Northflank Breach Exposes AI Keys: Have You Rotated Your Secrets Yet?

Northflank told customers to assume their environment variables were decrypted after stolen AI API keys were abused. Here's what happened and what to rotate.

TheTechLane cover on a cobalt-blue background with a large TL logo pinned to a white October 2026 wall calendar whose incident dates are stamped in orange, ending on a black-circled October 30, and the headline "Assume your secrets were decrypted. Rotated yet?"

Cloud platform Northflank has told every customer to assume the environment variables they stored on it were decrypted, and some customers say their stolen AI API keys are already being used. The company opened the incident on October 30 after a threat alert from Wiz, and it's still telling users to rotate everything.

Here's what you need to know:

  • Northflank's guidance is blunt: "Assume all environment variables have been decrypted. Disable/rotate all keys."

  • Multiple customers reported unauthorized use of AI API keys they had stored on the platform.

  • Northflank hasn't said how attackers got in or how many customers were affected.

  • Wiz says Northflank is at least the ninth AI developer platform to disclose an incident in October, a run it calls "Black October".

  • In two cases Wiz investigated, stolen enterprise keys drove roughly 2.5 million Amazon Bedrock calls and likely over $100,000 in usage.

UML sequence diagram of the Northflank security incident on October 30-31, 2026 (UTC): Wiz sends a threat alert to Northflank at 11:43, Northflank deploys network patches between 12:02 and 13:05 and asks Wiz incident response for help at 13:00, tells customers at 13:40 to rotate environment variables and at 13:58 to assume all environment variables were decrypted; attackers call AI providers with stolen AI keys, customers report unauthorised key use, and at 23:38 Northflank tells them to revoke, replace and check billing; on October 31 audit logs and add-on secret rotation roll out, while the root cause and number of affected customers remain undisclosed

Inside the Northflank incident, hour by hour (UTC)

What Happened

Northflank is a platform for deploying apps, containers, databases and AI workloads without running the infrastructure yourself. That means it holds a lot of its customers' configuration, including the secrets apps read from environment variables.

According to the timeline on Northflank's security incident status page, Wiz sent a threat alert at 11:43 UTC on October 30, and Northflank engineers reviewed it a minute later. An initial network policy patch went out at 12:02 UTC, more patches followed at 12:50 and 13:05 UTC, and the company asked Wiz's incident response team for help at 13:00 UTC.

The first public notice, at 13:40 UTC, said simply: "Rotate environment variables immediately." Eighteen minutes later it escalated to assuming every environment variable had been decrypted. That covers secrets on workloads, secret groups and global secrets.

By 23:38 UTC, Northflank confirmed that "users have reported unauthorised use of AI API keys supplied to the Northflank platform." It told customers to revoke keys with the issuing provider, generate replacements, update them in Northflank, and check AI usage and billing logs.

Since then, Northflank has switched on audit logs for every customer, including free users, and rolled out secret rotation for Postgres, MongoDB, MySQL, Redis, MinIO and RabbitMQ add-ons. The latest update, at 23:31 UTC on October 31, still asks everyone to rotate.

BleepingComputer's report on the Northflank breach says the company didn't answer its questions about impact or whether stored credentials were stolen.

Why It Matters

Northflank isn't an isolated case. In its Black October report on AI developer platforms, Wiz lists nine platforms that disclosed incidents this month: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank.

There's no single bug tying them together. Wiz says Fireworks, Zeabur and Lightning blamed credential access, Railway pointed to privilege escalation in its build infrastructure, Warp cited a third-party vendor dependency, and OpenCode blamed a legacy system. What the public reports share is attackers hunting stored environment variables, especially those that unlock AI services.

The reason is money. Stolen AI keys can be used for LLMJacking, running models on someone else's account or reselling the access. Wiz traced two stolen enterprise keys: one made about 800,000 Bedrock calls in 30 hours, the other about 1.7 million in 13 hours. The first unauthorized call on both came within 30 minutes of the reported credential theft.

Wiz also found two LLM resale sites whose infrastructure tested the stolen keys, though it says it can't prove they were behind the original breaches. Northflank itself said its customers' reports "may be consistent" with that wider pattern.

We saw the same playbook earlier this month when OpenCode's console breach exposed users' AI API keys.

What It Means for Developers

If you've stored anything on Northflank, treat it as public. And if you use any hosted platform, this is a good week to check how fast you could rotate.

  • Revoke at the source first. Kill each key at its issuing provider (AI, payments, cloud, database), then create a new one. Changing the value only in Northflank doesn't stop a stolen copy from working.

  • Prioritize AI and payment keys. Those are the ones attackers are actively abusing, and they turn straight into bills.

  • Check usage and billing since October 29. Look for traffic from unfamiliar IPs, new models, or calls at odd hours, and report it to Northflank and the provider.

  • Use the new audit logs to look for unusual activity on your account.

  • Turn off public access to add-ons if you'd enabled it, as Northflank recommends.

  • Scope your keys tightly. In Wiz's Case B, a key limited to US inference profiles blocked thousands of calls that asked for global routing. Spend caps and per-project keys limit the blast radius.

Flowchart of the LLMJacking pattern Wiz observed in two cases: a platform breach steals environment variables, a validation call follows within 30 minutes, daily key checks run 14 to 120 calls a day, then a catalog probe sends one call per model; in the cash-out stage the attacker enumerates Bedrock and EC2 quotas and floods the key with about 800,000 calls in 30 hours in case A and about 1.7 million in 13 hours in case B, leading to a likely bill of over $100,000 across the two cases while resale pools test the same keys; the defence is revoking at the provider, tight key scopes, spend caps and billing alerts

How stolen AI keys turn into a six-figure bill

Long-lived, broadly scoped keys sitting in plain environment variables are the common thread. Encrypted, server-side secret storage, like the WordPress 7.2 Secrets API for encrypted API keys, and short-lived credentials are the direction to move in.

What's Next

The big unknowns are still open. Northflank hasn't shared a root cause, how many customers or regions were hit, or whether attackers took anything beyond AI keys.

Watch for a full post-incident report, and for whether other AI platforms join Wiz's list before October's tally is final. Zeabur, one of the nine, has said it's shutting down because of its incident, according to Wiz.

Also watch the AI providers. Spikes in stolen-key traffic put pressure on them to flag anomalies and offer tighter default scopes.

FAQ

Do I need to rotate if I haven't seen any suspicious usage?

Yes. Northflank's guidance applies to all customers: assume every environment variable was decrypted and rotate every secret, whether or not you've seen abuse.

Was this the same attacker as the Railway and OpenCode incidents?

Nobody has confirmed that. Wiz says there's no single vulnerability linking the nine incidents and hasn't attributed them to one group, though many involved attempts to steal AI API keys.

What is LLMJacking?

It's using stolen credentials to run AI models on another organization's account. Attackers either burn through usage directly or resell the access, which leaves the victim with the bill.

Sources

Follow TheTechLane

Keep learning AI, development, and modern developer technologies with TheTechLane.

Learn • Build • Share

Follow @thetechlanehq for more developer guides, tutorials, and practical technology content.