At least nine AI developer platforms disclosed security incidents in October 2026, and attackers were hunting the same prize in every case: stored AI keys. Cloud security company Wiz grouped the incidents under the name “Black October” in a research post published October 30, documenting how stolen credentials moved from breached platforms into enterprise cloud accounts within 30 minutes.

The nine incidents

Wiz lists the platforms in disclosure order: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16-17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28) and Northflank (Oct 30). Each disclosure describes unauthorized access to systems holding customer credentials, most often environment variables or build artifacts carrying AI provider keys, TSN’s summary notes.

“All public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access,” Wiz researchers Benjamin Read and Rami McCarthy wrote. They were careful to add that “there is no single vulnerability or dependency linking these attacks.” The entry points varied: plaintext admin credentials at Zeabur, build infrastructure at Railway, a vendor dependency at Warp. The Cloud Security Alliance echoed that assessment, noting that no vendor has publicly linked the incidents to a single actor.

Fact card listing the nine AI developer platforms breached in Black October

Agent swarms and distillation

Some of the incidents look like AI attacking AI. Fireworks, OpenCode and Warp all reported indications of an “agent swarm” attack, while OpenCode and CommandCode explicitly attributed their incidents to attempted “distillation,” using another model’s outputs to help train a model, Wiz reports. Andromeda described its incident as part of an “industry-wide attack.”

Lightning AI had been hit before: Wiz notes it was previously impacted by a supply chain attack within the Mini-Shai Hulud campaign. Wiz researcher Rami McCarthy said on X that the list kept growing while the report was being written, with “two more disclosed incidents” appearing during drafting.

Thirty minutes to resale

Wiz’s most concrete findings come from tracking two stolen enterprise keys whose theft it could attribute to one of the vendor breaches. In both cases, the first unauthorized activity came within 30 minutes of the reported credential access: a single model call from a residential IP address, part of a one-minute sweep testing stolen keys across multiple organizations. The call asked for Claude Fable 5.1, failed, and fell back to Opus 5.5, which worked.

What followed was patience, then scale. For several days each key saw only 14 to 120 calls a day, running about a minute apart from the same small Go client, which Wiz reads as an ongoing check that the credentials still worked. Then came the flood: Case A made about 800,000 calls to Amazon Bedrock over 30 hours, roughly 90% succeeding, with Opus models making up about three quarters. Case B ran about 1.7 million calls over 13 hours, with over a million successful. At list price, Wiz estimates the two cases “likely ran up over $100k in usage.”

The keys also fed a resale market. Wiz linked them to two overt operations, “momo” and “Xingjiabi,” that advertise discounted access to frontier models. “The use of the keys by multiple actors suggests a robust market for this type of credential,” Wiz writes.

Fact card on stolen key abuse: 30-minute validation, 800k and 1.7M Bedrock calls, over $100k in usage

What it means for developers

The practical lesson is blunt: deleting a secret from a platform does not cancel it. Keys must be revoked with the provider that issued them, and teams should check AI usage and billing for calls they cannot explain. Railway told customers to rotate any sensitive environment variable set before October 21 and said at most 1.85% of its workspaces, about 100,000, had environment variables potentially compromised, as reported. OpenCode’s breach reached about 1.4% of Console users, according to TSN. Zeabur went further than any of the others: the company said it is shutting down, with all servers off by December 31, citing the incident as a contributing factor.

For businesses paying AI bills, Wiz’s two cases put a number on the risk: one compromised key, silently resold, can turn into a six-figure usage bill before the vendor’s disclosure even goes out. Spending caps, per-project keys and alerts on unusual model use are cheap insurance by comparison.

Sources