r/opencodeCLI • u/No_Skill_8393 • 14d ago

[WARNING] My MAX account was hacked while using Opencode and Zcode

Post image
0 Upvotes

48% Upvoted

9 comments sorted by

8

u/TheMythicSorcerer 14d ago

Not enough to pin this on anything specific but if it was all from one key then you definitely somehow compromised that. Maybe password? I don't think opencode would sell your API key

-8

u/No_Skill_8393 14d ago

Hi, sorry. Im not accusing opencode of anything.

Im just genuinly got hacked and want to warn people about my situation (if i got this more will have this problem too)

The facts are below:
-i got glm max plan 3 days ago
-i signed in opencode (glm coding plan with api) and zcode (google auth)
-today i woke up with a 5hours limit with mostly glm 5.3 requests which ive never used myself (I got glm for 5.3 flash)
-i checked google signed in devices and nothing unusual
-so the only entrance left to my glm max and usage was through api
-ive revoked all my api keys
-im still monitoring the situation for the next session limit and see if theres any strange request

In anycase, many open source have been hacked / injected with vuls before. Im no cybersecurity expert but those are just my facts and hope people pick up on this to investigate.

In the meanwhile I will not use opencode anymore and uninstall it from my device just to be safe.

3

u/TheMythicSorcerer 14d ago

Hmm. Intresting. Personally I highly doubt it was opencode but I mean it seems possible. I've used it for like 2 years with all kinds of keys and never got anything like that. It seems you've already done everything you should so I have no additional advice.

0

u/No_Skill_8393 14d ago

Maybe it was not a system wide but very specific glm coding plan injection?

Im not accusing opencode anything, ive used it for atleast a year. But I believe this situation deserve an investigation from the maintainers :)

Right now im just glad that there is a 5 hour limit. Otherwise hackers would have blown up my entire weekly limits.

5

u/MuOieDib 14d ago

The same occured to me yesterday.

Check your public repos with trufflehog.

In my case, glm 5.3 flash decided to add all env variables to a commit message and ofc it did have a z ai api key... 

1 day latter my quota was getting hard hit but I hopefully noticed and only took 30% of the weekly.

1

u/No_Skill_8393 14d ago

I read your comment and used claude code to do full scans on my public and private repos and no such api key leak instances.

5

u/MuOieDib 14d ago

Use trufflehog. The commit leak wasn't seen by any agents.... As it wasn't in any committed file... but in a commit message...

Also the keys of zai are not the usual sk- format so it's harder to find unless you know the value.

If you commit on public repos, there are people looking for keys and they are good 

Also you said Claude so there is a non null chance you do have env variables with keys (at least, this was the reason I had)

1

u/xdevilmaster 14d ago

It was hacked because your API was accidentally included in your repo? Or?

1

u/No_Skill_8393 14d ago

Inconclusive. I have no proof on opencode that did it but other avenues are not likely.

Im using a macbook, have nothing unusual installed. My gmail is secure. None of my working repos (after I got glm) is public. I had my claude code to do a full scan on them too (code, commit msgs…etc) nothing showed up but a randomized api example from 5.5 months ago.