[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-opencode-says-it-was-hacked-and-user-credentials-leaked":10,"sections":41},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":36,"feedback":40,"feedback_at":22,"cost_usd":40,"total_tokens":40},11715,"opencode-says-it-was-hacked-and-user-credentials-leaked","OpenCode Says It Was Hacked and User Credentials Leaked","A forum headline says the coding tool was breached and credentials leaked, but how many users, which secrets, and what cause remain unstated.","Anyone with an OpenCode account should treat credentials tied to it as exposed until the project says otherwise. A forum headline says OpenCode was hacked and that user credentials leaked, and it links to a post on the project's X account.\n\nThat is nearly all the source material contains. The forum link drew 287 points and 57 comments, which shows how closely developers are watching, not that any detail has been confirmed. The material does not include the text of the linked post, so this article does not describe what it says about scope, timing, or cause.\n\nThe gaps matter. \"Credentials\" could mean passwords, API keys (the secret strings that let software call a paid service), or login tokens. Each calls for a different response, and none is specified. Neither the number of affected users nor the way attackers got in appears in the source.\n\nStill, the sensible precautions do not depend on those answers. Change any password you reused elsewhere, and rotate any keys you gave the tool, particularly keys for AI model providers, since a stolen key can run up someone else's bill. Developer tools tend to hold secrets that open other doors. When CircleCI, a software build service, disclosed a breach in 2023, its advice was to rotate every secret stored on the platform, not just the CircleCI login.\n\nThe detail that will decide how serious this is has not surfaced: whether the leaked credentials were stored hashed (scrambled so they cannot be read back) or in a form an attacker could use directly.","[\"opencode\",\"data breach\",\"credentials\",\"ai coding\"]","2026-10-17T18:01:41.000Z","2026-10-18T01:15:26.697Z","2026-10-18T01:15:26.929Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Remove the invented 'dated October 17' detail, which appears nowhere in the source, and stop describing the contents of the X post as if you read it, since the only source is a Hacker News title linking to it. Attribute the claim to the Hacker News headline, drop the 'short announcement' characterization, and keep the headline hedged (for example 'OpenCode says it was hacked').","resolved","security",[32,33,34,35],"opencode","data breach","credentials","ai coding",[37],{"name":38,"url":39},"Hacker News","https:\u002F\u002Ftwitter.com\u002Fopencode\u002Fstatus\u002F2111516673953935833",0,{"sections":42},[43,48,52,57,62,67,72,77,82,87,92,97,102,107],{"name":44,"slug":45,"count":46,"latest_published_at":47},"AI","ai",7038,"2026-10-17T19:58:31.000Z",{"name":49,"slug":30,"count":50,"latest_published_at":51},"Security",1001,"2026-10-17T22:20:00.000Z",{"name":53,"slug":54,"count":55,"latest_published_at":56},"Policy","policy",538,"2026-10-17T19:38:12.000Z",{"name":58,"slug":59,"count":60,"latest_published_at":61},"Deals","deals",521,"2026-10-17T07:00:00.000Z",{"name":63,"slug":64,"count":65,"latest_published_at":66},"Hardware","hardware",260,"2026-10-17T19:55:36.000Z",{"name":68,"slug":69,"count":70,"latest_published_at":71},"Consumer Tech","consumer-tech",235,"2026-10-16T23:36:26.000Z",{"name":73,"slug":74,"count":75,"latest_published_at":76},"Science","science",202,"2026-10-16T11:00:53.000Z",{"name":78,"slug":79,"count":80,"latest_published_at":81},"Startups","startups",133,"2026-10-14T19:51:34.000Z",{"name":83,"slug":84,"count":85,"latest_published_at":86},"Software","software",128,"2026-10-14T22:23:48.000Z",{"name":88,"slug":89,"count":90,"latest_published_at":91},"Dev Tools","dev-tools",116,"2026-10-13T16:20:18.000Z",{"name":93,"slug":94,"count":95,"latest_published_at":96},"General","general",81,"2026-10-16T16:06:38.000Z",{"name":98,"slug":99,"count":100,"latest_published_at":101},"Gaming","gaming",77,"2026-10-17T16:59:39.000Z",{"name":103,"slug":104,"count":105,"latest_published_at":106},"Reviews","reviews",37,"2026-10-14T10:00:00.000Z",{"name":108,"slug":109,"count":110,"latest_published_at":111},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]