VULNpocalypse
HighBreach / campaignOngoing

Black October: nine AI developer platforms breached, stolen keys ran about 2.5M Bedrock calls

Nine AI developer platforms disclosed breaches in October 2026. Stolen keys from stored secrets drove about 2.5M Bedrock calls. Revoke, then rotate.

Published
Updated
Exploitation
Yes. Stolen keys were first used within 30 minutes of the reported credential access (Wiz)

What happened

On 30 October 2026, Wiz counted nine AI developer platforms that disclosed security incidents between 6 and 30 October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank (Wiz). Wiz reported credential access as the entry point at Fireworks, Zeabur and Lightning AI, and Railway’s preliminary finding as “privilege escalation in our build infrastructure”. Not every incident was the same, and not every one exposed stored secrets.

What the platforms themselves said:

  • Fireworks AI (identified 6 October): someone used internal Fireworks credentials to read environment variables used in evaluation jobs in “a limited number of customer accounts”. Fireworks warned that “removing a stored secret alone does not invalidate the underlying credential” (Fireworks).
  • Zeabur (14 to 15 October): a plaintext cluster admin token with no expiry sat in a private configuration repository, and the admin interface was reachable from the internet. Zeabur confirmed 3,218,965 environment variable records and 321,810 accounts were read. Commands ran inside 865 customer database services, and the attacker got root on 101 dedicated servers. Zeabur will shut down on 31 December 2026 (Zeabur).
  • Railway (detected 21 October): an unauthorized third party may have accessed encrypted environment variables and, for some, “obtained the decrypted contents”. Railway paused all deployments, asked upstream providers to revoke keys, and told every user to rotate (Railway). Railway has about 4.8 million users (BleepingComputer).
  • Northflank (30 October): told users to “assume all environment variables have been decrypted” and to rotate. Multiple users confirmed their AI keys had been used (Northflank status).
  • Warp reported a different kind of exposure: agent decision logs and telemetry, through an attack on a third-party vendor (BleepingComputer).

The stolen keys were used fast. Wiz traced two AWS keys. The first unauthorized Bedrock call came within 30 minutes of the reported credential access. One key then made about 800,000 Bedrock calls in about 30 hours. The other made about 1.7 million in about 13 hours. Together they “likely ran up over $100k in usage” at list price. Wiz also saw two key-resale operations test the same keys (Wiz).

Am I affected?

You are at risk if you stored any secret on an affected platform during 2026, whether or not you got a notice. Northflank and Railway told all users to rotate.

List what you stored. For Railway, the CLI shows a linked service’s variables:

bash
railway variables

For the other platforms, export or screenshot the variables page for every project and service, including secret groups and add-ons.

Then look for abuse of any AWS key you stored there:

bash
# When was each access key last used, and for which service?
aws iam list-access-keys --user-name YOUR_USER
aws iam get-access-key-last-used --access-key-id AKIA...

# Bedrock model calls are CloudTrail management events, logged by default.
# Event history is per region and covers 90 days; repeat for each region you use.
aws cloudtrail lookup-events --region us-east-1 \
  --lookup-attributes AttributeKey=EventName,AttributeValue=InvokeModel \
  --start-time 2026-10-01T00:00:00Z

# Daily spend by service for October
aws ce get-cost-and-usage --time-period Start=2026-10-01,End=2026-11-01 \
  --granularity DAILY --metrics UnblendedCost \
  --group-by Type=DIMENSION,Key=SERVICE

AWS logs InvokeModel, InvokeModelWithResponseStream, Converse and ConverseStream as management events (AWS docs), so check those event names too. For OpenAI, Anthropic and other AI providers, check the usage page in each console for October spikes and unfamiliar models.

What to do now

  1. Revoke at the issuer first. For every key that lived in a platform’s environment variables, revoke or delete it at the provider that issued it (AWS, OpenAI, Anthropic, Stripe, GitHub, your database host). Zeabur’s instruction is the right order: “Revoke the old ones with the service provider first, then create new ones and redeploy” (Zeabur).
  2. Change database passwords inside the database. Changing the environment variable does not change the password the database accepts (Zeabur). Rotate signing keys, encryption keys and session secrets too. For n8n, replace the encryption key and recreate every stored credential.
  3. Recreate platform credentials. Railway asked users to rotate private registry credentials and recreate CLI and CI tokens (Railway). Do the same for any deploy hook or webhook secret.
  4. Check your bills and logs from 1 October onward, or from 1 September if you ran Zeabur dedicated servers. Report unauthorized usage to the provider.
  5. Shrink the blast radius for next time. Give each service its own key with the narrowest scope. Restrict which Bedrock models and regions an IAM policy allows. Set billing alarms and spend limits on every AI provider. Where a platform supports it, use short-lived credentials (for example OIDC federation to AWS) instead of long-lived access keys.

Why this is part of the Vulnpocalypse

The Vulnpocalypse is usually told as a story about AI finding bugs. Black October is the other half: AI usage is now worth stealing. A frontier-model API key converts straight into cash, and Wiz saw resellers test stolen keys within days, which suggests “a robust market for this type of credential” (Wiz). Fireworks, OpenCode and Warp also reported signs of an “agent swarm” attack.

The developer lesson is about where secrets pile up. A hosting platform’s environment-variable store holds every key for every customer in one place. Treat it as a target, give each key the least power it needs, and know how to revoke all of them in an afternoon.

Sources