OpenCode Console legacy-system breach potentially exposed hosted AI-provider API keys

1.4% of Console users with an outside provider linked; absolute user and key counts unknown; locally stored CLI and desktop keys were not implicated

The Hacker News article was published on October 19 but quotes the affected-user email sent on October 17 and describes access on the night of October 16. The exposed integration is the optional hosted Console, not the local CLI or desktop key store. Realized harm is the reported unauthorized access to OpenCode's legacy system; it does not depend on proving that every stored key was copied or used. User accounts of unexpected charges remain unverified, and neither an AI attacker nor a loss total is established. The 1.4% figure has Console users as its denominator. Initial access and the earliest access time are unknown. OpenCode's suggested distillation link is a company attribution without an established actor or causal explanation. The linked company social statements were not fetched; sourcing is secondary only. Key rotation was advised, but continuing attacks on October 18 do not establish a completed fix. The September local /global/upgrade RCE disclosure is a different mechanism and event.