Cloud deployment platform Northflank is urging every customer to rotate their secrets after a breach exposed stored environment variables — including AI API keys that attackers quickly weaponized for unauthorized usage. The incident, disclosed on October 30 and updated on November 2, is part of what security firm Wiz is calling a "Black October" for AI developer platforms: at least nine such services were compromised in a single month, all targeted for the same prize — stored credentials that unlock paid AI models.
What Happened at Northflank
The timeline began at 11:43 UTC on October 30, when a Wiz threat alert fired against Northflank’s infrastructure. Engineers reviewed the alert within a minute, and the first network-policy patch landed by 12:02. Two more patches followed at 12:50 and 13:05. By 13:58, Northflank had posted public guidance telling customers to assume that all environment variables had been decrypted and to begin rotating every credential stored on the platform.
The worst fears were confirmed hours later. By 15:12, multiple users reported that their AI provider keys — for services like Anthropic’s Claude, OpenAI, and Amazon Bedrock — had been used without authorization. At 23:38, Northflank confirmed the abuse was real: attackers had extracted AI API keys from the platform’s control plane and were actively burning through customers’ paid quotas.
In a November 2 update, Northflank stated the attack was contained within an hour of the initial alert and that investigators found no evidence of persistent attacker access. Dedicated and forward-deployed control planes were unaffected. Running workloads themselves were not compromised — the breach targeted secrets at rest in the control plane, where environment variables are encrypted but decrypted before injection into the runtime. Northflank revoked all access tokens, sessions, version-control integrations, and cross-account IAM roles, forcing users to re-authenticate and reconnect their pipelines. Independent forensic auditors are now reviewing the incident, with a root-cause analysis to follow.
Critically, Northflank has not confirmed the exact entry point. The company patched CVE-2026-98432 — a Linux kernel TCP use-after-free vulnerability — across its fleet, but its update does not state that this flaw was the door the attackers walked through.
LLMjacking: Turning Stolen Keys into Cash
The endgame for these attacks has a name: LLMjacking. Coined by security researchers earlier this year, the term describes a growing criminal economy in which stolen AI credentials are used to run large language models on someone else’s dime — either to resell access on underground markets or to power the attacker’s own operations.
The financial damage can escalate shockingly fast. In two cases investigated by Wiz involving stolen Amazon Bedrock credentials, the first test call arrived from a residential IP address within 30 minutes of the key’s exposure. One compromised key generated roughly 800,000 API calls over 30 hours. A second key was hammered with approximately 1.7 million calls in just 13 hours. Wiz estimates that each case likely ran up over $100,000 in usage charges at list price — and the second key was restricted to US inference regions, demonstrating that region-scoping alone does nothing to cap spend.
The appeal for attackers is obvious. AI inference is expensive, and demand on underground markets is high. A single stolen enterprise key can yield tens of thousands of dollars in resold compute before the victim even checks their billing dashboard.
A Pattern, Not an Isolated Incident
Northflank’s breach does not stand alone. Wiz’s "Black October for AI Developer Platforms" report documents at least nine cloud and developer platforms that suffered similar incidents during October 2026. The targets share a common profile: they host customer applications and store environment variables that frequently contain AI provider credentials.
Railway, another popular deployment platform, may have exposed decrypted customer variables and issued its own rotation advisory. OpenCode disclosed exposed keys tied to a legacy system. Warp’s breach reached telemetry and agent logs. Lightning AI was also named. Each vendor offered a different root-cause explanation — privilege escalation in build infrastructure, a third-party dependency, a legacy system — but Wiz found no single shared vulnerability connecting the incidents. What they share is a target: the secrets store.
This convergence suggests that threat actors have identified cloud developer platforms as high-value treasure troves. A single breach can yield thousands of active credentials across dozens of AI providers, cloud services, and databases — all in one haul.
What Affected Users Should Do Now
Northflank’s guidance is unambiguous: treat every secret stored on the platform as compromised and rotate immediately. The recommended priority order starts with AI provider keys, since these are the credentials under active abuse. Next come cloud credentials, payment processor keys, private keys, and database passwords.
For each credential, the correct sequence is to revoke it at the issuing provider, generate a replacement, and then update the secret in Northflank along with every workload that references it. Simply removing a variable from the platform does not revoke the key at the provider — that step must happen separately.
For organizations using Amazon Bedrock, Wiz recommends querying CloudTrail logs for InvokeModel, Converse, and their streaming variants. Red flags include unrecognized access key IDs, bursts of activity at unusual hours, usage from regions the organization does not operate in, and unfamiliar source IP addresses. For direct provider keys (OpenAI, Anthropic, and others), the equivalent check is the provider’s usage and billing dashboard.
Broader Lessons for the Industry
The Northflank incident underscores a systemic weakness in how the industry handles secrets in cloud developer platforms. Environment variables remain the default method for passing credentials to applications, yet they sit in a control plane that, if breached, hands attackers a master key ring.
Security teams should consider several hardening measures going forward. Scoping each AI API key to a single deployment and a single model limits the blast radius if one key leaks. Setting per-workspace spending caps and billing alerts creates an early-warning tripwire. Using short-lived, just-in-time credentials rather than long-lived API keys reduces the window of exploitation. And monitoring AI provider usage dashboards as actively as production error logs can catch abuse before the invoice arrives.
The "Black October" campaign is a clear signal that threat actors have mapped the AI supply chain and found its soft underbelly. As organizations race to integrate AI into their products, the credentials that power those integrations have become some of the most valuable targets on the internet. The Northflank breach is a wake-up call: if your secrets live on a shared platform, your security is only as strong as that platform’s control plane.
Leave a Reply