Atuin Threads syncs coding-agent sessions across machines
From Atuin 18.24, opt-in end-to-end encrypted history can resume or fork sessions across Claude Code, Codex, Pi, Omp, and OpenCode.
1
Stories per day · 30 days
4 RSS
Relatedapi-keys6coding-agents4supply-chain4anthropic3claude-code3data-breach3mcp3command-injection2console2credential-exposure2credential-theft2model-distillation2openai2windows2ai-agents1ai-coding1atuin1aws1
26 stories, newest first · one card per story
Stories tagged #opencode
Hugging Face exec warns attacks may force open AI platforms to tighten access
Solaiman cited OpenCode API-key theft, an agent swarm on Hugging Face, and a Fireworks customer-data incident.
1
n0n extortion operator exposed AI-aided attack files on open server
SOCRadar says every examined break-in used weak or stolen credentials, not a software vulnerability.
1
Coding-agent memory files show no consistent security effect
Malicious CLAUDE.md-style files shifted secure completions by -8 to +6 points, while disclosure behavior differed by agent.
PHP2Shell attempts preceded same-week patches for PHP, GitLab and Node.js
GitLab’s unauthenticated RCE is CVSS 10.0 back to version 7.0; LiteLLM 1.107.0 stole credentials and OpenCode keys may have leaked.
Engineer runs OpenCode offline with local Qwen3.5 9B via Ollama
The walkthrough uses OpenCode 1.19.4, blocks web tools, and cites published Qwen scores rather than measurements from the laptop.
Coding-agent harnesses cost more without better benchmark scores
Harness swaps changed outcomes about as often as reruns, while system prompts made some tasks cost up to three times more.
6
OpenCode MCP sign-in flaw executes code on Windows and WSL
Builds 1.0.137 through 1.18.32 are affected; Anomaly fixed it in 1.18.33 without a CVE or advisory.
OpenCode 1.0.137–1.18.32 RCE silently fixed in 1.18.33
Pillar Security says a malicious MCP server can run code on Windows during OAuth, and scanners will not flag the flaw.
OpenCode says breach hit 1.4% of Console users
The company ties the October 17 incident to a distillation attack on users with external providers, but has not confirmed stolen API keys.
2
Attackers breach OpenCode Console and charge users’ AI API keys
About 1.4% of Console users had stored API keys exposed; the open-source app itself was not affected.
Cloudflare cuts AI code-review cost 68% to $0.77
Median review time fell from 4 minutes 9 seconds to 1 minute 32 seconds after the changes.
5
OpenCode breach exposes API keys for 1.4% of Console users
Some linked-provider users report overnight charges up to $1,700 and Google Cloud project suspensions.
OpenCode Console breach may have exposed provider API keys
OpenCode says 1.4% of Console users with linked external providers were affected; the OpenCode product itself was not.
OpenCode Console breach may have exposed OpenAI, Anthropic and Google keys
OpenCode emailed 1.4% of Console users on October 17 to revoke provider keys; local app keys were not involved.
OpenCode breach may have exposed Console users’ API keys
OpenCode says 1.4% of Console users who linked external providers were emailed on October 17.
OpenCode Hacked: User credentials leaked
OpenCode was hacked and user credentials were leaked, according to a Hacker News post.
Reconstructing AI Agent Activity: Two New Scripts for Forensic Review, (Thu, Oct 8th)
SANS published two Python scripts that reconstruct OpenCode and Hermes AI agent activity for forensic review.
Where Do the Tokens Go? Understanding and Reducing Costs in LLM Agents for Vulnerability Discovery
A 200-trace CyberGym study finds reasoning dominates token cost, and AVRI lowers it.
OpenCode AI Coding Agent Flaw Lets Malicious Websites Execute Code on Developer Machines
OpenCode versions 1.14.30 through 1.18.21 let a malicious site run code on a developer's machine via the local upgrade API.
Drawgent: Coding agent on a live Excalidraw canvas
Open-source tool drawgent connects Claude Code, Codex, or opencode to a live Excalidraw canvas for diagram-driven coding tasks.
5
Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)
Datadog demonstrates remote code execution in OpenCode AI coding agent via content-type confusion in the /global/upgrade endpoint, fixed in 1.18.22.
Best Open-Source Agent Harnesses for Local LLMs in 2026
A 2026 guide ranks 11 open-source agent harnesses, including OpenCode, Goose, Cline, and OpenHands, by local-LLM support, licensing, and safety controls.
7
ClashBench: Conflicts Leading Agents to Seize and Harm
ClashBench benchmark finds coding agents destructively terminate existing tasks to resolve resource conflicts in 44.5% of trajectories, often without disclosing it.