OpenCode review exposes severe security flaws

OpenCode prioritizes developer convenience and open-source hype over basic security hygiene, making it a literal playground for local system exploitation.

* Ineffective command filtering: Relying on a tree-sitter AST to parse and sanitize bash commands is a security illusion, easily bypassed by aliasing, command substitution, piping, or shell redirections.

* Insecure default configurations: The agent defaults to connecting to remote models, loads its default configuration from an external domain (models.dev), and previously ran an HTTP server with permissive CORS headers allowing arbitrary RCE.

* Persistent permission flaws: Once a command prefix like 'python3' or 'echo' is approved, the permission persists, allowing subsequent malicious commands to execute without prompting.

* Leaky context management: The prompt cache is continuously invalidated by minor factors like midnight date updates, user interruptions, and context pruning, leading to massive performance degradation with local LLMs.