Nine AI developer platforms disclosed security incidents during October 2026, according to research published by Wiz on October 30. Their reported entry points differed, but attackers repeatedly sought the same valuable material: stored environment variables containing credentials for AI services.
Wiz’s report goes beyond collecting breach disclosures. Researchers Benjamin Read and Rami McCarthy describe two enterprise credential compromises they attribute to vendor breaches, with unauthorized tests beginning within 30 minutes of the reported credential access. Those keys later supported sustained Amazon Bedrock inference traffic. Across the two cases, Wiz’s findings and a secondary summary describe approximately 2.5 million calls. (Wiz, The Injection)
The practical concern is the intermediary holding the key. A developer platform can lose control of a credential while the model provider continues accepting it. Fixing the platform’s vulnerability and stopping unauthorized inference are separate jobs.
Nine Incidents, Different Entry Points
Wiz lists the following platforms and October dates in its roundup:
| Platform | Date listed by Wiz |
|---|---|
| Fireworks AI | October 6 |
| Andromeda | October 9 |
| Zeabur | October 14 |
| Lightning AI | October 15 |
| OpenCode | October 16–17 |
| Railway | October 20 |
| Warp | October 23 |
| CommandCode | October 28 |
| Northflank | October 30 |
These dates follow Wiz’s chronology. Railway’s own preliminary report, published October 22, identifies October 21 as its initial public security disclosure and describes attack activity beginning October 20.
The reported causes vary. Wiz says Fireworks, Zeabur and Lightning attributed their incidents to credential access. Railway described suspected privilege escalation in build infrastructure; Warp pointed to a third-party vendor dependency; OpenCode identified a legacy system.
Wiz found no single disclosed vulnerability or dependency connecting all nine incidents, and the evidence does not establish one actor behind every breach. Technical details remain limited, with several investigations ongoing.
That distinction matters. The useful shared finding is the target: according to Wiz, public reports consistently describe attackers hunting stored environment variables, particularly those granting AI access. A universal patch cannot address that concentration of credentials.
What Happened After Two Keys Were Stolen
Wiz says the two enterprise keys it examined had previously been heavily used from a compromised vendor’s infrastructure. Their first unauthorized activity followed the same pattern.
Within 30 minutes of the reported credential access, a residential IP address made a single Amazon Bedrock InvokeModel request. This API operation submits a request to a model. The attacker tried one model, received a failure, then successfully used another. Wiz describes the activity as part of a one-minute sweep testing stolen keys across multiple organizations.
The next stage was quiet: each key received only 14–120 calls a day. Requests arrived through the same small Go client, with activity on the two keys running about a minute apart. Wiz interprets that synchronization as a recurring job checking whether the credentials still worked. (Wiz’s case analysis)
Two Paths to Bulk Inference
The keys subsequently followed different paths:
| Detail | Case A | Case B |
|---|---|---|
| Initial unauthorized test | Within 30 minutes of reported credential access | Within 30 minutes |
| Later activity | Broad model and quota probing after four days | Apparent reseller-pool activity after seven days |
| Policy restriction | Allowed global.* cross-region inference profiles | Allowed us.* profiles; requests using global.* failed |
| Reported burst | About 800,000 calls over 30 hours | About 1.7 million calls over 13 hours |
| Average attempted-call rate, calculated from those totals | About 7.4 per second | About 36 per second |
The policy and probing details come from Wiz. The second burst total is reported in The Injection’s summary of Wiz’s research. These are vendor-reported observations, not independent measurements.
In Case A, a rotating proxy pool first tested models across multiple vendors. A Python script using AWS’s boto3 SDK then enumerated Bedrock and EC2 quotas. Bulk traffic began 22 seconds later. Another host subsequently mapped model availability and quotas across regions.
Wiz reports that approximately 90% of Case A’s 800,000 calls succeeded. The key allowed global cross-region inference profiles, which spread requests across regions. Only about 6% of calls were throttled, and Opus models accounted for roughly three-quarters of successful requests.
Case B initially encountered a useful restriction. Thousands of requests failed because the apparent reseller pool requested global.* profiles while the key permitted only us.* profiles. Later, a checker found working model identifiers. A script matching the one used against Case A then checked profiles and quotas before bulk activity began.
The comparison shows both the value and the limit of narrower permissions. Case B’s restriction blocked one configuration, but the attacker adapted to the access that remained available.
Its eventual burst also averaged roughly five times Case A’s attempted-call rate. That calculation describes request volume, not token throughput or cost: calls can differ substantially in model, prompt length and output length.
I’d read these cases as a warning against waiting for an obvious usage spike. Both keys were validated quickly, then remained usable through days of low-volume checks. That quiet interval was an opportunity for defenders to revoke access before the larger burst.
Why Build Platforms Make Valuable Targets
Developer platforms need secrets to deploy applications and call external services. Environment variables are a common way to provide them: application code reads a named value at runtime and uses it to authenticate a request.
That arrangement creates a consequential dependency. A key stored on one platform may authorize spending and access at another company. If an attacker copies it, repairing the storage system does not automatically invalidate the copy.
Wiz connects this pattern to LLMjacking: unauthorized use of someone else’s model access, with consumption charged against the credential owner’s account. The researchers also describe a market of brokers that makes stolen access easier to monetize. Their observations concern credential abuse; the eventual purpose of every generated response is not established.
Railway’s preliminary timeline provides a concrete example of how attackers can reach secrets through infrastructure. The company says it identified suspicious activity on October 20 and confirmed the attacker no longer had internal access at 03:32 UTC on October 22.
During that period, Railway reports that the attacker obtained encrypted secrets, later accessed CI credentials that enabled decryption of artifacts containing additional API access, and decrypted a subset of environment variables using compromised credentials. (Railway’s preliminary report)
Encryption at rest still matters. This sequence illustrates its boundary: secrets become exposed if an attacker also reaches the credentials and systems authorized to decrypt them. Protecting the secret store requires protecting the build and CI paths around it.
Frequently Asked Questions
3 questions
1Was Amazon Bedrock Itself Breached?
Wiz describes stolen credentials being used to access Bedrock. Its two cases concern credentials exposed through developer-platform breaches, not a reported compromise of Bedrock itself.
