Mr. Nice Try Notes from the edge

· 12 min read

Distillation attacks and your keys on the internet

AI labs are copying each other's models by asking them millions of questions, and someone has to pay for all that. This week the bots behind my edge asked for AI key files 80,377 times, OpenCode's files joined their list 32 hours after the breach, and Monday set a new record.

On Saturday, OpenCode posted this:

I've already written about the breach itself: who was hit, the timeline, and what was sitting next to those keys. This post is about the two words most people skipped over: distillation attack.

Here's the short version. Distillation is the reason a stolen AI key is worth money, and it isn't going away. And all week, the bots knocking on the 3,597 websites behind the Mr. Nice Try Edge have been hunting for exactly those keys, harder than ever.

What a distillation attack is

Distillation is training a small, cheap model on a big model's answers. Ask the big model millions of questions, save every answer, and teach your model to answer the same way. It's a normal technique when you do it to your own models. It's called an attack when you do it to somebody else's without permission.

You don't need to break in to do it. You only need two things: a huge number of questions, and an account that will answer them. The labs selling the answers know this, and they've been fighting it all year.

  • February: OpenAI told US lawmakers that DeepSeek was distilling its models. Eleven days later, Anthropic named three labs, DeepSeek, Moonshot and MiniMax, that had generated over 16 million exchanges with Claude through about 24,000 fraudulent accounts. Anthropic said they came in through "commercial proxy services which resell access to Claude," and that one proxy network ran more than 20,000 fake accounts at once.
  • September: Anthropic's threat report named seven labs in China, Alibaba among them. The same report called out "compromised API keys, session tokens, and devices" as a target for criminal groups. It also described a reseller that sold cheap Claude access, quietly answered with a different model, and harvested its customers' Anthropic credentials.
  • October 12: Anthropic said its new defenses had cut the data distillers harvest by "around 90 to 99%," and that it has "resumed charging for requests that are blocked by our safeguards before Claude responds."
  • October 17: OpenCode's breach, "related to a large scale distillation attack."

A classroom: a big friendly robot teacher answers at the chalkboard while rows of little robots in fake mustaches and sunglasses scribble down every word. At the door, one more disguised robot slips in holding up a key with a coral tag. Mr. Nice Try stands outside, holding up his own key ring with one empty loop, looking from the loop to the robot's key.

Why it ends with your key

The labs are closing the front door. Fake accounts get banned faster, blocked requests still cost money, and a lab's own sign-up page is the place it watches most closely.

A real developer's key gets around all of that. It's a paid-up account with years of normal history, somebody else's card on file, and no reason for anyone to look at it twice. Spend it until it's revoked, then move on to the next one.

That's my reading, not something any lab has said, but every piece of it is public. The proxies need accounts. Fake accounts are getting harder to keep alive. Anthropic's report describes stolen credentials being sold to resellers that keep swapping in fresh keys until each one runs dry. And if a lab charges for blocked requests, a stolen key used for failed extraction attempts still runs up a bill. That bill goes to the key's owner.

Here's how the chain fits together:

  1. A scanner finds the key. A .env file in a web root, an agent's settings file deployed by accident, a repo, a screenshot, or a tool that kept your key and got breached.
  2. Someone checks it works. In the OpenCode breach, one victim's logs show a prompt meaning "please reply ok," answered "ok."
  3. It gets sold or pooled. Into a reseller's proxy, alongside thousands of others.
  4. It gets spent. Millions of tokens, often overnight. One OpenCode victim's key ran 8,966 requests and 35 million tokens in a day.
  5. You get the bill. Sometimes a refund. Sometimes a suspended account.

An assembly line from left to right: a robot on a ladder fishes a key out of a house window, a robot shopkeeper sells keys from hooks at a striped market stall, a robot tips armfuls of keys into a big funnel machine that pipes into a giant robot head while small robots take notes, and at the far right Mr. Nice Try sits at a desk holding up a receipt so long it runs across the floor.

I can't follow one key from my logs all the way to a distillation run. Nobody outside the labs can. But I can show you the first step happening, thousands of times a day.

What the edge saw this week

The Edge sits in front of 3,597 websites and writes down every request. I went through October 13–19 looking for one thing: requests for files that might hold an AI key, or an AI agent's settings. Things like /.env.anthropic, /.claude/settings.json, /config/openai.json and /litellm/config.yaml.

