---
title: Wiz 'Black October': nine AI developer platforms disclosed breaches this month, all hunting stored env vars for AI keys; stolen Bedrock keys made 800k and 1.7M calls within days | ctxsec
url: https://ctxsec.com/items/wiz-black-october-ai-developer-platform-breaches-llmjacking
description: ""
status: "vendor research (Wiz, Oct 30); Wiz says its IOCs are not directly linked to the platform breaches"
published: 2026-10-30
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/wiz-black-october-ai-developer-platform-breaches-llmjacking.md)

vendor research (Wiz, Oct 30); Wiz says its IOCs are not directly linked to the platform breaches

2026-10-30

### Wiz 'Black October': nine AI developer platforms disclosed breaches this month, all hunting stored env vars for AI keys; stolen Bedrock keys made 800k and 1.7M calls within days

Wiz counts at least nine AI developer platforms that disclosed incidents in October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack. Root causes differ (credential access, build-infra privilege escalation, a third-party dependency, a legacy system), but every public report describes targeted hunting for **stored environment variables**, especially AI provider keys.

- **Downstream abuse Wiz saw:** two enterprise Bedrock keys from a compromised vendor were first tested within 30 minutes (a single InvokeModel from a residential IP), then quietly re-checked for days. Then came floods of about **800k calls in 30 hours** (Case A, using `global.*` cross-region inference profiles so only about 6% were throttled) and about **1.7M calls in 13 hours** (Case B, restricted to `us.*`, so it hit regional quotas). Wiz puts it at over $100k at list price.
- **Resale:** the traffic looks like resold coding-agent usage. Wiz links key checks to resale operations it calls "momo" (23.106.46.239, llm-routing.com, which also hosted an ARTEX page and was named by Zeabur) and "Xingjiabi" (38.246.114.118, xingjiabiapi.org).
- **Key-check IPs:** 23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201. Shared pools: PEG TECH (AS54600/AS398823), Alibaba US (AS45102), Scloud (AS142002), Sharktech (AS46844), Level 3 (AS10753). Wiz says these are tied to key abuse and resale, not proven to be the breach operators.

Takeaway: a platform that holds your agents' and apps' AI keys is now a primary target. Scope every key to the narrowest model/region profile and alert on first-use from new IPs. See the [playbook](/playbooks/stolen-ai-provider-key-llmjacking-response).

Sources: [Wiz Blog: "Black October" for AI Developer Platforms (Oct 30)](https://www.wiz.io/blog/black-october-for-ai-developer-platforms) · [Northflank status: Security incident](https://status.northflank.com/cmvv0rn5a092f14rutwccodpp)