Published November 1, 2026 (IST) by the AgentStack News Desk. Facts were checked against Wiz’s October 30 research post, Northflank’s incident status page, BleepingComputer’s October 31 report, the Cloud Security Alliance’s October 23 research note, and our own secret scanner test on November 1.
At least nine AI developer platforms disclosed security incidents in October 2026, and keys stolen from them are now being resold for LLMjacking at scale, Wiz reported on October 30. Wiz calls the month “Black October.” Northflank, the ninth platform, told customers on October 30 to assume every environment variable had been decrypted.
Wiz traced two stolen AWS keys into reseller pools that made about 2.5 million Amazon Bedrock calls and ran up more than $100,000 at list price. The common thread across the platform breaches is simple: intruders went looking for stored environment variables that grant AI access.
We fed 16 synthetic AI provider keys to three open source secret scanners. In agent log lines, gitleaks and TruffleHog together missed 5 of the 16 key types. This piece follows our editorial standards. Attribution claims below come from the vendors and Wiz, not from our own investigation.
TL;DR
- What happened: nine AI developer platforms, from Fireworks AI to Northflank, disclosed incidents in October 2026, and public reports say intruders hunted stored AI credentials.
- What attackers did with the keys: Wiz saw stolen keys validated within 30 minutes, then sold through reseller pools that made about 2.5 million Bedrock calls.
- Northflank: the PaaS told users to assume all environment variables were decrypted, and customers then reported unauthorized use of their AI API keys.
- Key scope helped, a little: a key limited to us.* inference profiles blocked the pool’s first attempts, but regional quotas, not scope, capped the damage.
- Our test: in agent logs, gitleaks plus TruffleHog missed Groq, DeepSeek, Mistral, Cohere, and Together keys, and detect-secrets flagged 3 of 5 harmless values.
- What to do: rotate keys at the issuing provider, not just on the platform, then use separate, spend capped keys per platform and add custom scanner rules.
What Wiz Reported About Black October
Wiz says at least nine AI developer platforms disclosed incidents during October 2026: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Every public report describes targeted hunting of stored environment variables, with a focus on secrets that grant access to AI models and providers.
The root causes differ. Railway cited a privilege escalation in its build infrastructure, Warp pointed to a third party dependency, and OpenCode blamed a legacy system. Zeabur has since said it is shutting down. Wiz found no single vulnerability or dependency linking the incidents.
Fireworks AI, OpenCode, and Warp all reported signs of an “agent swarm” attack, and Andromeda called its incident part of an “industry wide attack.” OpenCode and CommandCode attributed theirs to distillation, meaning harvesting model outputs to train other models. Our report on Anthropic distillation defenses explains why labs now treat that as a threat.
No vendor has publicly tied the incidents to a single actor. The Cloud Security Alliance calls the pattern a “platform chain” campaign: attackers reach inference accounts through the hosting, evaluation, and developer platforms that hold customer keys, instead of attacking the provider or the customer directly.
What Happened at Northflank
Northflank, a platform for deploying apps and databases, received a Wiz threat alert at 11:43 UTC (17:13 IST) on October 30 and began patching within 20 minutes. By 13:58 UTC it told users to assume all environment variables had been decrypted and to rotate every key, including workload, secret group, and global secrets.
At 23:38 UTC on October 30 (05:08 IST on October 31), Northflank said users had reported unauthorized use of AI API keys supplied to the platform. It asked them to revoke credentials with the issuing providers and check AI billing logs, and noted the IP addresses matched those in Wiz’s report, as BleepingComputer also reported.
Since then, Northflank has turned on audit logs for every customer, including free users, and added secret rotation for Postgres, MongoDB, MySQL, Redis, MinIO, and RabbitMQ add ons. The status page still listed the incident as a major outage when we captured it.
How Stolen Keys Turned Into LLMjacking
LLMjacking means using stolen credentials to run someone else’s AI models at their expense. Wiz followed two enterprise AWS keys stolen in one of the platform breaches. Both were first tested within 30 minutes of the theft, with a single call that asked for Claude Fable 5.1, failed, and fell back to Opus 5.5.
