Whoever you hand your keys to, you hand your risks to! OpenCode's cloud backend was breached, leading to the leak of AI API keys for about 1.4% of users on the platform, resulting in unauthorized usage. OpenCode has been blowing up recently thanks to the hype around AGent, constantly promoting free access to various models. Who would’ve thought things would go wrong so quickly? Official statement from OpenCode: Last night’s security incident affected 1.4% of Console users, specifically those who had linked external models like OpenAI / Anthropic / Google, etc. According to notification emails shared by users, third-party API keys stored in cloud workspaces may have been leaked. Some users have already reported unauthorized charges ranging from tens to thousands of dollars overnight. Hopefully, none of you are affected. Crypto folks are probably the most sensitive to this: handing over your exchange API key to third-party bots or copy-trading tools is the same structure. If the tool gets compromised, you’re stuck with the bill. In severe cases, the API could even be used to drain your assets. APIs are something we’ll definitely need to use more in the future, especially when working with AI and agents. Here are four tips to keep in mind—save this and do a quick self-check: 1) Use a separate key for each tool. 2) Set strict spending limits—don’t confuse alerts with limits. 3) Grant only the minimum permissions needed. For exchange keys, never enable withdrawal permissions. 4) Revoke old keys directly from the source platform—don’t just delete them from third-party dashboards. The official team says the investigation is still ongoing. Stay tuned for updates!