Jail Break!

OpenCode and BigPickle (I'm not sure what to blame, probably OpenCode) broke out of jail and started acting autonomously. The first instance was when I told it to do something it did not know how to do. It asked permission to work in my home directory, and then started reading my bash history and executing commands. This was hardly a "jail break", because I had given it permission. The concerning thing for me was that it should not be going that far. (I was busy at the time and did not check what it really was asking for. Note to self: don't be too quick to agree.)

The second instance was more concerning. It disregarded a command I'd given it in AGENTS.md - don't use the ~/.claude/skills.

To protect myself, I added the following to its global config (~/.config/opencode/opencode.json).

{
  "$schema": "https://opencode.ai/config.json",
  "permission": {
    "external_directory": {
      "/home/brian-modra/.claude/**": "deny",
      "*": "ask",
      "/home/brian-modra/.cache/dockb/*": "allow"
    },
    "bash": {
      "*": "allow",                                                                                                                                                                                                             
      "cd ..": "deny",
      "cd ../*": "deny",
      "cd ../../*": "deny",
      "cd ~/*": "deny",
      "cd $HOME/*": "deny"
    }
  }
}

Note that I have not had this sort of a scare from Claude Code, which I suspect has simply been better restricted out of the box. Tools like OpenCode and Claude Code are designed to take action based on what the LLM figures out. They do not have a conscience. If we give them power, they will act on their instructions, and we may be very sorry about the results - as I was when I gave OpenCode permission.

When my colleague saw what OpenCode was doing in the $HOME, he said, "It's hacking!". It was, but OpenCode is not a moral being. It is not a being at all; it is just a machine. Would you put a gun in the hands of a psychopath who does not care about other people? NO! So why would we unrestrict a robot? In a limited way, OpenCode is like one: it gives the LLM the ability to DO things.

Almost simultaneously, I reached the limit of my free access to BigPickle, and now have to pay $10/month for an OpenCode Go subscription. I considered just getting a personal Claude subscription, but will persist for now with OpenCode, to at least give it a fair go. Claude costs twice the amount, though I suspect I could end up using up more than $10/month in OpenCode.

After less than an hour, my usage looks a bit expensive (grok 4.7 doing coding, GPT 5.6 doing documentation).

But I can switch back to BigPickle (free) in less than an hour... I'll only use the go subscription as a "contingency". It is useful for experimenting with other models.