OpenCode
OpenCode is an AI assistant that helps people understand, write, change and run computer code. It’s made by Anomaly, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from opencode.ai.
What it is
OpenCode is for people who write software. They can ask it to explain code, add features, fix problems and run tests. It works with several AI providers and can also use local models.
It can read and change files, run commands and fetch web pages to complete coding tasks. Its commands have the access of the person running it. Code and other material used in a task can go to the selected AI provider.
Its source code is public. Anomaly says its approval prompts do not provide security isolation: the assistant is not confined to a sandbox. This is a developer tool with broad access to the computer.
Who makes it
Anomaly makes open-source developer tools, including OpenCode and SST. Its legal name is Anomaly Innovations, Inc.. Its website is anoma.ly.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
The real OpenCode is signed by Anomaly Innovations, Inc., Apple team ID 5NZ4Q7NXJ4. A copy signed by anyone else isn’t from Anomaly. HARD’s Mac app checks this for you; to check by hand, open Terminal and run codesign -dv "/Applications/OpenCode.app", and look for that TeamIdentifier.
Its bundle ID, the name macOS knows it by, is ai.opencode.desktop or ai.opencode.desktop.beta or ai.opencode.desktop.dev. Download it only from opencode.ai, not from an ad or a link someone sends you.
Fakes. In October 2026, GitHub flagged similarly named npm packages, including opencode2, opencode2-darwin-arm64 and opencode2-darwin-x64, as malware.
What it connects to
In normal use, OpenCode talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
opencode.ai | Updates, account services and hosted AI models. |
models.dev | AI provider and model catalogue. |
github.com | Release downloads and optional GitHub integration. |
What it can see
macOS asks you before an app can use these. You can change them any time in System Settings → Privacy & Security.
| Permission | What it’s for |
|---|---|
| Notifications | To show system alerts when its window is not focused. |
Security record
Problems with OpenCode or Anomaly in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| Researchers disclosed a flaw that let a malicious connected tool server run commands during sign-in on Windows and WSL; macOS was unaffected and version 1.18.33 fixed it. | ↗ | |
| A hosted Console breach exposed linked AI provider API keys for 1.4% of Console users; Anomaly notified affected users, but the published report did not confirm a completed fix. | ↗ | |
| A malicious web page could install an attacker’s package through certain npm-based OpenCode server installations; version 1.18.22 fixed the flaw. | ↗ | |
| A malicious website could exploit the local web interface to run commands; a server-side change blocked the reported attack and version 1.1.10 added protection. | ↗ | |
| An unauthenticated local server allowed local programs or websites to run commands with the user’s access; version 1.0.216 fixed the flaw. | ↗ |
References
- OpenCode download opencode.ai
- OpenCode desktop build configuration raw.githubusercontent.com
- Anomaly anoma.ly
- About SST sst.dev
- OpenCode terms of use opencode.ai
- OpenCode privacy policy opencode.ai
- OpenCode tools opencode.ai
- OpenCode security policy github.com
- OpenCode providers opencode.ai
- OpenCode Go endpoints opencode.ai
- OpenCode desktop updater controller github.com
- OpenCode changelog opencode.ai
- OpenCode troubleshooting opencode.ai
- Malware in opencode2 github.com
- Malware in opencode2-darwin-arm64 github.com
- Malware in opencode2-darwin-x64 github.com
- Open and Shut: Remote Code Execution in opencode via MCP OAuth pillar.security
- OpenCode hack exposes API keys amid AI distillation attacks bleepingcomputer.com
- Cross-site OpenCode server upgrade request can install arbitrary packages github.com
- Malicious website can execute commands through the OpenCode web UI github.com
- Unauthenticated HTTP server allows arbitrary command execution github.com
- The signature on a real installed copy, read by HARD with
codesign.