I have one rule for coding agents now. If a tool wants to hold my provider keys, it has to be more reliable than my own laptop. This month, OpenCode asked its users to believe exactly that, and it did not go well.
On October 17, the official OpenCode account posted that user credentials had leaked. The Hacker News thread that followed pulled 976 points and 185 comments, and almost all of the anger was about a single missing sentence: which OpenCode?
What actually leaked, and what didn't
The answer, reconstructed by users in the thread rather than spelled out by the company, is OpenCode Console. That is the hosted inference gateway sitting behind Zen and Go, an OpenRouter-style service where you either buy tokens from OpenCode or bring your own keys from OpenAI, Anthropic, and Google.
If you run the opencode CLI in a terminal against keys that never left your machine, you were not in the blast radius. Neither was the desktop app. That is the good news, and it is real.
The bad news is the shape of what leaked: provider keys that customers had uploaded to somebody else's servers. Those are not password-reset keys. There is no self-serve revoke-everything button at OpenAI or Anthropic that a third party can pull on your behalf, which is why the response was an email telling each customer to rotate keys by hand, one provider at a time. As one commenter put it, it is a race against the clock, and everyone has to run it alone.
The name did the damage
Here is my problem with how this went down. OpenCode is now at least five products sharing one word:
- OpenCode CLI, the terminal agent most people mean
- OpenCode Desktop, the same idea with a window
- OpenCode Zen, the pay-per-token API
- OpenCode Go, subscription access to open-weight and cheap frontier models
- OpenCode Console, the gateway underneath both, plus a limited Black tier
When a breach notice says "OpenCode", that word does not tell a few hundred thousand developers whether their machine is fine or their billing account is on fire. The correct statement, that this was Console BYOK users only, existed. It just was not in the headline, and for roughly two days the vacuum was filled by people assuming the worst about the CLI installer they had run that morning.
Vague disclosure is not neutral. It converts an infrastructure incident into a trust incident, and trust is the only currency a tool that reads your source tree, your env files, and your deploy scripts actually has. The team earned the pile-on. Calling the story clickbait, as some defenders did, misses the point: the ambiguity was upstream of the headline.
The part that should scare you
The deeper issue is not OpenCode. It is BYOK as a product category. Bring your own key sounds like a convenience: you keep the billing relationship, they keep the routing. In practice it means your long-lived, high-limit credential sits in another company's database, guarded by another company's on-call rotation, exposed to another company's blast radius.
Compare the two failure modes. If my local key leaks because I committed it to a repo, that is my bug and I fix it in four minutes. If a gateway's database leaks, my key leaks alongside thousands of others, the attacker has a target list ranked by spend limit, and my only defense is that I happened to read an email before the drain hit the cap. One commenter reported exactly that: an OpenAI key that had quietly eaten its entire spending limit by the following Friday.
So the honest lesson is not that OpenCode is unsafe. It is narrower and more useful:
- Never upload a provider key with a high hard cap to a third-party gateway. Use a scoped, low-limit key, or a prepaid one.
- Set billing alerts at 20 percent of your cap. A leak you notice in an hour costs you an hour.
- Treat every gateway key as already compromised and rotate on a calendar, not on a press release.
OpenCode will recover. The CLI is good, the momentum is real, and the company is backed. But the next time a hosted layer asks me to hand over a key that can bill me, I will remember that the notice went out with the wrong noun in it, and that the noun was the whole apology.
Comments