OpenCode Breach: What Happened and How to Rotate Exposed AI API Keys

OpenCode disclosed a breach on October 17 affecting 1.4% of OpenCode Console users that linked external AI provider API keys; those keys may have been exposed, and some users reported unexpected usage charges. The report details why stolen provider keys are dangerous, recommends immediately revoking and reissuing keys at each provider, reviewing usage and billing, applying spend limits and least-privilege practices, and investigating where OpenCode is used within your environment.