← All incidents

Command Code says it stopped a security incident linked to a distillation attack and revoked all API keys as a precaution

Incident · Command Code (AI coding agent): Command Code API keys · MEDIUM

Summary

Command Code, an AI coding agent, says it stopped a security incident and revoked all API keys as a precaution. In a post on X at 7:16 p.m. ET on Oct 28, 2026, the company wrote: "Earlier today we detected and stopped a security incident linked to a large-scale distillation attack targeting Anthropic and OpenAI models." It said, "As a precaution, we've revoked all API keys," and told users: "To keep using Command Code, log in to Studio again to generate a new key." Command Code wrote that "So far, we've found no evidence that any users were impacted" and that it is "working with Cloudflare, Anthropic, and OpenAI to investigate." That post is the only statement about the incident we have found from Command Code. Its founder and CEO, Ahmad Awais, replied to two users on X that evening with login help but gave no other details. Command Code has not said how many accounts or keys the attack involved, when the incident began, what time it was detected, how it happened or how it is linked to the distillation attack it describes. As of Oct 29 at about 10:07 a.m. ET, Command Code had posted no follow-up statement on X and nothing on its blog, changelog or status page.

Severity

Timeline

1. Oct 28, 2026 (time not given)
   Command Code says it "detected and stopped a security incident" earlier that day, per its post on X that evening. It has not said when the incident began or what time it was detected.
2. Oct 28, 2026, 7:16 p.m. ET
   Command Code posts on X that the incident was "linked to a large-scale distillation attack targeting Anthropic and OpenAI models", that it has revoked all API keys as a precaution, that it has found no evidence so far that any users were impacted, and that it is working with Cloudflare, Anthropic and OpenAI to investigate.
3. Oct 29, 2026, about 9:55 a.m. ET
   Command Code has posted no follow-up statement on X, and its blog, changelog and status page do not mention the incident.

How it happened

Command Code has said very little about how the incident happened. Its statement on X says it detected and stopped "a security incident linked to a large-scale distillation attack targeting Anthropic and OpenAI models." Distillation is a training technique in which a smaller "student" model learns to replicate the behavior of a larger "teacher" model, as Command Code's own AI glossary puts it. Command Code has not explained what the attack involved, how its systems or keys were connected to it, or who it believes was behind it. It has not said what the incident was, whether anyone got into its systems, or whether any keys or user data were exposed. It has not said how many accounts or keys the attack involved, when the incident began, or when it was detected beyond "Earlier today". It has not said what role Cloudflare, Anthropic and OpenAI are playing in the investigation. We won't guess at any of these details, and we will update this entry if Command Code publishes them.

How to check your app

• Expect your old Command Code API key to stop working. Command Code says it revoked all API keys as a precaution. To keep using Command Code, it says, log in to Studio at commandcode.ai and generate a new key. Command Code's docs say the API keys page in Studio is where you generate and manage keys.
• Update everywhere the old key lives. Command Code's docs say CI pipelines, Docker images and scheduled jobs use the key through the COMMAND_CODE_API_KEY environment variable, and that the same key works with the Command Code Provider API. Replace it in your CI secrets, containers and any code that calls the Provider API. Command Code's quickstart says cmd login stores an API key in ~/.commandcode/auth.json, so if the CLI stops authenticating, we suggest running cmd login again (cmdc login on native Windows).
• Check your usage. Command Code's docs say the Usage tab in Studio tracks every request you make. Look for requests you did not make in the days up to and including Oct 28 (Command Code has not said when the incident began), and contact Command Code if you find any. Command Code says it has found no evidence so far that any users were impacted.
• Command Code's post does not mention provider keys you added to Command Code yourself (BYOK). Its docs say those keys are stored on your machine and that BYOK requests go straight to the provider without passing through Command Code's servers. If you want extra assurance, check usage on those keys in each provider's dashboard and set spend limits or alerts.
• Generate new keys only in Studio at commandcode.ai, and check any message about this incident against Command Code's official X account (@CommandCodeAI) before acting on links or instructions.

Sources

• Command Code (@CommandCodeAI) on X: security incident statement (Oct 28, 2026, 7:16 p.m. ET). Primary source
• Ahmad Awais, Command Code founder and CEO, on X: login-help reply (Oct 28, 2026, 9:09 p.m. ET)
• Command Code docs: Studio (API keys, usage, CI)
• Command Code docs: Quickstart (cmd login, COMMAND_CODE_API_KEY)
• Command Code docs: BYOK Providers (where your own provider keys are stored)
• Command Code blog: AI Terminology #20: Distillation (definition)
• Command Code website
• Command Code: About (team)
• Command Code changelog (no incident entry as of Oct 29, 2026)
• Command Code status page (no incident listed as of Oct 29, 2026)

Corrections and updates

None. Re-checked against every source on Oct 29, 2026.