If you host code on a developer platform and you've ever pasted an OpenAI, Anthropic or AWS Bedrock key into an environment variable, this one's for you. Wiz just connected the dots on a month I'd been watching one incident at a time. Their name for it is "Black October," and it fits.
What Happened
Wiz counts nine AI developer platforms that disclosed incidents in October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and, most recently, Northflank.
Northflank's status page is the clearest look at how this feels from the inside. On October 30, a Wiz threat alert landed at 11:43 UTC. Network policy patches went out within the hour. By 13:58 UTC the guidance to customers was blunt: "Assume all environment variables have been decrypted. Disable/rotate all keys." Later that day, users confirmed their AI keys had been used by someone else. Northflank switched on audit logs for every customer, free tier included, and has been rolling out one-click secret rotation for its database addons since. They haven't published a root cause yet, so I won't guess at one.
Credit where it's due: Northflank told customers to assume the worst within about two hours of the first alert. That's the right call. Hedging on "potential exposure" while attackers burn your keys helps nobody.
The Pattern, Not the Bug
Here's the important part. Wiz says there's "no single vulnerability or dependency linking these attacks." Railway cited privilege escalation in build infrastructure. Warp pointed to a third-party vendor. OpenCode blamed a legacy system. Different doors, same target: stored environment variables, especially the ones that unlock AI.
And several of the victims described the attacks as agentic. Fireworks, OpenCode and Warp reported signs of an "agent swarm." So we're watching AI-assisted attackers break into AI platforms to steal access to AI. Somewhere a product manager is calling that a flywheel.
What the Attackers Did With the Keys
Wiz tracked two enterprise cases where stolen Bedrock keys were abused, and the playbook is disciplined:
- Validate fast. Each key was tested within 30 minutes of the platform breach, with a single model call.
- Sit quietly. A small, steady trickle of calls for days. Just enough to confirm the key still works.
- Then go all in. In one case, about 800,000 Bedrock calls in roughly 30 hours. In the other, about 1.7 million calls in 13 hours from a single address. Wiz estimates the two cases alone ran up more than $100,000 in usage at list price.
Wiz also ties the stolen keys to a resale market: sites selling discounted frontier model access. That's LLMjacking as a business, not a prank. I wrote about Symantec's "Skynet mode" agent last week, which runs its attacks on stolen AI. Same economy, different storefront.
Why This Matters Beyond Your Cloud Bill
The bill is the part that gets noticed. It's not the scary part. A developer platform's environment variables rarely hold just an AI key. They hold database passwords, cloud credentials, payment and signing secrets. Wiz notes an anecdotal report of crypto theft using keys stored in Railway. If an attacker decrypts your env vars, the AI key is just the first one they test, because it's the easiest to cash out.
Disclosure: I work at Zscaler, and we sell security for exactly this kind of problem. But you don't need any vendor to do the first five things on this list.
What To Do About It
- If you use any of the nine platforms, rotate everything. Not just AI keys. Every secret in every environment, secret group and global secret. Then revoke the old keys with the provider, not just in the platform.
- Check provider usage and billing logs for calls you don't recognize, going back to early October. The quiet "validation" trickle is your tell.
- Scope AI keys tightly. Per app, per environment, with spend limits and model restrictions. One of Wiz's cases was limited to regional profiles, and quotas throttled most of the excess calls. Limits worked.
- Prefer short-lived credentials. Workload identity or federated tokens over long-lived keys sitting in an env var for months.
- Alert on the pattern, not just the spike: new source IPs, new clients, new models, calls from hosting providers you've never used.
- Route AI traffic through a control point so you can see which apps and keys are calling which models, and cut off what you didn't approve.
Bottom Line
Nine platforms in one month, no common bug, one common target. Attackers have figured out that an AI API key is cash, and that developer platforms keep a lot of them in one place. Treat every secret you've handed to a third party as something you may need to rotate at two in the afternoon on a Friday. Practice that before you need it.
Sources: Wiz, "Black October" for AI Developer Platforms, Northflank status page, and BleepingComputer on the Northflank breach