Nine AI developer platforms disclosed breaches in October, and the target is stored AI keys

Wiz lists Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16 to 17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28) and Northflank (Oct 30). It says most of the incidents are still being analyzed. Fireworks, Zeabur and Lightning attribute their root causes to credential access; Railway cites "privilege escalation in our build infrastructure"; Warp points to a third-party vendor dependency; OpenCode says a "legacy system." Wiz says "all public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access." Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, and OpenCode and CommandCode attributed their incidents to attempted distillation.

Wiz also followed two enterprise keys it attributes to a compromised vendor. In both, the first unauthorized call came within 30 minutes of the reported credential access: a single InvokeModel from a residential IP address, testing the key. Days later, the abuse started at scale. On the key whose policy allowed global.* cross-region inference profiles, Wiz counts about 800k Bedrock calls over thirty hours, roughly 90% successful, with about 6% throttled. On the restricted key, which allowed only us.* profiles, one address made about 1.7 million calls over thirteen hours, over a million successful, and nearly all the rest were throttled against regional quotas. Wiz says the two cases likely ran up over $100k in usage at list price. It could not establish whether the resale operators it found testing the keys also carried out the original breaches.

On Northflank's status page, at 7:38 PM EDT it added that users had reported unauthorised use of AI API keys supplied to the platform, and told customers to revoke the keys with their issuers and check provider billing. At 9:04 PM it said audit logs are now on for all customers, including free users. The page does not state a root cause.

Why it matters: Any AI key stored as an environment variable on a hosted platform is exposed if that platform is breached, and Wiz's two cases show how fast a validated key gets used. In its data the regional restriction did not stop the abuse; the account's regional quotas throttled part of it. Narrow key policies, tight quotas and usage alerts on provider billing are the controls you can set before the next disclosure.