Northflank Breach Is Ninth Hit on AI Developer Platforms in 'Black October' as Stolen AI Keys Fuel a Resale Market

By Kaeleb Savon Heck

Nov. 1, 2026 — Cloud hosting company Northflank has told every customer to assume the secrets stored on its platform were stolen, after attackers broke in and customers began reporting that their AI API keys were being used without permission. The breach, disclosed on Oct. 30, is the ninth incident this month at a company that builds or hosts tools for AI developers, according to security firm Wiz, which has labeled the run of attacks "Black October."

"Assume all environment variables have been decrypted. Disable/rotate all keys," Northflank warned customers in an Oct. 30 update quoted by BleepingComputer. The company later confirmed that "users have reported unauthorised use of AI API keys supplied to the Northflank platform."

The common thread across the nine incidents, Wiz says, is not a single software bug but a single goal. Attackers went hunting for stored environment variables, especially the ones that hold keys to paid AI services, and then either used those keys themselves or fed them into a growing underground market that resells cheap access to frontier AI models. Wiz documented two cases where stolen enterprise keys were used to make roughly 2.5 million calls to Amazon's Bedrock AI service, which it estimates ran up more than $100,000 in usage at list price.

What happened at Northflank

Northflank lets developers deploy and run applications, containers, databases and AI workloads without managing servers themselves. Like most hosting platforms, it lets customers store configuration settings as environment variables, which often include database passwords, cloud credentials, authentication tokens and API keys.

According to the incident timeline Northflank published, Wiz alerted the company to the breach at 11:43 UTC on Oct. 30, and engineers began reviewing it a minute later. Northflank pushed a network policy patch, followed by more patches at 12:50 and 13:05 UTC, and brought in Wiz's incident response team, BleepingComputer reported.

The company has not said how the attackers got in, how many customers were affected, or whether anything other than AI keys has been misused. BleepingComputer said Northflank had not answered its questions.

As part of its response, Northflank turned on credential rotation for PostgreSQL, MongoDB, MySQL and Redis databases, and enabled audit logs for all customers, including free accounts, so they can look for suspicious activity. It told customers to rotate secrets stored in workloads, secret groups and global secrets, to disable public access to add-ons, and to check their AI providers' usage and billing logs for anything unexpected.

Nine platforms in one month

In a report published Oct. 30, Wiz researchers Benjamin Read and Rami McCarthy listed nine AI developer platforms that disclosed security incidents during October, with these disclosure dates:

• Fireworks AI, Oct. 6
• Andromeda, Oct. 9
• Zeabur, Oct. 14
• Lightning AI, Oct. 15
• OpenCode, Oct. 16 and 17
• Railway, Oct. 20
• Warp, Oct. 23
• CommandCode, Oct. 28
• Northflank, Oct. 30

"Any other month, and this would be the top security story," the researchers wrote, noting that few reports had connected the incidents.

The companies have described different entry points. Fireworks, Zeabur and Lightning AI attributed their incidents to credential access, and Wiz noted that Lightning AI had earlier been hit by a software supply chain attack. Railway said it believes attackers got in through "privilege escalation in our build infrastructure." Warp pointed to a third-party vendor dependency, and OpenCode to a "legacy system." Fireworks, OpenCode and Warp all reported signs of what they called an "agent swarm" attack, and OpenCode and CommandCode said the attackers were attempting "distillation," which means using stolen model access to train or copy AI models.

The consequences have been serious for at least one company. Wiz said Zeabur has published a full write-up of its incident and will shut down because of it.

BleepingComputer reported that the Railway incident also involved potential exposure of decrypted customer environment variables, that OpenCode disclosed exposed AI API keys, and that Warp's breach exposed AI agent logs and user telemetry.

Wiz was careful not to claim that one group carried out all nine attacks. "There is no single vulnerability or dependency linking these attacks," the report says, but every public report "highlight[s] targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access."

How stolen AI keys turn into money

The report's most detailed section follows what happened to two enterprise keys that Wiz could trace back to one of the vendor breaches. The pattern it describes is methodical.

