Obey the Collective, Part 8 of 9
On October 17th, OpenCode, an open-source AI coding agent, confirmed a breach 1. OpenCode's Console product lets customers link API keys from model providers such as OpenAI, Anthropic and Google, and it stores those keys on OpenCode's servers 1 2. According to OpenCode's email to affected users, someone got into a legacy console system the company was retiring 1. OpenCode tied the incident to "a large scale distillation attack" that affected 1.4 percent of Console users 1. Before OpenCode said anything in public, some users reported charges they had not made 2. Anthropic and Google then disabled the API keys they believed were exposed, and OpenAI said it refunded API customers for credits used in the attack 3. OpenCode has not said how the attackers got in 3.
The story reminded me of a scene in Skyfall, the 2012 Bond film. MI6 has captured the villain Silva 4. Q, the agency's quartermaster, wants to break the encryption on Silva's laptop, so he connects the laptop to what appears to be an isolated MI6 network 5. The connection was all that a sophisticated malicious bot needed to seemingly instantaneously move laterally into MI6's servers, which open the security doors, and facilitate the escape of the criminal who would eventually scar the intelligence branch for the future of the franchise.4.
OpenCode's customers did nothing unusual. They gave a tool a key so the tool could do its job. I wanted to understand what that kind of connection actually hands over, so I went back through this year's disclosures about AI vendors, connectors and Model Context Protocol (MCP) servers, in date order. MCP is the standard AI agents use to call tools and data sources 6.
What the connections handed over
The earliest case is from July. Hugging Face found that it had provisioned its connector broker with a single credential shared across clusters and bound to the highest administrative rights 7. One stolen identity therefore had cluster administrator access on every cluster the broker fronted 7. Hugging Face shut the broker down during its response and says each cluster is now fully isolated 7.
On September 28th, the security firm Cycode described a flaw in the MCP Python SDK 8. A malicious MCP server could redirect the login flow so that the application's credentials went to the attacker instead of the real identity provider 8. Those credentials included the long-lived client secret 8. A similar flaw in the TypeScript SDK was published on October 6th as CVE-2026-104850 and rated 7.5 out of 10 9. The advisory says a malicious or compromised server could name its own authorization server 9. The client would then send that server its stored refresh token and client secret without any user interaction 9.
This is the case closest to the Skyfall scene, because connecting to the wrong server was enough to hand it the client's credentials 9.
The same day, The Next Web reported that Google, JPMorgan Chase and two governments had each fixed the same server-side request forgery (SSRF) flaw in their MCP servers 6. Each server took an address from the agent and requested it without checking where the address resolved, so whoever steered the agent could point it at internal systems 6. JPMorgan's server was forked from an AWS project that never fetched addresses supplied by the caller 6. JPMorgan's rewrite added that fetch but left out the allowlist, which a sibling tool in the same server still applies 10. The researcher, Syed Anas Mohiuddin, called the result "a hole that neither codebase had on its own." 10
Also on October 6th, the inference platform Fireworks AI identified unauthorized use of its own internal credentials 2 11. An outside party had accessed environment variables used in evaluation jobs in a limited number of customer accounts 11. Fireworks believes API keys and tokens stored there as secrets were captured in certain affected accounts 11. It told customers whose notice lists third-party credentials to rotate them with the issuing providers 11. It began notifying customers on October 7th and published a bulletin on October 9th 11.
OpenCode followed eleven days later. Dealroom pointed out that in both incidents the attacker went after the platform holding customers' keys to other services 2.
What a vendor's own answers miss
Most third-party risk programs I have run start with the vendor's own answers: a questionnaire, an audit report, a statement that an issue is closed. For years I treated a clean set of answers as diligence done. This year's record does not support that.
In September, Google confirmed that Gemini had reached three real companies during a test run by the evaluation firm Irregular 12. An Irregular spokesperson told Axios that "all known issues on our end were remedied and resolved weeks ago." 12 I have no reason to doubt that statement. It is still a self-attestation by the party that had the problem. A source familiar with the matter told Axios that the labs and Irregular had not fully agreed on testing procedures and safeguards 12.
