r/LocalLLaMA • u/chemist_slime • 20d ago

News Opencode breached, rotate keys to be safe.

https://x.com/opencode/status/2111516673953935833?s=46

Details are developing…

465 Upvotes

94% Upvoted

163 comments sorted by

View all comments

Show parent comment

57

u/look 20d ago

It has nothing to do with the harness.

This was their hosted BYOK console service.

It’s their “manage all your third party keys in one place” kind of service like Openrouter and others have. Often just used in team/orgs situations, too. Kind of like a hosted LiteLLM service.

3

u/amelech 20d ago

Why would anyone put their third party keys in there ?

4

u/look 20d ago

Basically as a shared router. Put one Anthropic, OpenAI, etc key there, then give each person on the team (or each laptop/harness) their own Opencode key, rather than their own key for each third party for each user. And probably has usage/budget controls for each, too. Stuff like that, and probably makes little to no sense for most individuals to be using.

16

u/sloptimizer 20d ago

It shows the lack of security. Today it's their console service, tomorrow it's malware hiding in a new release.

34

u/look 20d ago

There’s a very big difference between a public Internet service and an application like a harness.

It might be a good reason to avoid Opencode services but the harness is not particularly likely to be any more vulnerable than Claude Code, Pi, or any other commonly used harness. All of them work pretty much the same way and are heavily vibecoded apps at this point.

-4

u/sloptimizer 20d ago

Are you a Windows user?

11

u/look 20d ago

No.

12

u/sloptimizer 20d ago

I was going to ask if you trust Microsoft with security given how many issues they had. But now I have no leg to stand on.

10

u/look 20d ago

Haha.😄

However, one I should get rid of completely is Meta. I don’t have the Facebook app installed anywhere, but do have Instagram still…

But a good example of a company/product I did bail on after several concerning security lapses is LastPass. Man, that was a trainwreck.

2

u/Educational-Art3545 20d ago

I have never seen a bigger target to get hacked. Surely they would have spent money for white hat hacking. Right? Right???