Within 30 minutes of the reported theft, both keys were tested with a single request from a home internet address, part of a one-minute sweep that checked stolen keys across several organizations. For days afterward, the keys saw only a trickle of traffic, between 14 and 120 calls a day, which Wiz interprets as an automated job confirming they still worked.

Then came what the researchers call "the flood." In the first case, a script mapped the account's service limits, and bulk traffic began 22 seconds later. Over about 30 hours, before the key was shut off, the attacker made roughly 800,000 calls, about 90 percent of which succeeded. In the second case, a single hosting address made roughly 1.7 million calls over about 13 hours, more than a million of them successful.

Wiz said the traffic looked like resold coding-assistant usage, with many short requests that suggest many different end users sitting behind a reseller. It linked the stolen keys to two operations that openly sell discounted access to AI models: one centered on an actor who appears to call themselves "momo," whose infrastructure Zeabur had publicly named in its own incident report, and a second site called Xingjiabi. Wiz said it could not definitively connect either reseller to the original break-ins, but both had access to the stolen keys and tested them.

This kind of abuse has a name in the security industry: LLMjacking, using someone else's credentials to run large language models and leaving them with the bill. Wiz said the anecdotal impact reported so far on social media includes consumer AI bills in the hundreds to thousands of dollars and an alleged theft of about $371,000 in cryptocurrency using crypto keys stored in Railway. Those figures have not been independently confirmed.

Analysis: why platforms are the target

The logic of these attacks is simple. An individual developer's AI key is worth something. A platform that stores keys for thousands of developers is worth far more, because one break-in can yield a whole catalog of working credentials. AI keys are also unusually easy to cash in. Unlike a stolen credit card, they do not need to be laundered. They can be plugged straight into a reseller's service and sold as discounted access to the newest models.

The month's incidents also show how much trust developers now place in convenience platforms. Storing secrets as environment variables is standard practice and is usually encrypted at rest. But Northflank's warning to "assume all environment variables have been decrypted" is a reminder that encryption does not help much if attackers reach the systems that hold the keys to decrypt it.

For people outside the developer world, this may sound abstract. It is not. Many of the AI apps, chatbots and assistive tools that ordinary users rely on, including accessibility tools such as image describers and voice assistants, can run on these same kinds of keys and platforms. When a key is stolen, the immediate victim is usually the developer who pays the bill. The knock-on effects can include outages when keys are rotated, services that shut down, as Zeabur says it will, and personal data exposed along the way.

What developers should do now

Guidance from Northflank, Railway and the Wiz report, along with recommendations summarized by The Injection, points to a few concrete steps for anyone who has used one of the affected platforms:

• Rotate keys at the source. Revoke and reissue AI provider keys directly with the provider, such as OpenAI, Anthropic, Google or AWS, not only inside the hosting platform.
• Check usage and billing. Look for unexpected spikes in model calls, especially to expensive models, and report suspicious activity to both the platform and the AI provider.
• Use one key per service, with limits. Separate keys for each platform, with spending caps or tight permissions, limit the damage when one leaks. In Wiz's second case, a restrictive key policy caused thousands of the attackers' calls to fail until they found a workaround.
• Close public access. Northflank and others have advised disabling public network access to databases and add-ons where it is not needed.
• Turn on and review audit logs. Northflank has now enabled audit logs for all accounts.

What's next

Most of the incidents are still under investigation, and Wiz said detailed technical information is not yet public for most of them. Northflank has not said how its systems were breached or how many customers were affected. Railway has published a preliminary report and timeline, and further disclosures are likely as companies finish their reviews. Wiz has also published indicators, including IP addresses used to test stolen keys, so other defenders can look for the same activity in their own logs.

Sources

• BleepingComputer, "Northflank security breach leads to abuse of customers' AI API keys," Oct. 31, 2026: https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/
• Wiz Blog, Benjamin Read and Rami McCarthy, "'Black October' for AI Developer Platforms," Oct. 30, 2026: https://www.wiz.io/blog/black-october-for-ai-developer-platforms
• The Injection, "Black October: nine AI developer platforms disclosed credential breaches": https://theinjection.dev/items/wiz-black-october-ai-platforms/