opencode (Organization): news timeline & CVEs

Drawgent: Coding agent on a live Excalidraw canvas

Open-source tool drawgent connects Claude Code, Codex, or opencode to a live Excalidraw canvas for diagram-driven coding tasks.

drawgent is a Rust-based tool that bridges locally installed Claude Code, Codex, or opencode agents to an Excalidraw whiteboard via ACP with MCP canvas tools. Users write 'AGENT:' notes on the canvas and the agent inspects screenshots plus the scene, edits drawings live, and marks notes as DONE. It supports attaching to running agent sessions, joining end-to-end-encrypted excalidraw.com collaborative rooms, and Docker-based hosting.

Hacker News · AISep 26, 15:56 UTC · 17h agoAI tools & infra HN 40↑ · 17 comments

Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)

Datadog demonstrates remote code execution in OpenCode AI coding agent via content-type confusion in the /global/upgrade endpoint, fixed in 1.18.22.

Datadog Security Labs discloses GHSA-632h-h47v-g4x4, a remote code execution flaw in OpenCode, an open-source AI coding agent with over 200,000 GitHub stars and 16 million monthly users. A content-type confusion in the /global/upgrade endpoint lets a malicious webpage send a cross-origin text/plain POST to the unauthenticated local server on 127.0.0.1:4096, supplying an attacker-controlled npm tarball whose preinstall script executes arbitrary code. OpenCode 1.18.22 fixes the vulnerability; users should check their install method and version.

Datadog Security LabsSep 24, 00:00 UTC · 3d agoResearch

opencode

Timeline2 articles

Appears with

Drawgent: Coding agent on a live Excalidraw canvas

Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)