An unauthorized attack on OpenCode compromised approximately 1.5% of its user accounts to generate charges on external artificial intelligence APIs