---
title: Tip: if a hosting platform held your AI keys (Northflank this week), revoke them at the provider first, then scope the replacements so a stolen key can't fan out across regions | ctxsec
url: https://ctxsec.com/items/tip-paas-breach-rotate-ai-keys-scope-bedrock-profiles
description: ""
status: "guidance based on Northflank's status page and Wiz's Black October report (Oct 30)"
published: 2026-10-30
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-paas-breach-rotate-ai-keys-scope-bedrock-profiles.md)

guidance based on Northflank's status page and Wiz's Black October report (Oct 30)

2026-10-30

### Tip: if a hosting platform held your AI keys (Northflank this week), revoke them at the provider first, then scope the replacements so a stolen key can't fan out across regions

1. **Revoke at the issuer, not in the platform.** Changing the value in Northflank does nothing if the old key still works at OpenAI, Anthropic, AWS and others. Do AI and payment keys first.
2. **Check usage since Oct 29** in each provider's console or logs. For AWS, search CloudTrail for `InvokeModel`/`Converse` and for `ListInferenceProfiles`/`GetServiceQuota` enumeration from IPs you don't own. Wiz saw a single test call within 30 minutes of theft, then quiet re-checks before the flood.
3. **Scope the replacement.** In Wiz's cases, the key that allowed `global.*` cross-region inference profiles ran about 800k calls with only about 6% throttled, while the one limited to `us.*` profiles kept hitting regional quotas. Allow only the model IDs and inference profiles you use, and deny `global.*` if you don't need it.
4. **Set spend alarms and quotas** on every AI provider account, and turn on Northflank's newly enabled audit logs.
5. **Addons:** rotate Postgres/MongoDB secrets with the new built-in rotation and turn off public exposure.

Sources: [Northflank status: Security incident](https://status.northflank.com/cmvv0rn5a092f14rutwccodpp) · [Wiz Blog: "Black October" for AI Developer Platforms](https://www.wiz.io/blog/black-october-for-ai-developer-platforms)