# Northflank is the ninth AI platform breach this month. Make a stolen AI key worth less.

> Nine AI developer platforms disclosed breaches in October, and stolen AI keys were resold. How to scope a key so a leaked copy is cheap and loud.

URL: https://www.voirlabs.io/insights/stolen-ai-api-keys-platform-breaches
Author: Moosa Jafri, Full-stack · AI & integrations, Voir Labs (https://www.voirlabs.io/authors/moosa)
Published: 2026-11-01
Tags: AI agents, Security, Startups

An AI provider key stored as an environment variable on a hosting platform is only as safe as that platform, and in October nine of them disclosed incidents. The useful response is to plan for the next leak: make a stolen copy of your key able to do very little, and make its misuse loud within the first hour. This article walks through what attackers did with stolen keys, based on Wiz's investigation, and a small gateway design that limits the damage.

## Nine platforms, one target: the environment variables

On October 30, Wiz published "Black October for AI Developer Platforms", listing incidents at Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Its reading of the public reports: they "highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access." It also says "there is no single vulnerability or dependency linking these attacks".

The platforms' own words point the same way. Railway's October 21 disclosure says an unauthorized party "may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents", and that it believes this "is part of a series of attacks recently targeting platform companies with the aim of compromising AI inference providers." BleepingComputer reported on October 20 that at Zeabur an attacker used "leaked internal credentials stored in plaintext" and stole "over 3.2 million environment variable records". On October 31 it reported Northflank's warning to customers: "Assume all environment variables have been decrypted. Disable/rotate all keys," followed by "Users have reported unauthorised use of AI API keys supplied to the Northflank platform".

One label. Wiz has not confirmed that one group is behind all nine incidents, and Northflank has not said how attackers got in.

## A stolen key goes quiet for days before the flood

Wiz traced two enterprise Amazon Bedrock credentials that had been stolen through vendor breaches. Its timeline is the most useful part of the report, because it shows when a defender could have noticed.

- **Validation.** The first unauthorized activity on both keys came "within 30 minutes of the reported credential access within the vendor breach": a single InvokeModel call from a residential address, part of a sweep that tested stolen keys across organizations.
- **The quiet period.** Afterwards both keys saw "only a trickle of traffic: 14–120 calls a day from the same small Go client", which Wiz reads as a job checking that the keys still worked.
- **The probe.** On the first key, four days after validation, a proxy pool sent "one call per model across vendors": Amazon Nova, DeepSeek, gpt-oss, GLM, Kimi, Grok, GPT-6 Astra and older Claude models.
- **The flood.** Over thirty hours the first key made about 800,000 Bedrock calls, about 90% of them successful. The second made about 1.7 million in thirteen hours, over a million successful. Wiz estimates the two "likely ran up over $100k in usage" at list price, and says the traffic looked like "resold coding-agent traffic."

Two numbers are worth putting side by side. By our arithmetic, 1.7 million calls in thirteen hours is about 36 calls a second; during the quiet period the same key made at most 120 a day. And the probe asked for models across several vendors in one sweep. If an app only ever calls one or two models, a request for any other model is a signal that arrives days before the bill.

## The restricted key held for four hours

The second key in Wiz's report was scoped. Its policy allowed Bedrock "only through us.* cross-region inference profiles", and the reseller pool that picked it up asked for global.* profiles. For four hours, thousands of calls failed. Then a checker found the model IDs that worked, and the flood began.

That's the honest lesson on scoping. A narrow policy cost the attacker time and produced thousands of failed calls that someone could have alerted on. It didn't stop the abuse, because the allowed path was still worth money. Scope is a delay and an alarm; a ceiling on volume is what limits the bill.

## Keep the provider key in one place you run

Our approach for a team with several apps calling a model: the provider key lives only in a small gateway you operate, and each app gets its own token for that gateway. The app token is what sits in the hosting platform's environment variables. A sketch of how we would write the gateway's admission check, in TypeScript:

```ts
type AppPolicy = {
  models: Set<string>;  // the exact model IDs this app uses
  callsPerHour: number; // near normal use, far below the quota
};

const policies = new Map<string, AppPolicy>([
  ["support-bot", { models: new Set(["your-model-id"]), callsPerHour: 600 }],
]);

const usage = new Map<string, { hour: number; calls: number }>();

// Returns null to admit; the gateway then adds the provider key.
export function admit(appId: string, model: string): string | null {
  const policy = policies.get(appId);
  if (!policy) return "unknown app";
  if (!policy.models.has(model)) {
    alert(appId, `asked for ${model}, which it never uses`);
    return "model not allowed";
  }
  const hour = Math.floor(Date.now() / 3_600_000);
  const seen = usage.get(appId);
  const calls = seen?.hour === hour ? seen.calls + 1 : 1;
  usage.set(appId, { hour, calls });
  if (calls > policy.callsPerHour) {
    alert(appId, `${calls} calls this hour`);
    return "over hourly ceiling";
  }
  return null;
}

declare function alert(appId: string, why: string): void;
```

Notice what a stolen app token is worth here. It reaches one model, so a catalog probe like the one in Wiz's report fails on its first unfamiliar model and pages someone. And at 36 calls a second, a ceiling of 600 calls an hour is reached in under twenty seconds, by our arithmetic, so a flood stops at the ceiling instead of running for thirteen hours. Set the ceiling from your own usage, with headroom for your busiest hour.

Because the gateway is yours, revoking a leaked app token takes one change, and the provider key never needs to rotate across every app at once.

## Where this costs you

The gateway is now the secret worth stealing, so it doesn't belong on the same shared platforms. Run it where you already keep production secrets, and give it the cloud's short-lived credentials where your provider supports them, rather than a long-lived key in a variable.

It adds a hop to every model call and one more service to keep up. Ceilings set too tight will block a real traffic spike, which means a support bot going quiet on your busiest day; start with alerts only and turn on blocking once you trust the numbers. And none of this replaces rotation. If your keys sat on any of the nine platforms, rotate them now and check your provider's billing for October.

If you run one app with one key and little traffic, skip the gateway. Give the key the narrowest model scope your provider allows, set a spending alert, and keep it off shared hosting.

## What to take from Black October

1. Treat every AI key in a hosting platform's environment variables as exposed the day that platform discloses a breach, and rotate it that day.
2. Scope each key to the models it uses. Wiz's restricted key bought four hours and thousands of failed calls.
3. Alert on the two signals in Wiz's timeline: a request for a model the app never uses, and calls far above the usual hour.
4. Cap volume per app, because a scoped key can still be drained through its allowed path.

If you want a second opinion on where your AI keys live and what a stolen one could reach, [book a conversation](https://calendly.com/voirlabs/30min).

## Sources

- Wiz Research, "Black October for AI Developer Platforms", Benjamin Read and Rami McCarthy, October 30, 2026: https://www.wiz.io/blog/black-october-for-ai-developer-platforms
- Railway, "Security Disclosure: Wednesday October 21st", Jacob Cooper, October 21, 2026: https://blog.railway.com/p/security-disclosure-wednesday-october-21st
- BleepingComputer, "Northflank security breach leads to abuse of customers' AI API keys", Lawrence Abrams, October 31, 2026: https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/
- BleepingComputer, "Zeabur shutting down after second security breach in two months", Bill Toulas, October 20, 2026: https://www.bleepingcomputer.com/news/security/zeabur-shutting-down-after-second-security-breach-in-two-months/

---

Voir Labs is an AI-first design and development studio (https://www.voirlabs.io/). Related service: https://www.voirlabs.io/services/ai-automation. Book a 30-minute conversation: https://calendly.com/voirlabs/30min