Black October: nine AI developer platforms disclosed credential breaches
Black October is Wiz's name for a run of nine October breaches at AI developer platforms that held customers' model provider keys.
· Wiz · Research by Benjamin Read, Rami McCarthy
Wiz counted nine AI developer platforms that disclosed credential breaches in October 2026, and traced two enterprise key compromises to Amazon Bedrock abuse worth more than $100,000 in list-price usage.
01What happened
Wiz researchers Benjamin Read and Rami McCarthy published Black October on October 30, 2026, counting nine AI developer platforms that disclosed security incidents during the month. The post adds Wiz's own observations of what happened to the stolen keys, including two enterprise credential compromises it ties to vendor breaches. Wiz reports the stolen keys were first validated within 30 minutes of the reported credential access.
02How it works
Attackers target the intermediary platform rather than the model provider or the end customer, because build systems and stored environment variables hold provider keys for many tenants at once. A validated key then funds LLMjacking: inference calls billed to the key's owner. The Cloud Security Alliance calls the pattern platform-chain, and notes that no vendor has publicly tied the October incidents to a single actor.
03Who is affected
Customers of the nine platforms listed below are in scope, because each held provider keys on behalf of its users. Railway states that at most 1.85% of its workspaces, about 100,000, had environment variables potentially compromised. The Cloud Security Alliance reports that OpenCode's breach reached a legacy Console system holding OpenAI, Anthropic and Google keys saved by about 1.4% of Console users.
04What to do
Rotate AI provider keys at the issuing provider rather than only on the platform, which is the Cloud Security Alliance's first recommendation. Railway tells customers to rotate any sensitive environment variable set before October 21, remove public network access to databases and review GitHub audit logs. Issue a separate key per platform with a spending cap so one stolen key cannot draw unlimited inference.
Questions people ask
- Which AI developer platforms disclosed a breach in October 2026?
- Wiz lists nine: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Each disclosure describes unauthorized access to systems holding customer credentials, most often environment variables or build artifacts carrying AI provider keys. Wiz does not claim a single actor behind all nine, and the Cloud Security Alliance notes that only Railway has used the word campaign.
- Do I need to rotate my AI provider keys after the Black October breaches?
- Rotate keys at the issuing provider, not only on the platform, if any of the nine listed platforms held them. The Cloud Security Alliance makes that its first recommendation, because a key deleted from a platform dashboard stays valid at the provider. Railway specifically asks customers to rotate sensitive environment variables set before October 21, 2026.
- What did attackers do with the stolen AI provider keys?
- Wiz measured two cases of Amazon Bedrock abuse. One ran about 800,000 calls over roughly 30 hours with about 90% succeeding, and Opus models made up about three quarters of successful calls. The other ran about 1.7 million calls over roughly 13 hours. Wiz names two resale operations, momo and Xingjiabi, that used stolen keys.
Sources 3 links, all fetched
- 1wiz.ioWiz Research
- 2blog.railway.comRailway Report
- 3labs.cloudsecurityalliance.orgCSA Research Note