Nine AI Platforms Lost Customer Keys in One Month, in a Bite

Nine AI developer platforms disclosed breaches in October, and the attackers were after one thing, the environment variables that hold model API keys.

• Northflank opened an incident at 1.40pm UTC on 30 October and told every customer to assume their secrets were decrypted eighteen minutes later.
• Wiz traced two stolen enterprise keys through roughly 2.5 million Bedrock calls, and put the list price of those two cases past $100,000.
• The key routed through global cross-region inference profiles was throttled on about 6 percent of 800,000 calls. The one limited to a single geography lost about 40 percent.
• Zeabur is shutting down because of its incident. Railway says the actor wanted AI provider keys to distill model weights.
• Northflank enabled audit logs for every customer, including free accounts, and had MySQL and Redis rotation available by 1.34pm UTC on 31 October.

The full analysis covers the detection signal sitting in CloudTrail and why rotation at the issuing provider is the only remedy. Read the full analysis.