OpenCode Hacked: User credentials leaked

The discussion was less about the breach headline than about what OpenCode product was actually breached and whether users could trust the company’s explanation. Several commenters established that the known incident concerns the hosted OpenCode Console, where users may have stored third-party provider keys, rather than the local CLI/TUI coding agent. That distinction mattered enormously: readers worried that the shared branding made a hosted credential vault sound inseparable from a local coding tool, while others stressed there was no evidence of a compromised CLI supply chain. Opinion converged on the company’s communication being inadequate. The short notice gave affected users a revocation checklist but did not explain how unauthorized access occurred, what systems were reached, or why provider credentials were retained there. Readers saw the lack of a detailed incident report as especially damaging given earlier complaints about undisclosed routing of prompts or data through outside services. Some allegations about local environment files and large-scale model distillation remained unverified, and commenters pushed back on treating them as established facts. The practical fear was immediate financial and operational harm: stolen OpenAI, Anthropic, or similar keys can be spent rapidly, resold, or used for abusive workloads. Still, a few readers noted OpenCode had offered unusually cheap multi-model access, making the security failure painful precisely because its value proposition had attracted users in the first place.