{"type":"analysis","id":"analysis:hiding-provider-keys-behind-a-gateway-only-moves-the-pile-short-lived-scoped","slug":"hiding-provider-keys-behind-a-gateway-only-moves-the-pile-short-lived-scoped","title":"Hiding provider keys behind a gateway only moves the pile; short-lived, scoped keys are what limit a breach","description":"OpenCode's Console stored customers' OpenAI, Anthropic and Google keys, and it was breached in an incident the company links to a distillation attack. The usual advice is to put keys behind a gateway or vault. Our read is that this moves the concentration somewhere else without removing it. What limits the damage is keys that expire quickly and can do very little.","published_at":"2026-10-27T02:00:00.000Z","updated_at":"2026-10-27T02:00:00.000Z","record_date":"2026-10-27","topics":["anthropic","design","google"],"source_urls":["https://www.isec.news/2026/10/19/opencode-console-breach-provider-api-keys","https://builders.ramp.com/post/credit-analysis-using-semantics","https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation","https://www.wsj.com/tech/ai/1password-surpasses-500-million-in-revenue-as-ai-agents-drive-growth-903ccd4b?reflink=desktopwebshare_permalink&st=acBBcU","https://cellcog.ai/blog/opencode-breach-api-keys","https://thenewstack.io/karpathy-levie-ai-capability-gap"],"language":"en","routes":{"html":"https://newruntime.com/analysis/hiding-provider-keys-behind-a-gateway-only-moves-the-pile-short-lived-scoped/","markdown":"https://newruntime.com/analysis/hiding-provider-keys-behind-a-gateway-only-moves-the-pile-short-lived-scoped.md","json":"https://newruntime.com/analysis/hiding-provider-keys-behind-a-gateway-only-moves-the-pile-short-lived-scoped.json"},"author":{"role":"author","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]},"editorial_provenance":{"desk":"authorial","target_ref":"story_cluster:opencode-console-breach-and-exposed-third-party-api-keys-c15f550909bb","authorial_article_id":"511fd91d-5682-4444-b624-6230971404b0"},"next_reads":[{"type":"topic","path":"/topics/anthropic/","url":"https://newruntime.com/topics/anthropic/","title":"Anthropic","reason":"Explore the anthropic topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/anthropic.md","json_url":"https://newruntime.com/topics/anthropic.json"},{"type":"topic","path":"/topics/design/","url":"https://newruntime.com/topics/design/","title":"Design","reason":"Explore the design topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/design.md","json_url":"https://newruntime.com/topics/design.json"},{"type":"topic","path":"/topics/google/","url":"https://newruntime.com/topics/google/","title":"Google","reason":"Explore the google topic hub.","media_type":"text/html","markdown_url":"https://newruntime.com/topics/google.md","json_url":"https://newruntime.com/topics/google.json"},{"type":"collection","path":"/analysis/","url":"https://newruntime.com/analysis/","title":"Analysis","reason":"Open the latest authorial analysis.","media_type":"text/html","json_url":"https://newruntime.com/analysis.json"},{"type":"collection","path":"/source-ledger.json","url":"https://newruntime.com/source-ledger.json","title":"Source Ledger","reason":"Inspect the public source evidence graph.","media_type":"application/json"}]}