AI API Key Security: Black October Hits 9 Platforms

Wiz Research documented nine separate security incidents at AI developer platforms between October 6 and October 30, 2026, all exploiting stolen environment variables containing AI API keys, with combined estimated exposure exceeding $100,000 in stolen compute. One stolen key ran 1.7 million Claude API calls in 13 hours, another accrued $50,000 in Amazon Bedrock charges in 30 hours, and Claude Opus accounted for roughly 75% of successful LLMJacking calls. The affected platforms were Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank, and Northflank told customers to assume all environment variables are compromised and revoke credentials at the issuing provider rather than rotating them in the platform dashboard.

October 2026 is officially “Black October” for AI developer platforms. On October 30, Wiz Research published a report https://www.wiz.io/blog/black-october-for-ai-developer-platforms documenting nine separate security incidents across AI dev platforms in a single month — Fireworks AI, Railway, Northflank, Warp, and five others. The attack vector was identical in every case: stolen environment variables containing AI API keys. One stolen key ran 1.7 million Claude API calls in 13 hours. Another accumulated $50,000 in Amazon Bedrock charges in 30 hours. Combined estimated exposure: over $100,000 in stolen compute. If you store an Anthropic, OpenAI, or AWS Bedrock key in any cloud platform, you are in the same risk pool as those nine victims. Nine Platforms, One Playbook The nine breaches were not coincidence. They followed an industrialized playbook that security researchers now call LLMJacking https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-evolved-offensive-agentic-20260/ : compromise a developer platform, extract stored environment variables in bulk, validate the stolen AI API keys within 30 minutes, then monetize. Attackers either used the keys directly — running expensive model inference at the victim’s expense — or sold access on underground markets advertising discounted Claude Opus and GPT-4 access. The timeline ran from October 6 Fireworks AI through October 30 Northflank , hitting nine platforms in 25 days: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Attack techniques varied — agent swarm attacks, build infrastructure privilege escalation, vendor dependency exploitation — but the target was consistent: environment variables holding AI keys. Notably, Claude Opus represented approximately 75% of successful LLMJacking calls. Attackers deliberately target the most expensive, highest-capability models to maximize the value of each stolen credential. That tells you these attacks are not opportunistic; they are optimized. What Attackers Did with Your Keys The Railway breach on October 20 is the clearest case study. Attackers escalated privileges in Railway’s build infrastructure, pulled encrypted secrets from the database, then obtained CI credentials that let them decrypt those secrets. Up to 100,000 workspaces — 1.85% of all Railway deployments — had their environment variables compromised. Cryptocurrency wallets whose private keys were stored as Railway env vars were directly drained. However, for developers whose AI provider keys were already extracted, the damage was done before Railway could act. Northflank disclosed a similar exfiltration on the same day. Their statement was blunt: assume all environment variables are compromised. Not “consider rotating” — assume compromised. Northflank explicitly told customers to revoke credentials at the issuing provider https://runtimewire.com/article/northflank-tells-customers-to-assume-all-environment-variables-are-compromised-a Anthropic, OpenAI, AWS rather than simply changing them in the Northflank dashboard. That distinction matters: the platform cannot invalidate a key; only the provider can. Updating your key in a breached platform while the attacker still holds the original does nothing. Related: Northflank Breached: Your Secrets Are Exposed — Act Now https://byteiota.com/northflank-breached-secrets-exposed-rotate-now/ The 30-minute exploitation window is the detail that makes reactive response nearly impossible. Wiz Research documented that stolen keys were validated within 30 minutes of initial breach access through a single test InvokeModel request from a residential IP address. After validation, the key went straight into the attack pipeline — 36 API requests per second for 13 hours in the most documented case. By the time a developer gets a billing alert, the attacker has already moved on. What You Need to Do Right Now Start with your AI provider dashboards, not your deployment platform. Log into Anthropic, OpenAI, AWS, and Google Vertex AI directly and revoke any keys stored in third-party platforms. Then generate new keys and scope each to a single project or environment. Set hard spending limits at the provider level — Anthropic, OpenAI, and AWS all support configurable usage caps that limit your exposure when a key is stolen. Check your usage logs for anomalies going back to October 6, the date of the first confirmed breach. The longer-term architectural fix is harder but necessary: stop storing long-lived AI API keys in platform environment variables entirely. The platforms that got breached were not doing anything obviously wrong — they stored secrets encrypted. The problem is that encrypted secrets can be decrypted when attackers obtain CI credentials that serve as the encryption keys. The answer is ephemeral credentials: OIDC-based workload identity https://aviatrix.ai/threat-research-center/railway-2026-llmjacking-cloud-credential-theft-customer-secrets/ , where a short-lived token is issued at runtime and expires after use. There is nothing to steal because the secret never persists. Until your stack supports ephemeral tokens, a dedicated secrets manager AWS Secrets Manager, HashiCorp Vault, Infisical with access logging and automatic rotation is the next-best option. Related: Warp Breach Exposed AI Agent Logs — A New Data Risk Category https://byteiota.com/warp-breach-ai-agent-logs/ Key Takeaways - Nine AI developer platforms were breached in October 2026 in a coordinated LLMJacking wave; stolen keys were exploited within 30 minutes of theft - Revoke AI API keys at the provider level Anthropic, OpenAI, AWS , not just in your deployment platform — the platform cannot invalidate keys it no longer controls - Set hard spending caps on every AI API key today; this limits the damage from any future credential theft - Long-lived API keys stored in environment variables are the target; move toward ephemeral credentials OIDC/workload identity or a dedicated secrets manager - Treat AI API keys with the same security rigor as cloud IAM credentials — they are now worth thousands of dollars and actively hunted