A research report published by Wiz on October 30, 2026 connects the security incidents disclosed by nine AI developer platforms during October. The platforms listed are Fireworks AI (October 6), Andromeda (October 9), Zeabur (October 14), Lightning AI (October 15), OpenCode (October 16-17), Railway (October 20), Warp (October 23), CommandCode (October 28) and Northflank (October 30). Wiz calls it a "Black October" for AI developer platforms.
The attackers were after stored credentials
The disclosed root causes differ: Fireworks AI, Zeabur and Lightning AI all pointed to credential access, Railway believed the initial access came through privilege escalation in its build infrastructure, Warp suspected a third-party vendor dependency, and OpenCode blamed a legacy system. But Wiz notes a common thread in the public reports: the attacks were described as deliberately hunting for environment variables stored on the platforms, with a focus on credentials that grant access to AI services. Fireworks AI, OpenCode and Warp also reported signs of an "agent swarm" attack, while OpenCode and CommandCode explicitly attributed their incidents to theft aimed at "distillation". Wiz stresses that no single vulnerability or dependency links these attacks.
The monetisation chain for stolen keys is already running
What gives the report its weight is the follow-on abuse. Wiz observed two stolen enterprise keys being probed within 30 minutes of the reported credential exposure, then used for large-scale calls to cloud models: one key generated about 800,000 Bedrock calls in roughly 30 hours, the other about 1.7 million calls in roughly 13 hours, and the two cases together likely ran up more than $100,000 in usage at list prices. Wiz also linked the use of these keys to openly operating model-resale sites, while saying it could not definitively establish a relationship between the resellers and the original intrusions. For teams using these platforms, the immediate steps are concrete: rotate any potentially exposed keys, tighten what each key is allowed to call and where, and check logs for anomalous usage. Waiting for the platforms' full investigation findings before acting would be too late.
