the post wasn't there.

senordevnyc 31 minutes ago | parent

It’s #14 on homepage when not logged in, same as when logged in.

verbo_villain 1 hour ago | parent

So are people going to wake up and see their Anthropic, openAI, etc accounts drained?

oldfuture 1 hour ago | parent

https://news.ycombinator.com/item?id=50108261

that's why virustotal was flagging it then

ameliaquining 26 minutes ago | parent

It sounds like only a hosted service was compromised, not the open source OpenCode binary that users run on their own machines. So this wouldn't explain that.

Ciantic 1 hour ago | parent

I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.

Tiberium 1 hour ago | parent

It actually is a thing, although indirectly in a hacky way! If you push keys from GitHub secret scanning partners to a public repo or a gist, they get sent to the partner who (usually) instantly revoke them. So if you want to help someone, just make a public gist with the key and delete it like 15 seconds later, it'll be enough.

https://docs.github.com/en/code-security/reference/secret-se... has a table with the active partners

Ciantic 57 minutes ago | parent

Only responsible thing in this case would have been for OpenCode people to invalidate all keys. But I guess it is not that straightforward if Anthropic/OpenAI etc don't have endpoint for it.

ameliaquining 28 minutes ago | parent

There's no self-serve endpoint, but OpenCode could send the inference providers the leaked keys and ask for them to be revoked, which is a thing the inference providers can do. It's possible that this'll happen, apparently remediation is still in progress.

djchen 55 minutes ago | parent

Is my understanding correct that this only affected some OpenCode Zen users who stored their (BYOK) API keys from Anthropic/Google/OpenAI?

In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.

nightpool 49 minutes ago | parent

That's the only known impact so far. But we don't know the details of how these keys were exposed, so it's not entirely clear why or how "only keys" might have been affected

MisterMunchkin 43 minutes ago | parent

It’s fascinating that tokens are so valuable that people are spending so much time and effort hacking to obtain API keys.

nacs 33 minutes ago | parent

They might have spent next to 0 time actually 'hacking' - they may have just told Opencode to hack Opencode website and let it run for hours or days till it succeeded.

computerex 31 minutes ago | parent

Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?

pranshuchittora 30 minutes ago | parent

They need to explain this, by releasing a detailed RCA.

ameliaquining 24 minutes ago | parent

If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.

rvz 29 minutes ago | parent

Looking forward to the post-mortem of this incident.

monster_truck 27 minutes ago | parent

Wait, is the openchode hack the cause of all the people complaining about their OAI usage getting drained/vanishing at alarming rates? That's pretty funny ngl.

The way some of this place's employees post and act online, can't say I feel all that bad.

searealist 26 minutes ago | parent

> security breach

> related to a large scale distillation attack

I'm not sure how this adds up. I could understand if this impacted their uptime, but not security.

Are they actually saying a bunch of credentials were stolen and are being used for distillation?

pranshuchittora 23 minutes ago | parent

Yes, they think we are foooool

thway15269037 15 minutes ago | parent

Was it opencode who bragged about their vibecoding tokenmaxxing attitude or I'm mixing them with someone else?