OpenCode Has 217,837 Stars and a Security Policy That Says Its Permission Prompts Are Not a Sandbox

OpenCode, the MIT-licensed coding agent from the anomalyco organisation, gained 1,311 stars on GitHub's trending list today and has 217,837. Its SECURITY.md says plainly that "OpenCode does not sandbox the agent."

The permission prompts that appear before a shell command or file write, the file says, are "a UX feature to help users stay aware of what actions the agent is taking," and are "not designed to provide security isolation."

What the threat model says

The policy describes OpenCode as "an AI-powered coding assistant that runs locally on your machine" with "access to powerful tools including shell execution, file operations, and web access." Its advice for anyone who wants isolation is one line: "run OpenCode inside a Docker container or VM."

The README names two built-in agents. The build agent is the "Default, full-access agent for development work." The plan agent is read-only: it "Denies file edits by default" and "Asks permission before running bash commands." The policy tells you how much weight to put on that second sentence.

Server mode is opt-in. When it is on, the policy says to set OPENCODE_SERVER_PASSWORD to require HTTP Basic Auth, and without it "the server runs unauthenticated (with a warning)." The file adds that "any functionality it provides is not a vulnerability."

Five categories the project will not treat as vulnerabilities

The policy carries an out-of-scope table. Anything below is, by the project's own definition, not a security bug.

Category	Reason the project gives
Server access when opted in	API access is expected behaviour
Sandbox escapes	The permission system is not a sandbox
LLM provider data handling	Governed by the provider's policies
MCP server behaviour	Outside the trust boundary
Malicious config files	Users control their own config

The policy also opens with a rule about reports: "We do not accept AI generated security reports." It says that submitting one is "an automatic ban from the project." Reports go through the GitHub Security Advisory form, with an email fallback if there is no reply in 6 business days.

The install block

The README's first install command is labelled # YOLO: curl -fsSL https://opencode.ai/v2/install | bash. Below it come npm (@opencode/cli), Homebrew, Arch, mise and Nix routes. Two Homebrew formulas are listed. One, anomalyco/tap/opencode-v2, is marked "recommended, always up to date." The other, the official formula, is "updated less."

The script chooses where to install in a fixed order: $OPENCODE_INSTALL_DIR, then $XDG_BIN_DIR, then $HOME/bin, then $HOME/.opencode/bin. A tip under the block says "Remove versions older than 0.1.x before installing." The repository's latest release is v1.19.3, published October 16, so that tip refers to a version line well behind the current one.

The size of the project

The repository was created on April 30, 2025. The GitHub API shows 29,115 forks, and a search for open items returns 3,135 issues and 1,192 pull requests. Releases arrive quickly: v1.18.35 on October 6, v1.19.0 on October 11, and v1.19.1, v1.19.2 and v1.19.3 between October 15 and 16.

Orca, a worktree manager that gained 1,590 stars today, lists OpenCode among the agents it can run, so the no-sandbox statement is relevant to anyone driving OpenCode through it.

What to do about it

The policy leaves isolation to the user and names Docker or a VM. One commercial route to isolated agent runs, covered earlier on this site, is Agent37's agent sandboxes at $0.37 for 57 hours. Earlier coverage of an agent project with a large star count is Google Research's Harness2.

The SECURITY.md was read from the repository's dev branch. The 0.1.x tip in the README is the other line to watch: it still names 0.1.x while the latest release is v1.19.3.