OpenCode Hacked: User credentials leaked

The leak was for something called 'OpenCode Console', which is distinct and separate from the OpenCode coding agent. If you're just using the coding agent, you're not affected. 'OpenCode Console' is a service that is similar to OpenRouter, but is much less widely used.

The name 'OpenCode Console' is super confusing, because one might think it means the CLI coding agent. It does not. 'OpenCode Console' has nothing to do with the CLI/TUI coding agent, nor the desktop app version.

The situation is made worse by the fact that 'OpenCode Console' barely has any documentation online, and the official leak announcement does not make the distinction clear at all. The OpenCode team did a terrible job of communicating this, and that's on them.

Today is a bad day for people using 'OpenCode Console'. But most people, probably the vast majority of OpenCode users who are reading this, are not using 'OpenCode Console'.

In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.

  1. Last Friday I noticed that one of my OPENAI keys had used up my spending limit in the OpenAI Console.
  2. Today I got the e-mail from OpenAI quoted below.
  3. I haven't got any e-mail from OpenCode about it.

Mail from OpenAI:

Subject: OpenCode incident: update on your API keys and reimbursement

Body:

Hello,

We're writing about a security incident reported by OpenCode, a third-party AI coding tool. OpenCode reported unauthorized access to a system that stored customer API keys.

An OpenAI API key associated with your organization, [masked], was identified as affected. The affected OpenAI API keys are no longer active and cannot be used to make new API requests.

API usage is billed to the organization associated with the key, including when an exposed key is used without authorization. As part of our review, we have applied a one-time courtesy adjustment to address the charges associated with the unauthorized usage we identified. (...)

The opencode CLI has no impact.

The way some of this place's employees post and act online, can't say I feel all that bad.

that's why virustotal was flagging it then

Hackers breached an Open Code legacy system containing customer keys for openai etc, and ran up large bills against the customer's openai accounts . The tokens were used to train the hacker's ai models (the distillation).

My guess is a more primitive arbitrage / resale attack . Like reselling EBT cards or "free" vpn traffic.

you login to their website, and you are presented with a list of providers where you can click and add your provider api key.

how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.

from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.

someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.

https://github.com/anomalyco/opencode/issues/10416#issuecomm...

https://news.ycombinator.com/item?id=50075319

https://news.ycombinator.com/item?id=50060694

what’s interesting is that all those efforts that go into sandboxing through virtualization wouldn’t have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.

of course any sensible engineer that uninstalled this 6 months ago and used codex and claude code directly also avoided this, gg

> related to a large scale distillation attack

I'm not sure how this adds up. I could understand if this impacted their uptime, but not security.

Are they actually saying a bunch of credentials were stolen and are being used for distillation?

Account farming is one thing, and nobody apart from who's being distilled cares about that, but draining wallets of other people is a whole other thing.

They're skipping past the fact thay keys were even accessible by an intruder... Like huh?? They say its only third party keys, but all my opencode keys were deactivated in tbe process... Why is that, were they storing keys in virtually plain text...

Opencode CEO, Dax, brags all day on twitter (in the most narcissistic fashion) about how much they vibecode and how fast they move. Well, it really shows.

Not to mention, Ive tried to cancel my subscriptions and was double charged, they reverted one of them, then I cancelled again and was charged again....

It's not like there wouldn't be any other harnesses either. Just switch to literally anything else please.

I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?

---

Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.

We’re sorry this happened and will follow up with any updates.

Me, 68 days ago:

> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.

> https://github.com/anomalyco/opencode/issues/10416