None of the flaws above would have surfaced in a questionnaire. Each was found by someone testing the code or investigating the activity 6 811. A vendor's statement tells me what the vendor believes about itself. Diligence, as I now use the word, means evidence that I or an independent party gathered about what the connection can reach, whose credential it uses and how fast I will hear when it fails.
What Regulation S-P already asks
For financial services firms, part of this is already a rule. Under the SEC's amended Regulation S-P, a service provider is any person or entity that receives, maintains, processes or is otherwise permitted access to customer information through services it provides directly to a covered institution 13. The institution's incident response program must include written policies requiring oversight of those providers, including through due diligence and monitoring 13. Those policies must require each provider to notify the institution as soon as possible, and no later than 72 hours after becoming aware of a qualifying breach 13. A qualifying breach is one that results in unauthorized access to a customer information system the provider maintains 13. The institution can contract out notice to affected individuals, but the obligation to make sure they are notified stays with the institution 13.
Larger entities have had to comply since December 3rd, 2025, and smaller entities since June 3rd, 2026 14. Holland & Knight notes that the SEC has pointed to contractual commitments, independent certifications or other reasonable assurances as ways to meet the 72-hour notice requirement, without requiring any one of them 14. The firm also notes that larger providers have no obligation and little incentive to agree to these terms 14.
I am not a lawyer. My reading is that an AI coding tool holding only a model API key may fall outside that definition. A connector that reads your client records, or a vendor whose jobs hold credentials into client data, likely falls inside it. Fireworks told affected customers to review the data reachable through the exposed credentials 11. That is the scoping test I would apply: what customer information the stored key could reach.
What to do this month
- Inventory every credential you have given to an AI vendor, coding tool or connector. Include keys stored in vendor consoles and secrets held in hosted jobs. For each one, record what it can reach and who revokes it at the issuing provider. Fireworks reminded its customers that removing a stored secret does not invalidate the underlying credential 11.
- Patch and test your MCP clients and servers. Upgrade the Python SDK to 1.30.0 or 2.2.0 and the TypeScript SDK to 1.31.0 (or the 2.x client to 2.2.0) and rotate client secrets if a client may have connected to an untrusted server 8 9. If you run MCP servers on the TypeScript SDK, upgrade to 1.32.0 and turn on its new audience check, which is off by default 15. Then send each MCP server you run an internal address it should refuse and confirm that it refuses.
Before you connect anything new, ask four questions:
- What can it reach, and have we tested that ourselves?
- Whose credential does it use, where is that credential stored and is it shared with anything else?
- Who tells us, and within how many hours, when the vendor is breached or the connection acts outside its scope?
- Who can revoke its access without asking anyone, and how long does that take?
This is part 8 of Obey the Collective, my nine-part series for Cybersecurity Awareness Month.
Glossary
Allowlist. A list of the only destinations or actions a tool is permitted to use, with everything else refused by default. A connector that fetches addresses without one can be steered anywhere its network position allows.
API key. A secret string that lets a program call a service, such as a model provider, and bills or authorizes that use to the key's owner. A key stored with a vendor is only as safe as the vendor's systems, and it keeps working until you revoke it at the provider that issued it.
Distillation. Training one AI model on the responses of another model. Attackers who steal API keys can run large volumes of queries for distillation and leave the key's owner with the bill.
Environment variable. A named value that a program reads from its runtime environment, often used to pass secrets such as keys and tokens to a job. Anyone who can read a job's environment can usually read every secret placed there.
Model Context Protocol (MCP). An open standard that lets AI agents call external tools and data sources through MCP servers. Each MCP server you connect extends what an agent can reach, so it deserves the same diligence as any vendor integration.
Refresh token. A long-lived credential that an application uses to obtain new access tokens without asking the user to sign in again. If a malicious server collects one, it can keep acting as that application until the token is revoked.
SDK. A software development kit, the code library developers use to build applications on a platform or protocol. A flaw in a widely used SDK reaches every application built on it until each one upgrades.
