Nine AI developer platforms breached in October as attackers hunted stored AI keys, Wiz finds

Nine AI developer and hosting platforms disclosed breaches in October 2026, and on October 30 the cloud security firm Wiz published the first broad analysis tying them together: attackers went after the AI service keys customers had stored on those platforms, and two stolen Amazon Bedrock keys were used for an estimated $100,000-plus of AI model usage within days. If your team stored AI provider keys on Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode or Northflank, revoke and reissue them at the provider (deleting them from the platform is not enough) and check your usage logs.

What happened, in plain English

Developers increasingly build on platforms that host their apps, run their AI models or power their coding tools. To work, those platforms need the customer's secrets: database passwords, cloud keys and, more and more, API keys (the long passwords that let software call a service) for AI providers such as OpenAI, Anthropic or Amazon Bedrock, Amazon's service for running AI models. These secrets are usually stored as "environment variables", settings handed to an app when it starts.

In October, nine of these platforms reported intrusions, one after another. According to Wiz's analysis, the public reports consistently describe attackers hunting through stored environment variables, especially those that grant access to AI services. Railway, one of the largest, said in its preliminary report that the attack "was attempting to obtain AI provider API keys to perform distillation attacks", meaning copying a commercial model's abilities by feeding it huge numbers of requests and training a cheaper model on the answers.

Think of it like a valet parking service whose key box was raided: the thieves are not interested in the valet company, they want your car. Here, the "car" is your paid AI account. Wiz followed two stolen enterprise Bedrock keys and found them being run hard, about 800,000 calls in roughly 30 hours on one and about 1.7 million in roughly 13 hours on the other, mostly to the most expensive models, with the bill landing on the key owner.

Wiz calls the pattern "LLMjacking" (hijacking someone else's access to large language models) and says it found no single vulnerability linking the nine breaches.

Are you affected? What to do now

You should act if your organization stored any AI provider key, or cloud credentials able to call AI services, on one of the nine platforms Wiz lists: Fireworks AI (disclosed October 6), Andromeda (October 9), Zeabur (October 14), Lightning AI (October 15), OpenCode (October 16–17), Railway (October 20), Warp (October 23), CommandCode (October 28) and Northflank (October 30). Wiz says "at least nine", so the list may grow. If you use none of them, you have nothing urgent to do, but the second half of the checklist still applies to wherever you keep AI keys.

If you used an affected platform

• Find every secret you stored there: AI keys, cloud access keys, database URLs, GitHub and registry tokens. Ask the platform's notice or support which of your workspaces were in scope.
• Revoke and reissue each key at the provider that issued it (OpenAI, Anthropic, AWS, etc.), then update the platform. Deleting a secret from the platform does not switch it off; only the issuing provider can do that.
• Railway customers: Railway recommends that "all customers who signed up prior to October 21 rotate their keys stored on Railway", and also advises removing public network access to databases and checking GitHub and container-registry (for example Docker Hub) audit logs. Railway says at most 1.85% of all workspaces had some environment variables potentially compromised.
• Check provider bills and usage dashboards for spikes since early October.
• In AWS CloudTrail (AWS's activity log), look for unexpected Bedrock model-invocation calls and quota-listing activity from outside your network. Wiz published four IP addresses it saw testing stolen keys in late October: 23.106.46[.]239, 38.246.114[.]118, 104.243.32[.]50 and 31.57.201[.]201. Wiz says it has no evidence linking them directly to the platform breaches, so treat a match as a strong lead, not proof.

Wherever you keep AI keys

• Give each app its own key, scoped to the models and regions it needs, with a spending alarm.
• Prefer short-lived credentials over keys that never expire.
• Treat a sudden usage spike as a security alert, not just a finance question.

The expert view

What the attackers wanted. None of this is a classic data-theft campaign. The prize is resaleable compute. Frontier-model access is expensive, and there is demand for it at a discount, both from developers running coding agents and, according to Railway, OpenCode and CommandCode, from people attempting distillation. Wiz observed that the token usage profile of the abuse "resembles resold coding-agent traffic." The platforms were attractive because each one held many customers' AI keys in one place.

The abuse pattern. In both Bedrock cases Wiz analysed, the first unauthorised activity came within 30 minutes of the reported vendor credential access. Then came days of low, steady traffic (14 to 120 calls a day) from one small client that Wiz reads as a key-validity checker, followed in one case by scripted enumeration of Bedrock and compute quotas and then bulk traffic. Claude models on Bedrock took most of the traffic. The second key was restricted to US cross-region profiles, which made some of the pool's requests fail, yet it still served more than a million successful calls. Wiz's $100,000 figure is an estimate at list price for those two cases only.

The resale market. Wiz names two operators that tested the stolen keys: "momo", which Wiz links to a discounted-access resale site accepting USDT (a cryptocurrency stablecoin), and "Xingjiabi", another discount reseller. Wiz is careful: it says it cannot definitively tie either reseller to the initial compromises or to the bulk abuse.

Is AI doing the attacking? Claimed, not shown. Fireworks, OpenCode and Warp reported indications of an "agent swarm" attack, meaning many automated AI agents working in parallel. Wiz relays those vendor claims but does not confirm them itself. Our assessment: the confirmed part is the target (AI keys) and the monetisation (resale and, per vendors, distillation); AI-run intrusion is plausible but, for these breaches, still vendor assertion. No one has attributed the breaches to a named threat actor or country.

What is new. LLMjacking has been documented since 2024, and several of this month's breaches were reported individually. What Wiz adds is the cross-platform view: a whole category of developer infrastructure was hit in four weeks by attackers with the same goal, while the reported entry points differed from vendor to vendor. That points to demand-driven targeting rather than a single bug, and it means "which platform is next" is a fair question for any service that stores customers' AI keys.

Still unknown. Whether one actor or several are behind the nine breaches; how many keys were stolen and used in total; whether social-media claims of roughly $371,000 in cryptocurrency stolen via Railway-stored keys are true (Wiz describes them as an alleged theft); and final root causes, as most vendor reports are still preliminary.

Official sources

• Wiz Research — "Black October" for AI Developer Platforms (Benjamin Read, Rami McCarthy, October 30, 2026)
• Railway — Preliminary report on the October security incident (October 22, 2026)
• Railway changelog — October 21 security incident (October 23, 2026)
• Coverage: Cloud Security Alliance research note — Inference providers as the prize: platform-chain campaigns against AI serving
• Coverage: BleepingComputer — Railway warns devs to rotate secrets after potential breach