Northflank tells customers to assume every environment variable was decrypted after AI keys are abused
After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers then reported unauthorized use of AI API keys stored on the platform. Wiz counts nine AI developer platform incidents in October.
Cloud hosting platform Northflank told customers on October 30 to "assume all environment variables have been decrypted" and to disable and rotate every key, after a threat alert from Wiz at 11:43 UTC that morning. According to its status page, engineers began patching network policy at 12:02 and asked for Wiz's incident response team at 13:00. By that evening customers had reported unauthorized use of AI API keys stored on the platform, and Northflank told them to revoke credentials at each provider and review usage and billing logs. It turned on audit logs for every account, including free ones, and over the next day shipped secret rotation for its Postgres, MongoDB, MySQL, Redis, Minio and RabbitMQ add-ons. Northflank has not said how the attacker got in or how many customers were affected.
Why it matters
Wiz's "Black October" report, published the same day, counts nine incidents at AI developer platforms in October, including OpenCode, Zeabur, Railway, Warp and Northflank, with attackers hunting environment variables that grant AI access. It found "no single vulnerability or dependency linking these attacks." A platform that decrypts customer secrets for its workloads is one place to steal everyone's non-human identities.
If you ran on Northflank, rotate at the provider, not just in the platform, and check AI billing first, since that is where abuse shows. Everywhere else, prefer short-lived credentials through workload identity federation where a provider supports it, and put spend limits on AI keys. The pattern is static API key abuse.
Update, November 5, 2026: In a November 2 status update, Northflank said the attack was contained within an hour of the first alert, appeared focused on control plane secrets, and did not affect running workloads or dedicated and forward-deployed control planes. It patched the Linux kernel TCP flaw CVE-2026-98432 across its fleet and revoked certain tokens, sessions, VCS integrations and cross-account IAM roles. It plans to publish a root cause analysis.
Source: BleepingComputer
Related on Start with Identity
- BlogTrigger.dev says an attacker read environment variables for a subset of customer organizations
AI workflow platform Trigger.dev disclosed on November 1 that an attacker gained unauthorized access to environment variables for a subset of organizations. It
- BlogGoogle: LLMjacking starts with stolen cloud identities and has cost some companies $1 million
Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at s
- BlogIBM makes Agent Identity and HashiCorp Vault 2.2 generally available to govern AI agents
At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVELiteLLM MCP gateway accepts any Bearer token after key validation fails
LiteLLM's MCP Streamable HTTP endpoint fell back to an empty auth object when key validation failed, so a fabricated Authorization header reached the gateway's