TL;DR: In October 2026, at least nine AI developer platforms disclosed security incidents, according to a Wiz research post published on October 30. The common thread is that attackers went after stored environment variables, especially the ones that unlock AI models. Stolen keys were tested within about 30 minutes and later resold. If you have an OpenAI, Anthropic, Bedrock or similar key sitting in a hosting or dev platform, rotate it today. Then put a spend cap on it and narrow its scope. There's a checklist below.
Any other month, one AI platform breach would have been the security story of the week. This month there were nine, and Wiz's researchers had to point out that hardly anyone was connecting them. They called it "Black October".
I'm writing this for developers and small teams, not security specialists. Most of us have pasted an LLM API key into a platform dashboard at some point because it was the quickest way to get a demo running. This post covers what's confirmed so far, what attackers did with the keys, and what you can do in the next hour.
This is Wiz's list with the disclosure dates they give:
| Date (Oct 2026) | Platform |
|---|---|
| Oct 6 | Fireworks AI | | Oct 9 | Andromeda | | Oct 14 | Zeabur | | Oct 15 | Lightning AI | | Oct 16–17 | OpenCode | | Oct 20 | Railway | | Oct 23 | Warp | | Oct 28 | CommandCode | | Oct 30 | Northflank |
What's known about each one varies a lot. Most of these incidents are still under investigation, and Wiz says detailed technical information mostly isn't public yet. Here's what the post does say, attributed to the companies:
There's no single shared vulnerability. Wiz says no single vulnerability or dependency links these attacks. The shared pattern is what the attackers wanted: every public report describes targeted hunting for stored environment variables, with a focus on those that grant AI access.
Unconfirmed: whether one group is behind all nine incidents. Wiz doesn't claim that, and neither do I.
Wiz ties the campaign to two trends. Agentic attacks let attackers compromise targets faster. LLMJacking is the other: stolen model access gets resold through "LLM broker" services. The resale market is what turns a stolen key into money quickly, and that's why so many people are now hunting for these keys.
Wiz also traced downstream abuse of two enterprise keys, which it could attribute to one of the vendor breaches. Both cases are worth reading in full. These are the numbers that matter for your own setup:
global.* cross-region inference profiles, which spread the load across regions, so only about 6% of calls were throttled.us.* inference profiles. The reseller pool asked for Case B doesn't show that restrictions save you. They didn't stop the abuse. They slowed it, and the regional quotas limited it. That's the right way to think about scoping: it limits how much damage a stolen key can do, and you still have to rotate fast.
Wiz also mentions anecdotal impact reports from social media: alleged theft of about $371,000 in cryptocurrency using crypto keys stored in Railway, and stolen AI access (for example from OpenCode) producing consumer bills in the hundreds to thousands of dollars. Treat these as reports, not confirmed totals.
Northflank, the most recent platform on the list, put out the clearest customer guidance I've seen this month. Its status page told every customer to assume all environment variables have been decrypted and to rotate everything: secrets on workloads, secret groups and global secrets. It also recommended disabling public access to database addons, and said multiple users had confirmed their AI keys had been used. A later update told customers to revoke credentials with the issuing provider (not just change them in Northflank) and to check AI provider usage and billing logs for unexpected activity.
You don't have to be a Northflank customer for this to apply. If a platform that stores your env vars discloses an incident, the safe assumption is that every value in those env vars is gone. You rotate the keys first and investigate later.
Start with every platform that holds an AI key: hosting, CI, notebook services, agent platforms and coding tools.
A stolen AI key works like a payment card with no limit. So put a limit on it.
On our own client projects we keep production AI keys in the cloud provider's secrets manager rather than pasting them into every dashboard. Each environment gets its own key, and each provider account gets a budget alert. When a platform we use discloses an incident, we rotate first and investigate second. This month, the habit that made the biggest difference was keeping a written list of where every key lives. Rotating takes minutes. Working out where the keys are is the slow part.
I'll update this post if the platforms publish more detailed reports.
Be honest: how many dashboards hold a copy of your OpenAI or Anthropic key at the moment? Have you set a spend limit on any of them? Tell me in the comments. I'm curious whether this month has changed how anyone stores these keys.