Wiz Counts Nine AI Developer Platforms Breached in October, All Aimed at Stored API Keys

Wiz counted at least nine AI developer platforms that disclosed security incidents in October 2026, and the part that matters to a customer is narrower than the headline: the public reports describe attackers hunting for stored environment variables that unlock AI model access, not a single flaw in a shared dependency. Wiz's own write-up finds no single vulnerability or dependency linking the incidents, and says most of the platforms have published no indicators of compromise.

The report, titled "Black October for AI Developer Platforms", is Wiz's roundup of the disclosures. It is a list of other companies' statements, so each root cause below is the platform's own account, not Wiz's finding.

The nine October incidents, as Wiz lists them

Date (2026)	Platform	Root cause as disclosed
Oct 6	Fireworks AI	Credential access
Oct 9	Andromeda	Called part of an "industry-wide attack"
Oct 14	Zeabur	Credential access; shutting down
Oct 15	Lightning AI	Credential access
Oct 16-17	OpenCode	A "legacy system" and a "distillation" attempt
Oct 20	Railway	Privilege escalation in build infrastructure
Oct 23	Warp	Suspected third-party vendor dependency
Oct 28	CommandCode	A "distillation" attempt
Oct 30	Northflank	No technical detail published

Wiz also lists later cases: Brev (NVIDIA), Chainstack, kernel.sh, Blacksmith, Tensorlake, Trigger.dev on Nov. 1, and NEAR AI on Nov. 8. NEAR AI said an inference server was accessed through "a remote code execution vulnerability in SGLang", which is the only named software flaw in the list.

What the attackers were after

Fireworks, OpenCode and Warp each reported signs of what Wiz calls an "agent swarm" attack. Railway's preliminary report says its attacker was "attempting to obtain AI provider API keys to perform distillation attacks", and that staff read attacker payloads naming the specific API keys being searched for.

That is a different target from the usual cloud intrusion. The valuable object is not the customer's workload or database but the key sitting in its environment, because a key to a frontier model API converts directly into compute that someone else pays for. The same pattern appears at Chainstack, where an intrusion that began on a test Grafana ended in production secrets.

Two Bedrock cases and the $100,000 floor

Wiz describes two downstream cases in which enterprise keys taken from vendor breaches were then abused against Amazon Bedrock. In the first, about 800,000 calls ran over roughly 30 hours with about 90% succeeding. In the second, about 1.7 million calls came from a single Level 3 address over roughly 13 hours, with "over a million successful". Wiz says the two likely ran up over $100,000 in usage at list price, and that figure is a floor. BleepingComputer's Northflank report puts the combined total at about 2.5 million calls; Wiz does not state that sum itself.

1. Case A (about 30 hours)800K calls
2. Case B (about 13 hours)1.7M calls

Source: Wiz, Black October for AI Developer Platforms, accessed 2026-11-12

Case B ran at roughly 131,000 calls an hour, against about 27,000 an hour for Case A, from dividing Wiz's rounded figures.

What is not established

Wiz does not tie the incidents to one actor. It found two resale operations, called "momo" and "Xingjiabi", that had access to stolen keys, but says it cannot definitively link them to the initial compromises or to the flood of abuse. The word "distillation" comes from OpenCode and CommandCode's own statements, and Wiz observes that one resale operation appeared to guard against distillation, which could mean it wants distance from that activity.

Public loss figures are also soft. Wiz calls them anecdotal, including about $371,000 in alleged crypto theft from keys stored in Railway and consumer bills of "hundreds to thousands of dollars" from OpenCode. RunPod was named on social media and is unconfirmed.

Scale differs widely between the platforms that have published numbers. Zeabur's preliminary report counts 321,810 accounts and 3,218,965 environment-variable records in the platform database it says was read, and Zeabur is closing by Dec. 31. Railway's report says at most 1.85% of workspaces, about 100,000, had environment variables potentially compromised. Northflank has given no customer count at all. A reader comparing the three should not treat the figures as like for like, because one counts accounts, one counts workspaces and one counts nothing.

What a customer can check today

The instruction repeated across Railway, Northflank and Zeabur is the same: treat every secret stored on a platform that disclosed an incident as read, rotate it at the issuing provider, and check the provider's usage and billing logs for the window. Northflank told customers to "Assume all environment variables have been decrypted." Rotating at the platform alone does not help if the key was already copied and is in use elsewhere.

Wiz's list will keep growing until a root cause is published for the largest of these. Railway has said a follow-up report will come, and Northflank says its forensic review is ongoing. See also GitBook's post-mortem for a platform that did publish its path in.