Identifier / Programs / Linux and Unix
opencode
An AI coding agent. Some subcommands such as auth, models, web, etc. have their own usage documentation. tldr-pages
GTFOBins command, inherit 2 documented commands
How opencode is abused
command
inherit
Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for opencode.
2 documented commands
command unprivileged, with sudo, as SUID
opencode
! /path/to/commandinherit unprivileged, with sudo
This allows to run SQLite queries (...) provided that sqlite3 is installed.
opencode db '...'None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are, with GTFOBins’ notes, from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for opencode. The identifier reads the line of each that runs opencode.
Everyday use
Start the interactive TUI
opencodeIdentifyContinue the most recent session
opencode --continueIdentifyRun opencode in non-interactive mode by passing a prompt directly
opencode run "message"IdentifyNone of the 3 examples the identifier reads matches GTFOBins abuse or trips a Sigma process-creation rule.