Northflank breach exposes AI key theft risk

When Northflank's engineers received a threat alert from cloud security firm Wiz at 11:43 UTC on October 30, they had one minute before reviewing it. What followed was a scramble to contain a breach that ultimately forced the cloud application hosting platform to tell every customer to assume their environment variables had been decrypted and the secrets inside them stolen.

The incident at Northflank, which lets developers deploy and manage applications, containers, databases, and AI applications without handling the underlying infrastructure, is part of a broader wave of attacks targeting AI development platforms. According to Wiz, at least nine such incidents occurred during October, and the common thread is the theft of API keys that grant access to expensive AI services.

A warning to rotate everything

Northflank disclosed the security incident on October 30, advising customers to immediately rotate their environment variables and API keys. The company later escalated that guidance, telling all customers to assume their environment variables had been decrypted and that the secrets stored within them were stolen. Environment variables are a standard way for applications to hold sensitive data such as database passwords, cloud service credentials, authentication tokens, and API keys. If those values are exposed, they can be used to breach other customer services, potentially leading to data theft or unauthorized charges through API keys.

Northflank subsequently confirmed that multiple customers had reported unauthorized use of AI API keys stored on the platform. The company urged customers who had not already rotated their user-provided secrets to do so immediately, and advised them to review AI provider usage and billing logs for unexpected activity, reporting anything suspicious to Northflank and their AI providers.

Timeline of the response

Northflank's published incident timeline shows Wiz warned the company at 11:43 UTC on October 30, and engineers reviewed the alert one minute later. A network policy patch followed quickly, with additional patches at 12:50 UTC and 13:05 UTC. Northflank also requested assistance from Wiz's incident response team.

As part of its response, the company enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis. It also turned on audit logs for all customers, including those on free accounts, to help them investigate suspicious activity. Northflank continues to advise customers to rotate secrets stored in workloads, secret groups, and global secrets, and to disable public access to add-ons where it is enabled.

The company has not disclosed how attackers gained access to its systems, how many customers were affected, or whether credentials other than the reported AI API keys were stolen or abused. BleepingComputer contacted Northflank with questions about the breach, its impact on customers, and whether stored credentials were accessed or stolen, but had not received a response at the time of its report.

What attackers do with stolen AI keys

The theft of AI API keys is not an end in itself. Security researchers at Wiz say attackers involved in some of the October incidents specifically targeted environment variables containing AI service credentials, which can be exploited through a practice known as LLMJacking. That technique involves using stolen credentials to access AI models under another organization's API keys, which can generate massive API charges or allow the stolen access to be resold.

Wiz investigated two cases in which compromised enterprise credentials were used to make approximately 2.5 million Amazon Bedrock API calls, generating approximately $100,000 in AI usage. The researchers also found infrastructure linked to services reselling access to AI models, though they could not connect those operations to the initial breaches or the large-scale abuse.

The financial exposure from such abuse is direct and quantifiable, as the Wiz findings illustrate:

• 2.5 million Amazon Bedrock API calls made using compromised enterprise credentials in two cases investigated by Wiz
• $100,000 in AI usage generated by those calls
• Nine security incidents affecting AI development platforms identified by Wiz in October
• 11:43 UTC on October 30, when Wiz warned Northflank of the breach
• 12:50 UTC and 13:05 UTC, the times of Northflank's additional network policy patches

A wider pattern across AI platforms

Northflank is not the only AI development platform to report trouble in October. In a report titled "Black October for AI Developer Platforms," Wiz identified at least nine security incidents affecting such platforms during the month, including Northflank, Railway, OpenCode, Warp, and Lightning AI.

The Railway incident also involved potential exposure of decrypted customer environment variables, while OpenCode disclosed exposed AI API keys. Warp reported a breach that exposed AI agent logs and user telemetry data. Wiz has not confirmed that all nine incidents were carried out by the same attackers, but many involved attempts to steal AI API keys.

Northflank referenced Wiz's research in its incident updates, noting that customer reports of unauthorized AI key usage may be tied to the attacks the researchers observed.

"Users have reported unauthorised use of AI API keys supplied to the Northflank platform."

— Northflank, in a statement to customers

The same update continued: "If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately."

Why AI platforms are attractive targets

AI development platforms occupy a sensitive position in a customer's stack. They store the keys that connect applications to AI providers, and those keys often carry significant billing privileges. An attacker who obtains them can run up costs without touching the customer's own infrastructure, or sell access to others. The Wiz research suggests that at least some of the October incidents followed this pattern, with attackers focusing specifically on environment variables holding AI service credentials.

For customers of such platforms, the practical advice is consistent: treat any secret stored in a hosted environment as potentially exposed after a breach, rotate it promptly, and check usage logs for anomalies. Northflank's decision to enable audit logs for all customers, including free-tier users, gives those customers a way to review activity that might otherwise go unnoticed.

What remains unanswered

Several key questions about the Northflank breach remain open. The company has not said how attackers got in, how many customers were affected, or whether non-AI credentials were taken. It also has not confirmed whether the unauthorized AI API key usage reported by customers is directly linked to the attacks Wiz documented, though it has noted the possibility.

Wiz's researchers, for their part, have not tied all nine October incidents to a single actor. Their report describes infrastructure linked to AI access resale but stops short of connecting it to the original breaches.

For now, Northflank's public guidance is the clearest signal of the incident's scope: assume environment variables were decrypted, rotate secrets across workloads, secret groups, and global secrets, and disable public access to add-ons where enabled.

The bottom line for businesses

The Northflank incident, as reported by BleepingComputer, suggests that companies relying on AI development platforms should treat stored API keys as a financial exposure, not just a security one. The Wiz findings of approximately 2.5 million Amazon Bedrock API calls and approximately $100,000 in usage from compromised credentials show how quickly stolen keys can translate into real costs. Businesses using such platforms may want to review which secrets are stored in hosted environments, ensure that rotation procedures are in place, and monitor AI provider billing for unexpected spikes. The source material does not establish that every AI platform faces the same risk, but the pattern described by Wiz across at least nine incidents in October points to a consistent targeting of AI credentials, which could mean that any organization storing such keys with a third-party platform should verify its exposure and act on the rotation advice promptly.