At least nine AI developer platforms disclosed security incidents in October 2026, several exposing stored AI keys

An environment variable is a named setting that a platform hands to running software, and developers commonly use them to store passwords and API keys. An API key works like a password for a paid service: whoever holds a copy can run billable requests until the issuer revokes it. Using stolen keys to run or resell AI access is known as LLMjacking. Across October, these platforms each disclosed an intrusion or suspected intrusion. What each company itself said is set out below, and the entries differ widely in detail.

Vendor and dates	Root cause, as the vendor states it	What the vendor says was accessed	Key abuse, per the vendor	Agent-driven attack reported?
Fireworks AI: identified Oct. 6, bulletin Oct. 9	"unauthorized use of internal Fireworks credentials"; how they were obtained is not stated	Environment variables, including API keys and tokens stored as secrets, in evaluation jobs of a limited number of accounts. No evidence detected of access to models, datasets, training data, personal information or inference traffic	Not stated. Still reviewing calls made with exposed credentials	Not in the bulletin. Lin Qiao, in an X reply: "From the behavior, it seems agentic."
Andromeda: began about Oct. 9, identified Oct. 13, published Oct. 20	"we have not yet established the root cause"	"certain Andromeda and customer credentials" in a limited number of accounts. No evidence detected of access to models, datasets or training data	Not stated	No. Calls it part of "an industry-wide attack"
Zeabur: Oct. 14 to 15, report Oct. 19	Long-lived admin credentials "stored in plaintext" and usable from the public internet. How the attacker got them "cannot be confirmed"; a link to Zeabur's August breach is a stated hypothesis	Figures in Reported impact above, plus about 53 production secrets, including a GitHub App private key	One OpenAI key used for about 1,107 image requests, labeled a hypothesis. Attacker calls to Amazon Bedrock with Zeabur's own AWS keys all failed	No claim in the report
Lightning AI: identified Oct. 15	"certain customer credentials were compromised"; how is not stated	Customer environments and connected third-party services, on Studio platform services; GPU rental and managed services excluded	Not stated	No
OpenCode: night of Oct. 16, disclosed Oct. 17	A legacy system, per The Hacker News on the company's statement; entry route not stated	Third-party AI keys saved in hosted Console by 1.4% of Console users. The company's wording is that keys "may have been exposed." The app and command-line tool are excluded	No statement that keys were copied or used, per The Hacker News, though refunds are "underway"	Co-founder Dax Raad: "we basically need agents going 24/7 because that's what they have"
Railway: Oct. 20 to 22, disclosed Oct. 21	Privilege escalation in build infrastructure, then access to credentials for its CI (automated build) system; exploit details withheld	An unauthorized query of encrypted environment variables, with a subset decrypted. At most about 100,000 workspaces. Says no user accounts were logged into; source-code access not ruled out	Not confirmed. An Oct. 26 FAQ explains how to seek refunds for "fraudulent AI spend"	The word "agent" is not used. Says the actor "had access to abliterated models" (models with safety controls removed) and substantial compute
Warp: aware Oct. 23, statement Oct. 26	Exploitation of an unnamed vendor in Warp's infrastructure	Agent logs and telemetry; roughly 1% of users may be affected. Warp has not said whether these held credentials, per BleepingComputer	Not reported	Yes: "an agent swarm," as quoted by BleepingComputer
Command Code: Oct. 28	Not stated. Command Code said only that the incident was "linked to a large-scale distillation attack targeting Anthropic and OpenAI models"	Not stated. It revoked all API keys as a precaution and said it had found no evidence so far that any users were impacted (VibeIncidents transcribing the post)	No user impact found so far, according to Command Code	Not stated
Northflank: Oct. 30	Not disclosed	"Assume all environment variables have been decrypted"	"Users have reported unauthorised use of AI API keys"	No

