Wiz counts nine AI developer platform breaches in October as stolen keys fuel LLMjacking

What Wiz reported

Wiz Research published "Black October" for AI Developer Platforms on 30 October 2026. The post, by Benjamin Read and Rami McCarthy, counts at least nine AI developer platforms that disclosed security incidents during the month. The names given across the report and its coverage are Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, CommandCode, Railway, Warp and Northflank. The disclosures run from Fireworks AI on 6 October to Northflank on 30 October.

Wiz describes the wave as a run of attacks on the services developers use to build and host AI applications, leading to what it calls LLMjacking at scale: using someone else's credentials to call AI models on their account. Public reports, Wiz says, show attackers hunting stored environment variables, especially those that grant access to AI providers. Wiz is careful about attribution. It says no single vulnerability or dependency connects the incidents, and that most of them are still being analysed, so detailed technical information is not yet available.

The root causes that victims have shared differ. Wiz notes that several point to credential access. Railway suggested that initial access came through privilege escalation in its build infrastructure, and Warp pointed to a third-party vendor dependency. Wiz also cites reports of an alleged theft of about $371,000 in cryptocurrency as one of the impacts, alongside large AI usage bills run up on stolen keys.

Northflank, Railway and the stolen Bedrock keys

Northflank, a cloud deployment platform, disclosed its incident on 30 October after what several security outlets describe as a threat alert from Wiz. Its status page says users reported unauthorised use of AI API keys stored on the platform and tells customers to assume all environment variables were compromised and to rotate every secret, including those in workloads, secret groups and global secrets. On 31 October Northflank added secret rotation for add-ons and turned on audit logs for all customers.

Railway published a preliminary report on its 21 October incident. It says an intruder may have reached encrypted customer environment variables, in some cases in decrypted form, in no more than 1.85% of workspaces. Railway revoked all access tokens as a precaution and asked customers to rotate stored variables, API keys and registry credentials. OpenCode disclosed on 17 October that stored OpenAI, Anthropic and Google API keys were taken from a legacy system it was decommissioning.

The most concrete numbers in Wiz's report come from two cases in which compromised enterprise credentials for Amazon Bedrock, the model service from AWS, were abused. Wiz traced about 800,000 calls in one case and about 1.7 million in the other, the second over roughly 13 hours with more than a million calls succeeding. Wiz estimates the two cases together ran up more than $100,000 in inference usage at published prices. It does not say which platform the keys came from. The pattern it describes is quick validation of a stolen key, a check of its permissions and quotas, then a flood of requests. Wiz links some activity to sites that resell model access but says it has no evidence tying those sites directly to the October attacks.

What developers should do

Anyone who stored AI provider keys on one of the named platforms should treat them as exposed and rotate them at the provider, not only on the platform. The affected companies all give the same advice: revoke credentials with the issuing service, generate new ones and redeploy the workloads that use them. Teams should also read their usage and billing logs at OpenAI, Anthropic, Google and AWS for calls they do not recognise, since stolen keys can sit unused for days and then generate millions of requests in hours. Setting spending limits and alerts at the provider caps the damage if a key leaks again.

The report shows how much value now sits in a single environment variable. An AI key can be resold or used to run large workloads at the owner's expense, which makes hosting platforms that keep thousands of customer secrets an attractive target. Scoped keys with only the permissions and regions an app needs, short lifetimes and per-service credentials limit what an attacker gets from one breach. Wiz has published indicators of compromise in the post for teams that want to search their own logs.

Platform operators face a harder question. Railway says its customer variables were encrypted, yet the intruder may have reached some of them in decrypted form, and Northflank tells customers to assume the same. Wiz's report suggests that protecting the systems that can decrypt secrets matters as much as encryption itself, and that providers should alert customers quickly so keys can be revoked before resellers put them to work.

The wave follows the tampered Claude Code extension served through Cursor's marketplace and Google's AI threat tracker on agentic attacks, though Wiz does not connect those to the platform breaches. More coverage is in our cybersecurity section.

Questions people ask

What is LLMjacking?

Using stolen credentials to call AI models on another organisation's account, so the victim pays for the usage. Wiz says the October attacks on AI developer platforms led to LLMjacking at scale.

Which platforms were affected?

Wiz and its coverage name Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, CommandCode, Railway, Warp and Northflank, all of which disclosed incidents in October 2026.

What should Northflank and Railway customers do?

Both companies tell customers to assume stored environment variables are exposed, rotate every secret and API key at the issuing provider and check provider usage and billing logs for unexpected calls.

Sources

1. "Black October" for AI Developer Platforms (Wiz, 30 Oct 2026)
2. Security incident (Northflank, 30 Oct 2026)
3. Preliminary Report: Oct 21st Security Incident (Railway, 21 Oct 2026)
4. Wiz "Black October" report: at least nine AI developer platforms breached in October, with stolen API keys feeding an LLMjacking resale market (AICoder, 30 Oct 2026)