Post #1881612

I was digging in opencodes github repo to find a clue regarding how and when it parses remote configs from .well-known/opencode and found this issue https://github.com/anomalyco/opencode/issues/10939?issue=anomalyco%7Copencode%7C22191 TL;DR if the config contains a command key under auth it will silently execute on the client system when you authenticate to the provider 🤯 The security surrounding the AI ecosystem is a fucking joke #ai #llm #vibecoding #opencode EDIT: I did not find this issue myself, credit goes to the issue author. I just stumbled over the issue, I apologize for not making that clear