🧰 OpenCode

The items that name it 42

• “Black October” for AI Developer Platforms
  writeupas affected products2026-10-30
• OpenCode User Hit with Hostile Backlash After Reporting Free AI Loophole
  articleas tools2026-10-29

  Open source AI coding agent for terminal, IDE and desktop that connects to commercial or local models and offers hosted free models with usage limits

• cubillas (@cubillas888) on X
  threadas classification.technologies2026-10-27
• Ricardo Arguello (@RicardoIQSource) on X
  threadas affected products2026-10-26It is written here as OpenCode (breach on Oct 17, provider keys stored in its Console).

  breach on Oct 17, provider keys stored in its Console

• David Gutierrez | Eng (@david_x_ai) on X
  threadas classification.technologies2026-10-25
• VibecodersHQ (@VibeCodrHQ) on X
  threadas tools2026-10-21It is written here as OpenCode (open-source AI coding agent).

  open-source AI coding agent

• Santhosh Patel (@santhosh_patell) on X
  threadas classification.technologies2026-10-19
• OpenCode Security Breach: Distillation Attack Hit Console Users With Linked AI Providers. How to Find OpenCode on Developer Machines and Respond
  articleas classification.technologies2026-10-18
• OpenCode has a security breach last that impacted 1.4% of console users
  otheras classification.technologies2026-10-18
• Just say no to OpenAI and Anthropic
  articleas classification.technologies2026-10-12
• Governing the Agentic SDLC Through Continuous Policy Enforcement
  articleas classification.technologies2026-10-12
• StepSecurity Now Inventories AI Agent Skills in Your GitHub Repositories and on Developer Machines
  articleas affected products2026-10-08

  AI coding agent among the 18 covered by Dev Machine Guard.

• Top AI Coding Agent Security Resources — October 2026
  articleas affected products2026-10-02
• [tl;dr sec] #348 - Google's PageBreak Scanner, Perplexity's Agent Security Tool, Defending Agentically
  articleas tools2026-10-01

  Agent harness that Numbat integrates with

• LLM Agents Can Easily Tamper With Their Own Traces
  paperas tools2026-09-24It is written here as Open Code.

  local LLM agent harness tested for ability to tamper with its own execution traces

• Discovering and exploiting a remote code execution vulnerability in OpenCode (GHSA-632h-h47v-g4x4)
  writeupas tools2026-09-24

  Open-source AI coding agent developed by Anomaly, with a built-in web interface (opencode serve, opencode web) whose /global/upgrade endpoint is the vulnerable component

• leepokai/jev-guard
  toolas affected products2026-09-17It is written here as OpenCode (supported agent; plugin requires 0.2.1+).

  supported agent; plugin requires 0.2.1+

• [tl;dr sec] #346 - Can AI Do Novel Security Research?, Anthropic's Threat Intel Report, How Cloudflare Enforces Engineering Standards
  articleas tools2026-09-17

  Used in distillation campaigns, per Anthropic

• WordPress Security Skills
  repoas tools2026-09-15

  AI coding agent that loads skills from .opencode/skills/ (project) or ~/.config/opencode/skills/ (global), also reads Claude skill paths

• Maskit
  repoas affected products2026-09-15

  AI coding assistant that can leak sensitive code data to external model providers if unprotected

• What is an agent harness (and how do you secure one)?
  articleas affected products2026-09-14

  AI coding agent harness

• The Evolution of JFrog AI Catalog: Your AI Control Plane for Agentic Development
  articleas affected products2026-09-02
• Dark-Moon
  repoas tools2026-08-05

  The 'AI Brain' component that reasons, plans and delegates tasks to specialist agents

• System Prompts Leaks
  repoas affected products2026-08-03

  system prompt leaked

• asgeirtj/system_prompts_leaks
  repoas affected products2026-08-03

  system prompt leaked

• QM
  repoas tools2026-08-01

  One of the agent harnesses that can drive the QM core

• AI Security Briefing
  articleas affected products2026-07-18

  vulnerable to GuardFall bypass

• AI Security Briefing
  writeupas classification.technologies2026-07-18
• Destructive Command Guard (dcg)
  repoas affected products2026-07-15

  Native tool.execute.before plugin via dcg install --opencode

• HOL Guard
  repoas affected products2026-07-15
• JFrog: Managing AI Agent Primitives with APM
  articleas affected products2026-07-15

  AI coding tool supported as an APM target

• jscrambler npm Package Compromised in Supply Chain Attack
  writeupas affected products2026-07-11

  Targeted for credentials/MCP config

• elder-plinius/T3MP3ST
  repoas tools2026-07-07

  Local AI coding agent supported as T3MP3ST's agent backbone

• Reverse-Skill
  repoas tools2026-06-21

  AI coding agent client compatible with the routing repository

• DragonJAR/Android-Pentesting-Skill
  repoas classification.technologies2026-05-07
• Security in the LLM Age - Greg Kroah-Hartman
  videoas technologies
• NVIDIA/OpenShell — sandboxed runtime for autonomous AI agents
  repoas tools

  example agent run inside an OpenShell sandbox in the Run Your First Agent tutorial

• NVIDIA OpenShell — secure runtime for autonomous AI agent fleets
  repoas tools

  Example agent run inside OpenShell against a free OpenRouter model, per the Run Your First Agent tutorial

• Agent Control Standard (ACS)
  repoas classification.technologies
• AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
  articleas classification.technologies
• Coding Agents Are Guessing: Measuring Action-Boundary Violations in Underspecified DevOps Instructions
  paperas affected products

  LLM coding agent evaluated for action-boundary violations on DevOps tasks

• sage — Agent Detection & Response (ADR) for AI coding agents
  repoas affected products

In every workspace you can read 114