For days after that, each key saw only 14 to 120 calls a day from the same small Go client, a sign of an ongoing job checking that the keys still worked. Then the floods started. The same boto3 script, down to its version string, probed Bedrock and EC2 quotas on both keys before the bulk traffic began.
In Case A, the key’s policy allowed global.* cross region inference profiles, so the actor routed every call through them. About 800,000 calls ran over 30 hours, roughly 90% succeeded, and only about 6% were throttled. Opus models made up three quarters of successful calls.
Case B was restricted to us.* profiles, so a reseller pool’s global.* requests failed for four hours. A checker then found the working us.* model IDs, and one Level 3 address made about 1.7 million calls in 13 hours, over a million of them successful. Regional quotas throttled nearly all of the rest.
Wiz says the token pattern resembles resold coding agent traffic. It linked the keys to two resellers, one it calls “momo” and one at xingjiabiapi.org, without proving either ran the original breaches. If you route agents through a gateway, our LLM gateways guide and Portkey vs LiteLLM vs OpenRouter comparison show where per key limits live.
| Indicator | What Wiz observed | Dates (2026) |
|---|---|---|
| 23.106.46.239 | Reported by Zeabur, later used to check the Case A and Case B keys | Oct 26 to Oct 29 |
| 38.246.114.118 | Checked permissions on several stolen keys | Oct 25 to Oct 29 |
| 104.243.32.50 | Checked permissions on several stolen keys | Oct 19 to Oct 30 |
| 31.57.201.201 | Used multiple stolen keys | Oct 18 to Oct 25 |
Why AI Developer Platforms Became the Target
AI developer platforms are targets because each one stores working provider keys for many customers at once. One intrusion into a hosting, evaluation, or coding agent platform can expose keys for many inference accounts, and those keys turn straight into resale stock, free compute, or cover for further attacks.
The CSA note makes the uncomfortable point that a key is only as safe as its least protected copy. The same OpenAI or Anthropic key often sits in a PaaS, a gateway database, a CI system, and a developer’s agent console. Deleting it from a breached platform does nothing, which is why Fireworks told customers to rotate at the issuing provider.
October also brought the LiteLLM supply chain compromise, which went after the same class of secrets through a malicious release. Taken together with this month’s Claude Code agent incident on a Pentagon network, the message for agent teams is that credentials, not models, are the soft spot.
We Tested Whether Secret Scanners Recognize AI Provider Keys
Default open source scanners recognize the big provider keys well, but coverage drops sharply for newer inference providers. In our test, every scanner found OpenAI and AWS keys. In agent logs, gitleaks and TruffleHog together missed five provider formats, and the entropy based scanner raised false alarms instead.
Stolen keys often leak again through logs and agent transcripts, so we checked whether scanners would catch them there. We generated 16 synthetic keys that follow public formats for OpenAI, Anthropic, AWS, Amazon Bedrock, Gemini, Hugging Face, Groq, OpenRouter, xAI, Perplexity, DeepSeek, Mistral, Cohere, Replicate, Together AI, and Fireworks AI, plus five harmless high entropy values.
Each key went into a .env file as NAME=value and into an agent log line as a bare value. We ran gitleaks 8.30.1, TruffleHog 3.99.7 with verification off, and detect-secrets 1.5.0, all with default rules. A hit counts as named when a provider specific rule fired.
| Result | What we saw | What it means |
|---|---|---|
| .env files, gitleaks | 16 of 16 flagged, but 8 only by its generic rule | Coverage leans on variable names like API_KEY |
| .env files, TruffleHog | 9 of 16 by default | Its Groq detector fired but the result was filtered as a likely false positive |
| Agent logs, gitleaks plus TruffleHog | 11 of 16 found together | Groq, DeepSeek, Mistral, Cohere, and Together keys were missed |
| Agent logs, detect-secrets | 14 of 16 found, nearly all by entropy | Flagged a Git commit hash, an asset digest, and a trace ID |
| Bedrock API key (ABSK) and Gemini | Named by gitleaks, missed by TruffleHog | Run two scanners, not one |
| Scan time, 21 files each | Under 2 seconds for every tool | Cheap enough to run on every agent log export |
Two caveats apply. Our keys are synthetic, so detectors that check format details more strictly could behave differently on real keys, and we ran TruffleHog without live verification. We tested one log format, and other layouts may score differently.
