A teardown said stop using OpenCode. A core developer showed up to reply
A blog post cataloguing OpenCode's security holes, from bash filters that a base64-encoded command sails straight through to a CVE letting any open webpage fire shell commands at your machine, hit number one on Hacker News within hours. One of OpenCode's own developers showed up in the thread: most of what's "glaring" here, he said, is already fixed in the upcoming v2.
The complaints ran from petty (re-reading its whole config file every turn, wrecking prompt caching) to serious: approving one throwaway Python command with "Always" silently green-lights every future Python call, including one that reads your SSH keys.
Simon Willison defended one pettier complaint, baking the date into every prompt, as standard practice. OpenCode's own developer said the harshest bug, a context-pruning behavior, was already disabled by default months before the post went up.
The command filter that a base64-encoded pipe walks straight through
The post, written by a developer who says he's used every major AI coding harness, opens by comparing OpenCode's design to "a boot stamping on a human face forever" and only gets more pointed from there. The core complaint: OpenCode's safety filters check the text of a bash command before running it, but text filtering is trivial to route around. The author lists working bypasses: piping a blocked command through echo and into bash, prefixing it with env, calling a binary by its absolute path instead of its name, base64-encoding the payload, or just shelling out through Python. His verdict on the whole scheme: "Textual command filtering is entirely useless. It is fit for no purpose."
The permission system has a second flaw, this one about memory rather than parsing. Approve a single, harmless-looking command, like printing "hello" from Python, with the "Always" option, and OpenCode remembers that approval for every future Python invocation, including one that quietly reads ~/.ssh/id_rsa. A recently disclosed CVE compounded the picture: OpenCode's local HTTP server shipped with permissive CORS (cross-origin rules that let any site talk to it), letting any web page open in your browser fire arbitrary shell commands or read files off your disk, through the same API a legitimate client would use.
Underneath the security list sits a longer set of gripes: the tool re-reads its own config file and stuffs today's date into the system prompt on every turn, both of which blow out the prompt cache; its default system prompt tells sub-agents to write "ABSOLUTELY NO COMMENTS"; and it reaches out to remote model providers by default even when a user only wants local inference. The author's summary line, quoted approvingly and mockingly in roughly equal measure across the thread: "OpenCode is clown-car turboslop with a security posture of 'let me bend over for you daddy'."
The developer who actually builds OpenCode showed up
In the thread, an OpenCode core developer answered several complaints directly rather than letting the post stand unchallenged:
"Not too much actionable here. Most of the more glaring issues are already fixed in our upcoming v2 if you'd like to try beta... when we looked through our data it's not so clear cut that it's net negative." — an OpenCode core developer
He specifically pushed back on the context-pruning complaint, saying it had been off by default for a while "specifically because of complaints like this," and previewed a v2 system-prompt design meant to survive cache invalidation.
Other voices defended pieces of the design on their own technical merits, independent of the maker's reply:
"Including the date in the system prompt, at the cost of a cache invalidation at midnight, is an entirely reasonable decision. Most other harnesses do the same thing." — Simon Willison
A third reply came from someone already convinced enough to bookmark the post for future reference:
"None of the major issues listed are unique to OpenCode. At least the full list within the 'Alarming Things' seems in my mind to apply to Claude CLI, and I would guess most other agents from frontier model providers... it may as well be titled 'Stop Using LLMs.'" — a reader who bookmarked the post to reference widely despite the mismatch
The sharpest non-technical pushback in the thread came from a reader uncomfortable with the tone itself:
"There are regular people who wrote this software. When did it become normal to talk about open source like this?" — in the thread
And at least one reader pointed out the free-tier economics settle the argument before the security debate even starts: OpenCode gives away 200 requests every five hours, and for someone writing open-source software without an employer footing the bill, that's reason enough to keep using it despite everything above.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Google called her 'the Bard of Google.' Then HR called her walkout a breakdown.
In 2012, at her final T.G.I.F. before moving to YouTube, Larry Page called Claire Stapleton onstage and handed her a wooden plaque naming her "the Bard of Google" for the weekly recaps she'd written since 2007. Six years later she helped organize a walkout that hit Dublin, London, Zurich and Tokyo in a single day — and within months, an HR rep was steering her toward medical leave, as though organizing a protest were a symptom to be treated.