--- id: "CMP-202610-black-october-at-least-nine-ai-developer-platforms-railway-n" kind: "campaign" aliases: [] title: "Black October: at least nine AI developer platforms (Railway, Northflank, Warp, OpenCode, Fireworks AI and others) breached to steal stored AI and cloud keys, which are resold and used for LLMjacking" severity: "high" cvss: null epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Railway", "fixed": [], "affected": "secrets stored before the Oct 20, 2026 breach", "ecosystem": "saas"}, {"name": "Northflank", "fixed": [], "affected": "secrets stored before the Oct 30, 2026 breach", "ecosystem": "saas"}, {"name": "Warp", "fixed": [], "affected": "Oct 23, 2026 incident", "ecosystem": "saas"}, {"name": "OpenCode", "fixed": [], "affected": "Oct 16-17, 2026 incident", "ecosystem": "saas"}, {"name": "Fireworks AI", "fixed": [], "affected": "Oct 6, 2026 incident", "ecosystem": "saas"}, {"name": "Lightning AI", "fixed": [], "affected": "Oct 15, 2026 incident", "ecosystem": "saas"}, {"name": "Zeabur", "fixed": [], "affected": "Oct 14, 2026 incident", "ecosystem": "saas"}, {"name": "Andromeda", "fixed": [], "affected": "Oct 9, 2026 incident", "ecosystem": "saas"}, {"name": "CommandCode", "fixed": [], "affected": "Oct 28, 2026 incident", "ecosystem": "saas"}, {"name": "Amazon Bedrock", "fixed": [], "affected": "access keys stored on affected platforms", "ecosystem": "aws"}] ecosystems: [] tags: ["ai-platforms", "campaign", "early-warning", "llmjacking"] not_affected_if: [] published_at: "2026-10-30T00:00:00+00:00" first_seen_at: "2026-10-31T00:39:46+00:00" updated_at: "2026-10-31T00:39:46+00:00" sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-10-31T00:39:46+00:00"}] --- # Black October: at least nine AI developer platforms (Railway, Northflank, Warp, OpenCode, Fireworks AI and others) breached to steal stored AI and cloud keys, which are resold and used for LLMjacking Wiz Research (2026-10-30) ties together a month-long wave of breaches at AI developer platforms: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14, shutting down), Lightning AI (Oct 15), OpenCode (Oct 16-17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28) and Northflank (Oct 30). Several vendors report 'agent swarm' (AI-agent-driven) attacks; OpenCode and CommandCode call it a distillation attempt. Entry points differ (stolen credentials, privilege escalation in Railway's build infrastructure, a third-party vendor at Warp, a legacy system at OpenCode); no single vulnerability links them. Every report says the attackers hunt stored environment variables, especially AI provider keys. Wiz saw enterprise AWS Bedrock keys stolen in one of these breaches tested within 30 minutes, kept alive for days, then resold and flooded with ~800k and ~1.7M Bedrock calls (mostly Claude Opus, over $100k) through LLM reseller sites. Anyone whose secrets sat on these platforms is at risk; about $371k in crypto was reportedly stolen using keys stored in Railway. Attacker identity unknown; one reseller IP also hosted an ARTEX autonomous pentest console. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - saas:Railway affected secrets stored before the Oct 20, 2026 breach fixed ? - saas:Northflank affected secrets stored before the Oct 30, 2026 breach fixed ? - saas:Warp affected Oct 23, 2026 incident fixed ? - saas:OpenCode affected Oct 16-17, 2026 incident fixed ? - saas:Fireworks AI affected Oct 6, 2026 incident fixed ? - saas:Lightning AI affected Oct 15, 2026 incident fixed ? - saas:Zeabur affected Oct 14, 2026 incident fixed ? - saas:Andromeda affected Oct 9, 2026 incident fixed ? - saas:CommandCode affected Oct 28, 2026 incident fixed ? - aws:Amazon Bedrock affected access keys stored on affected platforms fixed ? ## How to check - Check whether your team stored secrets or env vars on Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode or Northflank in October 2026 - In AWS CloudTrail, look for Bedrock InvokeModel from unfamiliar residential or hosting IPs, boto3 calls enumerating Bedrock/EC2 service quotas, sudden use of global.* or us.* cross-region inference profiles, and PutAccountDataRetention calls - Look for any activity from 23.106.46.239 or 38.246.114.118, or references to llm-routing.com, xingjiabiapi.org, momo.skin, direct.465415.xyz or artex.nhhh.de - Review AI provider (OpenAI, Anthropic, Bedrock, others) usage and billing for spikes; Wiz saw a low steady trickle (14-120 calls/day from a small Go client) before the flood - Hashes and other indicators: unknown ## Fix - Rotate and revoke at the provider every key that was stored on any of the affected platforms, starting with AI provider keys, AWS credentials and crypto wallet keys - Restrict Bedrock keys to the regions and inference profiles you use (Wiz's restricted us.* key limited the damage) and set AWS budget and Bedrock quota alarms - Block 23.106.46.239 and 38.246.114.118 - Prefer short-lived, scoped credentials (OIDC/role federation) over long-lived keys stored as platform env vars - Follow each vendor's incident page for root cause and further steps ## Timeline - 2026-10-31T00:39:46+00:00 analyst ## Documents - [describes] Black October: At least nine AI developer platforms breached this month https://news.ycombinator.com/item?id=50311844 - [describes] “Black October” for AI Developer Platforms (Wiz Research) https://www.wiz.io/blog/black-october-for-ai-developer-platforms --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_