Northflank Breach: Stolen AI API Keys Abused by Attackers

Environment variables are where developers put the things that must never leak. Database passwords, cloud credentials, and the API keys that bill straight to a credit card all live there. On October 30, 2026, Northflank told its customers to assume all of them were gone.

The company's public status page carried the instruction in five words: "Disable/rotate all keys." By that evening, Northflank confirmed that customers were seeing their AI provider keys used by someone else. BleepingComputer reported the incident on October 31 and said Northflank had not responded to a request for comment.

Key Takeaways

• Northflank received a threat alert from Wiz at 11:43 UTC on October 30, 2026, and began patching its network policy at 12:02 UTC.
• Northflank told all customers to "assume all environment variables have been decrypted" and to rotate every secret in workloads, secret groups, and global secrets.
• Northflank confirmed at 11:38 PM UTC the same day that "users have reported unauthorised use of AI API keys supplied to the Northflank platform."
• Northflank has not disclosed how attackers got in or how many customers were affected.
• BleepingComputer reports that Wiz counted at least nine incidents at AI development platforms in October, including Railway, OpenCode, Warp, and Lightning AI.

What Happened at Northflank?

Attackers reached Northflank's infrastructure in a way that forced the company to assume customer secrets were readable, and stolen AI keys were being abused within about 12 hours of the first alert. Northflank posted this timeline on its status page (all times UTC, October 30):

• 11:43 Wiz threat alert
• 11:44 Northflank engineers review the alert
• 12:02 Initial network policy patch
• 12:50 Additional patching deployed
• 13:00 Wiz CIRT support requested
• 13:05 Additional patching deployed
• 13:40 "Rotate environment variables immediately."
• 13:58 "Assume all environment variables have been decrypted. Disable/rotate all keys."
• 15:12 "Multiple users are confirming that their AI keys have been used."
• 23:38 Formal confirmation of unauthorized AI key use, with a link to Wiz research containing "similar IP addresses."

Over the next day Northflank shipped rotation tooling one add-on at a time: Postgres and MongoDB on October 30, then MySQL and Redis, Minio, and RabbitMQ on October 31. At 1:04 AM UTC on October 31 it also turned on audit logs for every customer, free accounts included.

The phrase "network policy patch" is the only technical hint. Northflank has not said what was misconfigured, which systems were touched, or whether customers running in their own cloud accounts (Northflank's bring your own cloud mode) were in scope.

Which Secrets Were Exposed?

Northflank's guidance treats every user supplied secret as exposed, but the only confirmed abuse so far involves AI API keys. Its 7:28 PM update was blunt: "assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets."

In practice that scope covers:

• LLM provider keys (OpenAI, Anthropic, Bedrock, Gemini, and so on)
• Database connection strings for managed add-ons, which is why Northflank also told users to disable public access to add-ons
• Cloud provider credentials and deploy tokens
• Payment, email delivery, and webhook signing secrets

The order in which secrets got abused tells you about attacker economics. AI keys are the fastest to cash out. They need no lateral movement, no database dump, and no ransom note. You paste the key into a proxy and start selling tokens. We saw the same pattern when Claude was used to dig secrets out of 1.8 million Android apps, where AI credentials were among the most valuable finds.

How Do Attackers Abuse Stolen LLM Keys?

Stolen LLM keys are used to run model traffic on the victim's bill, a practice the security industry calls LLMjacking. The attacker either burns the credits directly or resells access through a reverse proxy, so dozens of buyers share one victim's quota without ever seeing the key.

This is not theoretical. Microsoft's Digital Crimes Unit named members of Storm-2139 in February 2025, a network that "exploited exposed customer credentials scraped from public sources" to get into generative AI accounts, then "altered the capabilities of these services and resold access to other malicious actors."

The bills scale fast. BleepingComputer cites separate Wiz investigations, not tied to Northflank, involving about 2.5 million Amazon Bedrock API calls and roughly $100,000 in usage from compromised enterprise credentials. Most providers bill monthly, so a key abused on October 30 may not show up as a shocking invoice until December unless you check the usage dashboard now.

Is This Part of a Bigger Campaign?

Possibly, though nobody has proven a single actor. According to BleepingComputer, a Wiz report titled "Black October for AI Developer Platforms" counted at least nine incidents in October, naming Northflank, Railway, OpenCode, Warp, and Lightning AI. Wiz has not attributed them to one group. Northflank's own update says the abuse it saw may be connected, and points to overlapping IP addresses.

If you have been following this month's coverage, the shape is familiar. The Warp breach exposed AI agent logs and telemetry days earlier, and the Stripe vendor leak exposed 1,033 API keys. Platforms that hold other people's secrets have become the target, because one breach yields thousands of keys.

Here is the part most coverage skips. "Encrypted at rest" did not help. A deploy platform has to decrypt your secrets to inject them into running containers, so anyone who gets far enough into the control plane gets plaintext. The fix is not better encryption on the vendor side. It is assuming every vendor eventually leaks and limiting what each key can do.

What Should Northflank Customers Do Now?

Revoke every secret at the issuing provider first, then put the replacement into Northflank. Changing the value in Northflank alone leaves the stolen copy valid. Northflank's own wording: "Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank."

Rotate, in this order

• AI provider keys (already being abused)
• Payment and email sending keys (direct money and reputation loss)
• Cloud and deploy credentials, then database passwords using Northflank's new add-on rotation

Limit the blast radius next time

• Use one key per service and environment, so a leak maps to one revocation.
• Set hard monthly spend limits and usage alerts in every LLM provider console.
• Scope keys to specific models or projects where the provider allows it.
• Turn off public exposure on database add-ons you only reach internally.

Detect

• Review AI provider usage and billing logs from mid October onward, and report anything odd to the provider and Northflank support.
• Read the newly enabled Northflank audit logs for unfamiliar access.
• Check cloud audit trails for calls from IPs you do not recognize.

Researchers keep finding how often these keys leak in the first place: Truffle Security found 543,000 credentials on GitHub. Rotation is cheap compared with the alternative.

What This Means for Your Inbox

Most Northflank apps send email, and the key that sends it was probably sitting in the same environment variables. A stolen Postmark, SendGrid, or SMTP credential lets an attacker send mail that passes SPF and DKIM as your domain. Your customers' inboxes trust it because, technically, it is you. Rotate those keys alongside the AI ones and check your provider's activity log for sends you did not make.

The second risk is fake breach notices. Northflank customers are expecting security emails this week, which is the best cover a phisher can ask for. A message that says "rotate your secrets here" and links to a lookalike login page would harvest exactly the credentials you are trying to replace. Developers have already been targeted with fake VS Code and GitHub alerts. Type the dashboard URL yourself and use the status page as your source of truth.

Looking Ahead

The facts that matter most are still missing: the entry point, the number of affected customers, and whether bring your own cloud deployments were exposed. Watch Northflank's status page for a postmortem.

Until then, rotate on suspicion, not on confirmation. Northflank needed about two hours and fifteen minutes to go from first alert to "assume decrypted." Attackers needed less than a day to start spending. Your rotation window is the gap between those two numbers, and for anyone who has not rotated yet, it has already closed.