Northflank Breach Caps a Month of Attacks on AI Developer Platforms

At 11:43 UTC on October 30, a threat alert from the security firm Wiz reached engineers at Northflank, a cloud platform developers use to deploy apps and databases. Less than three hours later, the company was telling every customer to assume the worst. The Northflank breach turned out to be the ninth incident at an AI developer platform that Wiz tracked in October, a run of attacks the firm calls "Black October."

The common thread, according to Wiz, is not a single bug. It is what the attackers went looking for: stored environment variables, especially the API keys that unlock paid AI models. If you build software and keep secrets on a hosted platform, this month deserves a close look. More security coverage lives on our tech page.

Nine platforms in one month

Wiz researchers Benjamin Read and Rami McCarthy listed the incidents in an October 30 post, writing that "at least nine AI Developer Platforms have disclosed incidents over the course of the month." Here is the order they gave:

• October 6: Fireworks AI disclosed an incident it later tied to credential access.
• October 9: Andromeda reported a breach.
• October 14: Zeabur disclosed an incident, also linked to credential access. Wiz says Zeabur is now shutting down because of it.
• October 15: Lightning AI followed, again citing credential access.
• October 16 and 17: OpenCode reported an incident involving a legacy system and described it as an attempt at "distillation," meaning copying a model's behavior.
• October 20: Railway pointed to "privilege escalation in our build infrastructure."
• October 23: Warp suggested a third party vendor dependency was involved.
• October 28: CommandCode disclosed an incident it also linked to distillation.
• October 30: Northflank posted its notice the same day Wiz published.

Inside Northflank's first 12 hours

Northflank's incident page gives an unusually detailed timeline. Engineers began reviewing the Wiz alert one minute after it arrived, pushed a first network policy patch at 12:02 UTC, added more patches through 13:05 and asked Wiz's incident response team for help at 13:00.

The guidance to customers hardened fast. At 1:40 PM UTC the instruction was to rotate environment variables immediately. Eighteen minutes later it read: "Assume all environment variables have been decrypted. Disable/rotate all keys." By mid afternoon, the company said multiple users were confirming their AI keys had been used.

Late that night Northflank confirmed reports of unauthorized use of AI API keys stored on the platform. Over the following day it switched on audit logs for every customer, including free accounts, and rolled out secret rotation tools for Postgres, MongoDB, MySQL, Redis, Minio and RabbitMQ add ons.

What Northflank has not said, according to the UK trade outlet teiss, is how attackers got in, how many customers were affected, or whether credentials beyond AI keys were abused.

Why stolen AI keys are worth so much

The goal Wiz describes is "LLMjacking," which means using someone else's cloud AI account to run model calls on their bill. In one case Wiz studied, attackers made about 800,000 calls to Amazon Bedrock over roughly 30 hours. In another, they made about 1.7 million calls in 13 hours, more than a million of them successful. Wiz estimates those two cases alone likely ran past $100,000 in usage at list prices.

That fits a pattern we have covered before, from the Claude Code extension backdoor that hit Cursor users to booby trapped AGENTS.md files that fooled coding agents, and the Cloudflare Workers AI bug that mixed up responses between customers. Developer tools hold the keys, so developer tools get targeted.

Nvidia's Brev adds an SSH key twist

The list may not be complete. On November 2, Tom's Hardware reported that Nvidia had notified users of its Brev GPU platform about a security incident. According to that report, unauthorized activity ran from October 4 to October 20, and an SSH key set up by Brev may have been exposed. Nvidia told customers it rotated the key, updated their instances with the replacement and found no evidence of improper use. Brev does not appear in Wiz's count.

Steps for developers on hosted platforms

1. If you use Northflank, follow its notice: revoke every credential stored there with the provider that issued it, create new ones, and update your secrets and workloads.
2. Check billing and usage logs at your AI providers, such as OpenAI, Anthropic and Amazon Bedrock, for calls you did not make, and report anything odd to both the provider and the platform.
3. Set spending caps or budget alerts on AI accounts so a stolen key cannot run up an open ended bill.
4. Turn off public access to databases and add ons that do not need it, as Northflank advised.
5. Treat keys on any platform named above as suspect if you have not rotated them since early October.

If personal data was part of what you stored, our data breach checklist covers the next moves. And keep watching usage dashboards for the next few weeks. In the cases Wiz studied, the damage piled up in hours, not days.