Command Code revokes all API keys after a security incident tied to a distillation attack

Command Code, a coding agent, posted on X on October 28 that earlier that day it "detected and stopped a security incident linked to a large-scale distillation attack targeting Anthropic and OpenAI models." This is the company's own account.

• As a precaution it revoked all API keys. To keep using Command Code, users must log in to Studio again and generate a new key. A user replying on X confirms their key was revoked.
• It says it has so far found no evidence that any users were impacted.
• It says it is working with Cloudflare, Anthropic and OpenAI to investigate. It has given no further detail.