3 stories
The breach is in 'OpenCode Console', an OpenRouter-like service where users paste provider API keys so it can proxy their requests. People running only the open-source terminal agent or desktop app are not affected.
Several commenters noted the Console had no visible privacy policy or terms of service and that the team's announcement never drew that line.
The top HN threads: facts from the discussions, both sides, insider voices. Email, Telegram, or RSS.
The complaints ran from petty (re-reading its whole config file every turn, wrecking prompt caching) to serious: approving one throwaway Python command with "Always" silently green-lights every future Python call, including one that reads your SSH keys.
Simon Willison defended one pettier complaint, baking the date into every prompt, as standard practice. OpenCode's own developer said the harshest bug, a context-pruning behavior, was already disabled by default months before the post went up.
MiMo Code ships under MIT with free access to Xiaomi's MiMo-V2.5 model, adding persistent memory, subagent orchestration and a "dream/distill" self-improvement loop on top of OpenCode's TUI and plugins.
"Why not just contribute to OpenCode instead of creating a clone?" asked one commenter. A user who actually ran it answered sideways: it's genuinely fast and pleasant — and the headline model is geofenced and pricier than DeepSeek.
