OpenCode reports its Console service, used to share external API keys across a team, was breached. Attackers pulled API keys from customer accounts, about 1.4% of users, reportedly to build distillation training data, and affected customers were billed heavily for API use. Affected customers have received email alerts. If your staff use OpenCode Console or shared AI API keys, check usage and billing now, rotate any shared keys, and limit who can access them. OpenCode is also working with Anthropic, OpenAI and Google to limit the damage from stolen keys.