Whether these are one record is a framing decision. This record groups them because they share a category of victim and a publicly described target, and it treats each as a separate event unless evidence ties them together. The links found so far are partial. Two IP addresses appear in both Zeabur's report and Wiz's list of addresses seen checking or using stolen keys (23.106.46.239 and 31.57.201.201), and Northflank says "similar IP addresses" appear in Wiz's report. Zeabur warns that addresses may be shared by proxy services, that "matching IPs alone cannot confirm it was the same person," and that the link between 31.57.201.201 and its incident "cannot be confirmed." Wiz writes of its indicators: "We do not have evidence that links them directly to the “Black October” attacks mentioned in this blog." Railway says it was part of "a series of attacks," and Andromeda calls its incident "industry-wide." Neither publishes the basis. The root causes the vendors do state differ, and Warp's account involves logs and telemetry rather than stored keys. (Zeabur; Wiz; Northflank; Railway; Andromeda)

Wiz is the main source for the pattern and has commercial and operational interests in it. It sells security products, and its site carries the label "Now part of Google Cloud." Northflank's timeline begins with a Wiz alert and records a request for Wiz incident support. Wiz's article points its customers to advisories, one labeled "overall campaign," that require a login. Its subhead calls the events "A series of agentic attacks." In four places its summary goes further than the vendor text reviewed:

• Wiz says Fireworks, OpenCode and Warp "reported indications of an “agent swarm” attack." Of the three posts it links, only Warp's account, as BleepingComputer quotes it, uses that phrase.
• Wiz says "All public reports" describe hunting stored environment variables with a focus on AI access. Warp reports logs and telemetry, and Andromeda, Lightning AI and Fireworks do not state an AI focus.
• Wiz calls Zeabur's report a "full write-up." Zeabur titles it preliminary.
• Wiz says Zeabur is shutting down "due to this incident." Zeabur gives several reasons (see Consequences).

"Agent swarm" and "distillation" are the vendors' own characterizations. No vendor reviewed has published technical evidence for either. Distillation means training a cheaper model on a stronger model's answers. Railway, OpenCode and Command Code tie their incidents to it. TechCrunch reports that OpenCode did not explain the connection and that some skeptics called the framing an overstretch; researcher Nathan Lambert questioned why key theft would be grouped under that term. Wiz describes token use in its two cases as resembling "resold coding-agent traffic," and one resale site it examined had a page for detecting distillation by its users. (TechCrunch; Lambert; Wiz)

The Cloud Security Alliance published a note on October 23 covering Fireworks, OpenCode and Railway. It says "No vendor has publicly linked these incidents to a single actor," and treats the shared structure as more useful to defenders than attribution. Anthropic's September threat report had already described AI keys stolen from enterprise software vendors and one actor attacking roughly thirty AI companies in about four days. That report predates these disclosures, names none of the nine vendors in the section reviewed, and claims no link to them. (CSA; Anthropic)

"Black October" is also used more broadly in the press, for PHP vulnerabilities and other hacks and, in the New York Post, the Binance theft. This record covers only the nine platform disclosures. (The Guardian; 404 Media; New York Post)

Customer stores an AI key or other secret on a platform
  → platform keeps it for running software (environment variable or saved key)
  → attacker gains platform-side access [route differs by vendor]
       Zeabur:     plaintext admin credentials (source unconfirmed) → clusters,
                   secrets service → platform database
       Railway:    build-system privilege escalation → CI credentials → decryption
       Fireworks:  internal credentials → evaluation-job variables
       OpenCode:   legacy Console system (entry route unknown)
       Lightning:  customer credentials (how obtained unknown)
       Warp:       outside vendor → agent logs, telemetry [no key theft reported]
       Andromeda, Command Code, Northflank: route not published
  → stored secrets are read [confirmed by Zeabur and Railway; believed by Fireworks;
    assumed by Northflank]
  → stolen key is tested, then abused or resold [seen by Wiz in two cases; otherwise
    reported by users or inferred]

Two boundaries are at issue. The first is the one between a platform's internal systems and the secrets it stores for customers. Zeabur gives the fullest account of how that failed: admin tokens with no expiry, created in January 2024 and left out of its post-August rotation, an admin interface reachable from the internet, and backups containing all secrets. Railway says its design limited exposure but that CI credentials let the attacker decrypt a subset. The mechanism for Andromeda, Command Code and Northflank is unknown.

