Security
OpenCode cloud users urged to rotate provider credentials
Users in r/LocalLLaMA are warning OpenCode Console customers about a reported compromise involving third-party provider API keys. Comments point to the hosted service, while local model use appears outside the reported scope. One commenter says an old Anthropic key with about $1.50 was stolen. The supplied material contains no official confirmation.
An r/LocalLLaMA discussion raises an unverified warning about a possible OpenCode compromise. The supplied material contains no incident notice or statement from OpenCode. It also questions whether a “distillation attack” could expose user credentials.
Comments associate the suspected exposure with OpenCode’s hosted service and OpenCode Console. They distinguish that service from local model setups, which commenters generally consider outside the reported scope. The keys mentioned are third-party provider credentials, not necessarily keys for a local model. One commenter says an old Anthropic API key with about $1.50 of credit was stolen.
A Go user reports that a session stopped with a message asking for an API-key change. Logging out and back in restored access. That user had no provider key and received no email. The thread calls for invalidating keys and notifying users. One commenter also recommends changing to another harness. The supplied discussion does not establish whether OpenCode took either action.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.