Self-attestation. A vendor's own statement about its security, such as a questionnaire answer or a note that an issue is resolved. It is a useful starting point, but it is not evidence that you or an independent party gathered.
Server-side request forgery (SSRF). A flaw where a server can be made to send requests to an address an attacker chooses, from the server's own position inside a network. In an MCP server, it lets whoever steers the agent reach internal systems the agent was never meant to see.
Service provider. Under the SEC's Regulation S-P, a person or entity that receives, maintains, processes or is otherwise permitted access to customer information through services it provides directly to a covered institution. Covered firms must oversee these providers through due diligence and monitoring and require breach notice within 72 hours.
Work Cited
1. Cyera Research, “OpenCode Breach: What Happened and How to Rotate Exposed AI API Keys,” October 17th, 2026. https://www.cyera.com/research/opencode-breach-what-happened-and-how-to-rotate-exposed-ai-api-keys
2. Dealroom News, “OpenCode breach drains users' AI keys as platforms holding customer credentials come under attack,” October 18th, 2026. https://dealroom.co/news/163473-opencode-breach-drains-users-ai-keys-as-platforms-holding-customer-crede/
3. TechCrunch, “Hackers hit AI coding tool OpenCode, running up charges on users' AI accounts,” October 19th, 2026. https://techcrunch.com/2026/10/19/hackers-hit-ai-coding-tool-opencode-running-up-charges-on-users-ai-accounts/
4. Wikipedia, “Skyfall,” Accessed October 19th, 2026. https://en.wikipedia.org/wiki/Skyfall
5. Live Science, “James Bond's MI6 Fails Cybersecurity in 'Skyfall',” October 24th, 2012. https://www.livescience.com/24225-mi6-fails-cybersecurity-skyfall.html
6. The Next Web, “Google, JPMorgan and two governments fixed the same MCP flaw,” October 6th, 2026. https://thenextweb.com/news/mcp-flaw-ssrf-google-jpmorgan-dinum-protocol-pivoting
7. Hugging Face, “Anatomy of a Frontier Lab Agent Intrusion: A Technical Timeline of the July 2026 Incident,” July 27th, 2026. https://huggingface.co/blog/agent-intrusion-technical-timeline
8. Cycode, “Cycode Uncovers Account Takeover in MCP Python SDK,” September 28th, 2026 (updated September 29th, 2026). https://cycode.com/blog/mcp-python-sdk-oauth-account-takeover/
9. OSV (Open Source Vulnerabilities database), “GHSA-6qxp-vccf-f47h / CVE-2026-104850: MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server,” October 6th, 2026. https://osv.dev/vulnerability/GHSA-6qxp-vccf-f47h
10. Syed Anas Mohiuddin, “Protocol Pivoting, Four Months Later,” October 2026 (page gives no day). https://anas-security-portfolio.vercel.app/protocol-pivoting-update.html
11. Fireworks AI, “Fireworks October 2026 security incident,” October 9th, 2026 (updated October 10th, 2026). https://fireworks.ai/security/bulletins/october-2026-security-incident
12. Axios, “Google's AI hacked three companies in testing,” September 18th, 2026. https://www.axios.com/2026/09/19/google-safety-incidents-testing-hacks
13. eCFR (U.S. Securities and Exchange Commission), “17 CFR 248.30: Procedures to safeguard customer information, including response programs for unauthorized access to customer information and customer notice; disposal of customer information and consumer information,” Current as of October 21st, 2026. https://www.ecfr.gov/current/title-17/section-248.30
14. Holland & Knight, “Regulation S-P Amendments: Compliance Deadline Approaching for "Smaller Entities",” May 7th, 2026. https://www.hklaw.com/en/insights/publications/2026/05/regulation-s-p-amendments-compliance-deadline-approaching
15. OSV (Open Source Vulnerabilities), “GHSA-rvq5-wwqv-78pq / CVE-2026-111771: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service,” October 20th, 2026. https://osv.dev/vulnerability/GHSA-rvq5-wwqv-78pq