The practical lesson is that default rules track yesterday’s providers. If your agents use Groq, DeepSeek, Mistral, Cohere, or Together, add custom regex rules for those key formats, and scan agent transcripts and tool outputs as well as repositories.
What to Do If Your AI Keys Lived on These Platforms
Start with rotation at the source, then shrink what any single stolen key can do. The steps below follow Wiz, Northflank, Fireworks, and the CSA guidance, plus the gaps our scanner test exposed, in the order we would run them this week.
- Rotate at the issuing provider: revoke and reissue every AI provider key, cloud credential, and database password stored on an affected platform. Deleting the secret from the platform does not revoke it.
- Check billing and usage logs: look back to mid September for volume spikes, unfamiliar models, or new regions. Our LLM cost monitoring tools guide covers tools that alert on this.
- Hunt in CloudTrail: for Bedrock, search InvokeModel and quota enumeration calls from unfamiliar addresses, and block the four IPs Wiz published.
- Use one key per platform: give each platform its own key with a spending cap and rate limit close to real use, so one breach can be revoked alone.
- Scope and expire credentials: limit Bedrock policies to the inference profiles you use, set service quotas, and prefer short lived role based access over long lived static keys.
- Map every copy: list each platform, gateway, CI system, and agent console that holds a production key. Our non-human identity tools guide covers inventory products, and Astrix vs Oasis vs Aembit compares three of them.
- Extend your scanners: add custom rules for provider formats your default rules miss, and run them over agent logs and transcripts as well as code.
For runtime controls on the agents themselves, see our AI agent security tools and MCP security tools guides. For incident playbooks, our NIST and CISA agent incident response piece covers how to prepare.
Frequently Asked Questions
What is Black October for AI developer platforms?
Black October is Wiz’s name for a run of at least nine security incidents at AI developer platforms in October 2026, including Fireworks AI, OpenCode, Railway, Warp, and Northflank. Public reports say intruders hunted stored environment variables holding AI credentials, and Wiz then saw stolen keys resold and abused for LLMjacking.
What is LLMjacking?
LLMjacking is the theft and abuse of credentials for large language model services, so attackers can run models on someone else’s bill. Stolen keys are often resold through cheap API reseller sites. In Wiz’s two October cases, abusers made about 2.5 million Amazon Bedrock calls and ran up more than $100,000 at list price.
Was Northflank hacked?
Yes. Northflank opened a security incident on October 30, 2026 after a Wiz alert and told users to assume all environment variables had been decrypted. Users later reported unauthorized use of AI API keys stored on the platform. Northflank switched on audit logs for all customers and added secret rotation for its database add ons.
Is deleting a leaked API key from the platform enough?
No. Deleting a secret from a hosting or evaluation platform does not invalidate it, because the attacker may already hold a copy. Revoke the key with the issuing provider, such as OpenAI, Anthropic, or AWS, create a new one, update your workloads, and then review usage and billing logs for activity you did not expect.
Do secret scanners detect AI provider API keys?
Partly. In our November 1 test with default rules, gitleaks and TruffleHog named common keys such as OpenAI, Anthropic, and AWS. In agent log lines they missed Groq, DeepSeek, Mistral, Cohere, and Together keys. detect-secrets caught more by entropy but flagged three of five harmless values, so custom rules help.
The Bottom Line
Black October shows that the cheapest way into an AI account now runs through the platforms that store its keys. Rotation at the provider fixes this month’s damage, but separate, capped, short lived keys and wider scanner rules are what keep next month’s breach from becoming another LLMjacking bill.
We will update this story as more platforms publish root causes or Wiz shares new indicators. Send corrections through our contact page.
Related coverage: the LiteLLM supply chain compromise, Anthropic distillation defenses, AI agent governance, and LLM gateways.