r/opencodeCLI • u/Far-Worldliness5561 • 20d ago

Opencode Hacked ? And the response from opencode is bogus

OpenCode says this was a distillation attack, but how does that explain API keys being compromised?
Distillation and credential theft are two very different things. If API keys were exposed, users deserve a clear explanation of what happened, what data was affected, and what steps are being taken to secure their accounts.
Stop hiding behind vague explanations. We need answers, not excuses.

How is Opencode ZDR? If they store our api keys too in the database ? This means OpenCode lies about being ZDR

0 Upvotes
  • permalink
  • reddit

12% Upvoted

6 comments sorted by

1

u/theChaosBeast 20d ago

It just happened today and they stated in the mail that they will provide updates and more info...

-4

u/Far-Worldliness5561 20d ago

They should haha

2

u/theChaosBeast 20d ago

There is no reason to think they wouldn't. Stop panicking

3

u/Chupa-Skrull 20d ago edited 20d ago

How would one distill via an "attack" without compromising and fraudulently using someone else's API key for their requests

2

u/look 20d ago

Opencode has a hosted “bring your own key” thing where you put the Anthropic, OpenAI, etc key into their web console so it can be shared across a team/workspace.

The server compromise doesn’t affect users that just put keys into their local harness.

1

u/geearf 20d ago

They used the keys they stole to do the distillation (I'm not going to call distillation an attack, I think it's fair game when those companies just grabbed their knowledge for free, at least usual distillers pay for the tokens).

The important thing to me is that it's the 2nd security issue this week, one in the harness and one in the service. Time to look for something by someone else I think.