Context: OpenCode Console breach. Treat any key that was ever saved in a Console workspace as exposed.

1. Usage anomalies: per key/project, compare hourly requests, output tokens and cost from Oct 16, 2026, 8:30 PM ET (00:30 UTC Oct 17, the earliest possible exposure per OpenCode's follow-up email) onward against the prior 14 days. Flag sudden 24/7 flat-rate traffic, models your team doesn't use (often the most capable or reasoning tiers), very long outputs and batch-like uniform prompts, all typical of output harvesting.
2. Key last-used: in each provider's key list, check last-used times for keys that should be idle; any recent use of a key only stored in Console is suspicious.
3. Org API key audit: inventory every provider key (owner, project, scope, spend cap, where it is stored). Find keys pasted into third-party SaaS gateways (OpenCode Console, routers, IDE clouds) and move them to per-tool keys with caps. Use admin usage APIs (OpenAI Usage/Costs API with an admin key, Anthropic Admin API usage and cost reports) to pull per-key data.
4. Google Cloud: check API metrics and billing for the Generative Language / Vertex AI APIs by credential, and any project restriction or abuse notices from Google.
5. Egress/proxy logs: list hosts and users calling opencode.ai inference endpoints to find who used Console in your org, then confirm which provider keys they linked.
6. Phishing follow-on: watch mail for fake OpenCode or provider "refund" or "verify your key" lures.