Northflank is the ninth AI dev platform breached in October

Northflank, a platform developers use to host and run applications, told customers on October 30 to assume that every environment variable they kept on it had been decrypted, and to rotate every secret. The warning came after several users said AI API keys stored on the platform were being used by someone else. Northflank has not said how the attackers got in, how they got past its encryption, or how many customers are affected.

The same day, Wiz researchers Benjamin Read and Rami McCarthy published a report that puts Northflank ninth on a list of AI developer platforms that disclosed breaches this month. Wiz calls it "Black October." The list is Fireworks AI (October 6), Andromeda (October 9), Zeabur (October 14), Lightning AI (October 15), OpenCode (October 16 to 17), Railway (October 20), Warp (October 23), CommandCode (October 28) and Northflank (October 30). The causes differ from one platform to the next. Fireworks, Zeabur and Lightning point to credential access, Railway to privilege escalation in its build systems and Warp to a third-party dependency. What the attackers wanted was the same: stored environment variables holding keys for paid AI models.

Why it matters to IT buyers

A model key kept on one of these platforms draws on the company's own AI bill. Wiz followed two stolen enterprise Amazon Bedrock keys. The first, whose policy allowed global cross-region inference profiles, made about 800,000 Bedrock calls in roughly 30 hours. About 90% of them worked, and roughly three in four of the successful calls went to Opus models. The second key was limited to us.* profiles. One address used it for about 1.7 million calls in about 13 hours, and more than a million went through before the key was shut off. Wiz estimates the two cases likely cost more than $100,000 at list price. In both, the first test call came within 30 minutes of the reported breach at the vendor. Wiz also found two sites reselling cheap access to frontier models, and both had tested the stolen keys.

What Northflank customers should rotate

According to Northflank's status page, as reported by StartupHub.ai, workload secrets, secret groups and global secrets are all in scope. Work through them in this order:

1. Revoke each AI key (OpenAI, Anthropic, Amazon Bedrock and any other provider) at the provider that issued it, then create a new one. Deleting the variable on Northflank does nothing to the key itself. Fireworks made the same point in its own notice: removing a stored secret does not invalidate the credential behind it.
2. Rotate the cloud keys and database passwords your workloads read from Northflank. BleepingComputer reported that Northflank has added tooling to reset PostgreSQL, MongoDB, MySQL and Redis credentials.
3. If any Postgres or MongoDB addon was open to the public internet, close that access, then rotate its secrets.
4. Read the audit logs Northflank has now switched on for every account, free accounts included.
5. Check each AI provider's usage and billing pages for spikes around or after October 30, and look back to October 1 to match the CloudTrail search below.

What to search for in AWS

Bedrock writes InvokeModel, InvokeModelWithResponseStream, Converse and ConverseStream to CloudTrail as management events, which are logged by default, Rajesh Beri notes in a guide built on Wiz's findings. Search every Bedrock account from October 1 for the four addresses Wiz lists: 23.106.46.239, 38.246.114.118, 104.243.32.50 and 31.57.201.201. Wiz says these are not definitively tied to the October breaches, so a hit is a lead, not proof. Other signs to look for are global.* profile requests from a key that normally stays in one region, quota enumeration from boto3 user agents, and failed calls followed a few seconds later by a switch to another model. CloudTrail logs the IAM identity behind a Bedrock API key, not the key, so give each outside platform its own identity.

What IT teams should do

1. Ask engineering leads whether any of the nine platforms runs your deployments, eval jobs or preview environments, counting personal accounts used for work.
2. For every platform on that list, revoke and reissue each secret it could read, even if the platform never sent you a notice.
3. Run the CloudTrail search on every Bedrock-enabled account, and set a separate Bedrock quota and invocation alarm for each outside platform.
4. If you run on Zeabur, plan the move now. It will shut down by December 31, and shared clusters pause on December 1.
5. Before the next renewal, ask each platform how stored secrets are encrypted, which staff or systems can decrypt them, and if it supports workload identity federation in place of static keys.

Railway customers can follow our Railway secrets guide, and our GhostAction story covers rotating secrets stolen from CI pipelines.

Sources: Wiz, "Black October" for AI Developer Platforms (October 30), Runtime Wire, StartupHub.ai, Tech Bytes, citing BleepingComputer, The Daily Brief, AICoder.