It makes me wonder.
One main security change in the harness and no warning: https://www.reddit.com/r/opencodeCLI/comments/1x4kkgg/security_opencode_does_not_ask_for_file/
And one breach in the service: https://www.reddit.com/r/opencodeCLI/comments/1x8gtjg/opencode_security_breach/
How can we trust the team anymore?
24 comments · 79% upvoted · other discussions
Considering:
I do not think the service is reliable enough to spend large amounts of money on yet, but for a $10/mo subscription there's not much at stake.
considering how open they are about using ai to develop opencode itself, im not surprised this happened... personally im moving to deepseek harness to not have any more risks with opencode's centralized proxy issues since everything is locally hosted
I've never tried DS's harness, how do you like it?
Is it ok with non DS's models too or...?
Thanks for the idea!
i think its a pretty good alternative, i like the customizability it offers
it works perfectly fine for me with non deepseek models, sometimes better than opencode depending on the model . the only issues ive had with it is due to the tradeoff with it being completely local hosted, you'll need to add your own plugin/api for web search capabilities. ive found this free one to work perfectly for me although there are many other options out there
I appreciate it!
Looking a bit into it it seems there's no TUI for it, only desktop and webapp, but you know while that's a con, if it works better, it's just that...
AI is used extensively in the development of the Deepseek Harness, too. In fact, I have yet to see a harness that does not use AI heavily in its development now.
even so its not as much an issue when everything is locally hosted
me personally I do think this are valid reasons to move out, they don't necessarily affect me yet (the things i use the agents for are so non-important for me that i blindly just say yes whenever it asked for permission before cause it really didn't matter, and at this point i was part of so many security breaches that i got kinda desintized, someone is probably selling information about my private data since 2019 anyways), but if people that use OpenCode for more serious things do see this as a reason to change to any other thing, I think they have all the reasons to, just the security change would be enough for me to dip-out if i actually used OpenCode for sensitive work
I think even if you don't have security requirements today, as a force of habit you might still use the same stuff whenever you do, so it's not terrible to move out before it becomes a problem, instead of after...But I get your point. :)
i get what you mean but the real issue with this breach was it cost many users with paid api keys linked to get charged hundreds in unauthorized usage
Yeah, that's why I said they have all the reasons to leave. Hope the team can fix all of this so the victims get their money back
curious
why do you guys even bother to use opencode ????
what possible benefit does it give you that codex or claude cant?
you know frontier labs have cheap models that performs better than anything opencode offers through its bullshit tier subs?
First of all, I get way more usage out of my $10 of OC Go Subscription using DS4 flash than I could by paying the double to Codex or Claude by using their cheapest models.
And their cheapest models are OK, but I didn't feel they are smarter than Deepseek. Especially that up until just recently, Anthropic's cheapest model was a really old and dumb Haiku. And with Sonnet I constantly hit usage limits. Luna is OK, but it's also more prone to hit limits.
Not to mention both Anthropic and OpenAI forces you to use their subscriptions with their software. And I just don't like them.
On the other hand, I could use my OC subscription with other clients. Heck, I could even use it with Codex or Claude if I wanted. But I don't, I actually prefer using the OpenCode CLI, because it may not have all the features, but it's UX is much more like how a TUI should be.
So, there are many benefits which can be summed up with lots of options, and dirt cheap low-mid-range inference.
He means that you can get deepseek super cheap via direct provider or openrouter. 10 bucks on deepseek last weeks!
Well, I don't deny, DS is super cheap in general.
But through Open Code it's cheaper, because you get... I don't remember exactly... $60 worth of usage for $10?
If you pay it directly you get $10 usage for $10. And I did that, and it was never enough for my purposes.
I used to use it. I just actually removed it today. I use pi.dev, hermes, and claude/codex. Hermes and pi.dev for local models. Open code was just too opinionated and heavy for a console tool, and Hermes for that kind of weight is more functional.
Other providers are definitely under similar attacks.
You see it in peoples usage disappearing and such, they just dont talk about it as much. Every provider has a big red target on their back.
Opencode does happen to have a higher tier of responsibility in this case because they are storing external credentials. But i wouldn’t say it’s indicative of particularly poor security practices.
I’ll be waiting for the full report.