AI Provider Key Custodians Breached One After Another in October

Fireworks, OpenCode and Railway are hosted platforms that store customer secrets, and an intruder reached each one. Fireworks says internal credentials were used to capture evaluation-job variables and that it found no access to customer models, datasets or inference traffic. OpenCode's Console was reached through a legacy system being retired. Railway says the attacker escalated privileges in its build infrastructure and pulled secrets in encrypted form, and that a subset of customers had secrets exposed that need rotating.

LiteLLM is different. It is the open source gateway many teams run themselves, and the poisoned release ran inside their own environments. It reads the proxy's provider-key table directly, takes cloud credentials, SSH keys and environment variables, and installs a backdoor that checks in hourly.

LiteLLM's attack chain starts on May 27, when a config file committed to a public repository held the master key to its internal LiteLLM Agent Platform. The commit was force-pushed over, but the key was never revoked. On Oct 10 the attacker used it to read the Agent Platform, which returned a GitHub CLI token belonging to an organization owner. LiteLLM says that token was not scoped down and skips GitHub's re-authentication for sensitive actions.

With owner access, the attacker pushed throwaway workflows that posted two maintainers' tokens, stored as CI secrets, to the attacker's endpoint, and took tokens for other internal systems, with a focus on upstream inference API keys. Release approval had been relaxed that week from a device-locked account to any two engineers, so one token triggered the release and another approved it; a third deleted the run records. The build ran from a look-alike repository, Berri-AI instead of BerriAI, and the official source tag stayed clean. JFrog notes that reading the source would have missed it.

Hijacked publishing access is a repeat pattern in our own briefings: in arrayref, a compromised maintainer account pushed malicious crates to crates.io.

OpenCode and Railway tie their breaches to distillation, the pulling of a strong model's answers at scale to train a cheaper copy. Anthropic says distillers often use stolen API credentials from legitimate customers. Railway adds that the attacker appeared to have abliterated models and substantial compute. LiteLLM says the attacker's activity focused on upstream inference API tokens. Fireworks has named no motive, and no source links the four incidents to one actor.

Our read, not the vendors': a gateway or platform holds keys for many customers in one place, so one intrusion yields a pile of paid, aged accounts with normal usage history. That is plausible, not proven. Stored tokens as the way in is not new: in Salesloft Drift, attackers stole the OAuth tokens a vendor held for customers and used them against customer CRMs.

Wiz counts at least nine AI developer platforms that disclosed incidents in October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Fireworks, OpenCode and Warp describe an "agent swarm" attack, and OpenCode and CommandCode attribute theirs to distillation. Root causes differ: credential access at Fireworks, Zeabur and Lightning, build infrastructure at Railway, a third-party dependency at Warp, a legacy system at OpenCode. Every public report describes attackers hunting stored environment variables, especially AI access. Zeabur is shutting down.

Warp's CEO said on Oct 26 that an agent swarm, likely starting with a hole in a vendor dependency, reached a limited amount of agent trace and telemetry data, with an upper bound of roughly 1% of users. Warp has not reported provider keys taken, and is working with CrowdStrike and law enforcement.

NVIDIA Brev may be a tenth. International Cyber Digest reports that NVIDIA told users of unauthorised activity from Oct 4 to 20 that may have exposed the SSH keys Brev set up for their VMs. We have not seen NVIDIA's notice, so treat this as reported, not confirmed. Andromeda, Zeabur, Lightning AI, CommandCode and Northflank have published less, and no single vulnerability links them.

Five more platforms disclosed incidents in October, per Wiz. Details are thin, and the dates are Wiz's.

Andromeda (Oct 9): its incident report calls the breach part of an "industry-wide attack".

Zeabur (Oct 14): its write-up puts the root cause at credential access and names attacker address 23[.]106[.]46[.]239, active Oct 12 to 14. Zeabur is shutting down because of the incident.

Lightning AI (Oct 15): its notice also points to credential access. Wiz notes Lightning was hit earlier in the Mini Shai-Hulud campaign.

CommandCode (Oct 28): its post on X ties the incident to an attempt at distillation, as OpenCode did.

Northflank (Oct 30): disclosed on its status page. No root cause is public yet.

NVIDIA Brev (reported, not confirmed): see above. NVIDIA has not published a notice we can check.

If you stored keys or environment variables on any of these, treat them as exposed and rotate them at the provider that issued them.

Wiz followed two enterprise AWS Bedrock keys it ties to one of these vendor breaches. Each was tested within 30 minutes of the theft by a single model call from a residential address, in a one-minute sweep across several organizations. A small checker then pinged both keys every day to confirm they still worked.

Four days later, the first key was flooded: about 800,000 Bedrock calls in 30 hours, mostly Opus models. Its policy allowed global cross-region inference profiles, so only about 6% of calls were throttled. The second key was restricted to US profiles. A reseller pool failed for hours until a checker found the working model IDs, then one address made about 1.7 million calls in 13 hours, with most of the rest throttled by regional quotas. Wiz estimates over $100,000 in usage at list price across the two.

Wiz traced checks on both keys to two open resale sites selling discounted frontier-model access, one at an address Zeabur named in its own breach. Wiz cannot tie either site to the original theft. Our read: key scope is a blast-radius control. The restricted key still leaked, but it cost the attacker a day and ran into quotas.

On Mar 24, versions 1.82.7 and 1.82.8 reached PyPI for about 40 minutes after attackers took LiteLLM's publishing token through a poisoned Trivy scanner (Cloud Security Alliance). CloudSEK later counted more than 2,500 organizations in the captured data, which means potential exposure, not confirmed compromise. JFrog says the October release uses different payloads and infrastructure and that no evidence links it to the March actor. Both went after the same asset: the keys a gateway holds.

In the Agentic Applications Top 10, ASI04 Agentic Supply Chain Vulnerabilities covers LiteLLM and the hosted custodians, and ASI03 Identity & Privilege Abuse covers the stolen keys. In the LLM Applications Top 10, LLM02 Sensitive Information Disclosure names API keys as protected information, and LLM06 Unbounded Consumption covers what stolen keys are used for, including distillation theft.

The OWASP GenAI Security Project does not endorse any product, service or tool, including Optimus Labs. We cite its lists to classify these incidents.

As of Nov 1, 2026, unpublished: how many Railway accounts were affected and the specific exploits used against Railway, which it says it will disclose later, how the Fireworks intruder got the internal credentials, whether the four (or the nine Wiz counts) share an actor, who ran the floods Wiz observed, and how many of the stolen keys are in use today.