Wiz ties break-ins at 14 AI developer platforms to stolen model keys

Wiz ties break-ins at 14 AI developer platforms to stolen model keys

7 November 2026: Wiz has tied a month of break-ins at AI developer platforms to one goal: the environment variables customers store there, and above all the keys that pay for AI model access. Its researchers count 14 platforms with incidents since early October, and say two cloud keys stolen in one of them were used for about 2.5 million model calls before they were shut off.

Not yet independently verified. The link between the incidents is Wiz's analysis; no platform has named a common attacker or a shared vulnerability, and most investigations are still open. The cryptocurrency theft and the RunPod incident Wiz mentions rest on social media reports only. We will update this when it can be confirmed, and remove this note.

Fourteen platforms in five weeks

Wiz's researchers Benjamin Read and Rami McCarthy first listed nine platforms that disclosed incidents during October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Their post has been updated since with Brev at NVIDIA, Trigger.dev, Chainstack, Kernel and, on 7 November, Blacksmith. Wiz notes that RunPod is named on social media but has published nothing.

The platforms do not describe one way in. Fireworks says an unauthorised party used internal Fireworks credentials to read environment variables from evaluation jobs in a limited number of customer accounts. Railway says the attacker wanted AI provider keys "to perform distillation attacks", and puts the attack between 13:58 UTC on 20 October and 03:32 UTC on 22 October. Kernel says a leaked API key gave access to its logging provider, where a small number of customer keys and deployment secrets sat, and then to four GPU servers on 3 November. Chainstack says its attacker came in through a third-party component and calls its incident "part of a broader AI-powered attack campaign".

Zeabur went furthest. After a second break-in, on 14 October, its founder Yuanlin Lin announced the platform will close: some services stop on 1 December 2026 and every dedicated server and shared cluster on 31 December.

What happened to two stolen keys

Wiz says it could follow two enterprise cloud keys whose theft it traces to one of the vendor breaches. Both were first tested within 30 minutes of the reported credential access, by a single model call from a residential address that also tried keys from other organisations. After days of a few dozen calls a day from a checking script, the abuse came in floods.

The first key allowed cross-region inference through Amazon Bedrock's global profiles. Over 30 hours it carried about 800,000 Bedrock calls, about 90% of them successful, and only about 6% were throttled. The second key was limited to US profiles. It turned up in what Wiz calls an apparent reseller pool after seven days, then made about 1.7 million calls from one address in 13 hours, over a million of them successful. Wiz estimates the two cases alone ran up over $100,000 of use at list price.

Wiz found two resale sites with access to the stolen keys, llm-routing.com and xingjiabiapi.org, both selling cheap model access. It says it cannot prove either was behind the original break-ins.

Deleting a key is not the same as revoking it

The stored secrets on these platforms were keys issued by someone else: a cloud account, a model provider, a payment or data service. Removing them from the compromised platform does not stop them working. Railway asks every customer who signed up before 21 October to rotate the keys stored with it, and Fireworks has told affected customers by email which credentials need action. The fix is at the issuer: revoke, reissue, and read the provider's usage logs for calls from unknown addresses, which in Wiz's two cases began within half an hour.

A narrow key policy also helped. The restricted key in Wiz's second case failed for hours because the reseller asked for profiles its policy did not allow, and its traffic ran into regional quotas.

Earlier reports in the same run

We reported Northflank's incident and the malicious extension in the Cursor marketplace separately. Railway is one of 17 products in our DevOps software category, and Chainstack is also listed. Wiz says it will keep updating its list as more platforms disclose.

Related on TrustList:

• Gheist campaign uses stolen GitHub tokens to dump Actions secrets
• Northflank tells every customer to rotate secrets after a breach
• PingCAP breach: TiDB Cloud users told to replace API keys now

Sources

• Wiz: "Black October" for AI Developer Platforms (updated to 7 November), 30 October 2026
• Railway: Preliminary Report, Oct 21st Security Incident, 22 October 2026
• Fireworks AI: October 2026 security incident bulletin, 10 October 2026
• Zeabur: Zeabur is shutting down, what happens next, 17 October 2026
• Kernel: Public Notice of Security Incident, 4 November 2026
• Chainstack: Incident report, what happened and what customers need to do, 3 November 2026