{"slug": "northflank-is-the-ninth-ai-platform-breach-this-month-make-a-stolen-ai-key-worth", "title": "Northflank is the ninth AI platform breach this month. Make a stolen AI key worth less.", "summary": "A developer at Voir Labs outlined a gateway design that limits the damage from stolen AI provider keys, after Wiz's \"Black October for AI Developer Platforms\" report documented incidents at nine platforms including Fireworks AI, Railway, Zeabur and Northflank. The design keeps the provider key inside a small self-operated gateway and issues each app its own token, with per-app model allowlists and hourly call ceilings; the author notes that scoping alone only delays abuse, citing one stolen Bedrock credential that made roughly 1.7 million calls in thirteen hours versus at most 120 a day normally.", "body_md": "*Originally published on [voirlabs.io](https://www.voirlabs.io/insights/stolen-ai-api-keys-platform-breaches?utm_source=devto&utm_medium=syndication&utm_campaign=distribution) by Moosa Jafri.*\n\nAn AI provider key stored as an environment variable on a hosting platform is only as safe as that platform, and in October nine of them disclosed incidents. The useful response is to plan for the next leak: make a stolen copy of your key able to do very little, and make its misuse loud within the first hour. This article walks through what attackers did with stolen keys, based on Wiz's investigation, and a small gateway design that limits the damage.\n\nOn October 30, Wiz published \"Black October for AI Developer Platforms\", listing incidents at Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Its reading of the public reports: they \"highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access.\" It also says \"there is no single vulnerability or dependency linking these attacks\".\n\nThe platforms' own words point the same way. Railway's October 21 disclosure says an unauthorized party \"may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents\", and that it believes this \"is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers.\" BleepingComputer reported on October 20 that at Zeabur an attacker used \"leaked internal credentials stored in plaintext\" and stole \"over 3.2 million environment variable records\". On October 31 it reported Northflank's warning to customers: \"Assume all environment variables have been decrypted. Disable/rotate all keys,\" followed by \"Users have reported unauthorised use of AI API keys supplied to the Northflank platform\".\n\nOne label. Wiz has not confirmed that one group is behind all nine incidents, and Northflank has not said how attackers got in.\n\nWiz traced two enterprise Amazon Bedrock credentials that had been stolen through vendor breaches. Its timeline is the most useful part of the report, because it shows when a defender could have noticed.\n\nTwo numbers are worth putting side by side. By our arithmetic, 1.7 million calls in thirteen hours is about 36 calls a second; during the quiet period the same key made at most 120 a day. And the probe asked for models across several vendors in one sweep. If an app only ever calls one or two models, a request for any other model is a signal that arrives days before the bill.\n\nThe second key in Wiz's report was scoped. Its policy allowed Bedrock \"only through us.* cross-region inference profiles\", and the reseller pool that picked it up asked for global.* profiles. For four hours, thousands of calls failed. Then a checker found the model IDs that worked, and the flood began.\n\nThat's the honest lesson on scoping. A narrow policy cost the attacker time and produced thousands of failed calls that someone could have alerted on. It didn't stop the abuse, because the allowed path was still worth money. Scope is a delay and an alarm; a ceiling on volume is what limits the bill.\n\nOur approach for a team with several apps calling a model: the provider key lives only in a small gateway you operate, and each app gets its own token for that gateway. The app token is what sits in the hosting platform's environment variables. A sketch of how we would write the gateway's admission check, in TypeScript:\n\n```\ntype AppPolicy = {\n  models: Set<string>;  // the exact model IDs this app uses\n  callsPerHour: number; // near normal use, far below the quota\n};\n\nconst policies = new Map<string, AppPolicy>([\n  [\"support-bot\", { models: new Set([\"your-model-id\"]), callsPerHour: 600 }],\n]);\n\nconst usage = new Map<string, { hour: number; calls: number }>();\n\n// Returns null to admit; the gateway then adds the provider key.\nexport function admit(appId: string, model: string): string | null {\n  const policy = policies.get(appId);\n  if (!policy) return \"unknown app\";\n  if (!policy.models.has(model)) {\n    alert(appId, `asked for ${model}, which it never uses`);\n    return \"model not allowed\";\n  }\n  const hour = Math.floor(Date.now() / 3_600_000);\n  const seen = usage.get(appId);\n  const calls = seen?.hour === hour ? seen.calls + 1 : 1;\n  usage.set(appId, { hour, calls });\n  if (calls > policy.callsPerHour) {\n    alert(appId, `${calls} calls this hour`);\n    return \"over hourly ceiling\";\n  }\n  return null;\n}\n\ndeclare function alert(appId: string, why: string): void;\n```\n\nNotice what a stolen app token is worth here. It reaches one model, so a catalog probe like the one in Wiz's report fails on its first unfamiliar model and pages someone. And at 36 calls a second, a ceiling of 600 calls an hour is reached in under twenty seconds, by our arithmetic, so a flood stops at the ceiling instead of running for thirteen hours. Set the ceiling from your own usage, with headroom for your busiest hour.\n\nBecause the gateway is yours, revoking a leaked app token takes one change, and the provider key never needs to rotate across every app at once.\n\nThe gateway is now the secret worth stealing, so it doesn't belong on the same shared platforms. Run it where you already keep production secrets, and give it the cloud's short-lived credentials where your provider supports them, rather than a long-lived key in a variable.\n\nIt adds a hop to every model call and one more service to keep up. Ceilings set too tight will block a real traffic spike, which means a support bot going quiet on your busiest day; start with alerts only and turn on blocking once you trust the numbers. And none of this replaces rotation. If your keys sat on any of the nine platforms, rotate them now and check your provider's billing for October.\n\nIf you run one app with one key and little traffic, skip the gateway. Give the key the narrowest model scope your provider allows, set a spending alert, and keep it off shared hosting.\n\nIf you want a second opinion on where your AI keys live and what a stolen one could reach, [book a conversation](https://calendly.com/voirlabs/30min?utm_source=devto&utm_medium=syndication&utm_campaign=distribution).", "url": "https://wpnews.pro/news/northflank-is-the-ninth-ai-platform-breach-this-month-make-a-stolen-ai-key-worth", "canonical_source": "https://dev.to/voirlabs/northflank-is-the-ninth-ai-platform-breach-this-month-make-a-stolen-ai-key-worth-less-1ckj", "published_at": "2026-11-13 15:14:22+00:00", "updated_at": "2026-11-13 15:23:47.886292+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-tools", "developer-tools"], "entities": ["Wiz", "Northflank", "Railway", "Zeabur", "Fireworks AI", "Lightning AI", "Amazon Bedrock", "Voir Labs"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/northflank-is-the-ninth-ai-platform-breach-this-month-make-a-stolen-ai-key-worth", "markdown": "https://wpnews.pro/news/northflank-is-the-ninth-ai-platform-breach-this-month-make-a-stolen-ai-key-worth.md", "text": "https://wpnews.pro/news/northflank-is-the-ninth-ai-platform-breach-this-month-make-a-stolen-ai-key-worth.txt", "jsonld": "https://wpnews.pro/news/northflank-is-the-ninth-ai-platform-breach-this-month-make-a-stolen-ai-key-worth.jsonld"}}