Northflank breach: assume all environment variables stolen, rotate AI API keys now

Northflank, a platform that runs developers' apps and databases, told customers on 30 October 2026 to assume that every environment variable stored on it was decrypted and to rotate all keys. Several customers have since reported that AI API keys they had given the platform were used without their permission. It is the latest of at least nine incidents at AI developer platforms in October that Wiz groups under the name "Black October".

Key points

• Northflank's status page says Wiz alerted it at 11:43 UTC on 30 October 2026; the guidance since 13:58 UTC has been "Assume all environment variables have been decrypted. Disable/rotate all keys."
• Multiple customers reported unauthorised use of AI API keys stored on the platform, according to Northflank's updates and BleepingComputer.
• Northflank has not said how the attacker got in or how many customers are affected, and its investigation is ongoing.
• Wiz lists nine October incidents at AI developer platforms, from Fireworks AI (6 October) to Northflank (30 October), but says no single vulnerability links them and it does not attribute them to one actor.
• Wiz estimates that two stolen enterprise cloud keys alone ran up more than US$100,000 of Amazon Bedrock usage at list price.

What to do

If you ever stored a secret on Northflank (in a workload, a secret group or a global secret), treat it as exposed, whatever it is.

1. Rotate everything stored on the platform. Northflank asks customers to rotate secrets in workloads, secret groups and global secrets, then update the affected workloads.
2. Revoke at the source. For credentials you supplied (AI provider keys, cloud keys, tokens), revoke them with the issuing provider, create replacements and put those into Northflank. Changing the value only inside Northflank does not cancel the old key.
3. Database add-ons. Northflank has enabled secret rotation for PostgreSQL and MongoDB, and, from 31 October at 13:34 UTC, for MySQL and Redis. If an add-on is reachable from the public internet, disable public access.
4. Check your AI bills. Review usage and billing logs at each AI provider for calls you did not make, such as unfamiliar models, regions or sudden spikes. Report suspicious use to Northflank support and to the provider.
5. Turn on audit logs. Northflank enabled audit logs for all customers, including free accounts, at 01:04 UTC on 31 October.

What happened

According to the incident page on Northflank's status site, a Wiz threat alert reached Northflank at 11:43 UTC on 30 October. Its engineers looked at it a minute later and shipped a network-policy patch at 12:02 UTC, with further patches at 12:50 and 13:05 UTC. It asked Wiz's incident response team for help at about 13:00 UTC.

At 13:40 UTC the page told users to rotate environment variables immediately. By 13:58 UTC the status was "Identified", and the advice was to assume all environment variables had been decrypted. At 15:12 UTC the page said multiple users had confirmed that their AI keys had been used. At 19:28 UTC the investigation was ongoing with no further confirmed findings, and at 23:38 UTC users were reporting unauthorised use of AI API keys, which Northflank tied to the wider "Black October" attacks on AI credentials.

BleepingComputer, which reported the story on 31 October, said it asked Northflank about the impact and whether stored credentials were accessed, and had no reply when it published. The article does not name the AI providers whose keys were used.

Background

Environment variables are where most apps keep secrets: database passwords, cloud credentials, tokens and AI keys. A platform that runs your code has to hold them in a form it can decrypt, so a break-in at the platform can expose them all at once.

Wiz's write-up, "Black October for AI Developer Platforms", lists these incidents:

• Fireworks AI (6 October)
• Andromeda (9 October)
• Zeabur (14 October)
• Lightning AI (15 October)
• OpenCode (16 to 17 October)
• Railway (20 October)
• Warp (23 October)
• CommandCode (28 October)
• Northflank (30 October)

We covered two of them as they happened: Railway's warning that an attacker may have read customers' environment variables and the OpenCode breach, where provider keys saved in its console may have been stolen.

Wiz says the reported causes differ: credential access at Fireworks, Zeabur and Lightning AI, privilege escalation in build infrastructure at Railway, a third-party vendor dependency at Warp, and a "legacy system" at OpenCode. Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, and OpenCode and CommandCode attributed theirs to distillation, according to Wiz. Wiz states that no single vulnerability or dependency links the incidents.

The numbers

Wiz observed two stolen enterprise keys being abused against Amazon Bedrock, the practice often called LLMjacking. In "Case A" it saw about 800,000 Bedrock calls over roughly 30 hours, about 90% of which succeeded and about 6% of which were throttled. In "Case B" it saw about 1.7 million calls over 13 hours, of which more than a million succeeded. Wiz says Opus models made up three quarters of successful calls in Case A, and that a mix of Opus 5.5, Sonnet 4.5 and Opus 5 made up three quarters in Case B.

Case B (about 13 hours)1.7

Case A (about 30 hours)0.8

Amazon Bedrock calls made with two stolen keys (Wiz, approximate) (million calls)

	million calls
Case B (about 13 hours)	1.7
Case A (about 30 hours)	0.8

Source: Wiz, Black October for AI Developer Platforms

Together that is about 2.5 million calls, which Wiz estimates ran up more than US$100,000 at list price. Wiz says it linked the keys to two resale operations, named "momo" and "Xingjiabi", but cannot tie either to the original break-ins. In its view, several actors using the keys points to an active market for stolen AI credentials. Wiz does not say these two cases came from Northflank, so we do not either.

What it means

For developers, the lesson is blunt: a key stored with a hosting platform is only as safe as that platform. Rotation is cheap before an incident and painful during one. Give each key the narrowest scope you can, set spending limits and alerts at the AI provider, and keep separate keys per project so one leak does not hand over everything.

For platforms, the pattern in October is a string of disclosures about stored secrets. Customers will reasonably ask how those secrets are encrypted, who inside the company can decrypt them, and whether usage alerts exist. Northflank's quick move to enable audit logs for free accounts too is one answer, though it came after the fact.

For AI providers, stolen keys turn into someone else's bill, and the providers are often the ones who see the abuse first. Wiz's Bedrock figures show how quickly it can scale: hundreds of thousands of calls in a day.

What we don't know yet

• How the attacker got into Northflank, and whether the break-in is linked to the other eight platforms. Wiz says it does not attribute them to one actor.
• How many customers and how many keys are affected. Northflank has not said.
• Whether anything beyond AI keys was stolen or used. Northflank tells customers to assume all environment variables are compromised, but only AI key misuse has been confirmed.
• Which AI providers' keys were abused. BleepingComputer's report does not name them.

What to watch next

Watch Northflank's status page for the root cause and the final scope, and for any change to its guidance. Watch your own AI provider dashboards for several days after rotating, because stolen keys can be tried late or resold. Also expect further disclosures: Wiz describes the campaign as ongoing, and each platform that stores customer secrets has the same exposure.

Sources

• Northflank incident notice (status page), 30 to 31 October 2026
• Wiz: Black October for AI Developer Platforms
• BleepingComputer: Northflank security breach leads to abuse of customers' AI API keys
• Railway security disclosure, 21 October 2026