Nine AI dev platforms disclosed breaches in October; stolen keys tested within 30 minutes

Nine platforms, one month

Between October 6 and October 30, 2026, nine platforms that developers use to build, host and run AI applications disclosed security incidents: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. The cluster was laid out in a Wiz research post published October 30 — a stretch the company's researchers nicknamed "Black October" — and relayed in a dev.to writeup aimed at developers and small teams.

According to Wiz, most investigations remain open and technical detail is limited. What the companies have said so far, as Wiz reports it:

• Fireworks AI, OpenCode and Warp each reported indicators of an "agent swarm" style attack, and Andromeda described its incident as part of a wider industry-wide campaign.
• OpenCode and CommandCode said the intrusions appeared aimed at distillation — exploiting stolen model access to copy or train models.
• Fireworks AI, Zeabur and Lightning AI traced their root causes to credential access; Wiz notes Lightning AI had previously been hit in the Mini-Shai Hulud supply-chain campaign.
• Railway's preliminary report points to privilege escalation inside its build infrastructure as the initial entry point.
• Warp suspects a third-party vendor dependency, and OpenCode points to a legacy system.
• Zeabur published a full write-up and, according to Wiz, intends to shut down as a result of the incident.

One shared target

Wiz says no single vulnerability or dependency connects the nine incidents, and it does not claim one group is behind them all. What the reports share is the objective: in every case, intruders hunted for stored environment variables, prioritising the ones that unlock AI models. Wiz ties the activity to two trends — faster agent-driven intrusion techniques, and LLMJacking, the resale of stolen model access through broker services.

What happened to the stolen keys

Wiz traced the downstream abuse of two enterprise keys back to one of the vendor breaches. In both cases the first unauthorised call arrived within roughly 30 minutes of the reported credential access: a single test call from a residential IP, part of a one-minute sweep probing stolen keys across multiple organisations.

The first key was unrestricted, allowing global cross-region inference on AWS Bedrock. Over about 30 hours before remediation it was used for roughly 800,000 calls, around 90 percent of them successful, with only about 6 percent throttled because the load spread across regions.

The second key was limited to US-region inference. Thousands of the reseller's initial requests failed because they requested global access, but a validation tool then identified the working US model IDs, and a single address made about 1.7 million calls over roughly 13 hours — more than a million successful, with most of the remainder throttled by regional quotas.

Wiz estimates the two cases alone generated over $100,000 in usage at list prices. The second case also shows the honest value of scoping: restrictions did not stop the abuse, they slowed it and let quotas cap it.

Wiz also relayed unverified social media reports of roughly $371,000 in cryptocurrency stolen using keys stored in Railway, and consumer bills in the hundreds to thousands of dollars from stolen AI access. These should be read as anecdotes, not confirmed totals.

Northflank sets the response standard

Northflank, whose disclosure came on October 30, issued the bluntest guidance of the group: assume every environment variable has been decrypted. It told customers to rotate secrets across workloads, secret groups and global settings; revoke credentials with the issuing provider rather than only updating them inside Northflank; disable public access to database add-ons; and inspect AI provider usage and billing logs. The company said multiple users had already confirmed their AI keys were used.

A practical checklist

The dev.to writeup distils the response into steps that take about an hour: inventory every AI key and note which platform holds it; generate replacement keys, update the platform and redeploy; then revoke the old keys at the provider, since deleting them from the platform does nothing about the attacker's copy. Rotate non-AI secrets too — database URLs, payment keys, cloud credentials — and audit usage logs for unfamiliar models, regions or IP addresses, because Wiz observed only a trickle of validation calls for days before the volume spiked. Finally, set the hardest spend limit your provider offers close to real usage, and give each app and environment its own key.

Why it matters

These breaches did not target model weights or training pipelines. They targeted the ordinary credentials developers paste into hosting dashboards, CI systems and notebook tools to get a demo running. With stolen keys validated within half an hour and a resale market ready to monetise them, revocation speed matters as much as prevention. The lesson also generalises beyond these nine platforms: when any service that stores your environment variables discloses an incident, assume every secret is exposed — rotate at the provider, cap spend and narrow scope first, and investigate after.