OpenCode Hacked: User credentials leaked

pranshuchittora

From OpenCode Team --- Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity. We’re sorry this happened and will follow up with any updates.

bewareofscams

I told you so: https://news.ycombinator.com/item?id=49243119 Me, 68 days ago: > Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all. > https://github.com/anomalyco/opencode/issues/10416

fleshers

I’m a bit confused by the wording here, does it mean the credentials were hacked and then used to perform a mass distillation campaign?

DavCreator

https://xxcancel.com/opencode

vinni2

But isn’t OpenCode open source why does it need credentials.

preommr

Why are the comments pointing out there were warning signs early on being downvoted/flagged? I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?

jchw

I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.

pranshuchittora

I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many. I never ask for upvotes, but would be great if you can upvote it. Thanks!

verbo_villain

So are people going to wake up and see their Anthropic, openAI, etc accounts drained?

oldfuture

https://news.ycombinator.com/item?id=50108261 that's why virustotal was flagging it then

Ciantic

I think every API key system should have endpoint "invalidate_api_key" this way whitehat hackers or the party who stored them could invalidate all keys in the case they leak. Now it is race against the time, and everybody got email, and everyone must act themselves.

djchen

Is my understanding correct that this only affected some OpenCode Zen users who stored their (BYOK) API keys from Anthropic/Google/OpenAI? In essence they used OpenCode Zen similar to OpenRouter, where you can BYOK or use theirs and be charged token rates.

MisterMunchkin

It’s fascinating that tokens are so valuable that people are spending so much time and effort hacking to obtain API keys.

computerex

Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?

rvz

Looking forward to the post-mortem of this incident.

monster_truck

Wait, is the openchode hack the cause of all the people complaining about their OAI usage getting drained/vanishing at alarming rates? That's pretty funny ngl. The way some of this place's employees post and act online, can't say I feel all that bad.

searealist

> security breach > related to a large scale distillation attack I'm not sure how this adds up. I could understand if this impacted their uptime, but not security. Are they actually saying a bunch of credentials were stolen and are being used for distillation?

thway15269037

Was it opencode who bragged about their vibecoding tokenmaxxing attitude or I'm mixing them with someone else?

9021007

https://nitter.click/opencode/status/2111516673953935833

yipinwong

wtf was I getting many use OpenCode on OpenCode cloud emails last few days. Were they set up so that hackers can get more info?