Agent News Daily

Security researchers link a month of break-ins at AI developer platforms to theft of AI keys

Wiz says nine AI developer platforms reported incidents in October. Stolen AI keys were resold, and some victims described an 'agent swarm'.

1 November 2026

Nine companies that host or build tools for AI developers disclosed security incidents during October, according to a report published by Wiz on 30 October. The cloud security company calls the period "Black October". It says the attacks have led to "LLMJacking at scale", meaning the theft and resale of access to AI models.

Which platforms were affected

Wiz lists these disclosures, in date order:

  • Fireworks AI (6 October)
  • Andromeda (9 October)
  • Zeabur (14 October)
  • Lightning AI (15 October)
  • OpenCode (16–17 October)
  • Railway (20 October)
  • Warp (23 October)
  • CommandCode (28 October)
  • Northflank (30 October)

Wiz says Zeabur is shutting down because of its incident. An earlier Cloud Security Alliance research note from 23 October gives slightly different disclosure dates for some of the same companies, such as 9 October for Fireworks AI and 21 October for Railway.

What the attackers were after

Wiz says every public report describes targeted attempts to find stored environment variables, especially those holding credentials for AI services. The reported root causes differ. Wiz cites stolen or exposed credentials at Fireworks, Zeabur and Lightning AI, privilege escalation in Railway's build infrastructure, a third-party vendor at Warp, and a legacy system at OpenCode. Wiz says no single vulnerability or dependency links the attacks, and that most incidents are still being investigated.

The latest disclosure came from Northflank. Its status page shows that a Wiz threat alert arrived at 11:43 UTC on 30 October. Northflank then told users to assume all environment variables had been decrypted and to rotate every key. Later updates said several users had confirmed their AI keys had been used, and on 31 October the company enabled audit logs for all customers.

The role of agents is not settled

Wiz reports that Fireworks, OpenCode and Warp described an "agent swarm" attack. Andromeda called its incident part of an "industry-wide attack". OpenCode and CommandCode instead attributed theirs to "distillation", which is collecting outputs from one model to train another. Wiz does not itself conclude that AI agents carried out the intrusions.

The Cloud Security Alliance note says OpenCode co-founder Dax Raad reported that attackers used AI agents against the company's systems for at least 48 hours. BleepingComputer reported that Warp's chief executive, Zach Lloyd, estimated about 1% of users may have been affected through a vendor in Warp's infrastructure, with agent decision logs and telemetry exposed. In BleepingComputer's account, the agent-swarm description comes from analysis of the incident rather than a confirmed Warp statement.

What happened to the stolen keys

Wiz describes two cases of enterprise credentials tied to vendor breaches being abused through Amazon Bedrock:

  • In one case, about 800,000 calls were made over roughly 30 hours, and about 90% succeeded.
  • In the other, about 1.7 million calls were made over roughly 13 hours, and more than a million succeeded.

In both cases, Wiz says the first unauthorised call came within 30 minutes of the reported credential access. It estimates the two cases ran up more than US$100,000 at list prices. The traffic resembled resold coding-agent use. Wiz also traced key testing to two discounted model-resale sites, but says it cannot confirm that they caused the original compromises. It also cites an unverified report of about US$371,000 in cryptocurrency stolen using keys stored on Railway.

What defenders are advised to do

The Cloud Security Alliance recommends the following:

  • Rotate every AI key and credential stored on an affected platform at the provider that issued it, because deleting a key from the platform does not revoke it.
  • Check usage and billing logs.
  • Issue separate, spend-capped keys for each platform.
  • Inject secrets at runtime rather than pasting them into dashboards.

Northflank gives similar advice to its own customers.

Sources

Sources