Attackers breached an older OpenCode Console system, exposing API keys and generating charges on affected users’ AI accounts. OpenCode said 1.4% of console users were affected and notified them by email; its AI tools repeatedly refused to inspect the malicious code.