API keys saved in OpenCode workspaces may have been exposed after someone accessed a legacy system. Users are reporting unexpected spending on connected AI accounts, with one putting the damage at $400. OpenCode has confirmed the breach and is working with three major AI providers.