anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-22 02:05:26 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

Recent Copilot commit seemingly opens the door to a possible malicious compliance scenario. #7157

New Issue
Closed
opened 2026-02-16 18:06:19 -05:00 by yindo · 5 comments
yindo commented 2026-02-16 18:06:19 -05:00
Owner
Copy Link
Copy Source

Originally created by @ariane-emory on GitHub (Jan 22, 2026).

Originally assigned to: @thdxr on GitHub.

Description

It seems that all subagent requests are now marked with "agent" as the value of the x-initiator header, based upon this recent commit:

https://github.com/anomalyco/opencode/commit/19fe3e265ad59e7e65df4b3d86b09ec88f454bde

While on its face, this seems like it adheres to Copilot's terms of service, it seems that it opens the door to a form of malicious compliance.

Imagine a scenario such as the following:

  1. All my primary agents are rigged to use models from providers other than Copilot.
  2. All my sub agent are configured to use models from Copilot that are ordinarily meant to consume premium requests.
  3. I do my work by dispatching many subagents, or by prompting the primary agent to dispatch the @general subagent (which I have configured to use a high PR cost Copilot model such as Opus) do all of the actual work.

Net result: I can use high-cost models from Copilot constantly, issuing hundreds (or even thousands) of requests while never consuming a single Premium Request. Possibly, this could trip Copilot's abuse detection circuits and result in accounts being banned from Copilot if they detect that hundreds (or thousands) of requests being issued, but no premium requests are ever being consumed.

It seems possible to me that the rules set out in Copilot's terms of service for how Premium Requests are consumed are themselves simply ill-conceived from the get-go. While the scenario that I laid out above may in fact be adhering to Copilot's rules-as-written, it seems like the scenario I'd laid out above would constitute a form of malicious compliance.

I'm not sure how concerned we are with this, but to me it seemed like an issue worth raising for discussion.

Plugins

No response

OpenCode version

No response

Steps to reproduce

No response

Screenshot and/or share link

No response

Operating System

No response

Terminal

No response

Originally created by @ariane-emory on GitHub (Jan 22, 2026). Originally assigned to: @thdxr on GitHub. ### Description It seems that all subagent requests are now marked with `"agent"` as the value of the `x-initiator` header, based upon this recent commit: https://github.com/anomalyco/opencode/commit/19fe3e265ad59e7e65df4b3d86b09ec88f454bde While on its face, this seems like it adheres to Copilot's terms of service, it seems that it opens the door to a form of malicious compliance. Imagine a scenario such as the following: 1. All my primary agents are rigged to use models from providers other than Copilot. 2. All my sub agent are configured to use models from Copilot that are ordinarily meant to consume premium requests. 3. I do my work by dispatching many subagents, or by prompting the primary agent to dispatch the @general subagent (which I have configured to use a high PR cost Copilot model such as Opus) do all of the actual work. Net result: I can use high-cost models from Copilot constantly, issuing hundreds (or even thousands) of requests while never consuming a single Premium Request. Possibly, this could trip Copilot's abuse detection circuits and result in accounts being banned from Copilot if they detect that hundreds (or thousands) of requests being issued, but no premium requests are ever being consumed. It seems possible to me that the rules set out in Copilot's terms of service for how Premium Requests are consumed are themselves simply ill-conceived from the get-go. While the scenario that I laid out above may in fact be adhering to Copilot's rules-as-written, it seems like the scenario I'd laid out above would constitute a form of malicious compliance. I'm not sure how concerned we are with this, but to me it seemed like an issue worth raising for discussion. ### Plugins _No response_ ### OpenCode version _No response_ ### Steps to reproduce _No response_ ### Screenshot and/or share link _No response_ ### Operating System _No response_ ### Terminal _No response_
yindo added the bug label 2026-02-16 18:06:19 -05:00
yindo closed this issue 2026-02-16 18:06:19 -05:00
yindo commented 2026-02-16 18:06:20 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Jan 22, 2026):

This issue might be a duplicate of existing issues. Please check:

  • #8700: GH Copilot | synthetic user messages burn premium requests - Describes the exact same root cause where synthetic user messages created for subagents are marked as 'user' instead of 'agent' in the x-initiator header
  • #8030: Copilot auth now sets far too many requests as "user" consuming premium requests rapidly - Related issue discussing excessive premium request consumption due to header classification
  • #8067: Github Copilot multiple premium request charges without subagents - Related to multiple premium request charges

These issues discuss the technical details of how subagent requests are being classified by the Copilot plugin and the implications for premium request consumption. Feel free to ignore if your specific concern is distinct from these.

@github-actions[bot] commented on GitHub (Jan 22, 2026): This issue might be a duplicate of existing issues. Please check: - #8700: GH Copilot | synthetic user messages burn premium requests - Describes the exact same root cause where synthetic user messages created for subagents are marked as 'user' instead of 'agent' in the x-initiator header - #8030: Copilot auth now sets far too many requests as "user" consuming premium requests rapidly - Related issue discussing excessive premium request consumption due to header classification - #8067: Github Copilot multiple premium request charges without subagents - Related to multiple premium request charges These issues discuss the technical details of how subagent requests are being classified by the Copilot plugin and the implications for premium request consumption. Feel free to ignore if your specific concern is distinct from these.
yindo commented 2026-02-16 18:06:20 -05:00
Author
Owner
Copy Link
Copy Source

@joseehilton147 commented on GitHub (Jan 22, 2026):

Should only work when user input came from copilot models, i think in this way should not have any problem.

@joseehilton147 commented on GitHub (Jan 22, 2026): Should only work when user input came from copilot models, i think in this way should not have any problem.
yindo commented 2026-02-16 18:06:20 -05:00
Author
Owner
Copy Link
Copy Source

@ariane-emory commented on GitHub (Jan 22, 2026):

@joseehilton147 Currently, I do not believe that that is the case (though I do agree with you that it likely should be). Only spent about 30 minutes digging into it, so I could be mistaken.

@ariane-emory commented on GitHub (Jan 22, 2026): @joseehilton147 Currently, I do not believe that that is the case (though I do agree with you that it likely should be). Only spent about 30 minutes digging into it, so I could be mistaken.
yindo commented 2026-02-16 18:06:20 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Jan 22, 2026):

this isn't an issue on our end its a limitation of their api

@rekram1-node commented on GitHub (Jan 22, 2026): this isn't an issue on our end its a limitation of their api
yindo commented 2026-02-16 18:06:20 -05:00
Author
Owner
Copy Link
Copy Source

@ariane-emory commented on GitHub (Jan 22, 2026):

Fair enough, just thought it was worth at least thinking about ;)

@ariane-emory commented on GitHub (Jan 22, 2026): Fair enough, just thought it was worth at least thinking about ;)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#7157
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?