al-ice.ai

Nine Platforms, One Shopping List: Northflank Closes Wiz’s “Black October” as Stolen Keys Burn 2.5 Million Bedrock Calls

Agent & Supply Chain Security by al-ice.ai Editorial

At 13:58 UTC on 30 October 2026, Northflank’s status page replaced “Investigating” with “Identified” and printed the sentence every platform dreads writing: “Assume all environment variables have been decrypted. Disable/rotate all keys.” Within hours, users were confirming that AI API keys stored on the platform had already been used without authorization. Northflank became the ninth AI developer platform to disclose a security incident in October — and on the same day, Wiz Research published the synthesis that connects them. “Black October for AI Developer Platforms,” by Benjamin Read and Rami McCarthy, argues there is no single vulnerability or shared dependency behind the month’s breaches. There is something simpler: attackers hunting stored environment variables, with a special appetite for AI credentials, feeding a resale market that makes each theft monetizable within hours. We read the Wiz report, the Northflank status page, and a detailed public timeline of the Northflank incident first-hand.

Northflank’s timeline, as its status page tells it

The sequence is unusually transparent about response mechanics and unusually silent about cause. At 11:43 UTC Wiz sent a threat alert; Northflank engineers reviewed it within a minute. Network policy patches went out at 12:02 and 12:50, Wiz’s incident-response team (CIRT) was called in at 13:00, and by 13:40 the page said “Rotate environment variables immediately.” The 13:58 update escalated to assumed decryption of everything: workload secrets, secret groups, and global secrets, plus a request to disable public access on addons. At 15:12 Northflank enabled emergency secret rotation for Postgres and MongoDB addons for all users, noting that multiple users were confirming their AI keys had been used. Audit logs were opened to all customers including free tiers on 31 October, with MySQL, Redis, MinIO, and RabbitMQ rotation following through the day. As of the morning of 1 November, networking, certificates, services, addons, jobs, builds, and logs remained in major-outage state while the app and API showed operational.

What the page does not say matters as much as what it does. As of the 31 October 23:31 UTC update there is no published root cause, no list of affected projects or regions, and no statement separating BYOC customers — whose workloads run in their own VPC — from the rest. The 23:38 update links the AI-key abuse only softly, calling it “consistent with the broader pattern of attacks targeting AI credentials” and pointing at Wiz’s research. Treat the BYOC question as open: if you run Northflank BYOC, rotate anyway until the company answers directly.

Wiz’s nine, and the pattern across them

Wiz counts, by date: Fireworks AI (6 Oct), Andromeda (9 Oct), Zeabur (14 Oct), Lightning AI (15 Oct), OpenCode (16–17 Oct), Railway (20 Oct), Warp (23 Oct), CommandCode (28 Oct), and Northflank (30 Oct). The self-descriptions rhyme: Fireworks, OpenCode, and Warp each reported signs of an “agent swarm”; Andromeda called its incident part of an “industry-wide attack”; OpenCode and CommandCode attributed theirs to attempted distillation. Stated root causes so far are all credential-shaped — Fireworks, Zeabur, and Lightning attribute theirs to credential access; Railway’s preliminary report says “privilege escalation in our build infrastructure”; Warp points at a third-party vendor; OpenCode at a “legacy system.” Zeabur published a full write-up and is shutting down over the incident; Railway published a preliminary report and timeline.

Wiz’s thesis is that the absence of a common vulnerability is the finding. Every public report describes targeted exploitation explicitly hunting stored environment variables, weighted toward AI access. That picture aligns, Wiz argues, with three background conditions: agentic attack tooling that lets intruders move faster, a mature LLMjacking economy with brokers ready to resell stolen inference access, and distillation demand — notably alleged against Chinese AI labs — that gives model weights and outputs a second market. We have covered several of these incidents individually — Railway’s environment-variable breach, Zeabur’s plaintext-credential shutdown, OpenCode’s distillation-attributed console breach plus its silent MCP OAuth RCE fix, Warp’s vendor-attributed breach, and Fireworks’ evaluation-jobs secrets breach — and this briefing deliberately does not relitigate them. What is new here is the downstream evidence: Wiz could watch what stolen enterprise keys did after they left the breached vendors.

Two keys, roughly 2.5 million calls

Both traced keys opened the same way: a single InvokeModel from a residential IP, inside a one-minute sweep testing stolen keys across multiple organizations. The call asked for Claude Fable 5.1, failed, and fell back to Opus 5.5, which worked — a capability probe, not yet theft. Then days of near-silence: 14–120 calls a day from the same small Go client, the two keys moving in lockstep about a minute apart, which Wiz reads as one ongoing job checking the keys were still valid.

