📖 Glossary
AI Box (also known as Agent Computer / Agent PC), is a dedicated local hardware device that runs AI Agents. Pre-installed with an AI agent management system, plug-and-play, running 24/7. Users can remotely command AI to work via Discord, Slack, Telegram, WhatsApp, and more.
Summary: Once an AI Agent operates your files, mail and payment endpoints, one question is unavoidable: on what authority does it hold the keys? An October breach at OpenCode Console put the answer on the table. KAIHE AIBOX is blunt: let an Agent do the work, but do not hand it your passwords.
Credentials changed category
Software asked for a password because a person used it. An Agent asks because a program runs, often while you sleep.
Three shifts land together. More credentials, one each for models, cloud, mail and payments. Higher frequency, dozens of calls a day you never watch. And a blurred boundary: most people keep one key that opens every door.
A credential stops being something you remember and becomes something a system holds permanently. Holding it permanently means exposing it permanently.
What OpenCode Console is, and what happened
OpenCode is a developer AI coding tool that also runs Console, where users upload provider keys and the platform calls providers for them. The key leaves your machine and enters its servers.
Between the night of October 16 and the early hours of the 17th, an attacker reached a legacy system being decommissioned. On the morning of the 17th, affected users were told workspace keys may have been exposed, and to revoke, replace and review usage.
At 15:30 UTC, researcher Matt Johansen published the email. At 18:08, OpenCode confirmed an incident tied to a large scale distillation attack, affecting 1.4% of Console users.
Be precise about the boundary: the keys taken were the Console copies, not the ones the CLI stores locally. Co-founder Dax Raad said keys used by the regular agent never reach company servers. Anthropic and Google revoked exposed keys; OpenAI restored access and refunded credits. Intrusion path, dwell time and key usage remain undisclosed.
The figure worth remembering is not 1.4% but the nature of the failure: a working copy sat indefinitely where you do not control it.
Three traditional approaches fail in the same place
In code or environment variables. It spreads through repositories, images and backups; rotation means editing code, so most teams never rotate.
In a hosted cloud workspace. Cross-device convenience, paid for with a working copy on someone else's server. The platform can only notify, revoke and refund afterwards.
One long-lived key for everything. Widest permission, no separation by purpose, logs that cannot say who called what.
All three share one flaw: long-lived, over-permissioned, not revocable per use. Once a credential leaves your control, who used it and why is no longer your decision.
The KAIHE Password Vault: local custody, on-demand authorization, controlled use
KAIHE AIBOX compresses the position into one sentence:
Let an Agent do the work, but do not hand it your passwords.
Local custody. KAIHE AIBOX is a dedicated Agent Computer shipping with the KAIHE Password Vault preinstalled. Keys go into the vault, travel with the device and stay on it. The device runs on your LAN, so credentials never cross your network boundary.
On-demand authorization. An Agent has no key access by default. When it needs one it searches the vault and files a request; you see who is asking, which credential and why, then approve. A grant is scoped five ways: Agent, task, endpoint, count and expiry.
Controlled use. The layer most discussions skip: approval is not handing over plaintext. The vault performs the call as a controlled proxy, so the Agent gets the result, not the credential. The secret is never seen.
Two properties follow: grants and calls are traceable, and any grant is revocable.
Two architectures, one table
| Dimension | Hosted cloud workspace | KAIHE Password Vault on KAIHE AIBOX |
|---|---|---|
| Credential location | Someone else's servers | Your LAN |
| Default permission | Platform holds a copy | Agents have none |
| Grant granularity | All or nothing | Agent, task, endpoint, count, expiry |
| Agent sees plaintext | Yes | No |
| Revocation | Post-hoc blocking | Immediate |
Three things you can do today
Rotate. Revoke and reissue any long-lived key ever uploaded to a hosted platform.
Narrow. Give a new key only the scopes it needs, with a spend cap and IP allowlist.
Move. Take Agent credentials off cloud workspaces onto a device you control, granted per task.
AI will operate real systems more deeply every year. What it lacks is not more permission, but permission that is exactly sufficient, revocable and visible to you.
Related Reading: - Meta Muse vs KAIHE AIBOX: what is actually different - When a Meta Muse subscription ends, does your data stay?
For more information, search [KAIHE AIBOX] or contact: [email protected]
KAIHE AIBOX · 7x24 Personal AI Assistant | Product Center