OpenCode — agentic threat model

Connects to multiple external model providers or uses free local models. Vulnerable to adversarial prompt injection, model reprogramming, and misaligned code generation outputs that could introduce security vulnerabilities into the codebase.

Not certain from the listing — the exact mechanism for indexing, vectorizing, or caching codebase data is not specified, though it reads and writes local files. Gaps in data lineage or insecure local storage of codebase embeddings could lead to local data exfiltration.

Orchestrates multi-file edits, refactoring, and terminal commands. High risk of tool misuse or insecure tool integration, where malicious instructions (e.g., via a compromised codebase or prompt injection) could trigger destructive terminal commands or unauthorized file modifications.

Deploys as a desktop app, IDE extension, or inside GitHub Actions runners. Compromise of the agent can lead to local host compromise, privilege escalation on the developer's machine, or lateral movement/secrets theft within the CI/CD runner environment.

Not certain from the listing — there is no mention of built-in guardrails, evaluation frameworks, or observability logging to monitor agent actions, detect anomalous commands, or prevent unauthorized file system changes.

Not certain from the listing — as an open-source tool, it lacks explicit enterprise compliance certifications (e.g., SOC2) or built-in policy enforcement mechanisms to restrict actions based on user roles or repository sensitivity.

Integrates with the GitHub ecosystem (issues and PRs). This introduces a severe risk of indirect prompt injection, where an untrusted external user could comment on a public issue/PR to trigger the agent inside a GitHub Actions runner and execute malicious code.