Northflank, Railway and seven more AI platforms were hit in October. Which keys to replace

What happened

On October 30, 2026, the hosting platform Northflank told customers: “Assume all environment variables have been decrypted. Disable/rotate all keys.” Wiz had sent it a threat alert at 11:43 UTC. Within hours Northflank wrote that “multiple users are confirming that their AI keys have been used.” As of November 1, its status page still lists the incident as open, with most of the platform’s components marked as a major outage.

The same day, Wiz published “Black October” for AI Developer Platforms, which counts “at least nine” AI developer platforms that disclosed incidents during the month. “All public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access,” it says.

Environment variables are the settings a hosted app reads when it runs. In Railway’s words, they “may contain secrets such as API keys or database and registry credentials.” A platform that runs your app holds them for you, which is what the attackers came for.

The nine platforms

The dates are the ones Wiz gives. The rest comes from each platform’s own notice.

Platform	Date	What it says was reached	Who needs to act
Fireworks AI	Oct 6	Environment variables, “including API keys and tokens stored as secrets,” in a limited number of accounts	Customers it emailed
Andromeda	Oct 9	“Certain Andromeda and customer credentials” in a limited number of accounts	Customers it contacted
Zeabur	Oct 14	3,218,965 environment variable records, and the details of 321,810 accounts	Everyone: “Replace every password and key stored on Zeabur”
Lightning AI	Oct 15	“Certain customer credentials”	Everyone, whether contacted or not
OpenCode Console	Oct 16–17	Provider keys saved by 1.4% of Console users	Users it emailed
Railway	Oct 20	Environment variables in at most 1.85% of workspaces, about 100,000	Everyone with variables stored before October 21
Warp	Oct 23	“A limited amount of agent trace and telemetry data,” with an upper bound of roughly 1% of users	Users it notified
Command Code	Oct 28	“No evidence that any users were impacted,” but it revoked all API keys	Everyone needs a new Command Code key from Studio
Northflank	Oct 30	Scope not confirmed; assume every environment variable	Everyone

These aren’t the same size. Railway says it has 5 million existing users, and it can’t say which keys were decrypted: the query it found “cannot identify specifically which keys” were affected. Zeabur published the fullest account, and it blames itself: “long-lived admin credentials were stored in plaintext and could be used from the public internet.”

Zeabur users have a second job, because it shuts down on December 31. Wiz says that’s due to the incident. Zeabur’s report calls the shutdown “an operational decision,” and its founder cites growth limits and a system that grew hard to maintain, while saying the company reassessed after this attack.

What happens to a stolen key

Wiz followed two enterprise Amazon Bedrock keys that it ties to one of these breaches, without saying which. Each got a test call “within 30 minutes” of the reported theft. Then both went nearly quiet, at 14 to 120 calls a day, while something checked that they still worked. Then came the flood:

	Case A	Case B
Nearly quiet for	About four days	About a week
Calls in the flood	About 800,000 in 30 hours	About 1.7 million in 13 hours
Calls that succeeded	About 90%	Over a million
Most-used models	Opus 5, Opus 5.5, Opus 4.8	Opus 5.5, Sonnet 4.5, Opus 5

“At list price, these two cases alone likely ran up over $100k in usage,” Wiz estimates. That’s a list-price estimate, not a billed total. The practical lesson is the gap before the flood: an account that looks normal today doesn’t clear a key. Fireworks says the same in its notice: rotate “even if you do not find suspicious activity.”

Wiz calls this LLMjacking, and says the traffic “resembles resold coding-agent traffic,” so other people’s coding agents may have been running on those bills. It found two operations selling discounted model access that had tested the stolen keys, though it can’t establish how they relate to the original break-ins.

Smaller accounts got hurt too. Customers on Railway’s forum describe a Gemini key running up €133 against an expected €0.02, and about $1,200 in Twilio calls. And it isn’t only AI keys: Wiz cites an alleged theft of about $371,000 in cryptocurrency using keys stored in Railway, reported on X by a user named Tay. Wiz describes such reports as anecdotal so far.

What to do now

1. List every hosted service that holds your keys. Start with the table, then add the deploy platforms, notebooks, CI systems and agent tools it doesn’t name. If you never stored anything on the nine, none of these notices asks anything of you.
2. Revoke each key where it was issued. “Removing a stored secret alone does not invalidate the underlying credential,” as Fireworks puts it. A copied key keeps working until its issuer kills it. The steps are in the next table.
3. Replace everything else stored there too. Database passwords, GitHub tokens, registry logins, and payment and messaging keys. Northflank says to rotate secrets on workloads, in secret groups and in global secrets, and it has turned on rotation for its Postgres, MongoDB, MySQL, Redis, MinIO and RabbitMQ add-ons. Zeabur lists further steps, including for n8n and for databases on its shared clusters.
4. Update the variables and redeploy, so your services stop using the old values.
5. Turn off public access to databases. Railway and Northflank both advise it.
6. Check your logs and bills back to the date in the table. That means each provider’s usage page, your GitHub audit log and installed apps, and your registry’s logs. Northflank has turned on audit logs for all customers, free ones included. Zeabur says to review bills from October 14, or September 1 if you had a GCP Dedicated Server. Keep what you find, since you’ll need it for a refund.
7. Give each service its own key and a ceiling. OpenAI offers hard limits, though “enforcement is not instantaneous.” Google suggests billing alerts.

