Wiz counts at least nine AI developer platforms that disclosed incidents in October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack. Root causes differ (credential access, build-infra privilege escalation, a third-party dependency, a legacy system), but every public report describes targeted hunting for stored environment variables, especially AI provider keys.

• Downstream abuse Wiz saw: two enterprise Bedrock keys from a compromised vendor were first tested within 30 minutes (a single InvokeModel from a residential IP), then quietly re-checked for days. Then came floods of about 800k calls in 30 hours (Case A, using global.* cross-region inference profiles so only about 6% were throttled) and about 1.7M calls in 13 hours (Case B, restricted to us.*, so it hit regional quotas). Wiz puts it at over $100k at list price.
• Resale: the traffic looks like resold coding-agent usage. Wiz links key checks to resale operations it calls "momo" (23.106.46.239, llm-routing.com, which also hosted an ARTEX page and was named by Zeabur) and "Xingjiabi" (38.246.114.118, xingjiabiapi.org).
• Key-check IPs: 23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201. Shared pools: PEG TECH (AS54600/AS398823), Alibaba US (AS45102), Scloud (AS142002), Sharktech (AS46844), Level 3 (AS10753). Wiz says these are tied to key abuse and resale, not proven to be the breach operators.

Takeaway: a platform that holds your agents' and apps' AI keys is now a primary target. Scope every key to the narrowest model/region profile and alert on first-use from new IPs. See the playbook.