OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole

What it claims

Sarah Gooding's Socket article covers a GitHub issue in the OpenCode tracker. OpenCode's free hosted models enforced usage limits per connecting IP address. Switching to a new address through a VPN restored access and kept the coding session intact. The reporter said they had automated the switching and kept DeepSeek V4 Flash and MiMo V2.5 running for weeks.

OpenCode is an MIT-licensed open source coding agent for terminal, IDE and desktop. It is developed by Anomaly, which sells hosted model access and enterprise features such as centralized configuration and SSO. The bypass affected only the free hosted models, not the open source client or bring-your-own-provider use.

How it works

The reporter's account was created 13 days before the issue was opened on June 28, 2026. The issue was then handled as follows:

1. The reporter proposed account-based limits and detection of rapid IP changes.
2. They closed the issue on July 31, 2026, then reopened it on August 24 to promote the workaround.
3. Three days later they claimed 130 agents across concurrent sessions, hitting limits six times in four to five hours.
4. On October 1, collaborator rekram1-node said limits are hard to enforce without authentication and closed the issue. No fix was announced.

A September 5 Hacker News comment described the same per-IP weakness independently.

OpenCode changed its infrastructure in October 2026. Free-model requests moved to a newer inference service, and an October 13 change addressed spoofed IP headers. Socket notes that header spoofing is a different problem from connecting through a genuinely different address. Release v2.2.0 on October 27 added usage and budget visibility but announced no bypass fix.

Limits

The main practical consequence is for legitimate VPN users. OpenCode contributor Tarquinen wrote that the restriction applies to the connecting network address: "Shared VPN addresses are often flagged, and we can't make exceptions for individual users." Reddit users reported several failures:

• A daily-limit message appeared immediately on launch behind a long-standing VPN setup.
• Free models were blocked after little activity, including for users not on a VPN.
• Sessions shrank from hours to one or two prompts.

Reports conflict. One user had usable access through a dedicated-IP VPN, and others said changing server or cellular IP still worked. A Reddit poster claimed OpenCode now tracks hardware IDs and account metrics but gave no evidence.

The thread drew harassment, including encouragement of suicide and demands for the reporter's identity. It was still up on October 28, 2026 and was later deleted without explanation. An earlier copy is on the Wayback Machine. OpenCode had not answered Socket's request for comment at publication, so the current enforcement mechanism and fix status are unconfirmed.