{"id":"CMP-202610-black-october-at-least-nine-ai-developer-platforms-railway-n","kind":"campaign","aliases":[],"related":["CMP-202610-northflank-paas-ai-app-hosting-platform-breached-attackers-d"],"title":"Black October: at least nine AI developer platforms (Railway, Northflank, Warp, OpenCode, Fireworks AI and others) breached to steal stored AI and cloud keys, which are resold and used for LLMjacking","description":null,"summary":"Wiz Research (2026-10-30) ties together a month-long wave of breaches at AI developer platforms: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14, shutting down), Lightning AI (Oct 15), OpenCode (Oct 16-17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28) and Northflank (Oct 30). Several vendors report 'agent swarm' (AI-agent-driven) attacks; OpenCode and CommandCode call it a distillation attempt. Entry points differ (stolen credentials, privilege escalation in Railway's build infrastructure, a third-party vendor at Warp, a legacy system at OpenCode); no single vulnerability links them. Every report says the attackers hunt stored environment variables, especially AI provider keys. Wiz saw enterprise AWS Bedrock keys stolen in one of these breaches tested within 30 minutes, kept alive for days, then resold and flooded with ~800k and ~1.7M Bedrock calls (mostly Claude Opus, over $100k) through LLM reseller sites. Anyone whose secrets sat on these platforms is at risk; about $371k in crypto was reportedly stolen using keys stored in Railway. Attacker identity unknown; one reseller IP also hosted an ARTEX autonomous pentest console.","severity":"high","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-10-31T00:39:46+00:00","products":[{"name":"Railway","fixed":[],"affected":"secrets stored before the Oct 20, 2026 breach","ecosystem":"saas"},{"name":"Northflank","fixed":[],"affected":"secrets stored before the Oct 30, 2026 breach","ecosystem":"saas"},{"name":"Warp","fixed":[],"affected":"Oct 23, 2026 incident","ecosystem":"saas"},{"name":"OpenCode","fixed":[],"affected":"Oct 16-17, 2026 incident","ecosystem":"saas"},{"name":"Fireworks AI","fixed":[],"affected":"Oct 6, 2026 incident","ecosystem":"saas"},{"name":"Lightning AI","fixed":[],"affected":"Oct 15, 2026 incident","ecosystem":"saas"},{"name":"Zeabur","fixed":[],"affected":"Oct 14, 2026 incident","ecosystem":"saas"},{"name":"Andromeda","fixed":[],"affected":"Oct 9, 2026 incident","ecosystem":"saas"},{"name":"CommandCode","fixed":[],"affected":"Oct 28, 2026 incident","ecosystem":"saas"},{"name":"Amazon Bedrock","fixed":[],"affected":"access keys stored on affected platforms","ecosystem":"aws"}],"ecosystems":[],"tags":["ai-platforms","campaign","early-warning","llmjacking"],"not_affected_if":[],"how_to_check":"- Check whether your team stored secrets or env vars on Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode or Northflank in October 2026\n- In AWS CloudTrail, look for Bedrock InvokeModel from unfamiliar residential or hosting IPs, boto3 calls enumerating Bedrock/EC2 service quotas, sudden use of global.* or us.* cross-region inference profiles, and PutAccountDataRetention calls\n- Look for any activity from 23.106.46.239 or 38.246.114.118, or references to llm-routing.com, xingjiabiapi.org, momo.skin, direct.465415.xyz or artex.nhhh.de\n- Review AI provider (OpenAI, Anthropic, Bedrock, others) usage and billing for spikes; Wiz saw a low steady trickle (14-120 calls/day from a small Go client) before the flood\n- Hashes and other indicators: unknown","fix":"- Rotate and revoke at the provider every key that was stored on any of the affected platforms, starting with AI provider keys, AWS credentials and crypto wallet keys\n- Restrict Bedrock keys to the regions and inference profiles you use (Wiz's restricted us.* key limited the damage) and set AWS budget and Bedrock quota alarms\n- Block 23.106.46.239 and 38.246.114.118\n- Prefer short-lived, scoped credentials (OIDC/role federation) over long-lived keys stored as platform env vars\n- Follow each vendor's incident page for root cause and further steps","status":"open","published_at":"2026-10-30T00:00:00+00:00","first_seen_at":"2026-10-31T00:39:46+00:00","triaged_at":"2026-10-31T00:39:46+00:00","updated_at":"2026-10-31T00:39:46+00:00","category":"vendor","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-10':71B '-17':105B '-202610':33A '-30':72B '1.7':206B '100k':214B '14':95B '15':101B '16':104B '20':108B '2026':70B '23':111B '28':114B '30':118B,193B '371k':230B '6':89B '800k':204B '9':92B 'agent':122B,126B 'ai':6A,14A,21A,40A,52A,54A,61B,83B,87B,99B,125B,176B 'ai-agent-driven':124B 'ai-platform':60B 'aliv':196B 'also':247B 'amazon':58A 'andromeda':56A,90B 'anyon':219B 'artex':250B 'at':37A 'attack':128B,170B,241B 'attempt':136B 'autonom':251B 'aw':182B 'bedrock':59A,183B,208B 'black':1A,35A,45A 'black-october-at-least-nine-ai-developer-platforms-railway-n':34A 'breach':17A,81B,190B 'build':147B 'call':132B,209B 'campaign':63B 'claud':211B 'cloud':23A 'cmp':32A 'commandcod':112B,131B 'commandcode':57A 'consol':253B 'credenti':141B 'crypto':232B 'day':198B 'develop':7A,84B 'developer':41A 'differ':139B 'distil':135B 'driven':127B 'earli':65B 'early-warn':64B 'enterpris':181B 'entri':137B 'environ':173B 'escal':143B 'especi':175B 'everi':166B 'firework':13A,86B 'fireworks':51A 'flood':202B 'host':248B 'hunt':171B 'ident':242B 'infrastructur':148B 'ip':246B 'kept':195B 'key':24A,178B,184B,237B 'least':4A,38A 'legaci':157B 'lightn':98B 'lightning':53A 'link':164B 'llm':216B 'llmjack':31A,67B 'long':78B 'm':207B 'minut':194B 'month':77B 'month-long':76B 'most':210B 'n':44A 'nine':5A,39A 'northflank':10A,48A,116B 'oct':88B,91B,94B,100B,103B,107B,110B,113B,117B 'octob':2A 'october':36A,46A 'one':187B,244B 'opencod':12A,102B,129B,160B 'opencode':50A 'opus':212B 'other':16A 'parti':152B 'pentest':252B 'platform':8A,62B,85B,225B 'platforms':42A 'point':138B 'privileg':142B 'provid':177B 'railway':9A,43A,47A,106B,145B,240B 'report':121B,167B,234B 'research':69B 'resel':217B,245B 'resold':27A,200B 'risk':228B 'sat':222B 'saw':180B 'say':168B 'secret':221B 'sever':119B 'shut':96B 'singl':162B 'site':218B 'steal':19A 'stolen':140B,185B,235B 'store':20A,172B,238B 'swarm':123B 'system':158B 'test':191B 'third':151B 'third-parti':150B 'tie':73B 'togeth':74B 'unknown':243B 'use':29A,236B 'variabl':174B 'vendor':120B,153B 'vulner':163B 'warn':66B 'warp':11A,49A,109B,155B 'wave':79B 'whose':220B 'within':192B 'wiz':68B,179B 'zeabur':55A,93B","nicknames":["Black October"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-30T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202610-black-october-at-least-nine-ai-developer-platforms-railway-n","url":null,"severity":null,"published_at":"2026-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-31T00:39:46+00:00","fetched_at":"2026-10-31T00:39:46+00:00","note":null}],"documents":[{"id":27128,"url":"https://news.ycombinator.com/item?id=50311844","title":"Black October: At least nine AI developer platforms breached this month","kind":"post","source":"hackernews","publisher":null,"text":"Black October: At least nine AI developer platforms breached this month\nhttps://www.wiz.io/blog/black-october-for-ai-developer-platforms\n\n2 points, 0 comments on Hacker News","published_at":"2026-10-31T00:11:32+00:00","relation":"describes","confidence":null,"note":null},{"id":27004,"url":"https://www.wiz.io/blog/black-october-for-ai-developer-platforms","title":"“Black October” for AI Developer Platforms (Wiz Research)","kind":"blog","source":"blog","publisher":null,"text":"Wiz (Benjamin Read, Rami McCarthy), 2026-10-30. At least nine AI developer platforms disclosed incidents in October 2026: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16-17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28), Northflank (Oct 30). Fireworks, OpenCode, Warp report 'agent swarm' attacks; OpenCode and CommandCode attribute to distillation. Fireworks, Zeabur, Lightning: credential access root cause; Railway: privilege escalation in build infrastructure; Warp: third-party vendor dependency; OpenCode: legacy system. No single vulnerability links them. Attackers hunt stored environment variables, especially AI access keys (LLMJacking). Wiz saw downstream abuse of enterprise AWS Bedrock keys stolen from a vendor breach: first use within 30 minutes, single InvokeModel from residential IP, then low-volume Go-client validation; days later boto3 script enumerated Bedrock and EC2 quotas, then floods of ~800k and ~1.7M Bedrock calls (global.* / us.* cross-region inference profiles), mostly Claude Opus; >100k USD. Attempted PutAccountDataRetention. Resellers: 'momo' at 23.106.46.239 (llm-routing.com, momo.skin, direct.465415.xyz, artex.nhhh.de ARTEX autonomous pentest console Oct 8; named by Zeabur), and xingjiabiapi.org / s3.xingjiabiapi.org at 38.246.114.118 doing key permission checks. Alleged ~371k USD crypto theft via keys stored in Railway.","published_at":"2026-10-30T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}