Nine AI Platforms Were Breached in October. The Attacker Wanted Your Inference Key.

Northflank told every customer to assume their secrets were gone, and it took eighteen minutes to reach that conclusion. The status page opened at 1.40pm UTC on 30 October. The first update logged as identified, at 1.58pm UTC, read “Assume all environment variables have been decrypted. Disable/rotate all keys.”

The company had known for two hours. Wiz raised a threat alert at 11.43 UTC that morning, Northflank engineers read it a minute later, and a network policy patch shipped at 12.02. A patch closes a door. It does not retrieve a key that was already copied out and tested against a catalog of models.

A patch cannot un-steal a key that has already been tested

Read the Wiz account of the downstream abuse twice, because the sequence is the useful part. Both keys were first used within thirty minutes of the credential access Wiz ties to a vendor breach. The opening move was one InvokeModel call from a residential address, a one minute sweep trying stolen keys across organizations. It asked for Claude Fable 5.1, failed, and fell back to Opus 5.5.

Then an inventory process. A liveness check of 14 to 120 calls a day from one small Go client. Then a rotating proxy pool probed a call per model. Then a boto3 script enumerated Bedrock and EC2 quotas, and twenty two seconds later the bulk traffic began.

That is why rotation at the issuing provider is the only real remedy. A platform can patch its own network. It cannot reach into a reseller key list. Revoke with the provider, generate a replacement, then update the value here.

Nine platforms in one month means a market, not a bug

Wiz counts at least nine AI developer platforms disclosing incidents in October. Fireworks AI on 6 October, Andromeda on 9 October, Zeabur on 14 October, Lightning AI on 15 October, OpenCode on 16 and 17 October, Railway on 20 October, Warp on 23 October, CommandCode on 28 October, Northflank on 30 October. Zeabur says it is shutting down because of it.

There is no shared vulnerability. The root causes differ. Railway points to privilege escalation in its build infrastructure. Warp blames a third party dependency. OpenCode says a legacy system. Fireworks AI, Zeabur and Lightning AI blame credential access. The nine share a target. Those AI platform breaches are one market chasing one class of secret.

The demand side is visible. Wiz followed both keys into operations advertising discounted access to frontier models, one taking payment in USDT. The Railway preliminary report is more direct, saying the attacker likely wanted AI and platform API keys for distilling model weights.

Your blast radius is set by your inference routing

The two Wiz cases behaved differently for a reason that lives in IAM and Bedrock inference profiles, not in the attacker tooling. The first key policy allowed global cross-region profiles. The attacker routed every call through them, load spread across regions, and about 6 percent of roughly 800,000 calls were throttled over thirty hours.

The second key was restricted. Its policy allowed Bedrock only through us profiles while the reseller pool kept asking for global, so thousands of calls failed outright. Once working model ids were found the flood still ran, 1.7 million calls in thirteen hours with over a million successful. About 40 percent died on regional quota.

AWS documents the difference plainly. Geographic profiles route inside a geography such as the US. Global profiles route across any supported commercial region, save roughly ten percent, and can reach regions you never enabled by hand. The setting chosen for a ten percent discount decides how much a stolen key can spend per hour.

Detection follows the same doc. CloudTrail logs cross-region inference in the source region, and the processing region sits in additionalEventData.inferenceRegion. A key that starts jumping geography is something you can alarm on, which beats waiting for a bill.

Three questions for your own platform. What sits in your environment variables right now, and can you rotate every one of them in under an hour without a deploy. Which of your keys carry a global routing policy, and who reviews that policy. If your provider posted this notice tomorrow morning, would your spend dashboard tell you before a status page did.

Related reading. LiteLLM was built to concentrate your keys covers the proxy layer. Our LLM jacking analysis follows what attackers do once a key works. Google Cloud spend caps is the control most teams reach for first.