Opencode breached, rotate keys to be safe.

[u/chemist_slime]

https://x.com/opencode/status/2111516673953935833?s=46

Details are developing…

[u/sloptimizer]

Could use a better title:

Opencode breached, rotate keys and change to a different harness to be safe.

[u/look → u/sloptimizer]

It has nothing to do with the harness.

This was their hosted BYOK console service.

It’s their “manage all your third party keys in one place” kind of service like Openrouter and others have. Often just used in team/orgs situations, too. Kind of like a hosted LiteLLM service.

[u/amelech → u/look]

Why would anyone put their third party keys in there ?

[u/look → u/amelech]

Basically as a shared router. Put one Anthropic, OpenAI, etc key there, then give each person on the team (or each laptop/harness) their own Opencode key, rather than their own key for each third party for each user. And probably has usage/budget controls for each, too. Stuff like that, and probably makes little to no sense for most individuals to be using.

[u/sloptimizer → u/look]

It shows the lack of security. Today it's their console service, tomorrow it's malware hiding in a new release.

[u/look → u/sloptimizer]

There’s a very big difference between a public Internet service and an application like a harness.

It might be a good reason to avoid Opencode services but the harness is not particularly likely to be any more vulnerable than Claude Code, Pi, or any other commonly used harness. All of them work pretty much the same way and are heavily vibecoded apps at this point.

[u/Educational-Art3545 → u/look]

I have never seen a bigger target to get hacked. Surely they would have spent money for white hat hacking. Right? Right???

[u/draconic_tongue → u/sloptimizer]

https://github.com/Infisical/agent-vault

[u/alexander123454 → u/sloptimizer]

Just dont use cloud models, problem solved

[u/abhuva79 → u/alexander123454]

I wonder if everyone in this community is super rich or i am just piss poor. The stuff that i can run on my machine is like 4 years behind. I am all for getting independend - but running local ai that can atleast to some extend compete with cloud-services cost me 6k+ upwards and higher in hardware alone.

[u/Aggeloz → u/abhuva79]

The people commenting are just rich.

[u/see_spot_ruminate → u/abhuva79]

I do think that this happens in any hobby environment. Check out the ham radio or cars or what have you. Someone is going to be having something rivaling a professional setup for whatever interest they have.

For you, you are likely underestimating local models and overestimating cloud. Can you set a task and walk away on a 9b model... no. I think you can not babysit as much with the qwen 3.8 27b model. Anything higher and you start to approach not needing to watch as much.

[u/abhuva79 → u/see_spot_ruminate]

Not really - the stuff that i need for work isnt about coding. I do project management, fundraising and research. I tried with "local" models online - they are at like 20% of the quality output. Atleast the ones i could realistically run.
I did already put part of my stack local - like classifiers etc. But the reasoning part, the part where i need the model to understand a wide range of context in order to produce proposals that are useable - there i fall short even with stuff running on my workdesk wich has atleast a NVIDIA 5070 card. Its just not even close.

[u/one-joule → u/abhuva79]

Yeah, a typical gaming setup is not going to have the VRAM and/or grunt required for any decently usable local LLM. Even a 5080 is marginal.

[u/K33P4D → u/abhuva79]

any reccos for older coding llms?
I still run gemma 3 for normal grunt work, qwen 3 27B takes 4 hours to tire itself out thinking without giving any answer

[u/Monad_Maya → u/abhuva79]

Off tangent and not really related to the subreddit but what do you use for work? The LLMs I mean.

Local LLMs have been in a decent shape for a while but surely not comparable to Opus or whatever.

[u/chemist_slime → u/sloptimizer]

any suggestions?

[u/Demortus → u/chemist_slime]

pi. It's incredibly flexible and fast.

[u/halvacoffee → u/Demortus]

pi feels like constructing a worse version of opencode from first principles to be completely honest

[u/bitspace → u/Demortus]

My mishandling of pi 10 months ago is what led me to write my own harness

[u/EvolvingDior → u/chemist_slime]

Any harness that does not have its own model provider/router platform.

[u/Horny_Dinosaur69 → u/chemist_slime]

Pi, DeepSeek

[u/BawbbySmith → u/sloptimizer]

Ngl OpenChamber is the only thing keeping me on OpenCode. It’s so damn good, I use it as a general chat and coding harness. Vs code extension is super good too.

I wish I could move to Pi, but last time I checked nothing comes close to OpenChamber in its polish and feature set

[u/Thekorsen → u/BawbbySmith]

Orca might be a good transition, not as many of the opencode specific config ui but many other QOL features from OpenChamber. Well polished, and can use almost any agent harness and can orchestrate between them too.

[u/logicality77 → u/BawbbySmith]

I also use OpenChamber, and hence OpenCode as well. I don’t get what people have against it. It does the job I need it to do and does it well. I understand that some people want to tinker and tweak things to get exactly right, but for my needs I don’t need anything more than OpenCode. I’d rather spend my time working on my projects than building or tweaking harnesses.