alt Hacker NewsI don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.
Replies
neya • today at 7:13 PM
Turns out even if you used credentials locally, you could've have been impacted as the .env files were also consumed by the agents. This is from some comments on Reddit / Google, so take it with a grain of salt.
This appears to affect users of Opencode Console, which appears to be an Openrouter-type thing?
https://dev.opencode.ai/console/
It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI
From https://opencode.ai/v2/docs#connect :
> If you’d like easy access to all the best coding models you can try out OpenCode Console.