Nine disclosures in twenty-five days
The cloud security firm Wiz published a count on 30 October of what it calls a “Black October” for AI developer platforms: at least nine platforms disclosed security incidents during the month. Benjamin Read and Rami McCarthy list them with the dates each disclosure landed — Fireworks AI on 6 October, Andromeda on 9 October, Zeabur on 14 October, Lightning AI on 15 October, OpenCode on 16 and 17 October, Railway on 20 October, Warp on 23 October, CommandCode on 28 October and Northflank on 30 October.
The stated root causes differ. Fireworks, Zeabur and Lightning AI point to credential access. Railway describes initial access as “privilege escalation in our build infrastructure”. Warp names a third-party vendor dependency, and OpenCode a “legacy system”. Wiz notes that Lightning AI had previously been hit in the Mini-Shai Hulud supply chain campaign.
What the disclosures share is the target. Wiz writes that all the public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access. Fireworks, OpenCode and Warp reported indications of an “agent swarm” attack; Andromeda called its incident part of an “industry-wide attack”; OpenCode and CommandCode attributed theirs to attempted distillation.
Two keys, two and a half million calls
Wiz traced two enterprise Amazon Bedrock keys that it ties to vendor breaches, and the pattern in both is the same at the start. Each was first validated with a single InvokeModel call within 30 minutes of the reported credential access, then saw 14 to 120 calls a day from one Go client — low enough to pass for nothing.
The first key was unrestricted, with a policy that allowed global.* inference profiles. About four days after validation, an actor probed model availability across vendors and enumerated Bedrock and EC2 quotas. Over roughly 30 hours until remediation it ran about 800,000 calls, about 90% of them successful and about 6% throttled. Opus models accounted for about three quarters of the successful ones.
The second key was restricted to us.* profiles. Seven days after validation it turned up in a reseller pool, with thousands of failed calls over four hours. Then, over roughly 13 hours until remediation, it ran about 1.7 million calls from a single address, more than a million of them successful. Opus 5.5, Sonnet 4.5 and Opus 5 made up about three quarters of the successes. Wiz estimates the two cases alone likely ran up over $100,000 at list price.
A market, not a culprit
Wiz is careful about attribution. It links the key usage to reselling organisations but says it cannot definitively connect them either to the initial compromises or to the flood of abuse.
One operation, which Wiz calls “momo”, had access to both keys from a single address that also hosted LLM resale sites and was named by Zeabur as part of its compromise. A second, “Xingjiabi”, ran permission checks on both keys, sometimes after high-volume abuse had already begun — which Wiz reads as the behaviour of an active resale market. Its site also hosted a “distillation detection” page, which Wiz suggests may be an attempt to avoid suspension. Wiz states plainly that its indicators are not directly linked to the Black October attacks, and draws the narrower conclusion that the use of these keys by multiple actors points to a robust market for such credentials.
What customers were told
The reported impact on users is still anecdotal in Wiz’s account: an alleged theft of about $371,000 in crypto keys stored in Railway, and stolen AI access producing consumer bills in the hundreds to thousands of dollars.
The bluntest instruction came from the last platform on the list. BleepingComputer reported that Northflank disclosed its incident on 30 October after a threat alert from Wiz, and told customers to assume all environment variables had been decrypted and to disable or rotate every key. Multiple users reported their AI keys had been used.
Wiz notes that only Zeabur has published a full write-up so far. Until the other eight do, the common thread — nine platforms, one class of secret, one month — rests on what each company chose to say about itself.
