An attack on OpenCode allowed unauthorized actors to extract user API keys and run up billing on artificial intelligence provider accounts