Wiz 'Black October' report: nine AI developer platforms lost customer secrets in one month

Wiz Research has documented what it calls 'Black October': at least nine AI developer platforms disclosed security incidents within a single month, and although the breaches share no common vulnerability, each targeted the same thing — environment variables holding credentials for AI services. The report, dated October 30, 2026, is summarized in a dev.to analysis cross-referenced against independent reporting from Bromure, Towards AWS, FourWeekMBA and teiss.

Nine disclosures, one target

According to the timeline in the dev.to write-up, Fireworks AI disclosed a credential-access incident on October 6, showing signs of what Wiz calls an 'agent swarm' attack pattern. Andromeda followed on October 9, described as part of an 'industry-wide attack.' Zeabur disclosed credential access on October 14, ahead of a separate, later incident that ended in a shutdown announcement. Lightning AI disclosed credential access on October 15, and OpenCode's October 16–17 disclosure traced to a legacy system that exposed stored provider keys.

Railway disclosed 'potential privilege escalation in our build infrastructure' on October 20. Warp pointed to a third-party vendor on October 23 and reported agent traces taken. CommandCode attributed its October 28 incident to model distillation, and Northflank closed the month on October 30 by telling customers to assume their environment variables had been fully decrypted.

Towards AWS's analysis of the report notes that the nine incidents had different root causes where any are known — credential access, build-infrastructure privilege escalation, a vendor dependency, a legacy system — but one objective: stored environment variables, especially those granting AI access. Most of the nine, including Northflank, have still not published a confirmed root cause.

What one stolen key is worth

The financial scale is what turns this from a compliance footnote into an active market. FourWeekMBA reports that Wiz traced a single stolen enterprise Amazon Bedrock key to roughly 1.7 million API calls in thirteen hours — about 36 calls per second, sustained for half a day before anyone intervened. Across two documented Bedrock cases, per teiss, Wiz counted roughly 2.5 million combined calls and more than $100,000 in usage at list price.

The practice is known as LLMjacking: using stolen AI credentials to reach models on someone else's paid account, either to run workloads for free or to resell the access. According to Bromure's reporting on the Wiz findings, keys from these breaches were tested within thirty minutes of exposure and then resold into pools whose outbound traffic resembles ordinary coding-agent usage — precisely what makes the abuse hard to distinguish from a customer's own spike in AI consumption.

The two most detailed disclosures

Railway's disclosure, quoted across multiple outlets, described an 'unauthorized query of encrypted environment variables,' a subset of which the attacker successfully decrypted. The company put the exposure at 'at most 1.85% of all workspaces' — roughly 100,000 — and on October 21 asked Anthropic, OpenAI, OpenRouter, GitHub and Stripe to revoke affected keys directly.

Northflank's public timeline is the most granular of the nine. A Wiz threat alert arrived at 11:43 UTC on October 30, followed by network-policy patches within twenty minutes. The public status escalated from 'rotate now' to 'assume all environment variables have been decrypted' within roughly two hours, and users had confirmed AI key misuse by 15:12 UTC the same day. The next morning Northflank switched on audit logging, previously a paid feature, for every customer including the free tier — a control that arrived only after the breach.

A shared business model, not a shared bug

Wiz researchers Benjamin Read and Rami McCarthy frame the cluster around two converging trends: the broader rise of agentic attacks and the economics of LLMjacking, where stolen access is 'easily monetizable' through resale. As far as Wiz could determine, the nine platforms shared no vulnerability, vendor or attacker. What they shared was a business model: centrally storing third-party API credentials on behalf of customers so those customers never have to manage secrets themselves. That is the core value proposition of a managed developer platform, and October showed what happens when that convenience becomes a single point of failure across an entire category of companies at once.

What affected teams should do

The dev.to write-up's guidance is blunt: any organization that deployed on Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode or Northflank should assume every environment variable those platforms could read is compromised, since several of the nine have not confirmed what was actually taken. Revoke and reissue credentials at the issuer — AWS, Anthropic, OpenAI, OpenRouter, GitHub or Stripe — rather than only inside the platform, because rotation accomplishes nothing if the original was already copied. Audit provider usage and billing logs from the period before disclosure, not just after; Northflank's own timeline shows confirmed misuse within roughly ninety minutes of the breach becoming public.

Why it matters

Black October is not nine unrelated vendor failures. It is evidence that the standard architecture of AI-era developer tooling — platforms that hold your model-provider keys for you — has become a concentrated, systematically targeted attack surface. The stolen credentials are immediately monetizable, the abuse traffic mimics legitimate coding agents, and the exposure window opens long before any public disclosure. For engineering teams, secret hygiene, issuer-side revocation and minimizing how many platforms hold a copy of each key have shifted from compliance checkboxes to prerequisites for using managed AI infrastructure at all.