80,377requests for AI key files in 7 days
463IPs doing the asking
2,939sites they asked
352different files they tried

Requests for AI key files, per day

Every site behind the Edge · October 8–19, 2026 (UTC)

030,106Oct 9Oct 11Oct 13Oct 15Oct 1717,071OpenCode breachOct 1930,106, a record
The dip on the 14th and 15th is the biggest fleet taking two days off. It came back the night before the OpenCode breach.

On Saturday, the day of the OpenCode breach, it set a record: 17,071. On Monday it nearly doubled that, with 30,106. Here's what's behind the numbers.

Anthropic's keys are the most wanted

Whose keys Requests IPs
Anthropic, including Claude Code's settings 48,232 110
OpenAI 22,484 103
Google Gemini 1,915 51
AI gateways (OpenRouter, LiteLLM, Ollama) 1,581 11
Coding agent configs (MCP, Cursor, Copilot, AGENTS.md) 1,250 60
OpenCode 991 2
Hugging Face 772 323

October 13–19, 2026. Each file is counted once, for the first name in its path.

Anthropic beat OpenAI more than two to one. A big part of that is two files: /.claude/settings.json and /.claude/settings.local.json, the settings for Claude Code. Those files can hold environment variables, API keys included, and they live in the project folder. If that folder gets deployed as-is, they're on the internet.

That's the new part. A year ago scanners hunted for keys in your app's config. Now they hunt in your coding agent's config too.

AI keys are on the same checklist as AWS keys

70% of all these requests came from Google Cloud. Not from Google itself: from rented servers on it.

The biggest single source is a fleet of about 60 servers on Google Cloud, 45 of them in the Brussels region. Nearly all of them share one TLS fingerprint and a browser name that's cut off halfway through. Every visit runs the same checklist of dozens of files, and each file was asked for about 13,100 times this week:

  • /.env, /.env.local, /.env.production, /.env.backup and friends
  • /.git/config and /.git-credentials
  • /.aws/credentials
  • /.env.openai, /.env.anthropic, /.claude/settings.json, /.claude/settings.local.json

AI keys sit on the list right next to cloud keys and git passwords. Nobody had to build a special AI-key scanner. They added four lines to the one they already had.

A second Google Cloud fleet works the other way: 324 IPs, about three requests each, asking for /.cache/huggingface/token and /llm/.env. Spread that thin, no single IP looks like anything. Together they visited 217 sites.

If you saw my post on banning networks, this is why Google Cloud keeps coming up. You can't ban it outright, but almost all of this fleet's traffic came from outside the US.

OpenCode joined the list 32 hours after the breach

OpenCode posted about its breach at 17:56 UTC on Saturday. Until then, the only OpenCode file anyone had asked the Edge for was /opencode.json, the project config: 30 times in a week. Nobody had gone looking for an OpenCode key.

At 01:37 UTC on Monday, 31 hours and 41 minutes later, a server on TC DATACENTER in Hong Kong tried these on two sites:

/opencode-zen/.env
/opencode/.env
/.opencode/auth.json
/.opencode/config.json
/.opencode/settings.json
/lib/opencode.js
/api/opencode/config.js
/services/opencode/index.js

It took four minutes. Then it stopped.

At 22:15 that night its next-door neighbor, one IP over, sprayed the same eight files at 122 sites in 80 seconds. It was in the middle of the attack that cold-booted 926 servers, and I'd missed this part of it. Of that burst's 84,161 requests, 16,848 were for AI keys, across 132 different files: 48 for OpenAI, 42 for Anthropic, 9 for gateways like OpenRouter and LiteLLM, 8 for OpenCode and 5 for Gemini.

31h 41mfrom OpenCode's post to the first request for an OpenCode file
4 mintest run on 2 sites
80 secto spray 122 sites

/opencode-zen/.env isn't a real file. Zen is OpenCode's paid service, and nobody keeps a .env named after it. Somebody read the news, guessed where an OpenCode key might live, wrote eight guesses down, tested them, and shipped them, all in under a day and a half.

That's how fast a headline becomes a wordlist. When a tool that holds keys makes the news, assume its files are being looked for by the next day.

A city sidewalk: a robot at a newsstand reads a paper with a broken padlock on the front page while adding one more line to an endless scroll that trails over a park bench to two robots loading a little cannon. Mr. Nice Try sits on the bench with the scroll across his lap and a coffee in hand, checking his watch.

Sometimes they don't need a key at all

The other half of the hunt doesn't look for keys. It looks for an AI that will answer without one.

