Nine AI developer platforms report breaches in October, Wiz links stolen keys to LLM resale

Nine platforms in one month

Wiz lists the platforms that disclosed incidents: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16 and 17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28) and Northflank (Oct 30). The firm says that in any other month this would be the top security story, yet few reports connect the incidents to each other. It names the Cloud Security Alliance as a notable exception.

Fireworks, OpenCode and Warp have reported indications of an "agent swarm" attack, according to Wiz. Andromeda's incident report calls its case part of an "industry-wide attack." OpenCode and CommandCode have explicitly attributed their incidents to an attempt at distillation. Zeabur has published a full write-up and will shut down because of the incident. Railway has released a preliminary report and timeline.

What the root causes have in common

Most incidents are still under analysis, and detailed technical information is limited. Wiz says Fireworks, Zeabur and Lightning all attribute their root causes to credential access. Lightning had earlier been affected by a supply chain attack within the Mini-Shai Hulud campaign. Railway believes initial access came through "privilege escalation in our build infrastructure." Warp has suggested a third-party vendor dependency, and OpenCode points to a "legacy system."

No single vulnerability or dependency links the attacks. Still, Wiz notes that all public reports describe targeted exploitation that hunted stored environment variables, especially those granting AI access. The firm ties this to two trends: agentic attacks, which can let threat actors compromise victims faster, and the rise of LLMJacking with its associated infrastructure of LLM brokers. Together these create a market that makes stolen credentials easy to monetize. Distillation, notably alleged against Chinese AI labs, adds to the demand.

Reported impact and two cases Wiz observed

Public reports of impact have been anecdotal so far. They include an alleged theft of about $371,000 in cryptocurrency using keys stored in Railway, and abuse of stolen AI access from OpenCode that produced consumer bills in the hundreds to thousands of dollars.

Wiz says it has also seen downstream abuse of enterprise credentials that it can attribute to one of these vendor breaches. In two cases, keys that had been heavily used from a compromised vendor's infrastructure were tested within 30 minutes of the reported credential access. The first activity was a single InvokeModel call from a residential IP address, part of a one-minute sweep across multiple organizations. The call requested Claude Fable 5.1, failed, and fell back to Opus 5.5, which worked. Afterwards both keys saw only 14 to 120 calls a day, which Wiz reads as a single job checking that the keys stayed valid.

• Case A: Four days after validation, a rotating proxy pool probed models from Amazon Nova, DeepSeek, gpt-oss, GLM, Kimi, Grok, GPT-6 Astra and older Claude models. Over thirty hours, until the key was remediated, the actor made approximately 800k Bedrock calls, about 90% of them successful. The key's policy allowed global.* cross-region inference profiles, so only about 6% of calls were throttled. Opus models made up three quarters of successful calls, led by Opus 5 (36%), Opus 5.5 (22%) and Opus 4.8 (10%).
• Case B: This key was restricted to us.* inference profiles, so early attempts using global.* failed. Once a script identified the working model IDs, a single Level 3 address made approximately 1.7 million Bedrock calls over thirteen hours, with over a million successful. Nearly all the rest were throttled by regional quotas. Opus 5.5, Sonnet 4.5 and Opus 5 made up three quarters of successful calls.

Wiz says the same boto3 script, down to the version string, probed both keys. The token profile resembles resold coding-agent traffic: small uncached inputs typical of prompt caching, plus a long tail of calls with tens of thousands of uncached input tokens, consistent with many end users behind a reseller. At list price, the two cases alone likely ran up over $100k in usage, according to Wiz.

The resale operations behind the keys

Wiz Research linked the keys to overt reselling organizations, though it says it cannot definitively establish whether these groups were behind the initial compromise or the flood of abuse. They did have access to the compromised keys and tested them from their own infrastructure.

One actor, centered on the IP address 23.106.46.239, appears to call themselves "momo." Wiz says this actor had access to the keys in both cases and is tied to llm-routing.com, a site that is currently active and advertises discounted access to frontier models, with payment in USDT. Infrastructure linked to the address goes back to 2025 and has hosted several sites with titles related to LLM resale. On October 8, 2026, a subdomain on the same address hosted a page titled "ARTEX", described as an autonomous penetration testing console. Zeabur publicly named the same IP as part of its compromise. In late October the address ran API key checks on the keys from both cases.

Wiz also identified a second resale hub, xingjiabiapi.org, which offers a wide range of frontier models at discount prices using stolen keys. That multiple actors used the keys suggests a robust market for this type of credential, according to Wiz.

What it means for platform users

The cases show how quickly stolen AI credentials are tested and put to use: first validation came within 30 minutes of the reported credential access at the vendor. Wiz's findings also show that key restrictions mattered. The restricted key in Case B was slowed by regional quotas, while the broader policy in Case A let the actor spread load globally. Teams that store AI access keys as environment variables on third-party developer platforms are exactly what the reported attacks have targeted. Wiz customers are pointed to its Threat Intel Center advisories on the Railway breach, the Lightning AI incident and the wider campaign.