The second boundary is the one between the platform and the company that issued the key. A key copied from a platform keeps working elsewhere until the issuer revokes it. Fireworks told customers that removing a stored secret "does not invalidate the underlying credential," and The Hacker News reports that OpenCode's Console budget cannot cap use of a copied key because Console only sees its own traffic. The diagram groups the vendors for comparison and does not show one attacker moving between them. (Zeabur; Railway; Fireworks; The Hacker News)

Zeabur's shutdown. Zeabur is shutting down, and the October incident is a stated reason but not the only one. Founder Yuanlin Lin's October 17 notice says services begin stopping December 1 and end by December 31. It lists slowing growth as AI makes deployment easier, an architecture that had become hard to maintain, and two security incidents that "made the shortcomings in our security and operations even clearer." It then says: "Following this latest incident, we reassessed what it would take to keep operating and the responsibilities our team could carry. We ultimately decided to wind down." Zeabur's incident report calls the shutdown "an operational decision." iThome reports the same reasons and notes the notice does not address investors. No financial records were available to test the account. Wiz's "due to this incident" shortens this. (Shutdown notice; Zeabur report; iThome)

Customers. Zeabur, Railway, Northflank, Fireworks, OpenCode and Lightning AI all asked some or all customers to replace credentials, work that falls on those customers and is not measured in any source. Railway asked key issuers to revoke keys broadly, so some users saw revocations without being affected; it paused builds and new signups but says running services stayed online. Lightning AI's platform was closed to all users from October 16, with read-only Drive access restored October 28 and other services still pending in its latest update. Some OpenCode users reported that Google suspended their projects. (Railway; Lightning AI; BleepingComputer)

Limits. Total financial loss, the number of abused keys, and the share of exposed credentials used for resale or for distillation are unknown. Exposed credentials also covered services other than AI: Zeabur said 602 of 607 n8n instances it checked kept their encryption key in an environment variable, and Railway advised customers to check GitHub and registry logs. No source reviewed reports the follow-on effects at those customers. (Zeabur; Railway)

All nine vendors acknowledged an incident in some form. These are announced actions; their effectiveness has not been independently checked.

• Fireworks revoked internal credentials and affected keys, including keys it identified as created by the actor, notified affected customers directly and is working with an outside firm. (Fireworks)
• Andromeda disabled compromised accounts, rotated affected keys and engaged outside forensic teams. (Andromeda)
• Zeabur revoked or rotated the credentials used, signed out all users, and accepts loss claims through November 30. It also corrected its August statement that all internal admin keys had been disabled or rotated, calling it "incomplete." (Zeabur; Claims notice)
• Lightning AI revoked identified credentials, closed the platform, is working with an outside firm and advised all users to rotate secrets. (Lightning AI)
• OpenCode emailed affected users and says refunds are underway. (OpenCode; Raad)
• Railway halted builds, notified GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe and others, rolled keys, moved to single-tenant builders and promised a final report. It says it cannot refund AI spend made with stolen keys but will escalate requests to providers. (Railway)
• Warp notified affected users and engaged CrowdStrike, per BleepingComputer. (BleepingComputer)
• Command Code revoked all API keys. (Command Code)
• Northflank patched network policy, requested Wiz incident support, enabled secret rotation by add-on type and turned on audit logs for all customers. Its status page still read "Identified" when retrieved on November 2 UTC, and BleepingComputer's questions had gone unanswered at publication. (Northflank; BleepingComputer)

Key issuers responded to OpenCode's incident in posts on X that TechCrunch cites as their responses. Anthropic's Lydia Hallie said it "revoked Claude API keys we believe were affected," Google's Evan Otero said it blocked exposed keys, and OpenAI's Tibo said credits drawn in the attack would be refunded and pointed to its Daybreak Blue defensive program. Raad said AI models used in the investigation "started refusing" mid-incident before OpenCode received that access. (Anthropic staff; Google staff; OpenAI staff; Raad; TechCrunch)