Birbla

Join the discussion

Write your take first — we'll ask for email only when you're ready to publish.

Sign in
  • Hacker News
  • @dang this title needs updating: "OpenCode Console hacked: User credentials leaked"

    The opencode CLI has no impact.

    by rozenmd
  • I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.
    by jchw
  • Is my understanding correct that this only affected some OpenCode Zen users who stored their (BYOK) API keys from Anthropic/Google/OpenAI?

    In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.

    by djchen
  • I'm confused. Who would be performing distillation? Surely someone for whom distillation is valuable has enough money not to resort to this sort of crime?

    Account farming is one thing, and nobody apart from who's being distilled cares about that, but draining wallets of other people is a whole other thing.

    by glub
  • Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?
    by computerex
  • I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.
    by Ciantic
  • I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many. I never ask for upvotes, but would be great if you can upvote it. Thanks!
    by pranshuchittora
  • To clarify something that the OpenCode team has done a bad job of clarifying:

    The leak was for something called 'OpenCode Console', which is distinct and separate from the OpenCode coding agent. If you're just using the coding agent, you're not affected. 'OpenCode Console' is a service that is similar to OpenRouter, but is much less widely used.

    The name 'OpenCode Console' is super confusing, because one might think it means the CLI coding agent. It does not. 'OpenCode Console' has nothing to do with the CLI/TUI coding agent, nor the desktop app version.

    The situation is made worse by the fact that 'OpenCode Console' barely has any documentation online, and the official leak announcement does not make the distinction clear at all. The OpenCode team did a terrible job of communicating this, and that's on them.

    Today is a bad day for people using 'OpenCode Console'. But most people, probably the vast majority of OpenCode users who are reading this, are not using 'OpenCode Console'.

    by redsymbol

Explore Birbla archives