OpenCode 遭入侵，用户凭证泄露

#ARTICLE HackerNews 2026.10.18

推荐指数 46.0 NO. 016 · 2026.10.18

发布2026/10/17Score269Comments49

为什么值得看

AI 编程工具 OpenCode 发生安全事件，攻击者获取了用户凭证数据。AI 工程师需立即检查是否重复使用密码并启用 2FA，尤其是用企业邮箱注册过该服务的团队。

编辑判断

OpenCode 是 Cursor 的开源替代方案之一，很多团队因为成本或数据隐私考虑从 Cursor 迁移过来。这次事件暴露了一个被低估的风险：新兴 AI 工具为了快速获客往往在安全基建上投入不足，反而比成熟大厂更容易成为攻击目标。

如果你团队在用 OpenCode 处理私有代码库，建议立即审计代码提交历史中是否包含密钥或内部 API 端点，因为攻击者拿到的不只是密码，还有代码访问权限的关联信息。短期内可以考虑把敏感项目切回本地 LLM 或已建立 SOC2 合规的成熟工具。

社区反馈

负面 49 条评论

核心争论：OpenCode 安全事件暴露信任危机：早期警告被忽视，用户 API 密钥遭泄露

pranshuchittora

From OpenCode Team --- Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dash

sebastiansm7

We were planning to fix our vibecoded mess.

bewareofscams

I told you so: https://news.ycombinator.com/item?id=49243119 Me, 68 days ago: > Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode a

查看原文 →