Wiz Research has called “Black October” a run of nine security incidents disclosed in October 2026 by AI developer platforms. According to the report published on 30 October, the common pattern was not a single vulnerability: in every public case, attackers hunted stored environment variables, with a special focus on the keys that grant access to AI model providers.
The nine platforms listed by Wiz are Fireworks AI (6 October), Andromeda (9 October), Zeabur (14 October), Lightning AI (15 October), OpenCode (16–17 October), Railway (20 October), Warp (23 October), CommandCode (28 October) and Northflank (30 October). Wiz makes clear that it does not claim a single actor is behind all the incidents, nor that a single vulnerability or dependency links them.
What the reports point to
Fireworks, OpenCode and Warp reported indications of an “agent swarm” attack. Andromeda described its case as part of an “industry-wide attack”. OpenCode and CommandCode attributed their incidents to an attempted model “distillation”. Fireworks, Zeabur and Lightning AI attributed the root cause to credential access, according to Wiz. Zeabur published a full write-up and announced it will shut down because of the incident.
From leak to LLMJacking
The risk does not end with the leak: stolen keys can be resold and used to run models at the victim's expense, a practice known as LLMJacking. Wiz documented downstream abuse of two enterprise Amazon Bedrock keys attributable to one of these vendor breaches. In both cases, the first unauthorised activity happened within 30 minutes of the credential access at the vendor.
In Case A, there were about 800,000 Bedrock calls in roughly 30 hours, with about 90% succeeding, before the key was remediated. In Case B, a single address made about 1.7 million calls in 13 hours, with over 1 million successful. Together, the two cases likely ran up over $100,000 in usage at list price, according to Wiz. The usage profile resembled resold coding-agent traffic, and Wiz identified resale operations — called “momo” and “Xingjiabi” — that had access to the keys and tested them, without definitively claiming they carried out the initial breach or the flood of calls.
For anyone using platforms of this kind, the practical lesson is direct: treat any key or environment variable that may have been exposed as compromised, rotate it, review usage logs and restrict permissions to the minimum necessary. The report reinforces that AI key security has become a central part of developer-platform security — not a configuration detail.
Image credit: illustrative server-room photo, via SC Media / CyberRisk Alliance. The image does not show the Wiz incident, only the server infrastructure behind AI platforms.
Fontes: Wiz Research — “Black October” for AI Developer Platforms (30 de outubro de 2026); Futurum Group — cobertura do relatório da Wiz.
Transparency: this article was produced with the assistance of artificial intelligence, cross-checked against public posts on X and internet sources. Consult the original sources to verify the details.
Muse
