Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
redsymbol1 day ago | parent | context | favorite | on: OpenCode Hacked: User credentials leaked To clarify something that the OpenCode team has done a bad job of clarifying: The leak was for something called 'OpenCode Console', which is distinct and separate from the OpenCode coding agent. If you're just using the coding agent, you're not affected. 'OpenCode Console' is a service that is similar to OpenRouter, but is much less widely used. The name 'OpenCode Console' is super confusing, because one might think it means the CLI coding agent. It does not. 'OpenCode Console' has nothing to do with the CLI/TUI coding agent, nor the desktop app version. The situation is made worse by the fact that 'OpenCode Console' barely has any documentation online, and the official leak announcement does not make the distinction clear at all. The OpenCode team did a terrible job of communicating this, and that's on them. Today is a bad day for people using 'OpenCode Console'. But most people, probably the vast majority of OpenCode users who are reading this, are not using 'OpenCode Console'. help 
wren699121 hours ago | next[–] As a philosopher^H person on twitter once said: "If you find two ants in your kitchen, the best estimate of the total number of ants in your kitchen is not two." OpenCode has some pedigree here. reply jerieljan22 hours ago | prev | next[–] Yeah, it's very confusing especially if you're not in the loop and their docs were only updated recently and was confusing during the v1 -> v2 transition weeks / months ago. So far, "OpenCode" has gone through several possible definitions: - OpenCode Terminal / CLI - This is what you get normally. Runs a service in the background and the CLI is your interface. - OpenCode Desktop - Instead of a CLI, you get a desktop interface. Most users usually stop here. You just install the app and you connect wherever. So there's the services where they both make money and make things easier for users: - OpenCode Console - Basically the serving platform for both Zen and Go, and has expanded to a hosted inference gateway and somewhat similar to OpenRouter or a managed LiteLLM. Has the option to BYOK if you have existing AI platform accounts so it charges those instead of Zen, and that's what got compromised. - OpenCode Zen - the API service they host if you want to get access to providers but don't want to pay individually per API platform. Similar to OpenRouter. I noticed they're kinda slowly dropping the Zen moniker. - OpenCode Go - the subscription service that they host that features open weight models and select low-cost models from frontier labs. Has different policies when it comes to privacy and retention compared to Zen. - OpenCode Black - a limited-time, limited access subscription service that grants access to frontier models. Not sure if this is still alive or not. reply john01dav1 day ago | prev | next[–] I thought that the many provider pay as you go product from OpenCode was Zen. Also, how does OpenCoe Go fit into this? reply redsymbol1 day ago | parent | next[–] No, Console is different from Zen (and from Go). But you are reasonable in asking about it. The opencode team has done a horrible job of communicating what's actually going on. They have suffered real brand damage from this, and they deserve it. reply PalmPilotProMax22 hours ago | root | parent | next[–] But what about Open Code Pro Max? Or Open Code Rust? reply pranshuchittora1 day ago | prev[–] NNN... trust is already broken reply
Consider applying for YC's Winter 2027 batch! Applications are open till November 2. Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact Search: