OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole

What it is

Socket's report on a GitHub issue in the OpenCode tracker (Anomaly's open source coding agent, MIT-licensed). The issue was opened on 28 June 2026 and said the per-IP limits on free hosted models could be bypassed by switching VPN addresses, which kept the coding session alive. The reporter said they automated this and kept DeepSeek V4 Flash and MiMo V2.5 running for weeks. The thread was deleted after 28 October 2026, and an earlier copy remains on the Wayback Machine.

How it works

Free-tier limits were tied to the connecting network address, with no authentication. A new IP reset the allowance. The reporter proposed account-based limits and detection of rapid IP changes. On 24 August they reopened the issue to promote the workaround, and on about 27 August they claimed 130 concurrent agents that hit the limit six times in four to five hours. A Hacker News comment on 5 September 2026 described the same technique, recommending "high-quality proxies".

Preconditions / Affected

Only OpenCode's hosted free models are involved. Self-hosted models and bring-your-own-provider setups are not.

What to do

The page gives no patch or command. Two points matter to anyone running or using a similar free tier:

• Anonymous per-IP limits are weak. Collaborator rekram1-node said on 1 October that enforcing limits without authentication is difficult.
• Users on VPNs may be blocked regardless of intent. Contributor Tarquinen said shared VPN addresses are often flagged and exceptions are not made for individuals. Reddit users reported immediate daily-limit messages on VPNs, and some reported low limits without a VPN.

Caveats

• Whether the bypass is fixed is unknown. Reports in late October conflict: some say IP switching stopped working, others say it still works, including on cellular or dedicated-IP VPNs.
• OpenCode made infrastructure changes in October, including a new inference service for free models and tighter client-IP handling. The 13 October change covered spoofed IP headers, which is a different issue from real IP rotation.
• Release v2.2.0 (27 October 2026) added usage and budget visibility and announced no fix.
• A claim that OpenCode now tracks hardware IDs and account metrics came with no evidence.
• Socket received no response from OpenCode on the bypass or the deletion.
• The thread drew harassment, including at least two comments encouraging suicide and requests for the reporter's identity. The reporter's account was created 13 days before the report and has no public repositories.