  • One IP on TECHOFF SRV sent 756 POST /v1/chat/completions requests to 133 sites. That's the address of any OpenAI-compatible API: OpenAI itself, a LiteLLM proxy, a self-hosted model. If any of those sites had answered, it would have had free AI on someone else's bill.
  • An Azure server in India did the same to 74 sites, with the same client: Python/3.12 aiohttp/3.9.1.
  • Datacamp servers located in Ukraine asked /v1/models and /v1/chat/completions on dozens of sites, without even sending a browser name.
  • Others asked for /api/tags, /api/generate and /api/ps: an Ollama server's addresses, in case someone left one open to the world.

Not one of them got an AI to answer. But think about what they're after. An open AI endpoint is a free key that never gets revoked.

A long wall with a row of outdoor taps, each with an empty speech bubble painted above it. A robot with an empty bucket strains at one tap after another, all padlocked, while two more robots with buckets wait their turn. At the far end, Mr. Nice Try clicks a padlock shut on the last tap.

What they got

Nothing worth having, as far as I can see. 98% of those 80,377 requests got a 404, or a 429 telling them to slow down. The rest were redirects, catch-all pages and errors.

But they don't need a high hit rate. They need one key, once. Running the checklist costs them almost nothing. That math only works because somewhere, every day, it does pay off.

What to do about it

None of this is new advice. It's just that the keys are worth a lot more than they used to be.

Keep keys out of anything a web server can serve

Your web root should be one folder that holds only public files. If you use Laravel or Rails, that's public/, and .env lives one level up. If you deploy a whole project folder, everything in it is a URL.

Then block the obvious ones at the server anyway. In nginx:

# Dotfiles (except .well-known), .env files of any name, and agent notes
location ~ (/\.(?!well-known/)|\.env(\.|$)|/(AGENTS|CLAUDE)\.md$) {
    return 404;
}

In Caddy:

@secrets {
    path_regexp (/\.[^/]|\.env(\.|$)|/(AGENTS|CLAUDE)\.md$)
    not path /.well-known/*
}
respond @secrets 404

Don't ship your agent's settings

Add these to .dockerignore, and to whatever your host uses to decide what gets uploaded:

.env*
.claude/
.cursor/
.codex/
.opencode/
.continue/
mcp.json

Coding agents save settings in your project folder because that's convenient. It's also how they end up in production.

Give every key a small blast radius

  • One key per app or tool. When one leaks, you revoke one key and nothing else breaks.
  • A hard spend limit on every key, plus an alert well below it. A distiller can empty a big balance overnight. Make the balance small.
  • Rotate keys you saved in tools you've stopped using. OpenCode's breach hit a legacy system that was being shut down. Old tools still hold old keys.
  • Revoke at the provider. Deleting a key from a tool doesn't kill it. Only OpenAI, Anthropic, Google or OpenRouter can.

Never leave an AI endpoint open

If you run a LiteLLM proxy, set a master key. If you run Ollama, keep it on 127.0.0.1 (the default), or put something that checks a password in front of it. Assume any address on the internet that speaks /v1/chat/completions will be found within days.

Treat the first ask as a confession

Nobody with good intentions asks your website for /.env.anthropic. Not a customer, not a search engine, not a monitor. Whoever asks is telling you exactly what they're there for. Block them on the first request, and keep blocking them.

The fight is between labs. The bill isn't.

Distillation is a fight between AI labs: who gets to learn from whose model, and what it costs. The labs are getting better at stopping it. Anthropic says its new defenses cut what distillers harvest by 90 to 99%.

That's good news, and it pushes the cost onto everyone else. Every door a lab closes makes a real developer's key worth more. The scanners have noticed. This week they asked for AI keys 80,377 times on the sites behind my edge alone, added a breached tool's files within a day and a half, and set a new record on Monday.

Keep your keys out of reach, keep your limits low, and when a tool you use makes the news, rotate first and read the details later.

How I put this together

The traffic numbers come from the Mr. Nice Try Edge's request logs for 3,597 websites, October 8–19, 2026, UTC. A request counts as an AI key hunt if its path names an AI provider, gateway or coding agent (OpenAI, Anthropic, Claude, Gemini, OpenRouter, LiteLLM, Ollama, MCP, Cursor, Copilot, OpenCode, Hugging Face and about two dozen others). I matched whole words only, so a random token that happens to contain "xai" doesn't count. That list is a bit wider than the one in the daily reports, which is why Saturday's count here (17,071) is a little higher than the one I gave before (16,813). Network names come from each IP's ASN, and the Google Cloud regions from IP location data.

The lab and breach details come from the sources linked above. Where I'm inferring, such as stolen keys becoming more valuable as labs shut out fake accounts, I've said so.

References