OpenCode install or execution on developer endpoints (breach exposure hunt)
Exposure-assessment hunt for endpoints running OpenCode and contacting OpenCode Console or AI provider APIs, to prioritise API key rotation after the October 2026 OpenCode breach.
Microsoft Sentinel (KQL)

