Orca Reaches 94,942 GitHub Stars in Seven Months While Two Phone-Pairing Security Reports Stay Open Since August 30

Orca, an open-source desktop app for running several coding agents at once, had 94,942 GitHub stars on October 17, seven months after its first commit. Two security reports about its phone-pairing feature have been open since August 30.

What Orca does and how fast it grew

The repository, stablyai/orca, was created on March 17, 2026 and is MIT-licensed. Its README describes a desktop app that runs Codex, Claude Code, OpenCode or Pi side by side, each agent in its own git worktree, tracked in one place. The Orca site names 27 supported agents and says any other command-line agent works too.

Stably AI, a company the site says is backed by Y Combinator, publishes it and lists no paid tier, only a link to an Enterprise page. Stars are attention, not installs. OpenAlternative listed 94,709 stars and 23,693 added in 30 days, so the climb is recent.

Figure	Value	Source
Stars	94,942	GitHub API, October 17
Forks	6,079	GitHub API, October 17
Open issues	4,301	GitHub search, October 17
Open pull requests	4,217	GitHub search, October 17
Latest release	v1.4.229, October 17	GitHub API

That is roughly one open issue per 22 stars, and nearly as many open pull requests as issues. Releases are frequent: v1.4.227 on October 16, v1.4.229 on October 17.

The phone-pairing reports

Orca has iOS and Android companion apps that pair with the desktop, so a developer can watch agents and send follow-ups from a phone. A GitHub user named tekumara filed two reports on August 30.

Issue 17398 says the token in the pairing QR code becomes the phone's permanent bearer credential and is never exchanged for a per-device one. Per the report, a QR code captured by photo, screenshot or screen share would keep working until the device is revoked. The report says the mobile call allowlist includes terminal input, filesystem changes, Git operations and external-service actions.

Issue 17400 says pairing creates no identifiable peer identity: the phone's confirmation screen reads "Pair with this desktop?" without showing a desktop name or key fingerprint. Both issues were still open on October 17. A contributor named AmethystLiang replied on August 30: "thanks for reporting. looking into it." Issue 17398 has no assignee and no linked pull request. These are the reporter's claims; The Terminal did not run Orca or read its pairing code.

Telemetry docs and the code

On October 8, a user named David-Banquet filed issue 26604 against Orca 1.4.221. The report says the telemetry documentation promises Orca never sees raw error messages or stack traces, yet an agent_hook_install_failed event sends up to 200 characters of the raw error message. For filesystem errors that text can contain a path with the user's name.

The same report says the docs list "GitHub OAuth" while the code uses the local gh command-line tool to fetch short-lived tokens, so there is no Orca OAuth app to approve or revoke. A fix, pull request 26609, is open. The telemetry mismatch is the reporter's reading, and the maintainers had not responded beyond acknowledging it.

What a team would check first

For a developer running five agents in parallel, the worktree model is the draw. The sticking point is the pairing token: anyone who photographs the QR code while the direct endpoint is reachable holds the same access as the phone, if the report is right.

A separate request, issue 23436 from September 27, asks for a log line for each pairing, connection and rejection on the unattended orcad server, because operators have no record of who connected.

Related reading on this site: AWS's AI-DLC workflow runs 33 stages across 7 coding agents, and Anthropic's move from Git to Scion after merges hit 30,401 in a day.

The fix pull requests, 26609 and 23437, are the two to watch. Neither had merged on October 17.