Story

The idea that the key is constantly generating a signal is a little difficult to believe - receiving signals is cheap, battery-wise, but sending would surely wear that sucker out in a year or less. More likely it only 'wakes' when it detects a ping from the car that passes whatever authentication it has built in, probably with some form of RFID passive receiver. Thus the car is doing the generating, and the thieves have access to the car because it's parked on the street or in a driveway.

The scenario goes something like this. The thief pulls up to the sidewalk in getaway car and hits the button. The amplifier amplifies the signal the car is constantly sending to the key. The key responds to the amplified "Key where are you?" signal with its usual "Itsa me, the key!" signal, et voila, the car is unlocked.

Surely it wouldn't be that easy, but the evidence seems to suggest it is. There seems to be no validation beyond sign and countersign. Maybe they'll patch that up by adding more tests to the car's routine, but the key is probably always going to be a dumb device (unless they make it a smartphone app) due to battery life.