Black October: Nine AI Developer Platforms Hacked

According to Wiz's "Black October" report dated October 30, 2026, at least nine AI platforms for developers disclosed security incidents in one month, which Wiz assesses to be related to the targeted theft of LLM service API keys—LLMJacking.

Compiled by Sergey KostenchukPublished 2026-10-31Updated 2026-10-31

2026-10-31 Safety OpenAI

🛡 Black October: Nine AI Developer Platforms Hacked

In October 2026, Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank were affected. According to Wiz, the attacks were targeted: attackers sought environment variables containing API keys—LLMJacking, the theft and resale of keys. Stolen Bedrock keys began being used within 30 minutes: 800,000 calls in 30 hours, 1.7 million in 13 hours—losses exceeded $100,000. An additional ~$371,000 in cryptocurrency was drained from Railway keys.

🌍 AI development infrastructure—hosting, CI/CD, agent platforms—has become a target: a stolen key is monetized within minutes on the LLM access resale market.

👤 Did you store keys on these platforms? Check your logs: a sharp increase in calls, requests from residential IPs, proxy pools, and global.* inference profiles.

Source 1: https://www.wiz.io/blog/black-october-for-ai-developer-platforms Source 2: https://news.ycombinator.com/item?id=50311844

Sources