Case A detonated four days after validation. A rotating proxy pool ran a catalog probe — one call per model across Amazon Nova, DeepSeek, gpt-oss, GLM, Kimi, Grok, GPT-6 Astra, and older Claude models; everything worked except Fable. Hours later a boto3 script on a residential address enumerated Bedrock and EC2 quotas, a second host mapped quotas and model availability across regions at over a thousand calls a minute, and bulk traffic began 22 seconds after that. Over thirty hours the actor made approximately 800,000 Bedrock calls at ~90% success, first from the residential address, then overnight from a Level 3 hosting address. The key permitted global.* cross-region inference profiles, and the actor routed everything through them — spreading load across regions so only ~6% of calls throttled. Three quarters of successful calls were Opus models, led by Opus 5 (36%), Opus 5.5 (22%), and Opus 4.8 (10%).

Case B was a restricted key and therefore a slower burn with a hotter ending. Seven days after validation it surfaced in an apparent reseller pool: thousands of failed calls from rotating hosting addresses, failing because the pool requested global.* while the key allowed only us.* profiles. A checker on a shared VPN exit found the working us.* model IDs; two hours later the same boto3 script down to the version string that had probed Case A retested both profile scopes and enumerated quotas — and within minutes the floodgates opened. Over thirteen hours, a single Level 3 address made approximately 1.7 million Bedrock calls, over a million successful, nearly all the rest throttled against regional quotas. Traffic spread across a dozen Claude models, led by Opus 5.5, Sonnet 4.5, and Opus 5. Combined, the two cases ran up what Wiz prices at over $100,000 in usage at list price, and the token profile — a few uncached input tokens per typical call (the signature of prompt caching) with a long tail of tens of thousands (many distinct end users) — reads exactly like resold coding-agent traffic.

The resale layer, with receipts and caveats

Wiz names two resale operations that handled the traced keys, with an explicit caveat it repeats twice: it cannot definitively tie either operation to the initial compromises or to the flood traffic — but both had the stolen keys on their infrastructure. The first, self-styled “momo,” centers on 23.106.46.239: infrastructure tied to the overt resale site llm-routing.com (discounted frontier-model access, USDT accepted), key checks on both case keys from 26–29 October, and an attempted PutAccountDataRetention call with the Case B key. The same IP hosted an Artex landing page on 8 October — artex.nhhh.de, titled “ARTEX — autonomous penetration testing console” — four days before Zeabur’s timeline places that IP against its infrastructure (12–14 Oct), and Zeabur publicly named the address as part of its compromise. The second, “Xingjiabi” at xingjiabiapi.org (infrastructure at 38.246.114.118, resolving since 10 September), enumerated the Case A key’s inference profiles region by region and manually tested the Case B key — in both cases after the high-volume abuse had already begun, which is what an active resale market looks like. Amusingly, the Xingjiabi operators appear to be guarding against distillation themselves, with a snapshotted page for distillation-behavior detection scoring users high-risk, watch, or normal. Wiz publishes four checker IPs with date ranges plus the shared-proxy ASNs seen in the floods; defenders should ingest the IOC table from the report rather than this briefing.

What to do

  • If you used any of the nine platforms, rotate in monetization order. AI provider and inference keys first (abuse was confirmed within hours at Northflank), then payment and billing keys, then database and cloud credentials. Check provider-side usage logs for the days before each incident disclosure — Wiz’s validation sweeps ran days ahead of the floods.
  • Scope Bedrock keys to the narrowest inference profiles that work. Case B’s us.*-only key forced the reseller pool through days of visible failure; Case A’s global.* key let the actor dodge throttling to 6%. Regional scoping does not prevent theft, but it measurably slows monetization and buys detection time.
  • Alert on the validation signature, not just the flood. One cheap probe from a residential ASN, a model-availability sweep (including a model that fails), then a days-long trickle of tiny prompt-cached calls in lockstep — that is the shape of stolen-key verification. Quota-enumeration scripts and catalog probes across vendors are the escalation signal.
  • Price your detection in dollars per hour. Case B moved 1.7 million calls through one address in thirteen hours. Spend caps, per-key budgets with hard stops, and CloudTrail alarming on quota-enumeration APIs turn a six-figure incident into a paging event.
  • Stop storing long-lived plaintext-adjacent secrets on shared build platforms. The month’s through-line is not a bug class but an architecture: one platform holding every customer’s environment variables pays off every break-in many times over. Short-lived credentials, customer-held secret managers, and IAM roles the customer can revoke are the structural fix — Zeabur’s shutdown is the cost of learning it late.

Our verification was read-only: we read the full Wiz report including both case timelines, the resale-infrastructure section, and the IOC table; the complete Northflank status-page incident history including the UTC timeline and rotation updates; and a full public timeline article quoting that status page. BleepingComputer’s Northflank coverage would not render past its outage page from our network and is carried by URL only. We accessed no platform infrastructure, rotated no keys, and contacted no vendor.

Sources: