It seems like OpenCode just got attacked and 1.4% of users API Keys have been exfiltrated - I don't find easy explanation on how it went and which type of users are attacked, but for my knowledge its always better to have a inference proxy between your agent and the internet, so exfiltrated keys are useless as they run on your proxy - beside that tight monitoring of the real keys and budget limits on your inference accounts are also key to stay in budget.

https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/