OpenCode Console breached: centrally hosted vendor keys at risk

OpenCode disclosed that its hosted Console service was breached, affecting 1.4% of Console users, all of whom had linked external AI vendor keys. What leaked were the OpenAI, Anthropic, and Google keys users had stored in their Console workspaces, and some users reported unauthorized spending afterward. OpenCode attributed the incident to a "large-scale distillation attack," but did not explain how that claim relates to the breach or who was responsible, nor did it confirm whether the keys were encrypted.