Damn, that sucks. I didn't know OpenCode was this bad when it came to privacy.

If i dont use any of their models nor i am signed in, is that a problem? i dont see anything in wireshark except for models.opencode.ai

This is one of the reasons I don't trust opencode. It looked very nice on paper when it first came out and there were no alternatives. However, today I'd probably stick with simple pi setup (not sure how much better than opencode, but it looks like they don't have all this cloud stuff) or just use one of the big tech agents and call it a day.

You might reconsider how serious the Pi team takes security based on the eventual result of this issue. They are also working on a service like this called Radius.

https://github.com/earendil-works/pi/issues/10895

https://radius.earendil.com/

"when challenged about sending data to openrouter without listing it as a 3rd party processor they offered a dismissive response. the same with running prompts through cloudflare. seems trivial, but signifies general disinterest in security."

I did have an account but moved off for security reasons.

I love the smell of misinformation in the morning. All it ever did was give people free model for title gen, if they didn't set one themselves. Feature you could disable or set on your own model. That was since removed, so now there is no free fallback model.

That is it. It is still private by default

> All it ever did was give people free model for title gen,

All it "ever did" was send your entire prompt/context to a "free" model for harvesting. The astroturfing in this thread is absurd.

It sent the prompt to a GPT-5-nano model with the max zdr you can get on openai. That was done to give people free title gen, unless they set it themselves. Title gen does not send anything but the prompt.

Maybe try a sensible approach first, cause so far this is assumed, for no reason, to be done maliciously. "to steal data" and the like.

Opencode's source code is public, so you can verify any claim against it directly.

but the prompt was sent to OpenAI via Opencode's servers right? So even when you use a local model, Opencode can still see your prompt by default?

It was going through zen, so they CAN see it if they want to. Same applies to anything on Zen. But, zen is ZDR. Same goes to any provider, ZDR or not, as ZDR is just an agreement. With Openai - caveats apply on Openai side itself(they retain logs regardless).

During this short period - yes. Unless it finds a valid small model, or you set one yourself - it would use the one provided by zen. or you could disable it with an invalid model altogether. Good gesture for most users and something else to others.

It's *could by the way, as this was only a short window when this was a thing. It went back to not having this fallback pretty fast, i don't think it even lasted a month.

In other words, yes they could see all your prompts by default and yes their privacy claims were BS. I'm not that sympathetic to "only a short window" given how they dismissed the github issue until they got flooded with complaints