Before v1.1.10, OpenCode automatically and silently started an unauthenticated web server which allowed connecting peers to execute arbitrary code.
OpenCode’s core feature is arbitrary code execution. The bug was making that feature available to
every process on the machine—and, in earlier versions, every website—without asking. localhost is
a routing decision, not a security boundary, and CORS is not authentication.
Coding agents need broad authority to be useful, which makes their boring boundaries more important than their clever models. The shell is the product. Authorization has to be part of it.