Key findings
- OpenCode published three security advisories in 2026, two in January for an unauthenticated server and a web UI flaw and one in September for a cross-site upgrade path. It then disclosed a breach of 1.4% of Console accounts on October 17.
- Every OpenCode client talks to an HTTP server that is unsecured unless OPENCODE_SERVER_PASSWORD is set; in OpenCode 2 that server runs in the background for every client.
- Requests can reach OpenCode's own services through Zen, Go, free models, and share pages, so a team that wants one data path has to configure it.
- Two public measurements put OpenCode's fixed prompt at about a third or less of Claude Code's on the same model, with a steadier prompt cache.
If you deploy OpenCode, where does your code go, and what does the agent itself cost in tokens? This piece reads OpenCode's own advisories, breach notice, and documented defaults, then two public measurements of its prompt overhead against Claude Code.
The 2026 security record
In January 2026 OpenCode published GHSA-vxw4-wv6m-9hhh (CVE-2026-22812): before 1.1.10 it started an HTTP server on launch with no authentication, and the server exposed endpoints that ran shell commands and read files. The advisory lists 1.0.216 as the patched release and notes an email report on November 17, 2025 that drew no response. The reporter's disclosure, published January 11, 2026, adds that 1.1.10 turned the server off by default. A companion advisory, GHSA-c83v-7274-4vgp (CVE-2026-22813), rated critical a cross-site scripting flaw in the web UI that let a malicious site run commands.
On September 24, 2026 OpenCode published GHSA-632h-h47v-g4x4. For installs managed by npm, pnpm, or Bun that run opencode serve, a web page could send a cross-site request to the upgrade endpoint and install an attacker's package. It is patched in 1.18.22.
On October 17, 2026 OpenCode stated on X that a breach the night before, tied to a large-scale distillation attack, affected 1.4% of OpenCode Console users. It said it had emailed each of them.
Where requests go
OpenCode states it does not store your code or context, and that data is stored only when you use its free models. Zen and Go route requests through OpenCode to the model providers it has tested. Go's page lists retention per model, from zero days for most to 30 days for some, and two contributor models priced low in exchange for training on prompts.
Side tasks follow their own setting. The small_model option runs title generation on a cheaper model from your own provider when one exists and otherwise falls back to the main model, so set it explicitly. OpenCode's Enterprise docs recommend disabling share pages, and central config can disable every provider except your internal gateway.
What the agent may do
OpenCode 2 starts every agent from a policy that allows every action except reading .env files. The plan agent denies edits outside ~/.opencode/plan, and paths outside the project proceed without a prompt unless you add an external_directory rule. OpenCode 1 also allowed most actions by default, asking only for .env reads, external directories, and repeated-loop detection.
There is no built-in sandbox, so isolation is an operating choice: run the agent in a container or virtual machine with only the project mounted when it holds credentials that matter.
Prompt overhead against Claude Code
Systima ran Claude Code and OpenCode on the same model, machine, and tasks and captured every request. For a one-line reply, Claude Code sent about 33,000 tokens of system prompt, tool schemas, and scaffolding before the prompt. OpenCode sent about 7,000, and its request prefix stayed byte-identical across runs, so the prompt cache was written once per session. On one multi-step task Claude Code's total came out lower, because it batched tool calls into fewer requests.
Carmelo Daniele captured the first request of Claude Code, OpenCode, and Pi on the same Bedrock model. He found OpenCode's system prompt about one third the size of Claude Code's, with safety guidance in its tool definitions.
Methodology
GILD read OpenCode's and Anomaly's pages, the three security advisories on anomalyco/opencode, and OpenCode's breach notice on October 25, 2026, and checked each against the live page. The token figures come from two public measurements, cited with their dates; GILD did not rerun them. Practitioner reports about these topics are counted in the OpenCode Signals record and are not restated here.
Products in this piece
Sources
- Official documentation
- 15
- Public source
- 3
- OpenCode security advisory GHSA-vxw4-wv6m-9hhh, CVE-2026-22812 (Jan 12, 2026)
- OpenCode security advisory GHSA-c83v-7274-4vgp, CVE-2026-22813 (Jan 12, 2026)
- OpenCode security advisory GHSA-632h-h47v-g4x4 (Sep 24, 2026)
- OpenCode on X: security breach notice (Oct 17, 2026)
- OpenCode
- OpenCode Go
- OpenCode Zen
- OpenCode docs: Config
- OpenCode docs: Enterprise
- OpenCode docs: Server
- OpenCode docs: Web
- OpenCode 2 docs: Permissions
- OpenCode docs: Permissions (OpenCode 1)
- Anomaly: OpenCode 2.0 (Oct 12, 2026)
- OpenCode privacy policy
- CyberShadow: Unauthenticated Remote Code Execution in OpenCode (Jan 11, 2026)
- Systima: Claude Code Is Way More Token-Hungry Than OpenCode (Jul 12, 2026)
- Carmelo Daniele: Claude Code, OpenCode, and pi, anatomy of a trivial request (May 18, 2026)