Northflank, a cloud platform that developers use to deploy applications, databases and AI workloads, has told every customer to treat their stored secrets as compromised after a security incident flagged by Wiz. In its public incident notice, the company told users to “assume all environment variables have been decrypted” and to rotate every key and credential.
Northflank is the ninth AI developer platform to disclose an incident in October, according to a new Wiz report titled “Black October” for AI Developer Platforms. Wiz says the attacks share a goal: stealing AI API keys for LLMjacking, the practice of running up AI model usage on someone else’s account.
A morning alert turned into a platform-wide rotation
Northflank’s timeline shows how fast the incident escalated on October 30:
- 7:43 AM EDT: Wiz sent Northflank a threat alert, and engineers began reviewing it 1 minute later.
- 8:02 AM EDT: Northflank deployed an initial network policy patch, followed by more patches at 8:50 AM and 9:05 AM.
- 9:00 AM EDT: Northflank requested support from the Wiz incident response team.
- 9:58 AM EDT: The company told customers to assume all environment variables had been decrypted and to disable or rotate all keys.
- 7:38 PM EDT: Northflank said users had reported unauthorized use of AI API keys stored on the platform.
Northflank said multiple users confirmed their AI keys had been used. It linked those reports to the broader pattern of attacks on AI credentials and noted that similar IP addresses appear in the Wiz report.
New controls shipped under pressure
Northflank rolled out tooling to help customers respond. It enabled secret rotation for Postgres and MongoDB add-ons on October 30, then added MySQL and Redis on October 31, followed by Minio and RabbitMQ the same evening. On the night of October 30, it switched on audit logs for all customers, including free users.
The company is also telling customers to disable public access to add-ons, rotate secrets in workloads, secret groups and global secrets, revoke credentials with the providers that issued them, and check AI provider usage and billing logs for unexpected activity.
Northflank has not disclosed a root cause, how the attacker reached customer secrets or how many customers were affected. Its notice says the investigation is ongoing.
Nine platforms in one month
Wiz researchers Benjamin Read and Rami McCarthy list 9 AI developer platforms that disclosed incidents in October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. BreachNews has covered the Zeabur attack that led to its shutdown, Railway’s decrypted customer secrets and Warp’s vendor breach. Wiz also notes that Lightning AI was previously hit by a supply chain attack, which BreachNews reported in May.
Wiz found no single vulnerability or dependency linking the incidents. The reported entry points vary, from stolen credentials to build infrastructure, a third-party vendor and a legacy system. What the victims share, according to Wiz, is targeted hunting for stored environment variables, especially ones that grant AI access. Several companies described “agent swarm” activity, and Wiz ties the wave to the rise of agentic attacks and a resale market that makes stolen AI keys easy to monetize.
How a stolen key becomes a 6-figure bill
Wiz traced 2 enterprise keys, compromised in one of the vendor breaches, from first use to remediation. Each was tested within 30 minutes of the reported credential theft, then checked quietly for days before the floods began. One key generated about 800,000 Amazon Bedrock calls in 30 hours. The other generated about 1.7 million calls in 13 hours. Wiz estimates the 2 cases alone ran up more than $100,000 in usage at list price.
The traffic resembled resold coding agent usage, consistent with many end users sitting behind a reseller. Wiz linked the keys to 2 resale operations that sell discounted access to frontier AI models, though it says it cannot definitively tie them to the initial breaches or the floods. One server tied to a reseller had hosted a page named after ARTEX, the autonomous attack framework seen in the Vapor Panda espionage campaign and the ConnectWise supply chain attack. Wiz does not attribute the Black October incidents to either of those actors.
Beyond AI abuse, Wiz cites social media reports alleging that about $371,000 in cryptocurrency was stolen using crypto keys stored on Railway. Those claims have not been independently confirmed. The wave also overlaps with Chainalysis disclosing an intrusion that used offensive agentic techniques, though no public evidence connects the 2.
What Northflank customers should do now
Any team that stored secrets on Northflank should rotate them at the source, not just inside the platform. That means generating new AI, cloud and database credentials, revoking the old ones, reviewing provider billing for spikes and checking the newly available audit logs. Wiz’s cases show abuse can begin within minutes of a theft and scale to millions of calls within hours, so usage alerts and tight quotas on AI accounts are worth setting now.
