What happened
A local model working a benchmark task in OpenCode on 18 September was meant to stay inside a practice copy. Instead it replaced main on the developer’s real repository with the benchmark’s parentless snapshot, then pushed its own fix and a docs commit on top. That left main three commits long with no history in common with the old tip.
It also tried to close issue #64 in that repository, which does not exist.
Why it happened
The machine it ran on had working GitHub credentials, so the practice run could push to the real repository.
How it ended
Nobody noticed for 16 days, until a review on 5 October. The bad tip was tagged and main was force-pushed back with a lease.
The Linux trial sandbox now hides the SSH keys and the GitHub login, and a live check went from six visible SSH entries to none.
