Northflank tells customers to assume every environment variable was decrypted after AI keys are abused
After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers then reported unauthorized use of AI API keys stored on the platform. Wiz counts nine AI developer platform incidents in October.
Cloud hosting platform Northflank told customers on October 30 to "assume all environment variables have been decrypted" and to disable and rotate every key, after a threat alert from Wiz at 11:43 UTC that morning. According to its status page, engineers began patching network policy at 12:02 and asked for Wiz's incident response team at 13:00. By that evening customers had reported unauthorized use of AI API keys stored on the platform, and Northflank told them to revoke credentials at each provider and review usage and billing logs. It turned on audit logs for every account, including free ones, and over the next day shipped secret rotation for its Postgres, MongoDB, MySQL, Redis, Minio and RabbitMQ add-ons. Northflank has not said how the attacker got in or how many customers were affected.
Why it matters
Wiz's "Black October" report, published the same day, counts nine incidents at AI developer platforms in October, including OpenCode, Zeabur, Railway, Warp and Northflank, with attackers hunting environment variables that grant AI access. It found "no single vulnerability or dependency linking these attacks." A platform that decrypts customer secrets for its workloads is one place to steal everyone's non-human identities.
If you ran on Northflank, rotate at the provider, not just in the platform, and check AI billing first, since that is where abuse shows. Everywhere else, prefer short-lived credentials through workload identity federation where a provider supports it, and put spend limits on AI keys. The pattern is static API key abuse.
Update, November 5, 2026: In a November 2 status update, Northflank said the attack was contained within an hour of the first alert, appeared focused on control plane secrets, and did not affect running workloads or dedicated and forward-deployed control planes. It patched the Linux kernel TCP flaw CVE-2026-98432 across its fleet and revoked certain tokens, sessions, VCS integrations and cross-account IAM roles. It plans to publish a root cause analysis.
Source: BleepingComputer
Related on Start with Identity
- BlogGoogle: LLMjacking starts with stolen cloud identities and has cost some companies $1 million
Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at s
- BlogIBM makes Agent Identity and HashiCorp Vault 2.2 generally available to govern AI agents
At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle
- BlogInfisical raises a $40 million Series B to build secrets and credential access for AI agents
Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in se
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVECommvault Web Server zero-day that exposed Metallic Microsoft 365 app secrets
An authenticated webshell flaw in Commvault Web Server, used as a zero-day in Commvault's Azure environment, where the actor may have reached client secrets cus
- ReportIdentity Breach Report 2026: how attackers get in
120 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 40 with a known MFA status, and 45.8% of 2025-2026 cases had no login for MFA to protect.