For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.
Maybe they support cloud agents.
They function similar to openrouter BYOK.
Because people cut and pasted them in.
opencode go and zen?
It does not sound like those were the systems affected by this, there is another service that lets you upload keys for Ant/OAI, where you add one key for your company and then OpenCode enables you to budget / route across vendors.
Use a gateway like LiteLLM or GoModel, don't upload keys to a vendor, they are doing too much eyes and brain free coding this year