OpenCode Console breach: affected scope, provider credentials and practical checks

What this video covers

• The 1.4% figure applies to Console users; installing the local coding agent alone does not establish inclusion in the reported affected subset.
• Console's provider documentation says it stores connected credentials behind its gateway. This is documented architecture, not a reconstruction of the undisclosed breach path.
• Review official notification and provider activity; preserving evidence and revoking suspicious credentials are general incident-hygiene advice, not an announced complete repair checklist.
• Sphinx sends changed code and answers to a separate reviewer, changes a global Git hook path, and has no default model-call cap. Its examiner can be wrong and local checks can be bypassed.
• Pele supports CSS changes to the same SVG. Its speed comparison is vendor-reported; images can still issue network requests and caller-supplied icon markup remains an application responsibility.
• Distillation describes an alleged purpose involving model outputs; the incident's access path, attacker identity and full customer impact remain undisclosed.

Transcript

Who was actually affected?

0:00 You hear OpenCode got hacked and picture your laptop. Its notice names a subset of Console users. Our earlier needs review verdict deserves the full story. In this video, who was affected? What should you check? Why does one label matter? It's Sunday, October eighteenth, and this is The Daily Diff. Keep that label in mind.

0:18 OpenCode is an open source coding agent for your terminal, editor or desktop. Console is its optional hosted model gateway. It also serves provider accounts you connect. The notice names that hosted piece. The overnight notice leads today's diff. Then a Git hook quizzes you on your agent's code, and a diagram renderer spells

0:35 out its safety boundaries. Apparently the new productivity feature is reading. OpenCode says one point four percent of Console users were impacted,

What does 1.4% actually describe?

0:42 a subset with external providers linked. It says they were emailed. That's the company's current scope, with the incident still ongoing. Keep the denominator attached. Console users are that population. Its size is undisclosed, so we cannot calculate a victim count. Installing the local agent alone doesn't put you in the reported group. A developer named timo says the breach matters more to customers than the

1:03 distillation label. Fair concern. People want answers about their accounts while the internet is arguing about model training. The provider documentation explains the trust boundary.

Where does the provider credential live?

1:12 Console stores the credential and routes requests through its gateway. Workspace members use models without seeing the provider key. Useful administration puts the gateway in a position you have to trust. You can share access without putting the upstream key on every teammate's machine. A small percentage can still describe serious exposure. The notice has not supplied a technical account of how access was gained. Security marketing likes a comforting word. Developers follow which component holds which secret.

1:37 Console deserves another box in your mental diagram, which is how every architecture drawing gets longer. Check the official notification and provider activity records.

What should an affected user check?

1:45 For suspicious use, preserve evidence and revoke the exposed credential through your provider. Replace affected integrations deliberately. That's general incident hygiene; the notice lacks a complete customer remediation checklist. OpenCode says it is working with Anthropic, OpenAI and Google to remediate. It cannot share more details yet. We'll need the later report to judge the fix. This notice makes no verified reimbursement promise.

Can a Git hook check understanding?

2:08 Sphinx offers a different kind of supervision. It pauses a protected branch push and asks whether you understand your agent's code. The pull request has acquired an oral exam. Your autocomplete is sitting suspiciously quietly. A separate reviewer reads the committed change through read only Git tools, without seeing the generating chat. It asks about behavior and failure cases. Answer incorrectly and you get another scenario.

2:30 Pass, and the original push continues. The readme asks what happens when a worker commits, then crashes before acknowledging its job. Redelivery can repeat the operation. The example is illustrative; we have not installed Sphinx or measured an improvement in production review. Sphinx yolo disables checks and logs the skip. Local hooks can be bypassed, and the readme says the examiner can be wrong.

2:51 The robot teaching assistant has permission to admit it is a robot. Setup changes your global Git hook path, including other repositories.

What does the Sphinx reviewer receive?

2:58 The reviewer receives changed code and your answers. Filename exclusions cannot catch a secret pasted into ordinary source. Read that before adopting it. There is no default cap on model calls. A typical check uses five to eight requests, plus one per answer. Set spending limits. You can pay for the privilege of explaining yourself twice.

What changes when Pele renders Mermaid?

3:17 Obsidian's kepano just released Pele, which turns Mermaid text into SVG. Replying to a skeptical developer, he points to six years of writing Mermaid themes. There's maintenance history behind the launch thread. Its compressed bundle is reported around two hundred thirty kilobytes, against Mermaid's one point six megabytes. It supports Mermaid twelve point one's diagram types. The speed claims are the project's measurements. We have not reproduced that comparison.

3:40 Write the diagram's text, get SVG, then change its colors with CSS without rendering it again. The same diagram keeps its identity. Your architecture can stop dressing like an unrelated website. Pele escapes diagram text and filters links.

Which diagram boundaries remain yours?

3:54 JavaScript click callbacks are ignored. Images can still make network requests when displayed. Your application owns the icon markup it supplies and how it opens internal links. Pele lets you disable links and images, with limits on source and output size. The application still has work to do. Awkward news for anyone hoping a smaller dependency also shrinks responsibility. Now that label.

What does distillation actually explain?

4:15 Distillation means training a model using another model's outputs. OpenCode associates the breach with a large scale distillation attack. That's the alleged purpose. It leaves the access path, attacker identity and full customer impact undisclosed. My verdict is needs review. I'd keep the Console incident under review until we can assess the affected credentials and the fix. Identify which service holds your provider access,

4:39 before a headline chooses the threat model for you. If you'd rather read this than hear me say it, the diff lands in your inbox every morning, free at the daily diff dot dev, link below. And that's the diff for today. I'm Niko from Axrisi. Merge responsibly.

Sources

1. Latest edited OpenCode Console security noticeOpenCode
2. Connected provider credentials and Console gatewayOpenCode documentation
3. Console is an optional providerOpenCode documentation
4. Distillation definition and separate background casesAnthropic
5. Sphinx understanding checks and adoption caveatsSphinx project
6. Pele Mermaid-to-SVG rendererPele project
7. Pele security and application responsibilitiesPele documentation
8. Pele maintainer's public explanationkepano