A breach at the cloud hosting platform led customers to report unauthorized use of their stored AI provider keys.
BleepingComputer reports that Northflank, a cloud hosting platform, disclosed a security incident on October 30 after a threat alert from Wiz, telling customers to rotate their environment variables and API keys and assume those secrets had been exposed. Northflank later confirmed that multiple customers had reported unauthorized use of AI API keys stored on the platform, and advised everyone to check their AI provider usage and billing logs for unexpected activity. The company has not said how attackers got in or how many customers were affected.
Northflank applied network policy patches, brought in Wiz's incident response team, enabled credential rotation for several database types, and turned on audit logs for all customers, including free accounts. The report ties the incident to Wiz's wider "Black October for AI Developer Platforms" findings, which counted at least nine incidents that month at platforms including Railway, OpenCode, Warp and Lightning AI, with stolen AI credentials in some cases used for roughly 2.5 million Amazon Bedrock API calls.
Why it matters: AI provider keys are now high-value targets sitting inside everyday cloud and developer platforms, not just inside AI products themselves. Enterprises should treat AI API keys like production secrets: scope them narrowly, rotate them on a schedule, and monitor provider billing dashboards as an early warning signal, not an afterthought.