Cloud security firm Wiz has counted at least nine AI developer platforms that disclosed security incidents during October 2026, a run it calls “Black October”, after the month closed with a breach at Northflank that left customers’ AI API keys open to abuse. The incidents shared a target rather than a single flaw: stored environment variables holding the keys that pay for model calls. In two enterprise cases Wiz traced, stolen keys ran about 2.5 million Amazon Bedrock calls and likely cost more than $100,000 at list prices.
Nine platforms in one month
Wiz published its count on 30 October. It lists nine platforms, from Fireworks AI on 6 October to Northflank on 30 October. The firms differ in size and product, but each holds credentials that unlock paid frontier-model access. That shared prize is what ties a scattered month together.
The damage varied widely. Zeabur said over 3.2 million environment-variable records were read, plus data from 321,000 accounts. The company said it would shut down by 31 December. Railway said up to 1.85 percent of workspaces, about 100,000, may have been exposed. OpenCode put its figure at 1.4 percent of older Console users.
Northflank was the final name on the list. On 30 October it told customers to assume every stored environment variable had been decrypted. It told them to rotate all keys at once, after Wiz warned it that morning. It later confirmed unauthorised use of AI keys, but has not said how attackers got in.
What the attackers wanted
Across the reports, attackers hunted stored environment variables, especially those granting AI access. Fireworks, Zeabur and Lightning traced their incidents to credential access. Railway pointed to privilege escalation, Warp to a vendor dependency, OpenCode to a legacy system. Wiz stresses no single vulnerability links all nine cases.
What links them is economics. A stolen key lets thieves run model calls on another firm’s bill, or resell that access. Wiz ties the pattern to agentic attacks and to LLMJacking, the resale market for stolen access. Demand keeps growing as models get pricier to run.
Several platforms reported signs of an “agent swarm” attack. Andromeda called its incident part of an industry-wide attack. OpenCode and CommandCode blamed attempted distillation, training a cheaper model on a rival’s outputs. Wiz does not claim the same actors hit every platform. But automated intrusion at this scale is itself the story.
How two stolen keys were spent
The report’s most concrete section follows two enterprise keys. Wiz attributes their compromise to one vendor breach, without naming the vendor. Both showed the same first abuse within 30 minutes: one test call from a residential address. It tried one model, failed, then fell back to a working model.
Case A then exploded. Four days after validation, the actor mapped model availability across regions. Within half an hour, bulk traffic began and ran about thirty hours until remediation. About 800,000 Bedrock calls followed, with about 90 percent succeeding. Global routing spread the load, so little traffic was throttled; Opus models were three quarters of successes.
Case B was restricted to United States regions. That slowed the attacker but did not stop the abuse. Seven days later, the key surfaced in what looked like a reseller pool. After a checker found the working regional model identifiers, the flood began. One address then made 1.7 million calls in thirteen hours, with over a million succeeding.
The resale market behind the theft
Wiz linked the keys to two resale operations, “momo” and “Xingjiabi”. It cannot definitively tie either operation to the original breaches or the floods. Infrastructure tied to the first checked both keys and links to a discount model-access site. Infrastructure tied to the second checked permissions after the heavy abuse had begun.
The traffic looked like resold coding-agent use. Most calls sent few uncached input tokens and returned a few hundred output tokens. That is the signature of prompt caching. A long tail of larger calls suggested many end users behind each reseller. One key can thus be sliced and resold many times before the owner notices.
Wiz is careful about what it has not proved. A reported $371,000 crypto theft via Railway keys rests on social media posts, not verified reports. Wiz calls it anecdotal. Its indicator addresses tested stolen keys, but Wiz cannot tie them to the platform attacks. The confirmed core is narrower, and stronger for it.
Why this month was different
October revealed a new kind of asset, not a new kind of attack. When model access was cheap, a leaked key was an embarrassment. Now one key can run hundreds of thousands of calls an hour and be resold within minutes. Key-holding platforms have become like banks, without always having bank-grade controls.
The other shift is speed. A key tested in thirty minutes, checked daily, then flooded, leaves no window for slow response. Rotation advice assuming a human working office hours is out of date. Revoke at the provider, not just on the breached platform, and check billing at once.
There is a warning here for agent-security debate. Much of it focuses on what agents might do wrong on their own. Black October is the other side: automated tooling in attackers’ hands, aimed at developer infrastructure. The recent backdoored coding extension incident pointed the same way. The supply chain around AI coding tools is now a target itself.
Why It Matters
For teams building with AI models, Black October changes where keys may safely live. A breach can now hand attackers a direct line to a firm’s model bill. Through resellers, that access can be used within the hour. Short-lived keys, tight scopes, spending alerts and instant revocation are now essential, not optional.
For operators, the month is a competitive signal, not just a security one. Zeabur’s shutdown shows a credential incident can be existential for a smaller provider. Larger platforms will be judged on detection, disclosure and rotation help. The defence-first model work from Google shows security becoming a selling point across the AI stack.
Background
Wiz published “Black October” on 30 October 2026, drawing on the platforms’ disclosures and its own abuse observations. It also drew on BleepingComputer’s reporting of the Northflank breach. Most investigations remain open, with detailed technical findings still unavailable for several incidents.
Source: Wiz research and Northflank breach report
0 Comments