Nine AI platforms fell in October — thieves resold their users' keys

Wiz's October 30 “Black October” roundup counts nine AI developer platforms that disclosed security incidents during the month, from Fireworks AI on October 6 through Northflank on October 30, including OpenCode, Railway and Warp — and every public report describes attackers hunting stored environment variables, above all the keys that unlock AI models.

Wiz traced downstream abuse of two enterprise Amazon Bedrock keys back to one vendor breach: the first unauthorized call landed within 30 minutes of the reported credential access, then came the floods — about 800,000 calls in 30 hours in one case and about 1.7 million in 13 hours in the other, together over $100,000 at list price, in traffic that looks like resold coding-agent usage.

No single actor or vulnerability links all nine: Fireworks, OpenCode and Warp reported signs of an “agent swarm” attack, Zeabur says it will shut down over its incident, and Wiz found resale operations it calls “momo” and “Xingjiabi” holding the abused keys — the target, month after month, is the key itself.