Dang, seems like @opencode got hacked. Change your keys!
🚨 Confirmed. OpenCode hacked. Keys stolen.
Telling customers to revoke.
Oct 17, 2026 · 3:40 PM UTC
49
100
1,117
115,088
@NetworkChuck @opencode Сегодня хотел поставить. Не поставил. Господь с русскими.
1
0
2
377
Most developers aren't aware of this hack but you can actually run coding agents without any API keys and substantially reduce any risk associated with agents leaking keys.
This is generally a best practice and we implement this using a transparent proxy at @infisical.
The u scaffold the agent's environment to proxy all traffic through a transparent HTTP proxy. This is non-intrusive and covers all CLI, local MCP, LLM provider traffic.
On a more practical level this means:
- OpenCode invokes the GitHub CLI to raise a PR without holding a GitHub PAT.
- OpenCode connects to any LLM Provider (e.g. Anthropic) without holding any API key.
- You get the point.
We've open sourced Agent Vault which holds agent credentials as part of Infisical and Agent Proxy, the standalone companion transparent proxy that fetches back credentials and brokers them for agents like OpenCode.
Linking the docs below; you're welcome 👇
0
0
1
660
@NetworkChuck @opencode Hopefully this will highlight to them how weird of a dark pattern they have with the keys now. Why do we need to go to Console -> Settings -> Service Accounts -> Account -> then the keys, lol
0
0
17
2,621
most rewriters clear the flag by breaking the sentence.
if the meaning moved, it didn't help you.
trywalterai.com/study/?utm_sou…
if the meaning moved, it didn't help you.
trywalterai.com/study/?utm_sou…
2
4
31
31,140
@NetworkChuck @opencode This doesn't affect free users in any way does it lol ?
1
0
9
3,181
@NetworkChuck @opencode oh thats why their boss main character isn't posting any cool stuff about his thoughts.
0
0
2
1,458
@NetworkChuck @opencode It’s just Codex looking for free Claude access.
0
0
0
1
@NetworkChuck @opencode Same playbook crypto traders learned with exchange API keys: one key per tool, hard spend cap, no extra permissions. Then a breach is one rotation and a small bill instead of every provider lit up at 2 AM.
0
0
1
375
@NetworkChuck @opencode This just for a cloud version or just using the desktop app??
0
0
0
2,088
@NetworkChuck @opencode fr, security is no joke. always gotta double-check everything.
0
0
0
850
@NetworkChuck @opencode Oh I forgot there was this one thing like months ago related to security. Need to reach out to them about it
0
0
0
715
@NetworkChuck @opencode this is why every key I hand a tool gets its own spend limit, one leaked key shouldnt be able to drain the whole account
1
1
6
1,166
@NetworkChuck @opencode Well too late already burned all my api credits. 😓😢
0
1
1
349
@NetworkChuck @opencode if you had a key saved in opencode console, deleting it there doesn't kill it. revoke it in the openai or anthropic dashboard and make a new one. then set a spend limit at each provider and give every tool its own key, so you know which one leaked and the bill stops at the cap
0
0
0
22
@NetworkChuck @opencode I can hear your voice in this post exactly how you talk. Your voice is there in the text
0
0
0
19
@NetworkChuck @opencode Rotate, then check each provider's usage page for spikes since the breach window. Revoking a key doesn't undo what was already billed on it.
0
0
0
118
@NetworkChuck @opencode They should have a better design to store those API keys internally
0
0
0
70
@NetworkChuck @opencode yikes :( an agent tool sits on keys for a bunch of providers at once, so one leak means a long evening of rotating all of them...
0
0
0
818
@NetworkChuck @opencode Revoke first, read the postmortem later. Reports say keys stored in a legacy system were exposed, so treat any key that ever lived there as burned. Good reminder to give each tool its own key with a hard spend cap, so a breach is one rotation and a small bill.
0
0
0
939
@NetworkChuck @opencode Literally that's what can't able to see opencode api keys section
0
0
0
838
@NetworkChuck @opencode opencode in paperclip is safe, right?
0
0
0
38
@NetworkChuck @opencode Rotate the keys, turn on MFA, and use strong unique passwords. The boring basics save you when someone else gets popped.
0
0
0
446
@NetworkChuck @opencode Revoking is step one. I'd put a hard monthly cap on the new key too. People are posting overnight charges up to $1,700 on a single leaked key.
0
0
0
360
@NetworkChuck @opencode One user says an OpenAI key that only lived in OpenCode got run up $281 overnight. This is why I keep my API Keys LOCAL on my machine and not in someone else's CLOUD 🔐
0
0
0
662