OpenCode says a Console breach may have exposed provider API keys for 1.4% of Console users

OpenCode told affected users someone got into a legacy Console system it was decommissioning, and that OpenAI, Anthropic, and other provider keys saved in their workspaces may have been exposed; it tied the Oct 17 breach to a "large scale distillation attack" and says only users with linked external providers who got its email were hit. If you got that email, revoke and reissue those keys in each provider's dashboard and check recent usage, since some users report charges they didn't make.