If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.

The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.

They need to explain this, by releasing a detailed RCA.