Who issued the key	How to replace it
Anthropic	On the Claude Console’s API keys page, open the menu beside the key and choose “Delete API key,” then “Create key.” Contact support about suspicious activity
OpenAI	Delete the key in the API key dashboard, review your usage and keep the details, then contact support
Google Gemini	Create a new key, deploy it, disable the old one in the Cloud console, then check billing logs and API usage
AWS	Create a new access key, deactivate the old one, confirm your app works, then delete the old one

Google’s and AWS’s order keeps your app running. If someone is already spending on the key, kill it first and accept the downtime.

If a provider revoked your key

You may get an email from a provider before you’ve done anything. Railway gave its key lists to GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Stripe and others, in some cases every key on the platform. “Users being notified by vendors about revocation does not imply that their credentials were impacted by the incident,” it says.

Some people then had their replacement keys revoked as well. On October 23, providers asked for another batch. Railway says it sent one to OpenAI and Anthropic, “but because we could not filter keys by when they were added, it inadvertently included newer keys.” It adds: “These revocations do not indicate that your replacement keys were compromised.”

The fix is the same either way: create a replacement, update the variable, redeploy. If your replacement keys still work, Railway says you don’t need to rotate them again. A key you never replaced still needs replacing.

Getting money back

Start with the provider that billed you, and bring evidence. We didn’t find a refund policy from any provider covering this wave as a whole.

Who	What’s been said
Railway	“Railway is unable to refund customers for spend performed with compromised API keys.” Go to the provider first, then file a request at station.railway.com with timestamps and proof, and it will escalate
Zeabur	Request compensation through a support ticket. It will check the provider’s records
OpenAI	For OpenCode, Thibault Sottiaux said affected API customers would have “any credits refunded which would have been drawn in the attack”
Google	On Railway’s forum, one customer says Google declined a refund and another says it credited part of the charge. These are customers’ reports, not a policy
Twilio	A customer on the same thread says Twilio gave credits rather than a refund, and that evidence of what happened mattered most
Northflank	Report suspicious usage to its support and to the provider. It hasn’t mentioned refunds

The notices from Fireworks, Andromeda, Lightning, Warp and Command Code don’t mention charges. The OpenCode memo has what OpenCode, Anthropic and Google said about theirs.

What nobody has said

• Who did it. Wiz finds “no single vulnerability or dependency linking these attacks,” and says it has no evidence tying the addresses it lists directly to them. Fireworks, OpenCode and Warp reported signs of an “agent swarm,” meaning attackers working through AI agents.
• Why. Railway, OpenCode and Command Code call it distillation, collecting a model’s answers in bulk to train another. Wiz agrees distillation drives demand, but what it measured looks like resale, and one resale site it found ran a page to detect distillation among its own users. None of these reports shows stolen keys training a model.
• How Northflank was reached. It hasn’t said how attackers got in or how many customers were affected, and it hadn’t answered BleepingComputer’s questions as of October 31.
• Whether Railway’s attacker saw code. “We are not ruling out that they accessed user source code,” it says, pending a final report. New signups were still paused at its latest update on October 29.
• What was in Warp’s traces. The company didn’t clarify whether they included source code, prompts or credentials, BleepingComputer reports. Warp says anyone affected will get instructions from it.
• The final count. Wiz says “at least” nine and that most incidents are still being analyzed. LiteLLM’s compromise that month isn’t on its list, and no one has shown it’s connected.

Keeping less at risk

A key you never hand to a hosted service can’t leak from one. The apps you deploy still need their secrets somewhere, so give each its own, as narrow as it can be. Restrictions helped, if only partly, in Wiz’s cases: Case B’s key was limited to one set of Bedrock routes, so a reseller’s first attempts failed and more of the flood was throttled, while Case A’s broader key saw only about 6% throttled.

Writing code doesn’t need a key on anyone’s server. Claude Code and Codex sign in with your plan, OpenCode keeps the keys you add on your computer, and a local model needs no key at all. Enjoy runs these agents on your computer, each signed in with your own account on the plan you already pay for. That covers the agents, not your deployed apps, whose secrets still live wherever you host them. For secrets in your own projects, see Keep passwords and API keys safe.