{
  "type": "bundle",
  "id": "bundle--ebe96ff0-0102-4992-8151-4d99eecebb98",
  "objects": [
    {
      "type": "identity",
      "spec_version": "2.1",
      "id": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "Optimus Labs · Civilizations",
      "identity_class": "organization",
      "description": "Threat research team at Optimus Labs. Agentic AI attack surface research.",
      "contact_information": "https://optimuslabs.io/research/briefings"
    },
    {
      "type": "report",
      "spec_version": "2.1",
      "id": "report--1008e738-0101-4716-8109-502e110a9e4e",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "AI Provider Key Custodians Breached One After Another in October",
      "description": "Fireworks, OpenCode, LiteLLM and Railway hold customers' AI provider keys or environment variables, and each has been breached or backdoored. Warp lost agent trace and telemetry data. Wiz counts at least nine such platforms hit in October, including Andromeda, Zeabur, Lightning AI, CommandCode and Northflank, and has watched stolen keys resold within days. Attribution is unconfirmed.\n\nLive incidents, as of Nov 1, 2026. On Oct 6, Fireworks found that someone had used internal credentials to read environment variables, including API keys, in a limited number of customer accounts. On Oct 17, OpenCode said a breach of its hosted Console may have exposed provider keys for 1.4% of Console users. On the morning of Oct 21, a poisoned LiteLLM release went out through PyPI and Docker with a credential stealer built to take the provider keys a proxy stores. The same day, Railway said someone may have read decrypted customer environment variables and paused all deployments. In its preliminary report, Railway says the attacker was after AI provider keys for distillation. LiteLLM's attack chain starts with a master key committed to a public repository on May 27 and never revoked. No one has published a root cause that links all four. Wiz counts at least nine AI developer platforms that disclosed incidents in October.",
      "published": "2026-10-21T00:00:00.000Z",
      "report_types": [
        "threat-report"
      ],
      "confidence": 85,
      "labels": [
        "Credential",
        "Inference",
        "AI Asset Supply Chain Security",
        "Cyber Hygiene",
        "severity:critical"
      ],
      "object_refs": [
        "indicator--d13ae5a0-0108-4745-82fc-d6d1bd2435ce",
        "indicator--77a7bbb1-0102-4bfb-86a5-704a78aa87ac",
        "indicator--6a5a0f64-0103-445c-8b59-db386b5de3c0",
        "indicator--4c199828-0105-4216-8d1c-5a3e4d1f5a3e",
        "indicator--ddfa2058-0105-45b5-8230-0fa13deff460",
        "indicator--c61fa28a-0102-4115-838e-29c61c722639",
        "indicator--857b4830-0102-4ebb-87b8-67975867e16e",
        "indicator--9c08831c-0102-4de9-862f-5c10b9d0b410",
        "indicator--7585d4e4-0102-4d48-8487-69ac7688922c",
        "software--58392834-0102-4ddd-893b-95e9593be611",
        "software--9157ed70-0102-4c1e-86fa-a7e92925a598",
        "software--4e18a728-0102-48fa-8f1a-efd24f1af022",
        "software--a57096cc-0102-4fc6-85b8-d36f6a672f69",
        "software--b4a90ef8-0102-4881-84a5-4e987b5ab277",
        "software--091b2f20-0102-496b-8819-a64b0a1db88b",
        "software--e94f7fb0-0102-4653-817b-2c61dea51c60",
        "software--76daf973-0102-485e-87d8-412d77ddb1d1",
        "software--4c422a93-0102-43c1-8d40-99524d44de54",
        "software--686a4e69-0102-49ff-8968-e796696cf868",
        "software--59c8ddc2-0102-4690-88ca-5b525acb6452",
        "software--f4d92c28-0102-4fdc-8a24-5c0cf5dbbc04",
        "software--051e80c8-0102-4549-841c-b5810620b611",
        "software--f0fbc6c7-0102-43b3-8e06-7a8cf1fe0a7a"
      ],
      "external_references": [
        {
          "source_name": "Optimus Labs · Civilizations",
          "url": "https://optimuslabs.io/research/briefings/ai-provider-key-custodians-breached-oct-2026"
        },
        {
          "source_name": "Andromeda: October 2026 security incident",
          "url": "https://andromeda.ai/security-updates/october-2026-security-incident"
        },
        {
          "source_name": "Zeabur: October 2026 security incident",
          "url": "https://zeabur.com/blogs/october-2026-security-incident"
        },
        {
          "source_name": "Lightning AI: October 2026 incident",
          "url": "https://lightning.ai/blog/oct-2026-incident"
        },
        {
          "source_name": "CommandCode on X",
          "url": "https://x.com/CommandCodeAI/status/2115583532055826770"
        },
        {
          "source_name": "Northflank status page",
          "url": "https://status.northflank.com/"
        },
        {
          "source_name": "Zach Lloyd (Warp CEO) on X, Oct 26",
          "url": "https://x.com/zachlloydtweets/status/2114800787716972873"
        },
        {
          "source_name": "International Cyber Digest on X: NVIDIA Brev (unconfirmed)",
          "url": "https://x.com/IntCyberDigest/status/2116580207197094359"
        },
        {
          "source_name": "Wiz: Black October for AI developer platforms",
          "url": "https://www.wiz.io/blog/black-october-for-ai-developer-platforms"
        },
        {
          "source_name": "Railway security disclosure, Oct 21",
          "url": "https://blog.railway.com/p/security-disclosure-wednesday-october-21st"
        },
        {
          "source_name": "Railway preliminary report, Oct 22",
          "url": "https://blog.railway.com/p/preliminary-report-october-security-incident"
        },
        {
          "source_name": "Railway incident status",
          "url": "https://status.railway.com/incident/QH8L8B3E"
        },
        {
          "source_name": "LiteLLM incident report, Oct 21",
          "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026"
        },
        {
          "source_name": "LiteLLM attack chain, Oct 23",
          "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain"
        },
        {
          "source_name": "LiteLLM security issue #47826",
          "url": "https://github.com/BerriAI/litellm/issues/47826"
        },
        {
          "source_name": "The Hacker News: LiteLLM compromised",
          "url": "https://thehackernews.com/2026/10/litellm-compromised-in-supply-chain.html"
        },
        {
          "source_name": "The Register: LiteLLM supply chain attack",
          "url": "https://www.theregister.com/security/2026/10/21/litellm-supply-chain-attack-hoovers-up-passwords-and-secrets/5304548"
        },
        {
          "source_name": "JFrog: LiteLLM hijacked again",
          "url": "https://research.jfrog.com/post/litellm-hijacked-again/"
        },
        {
          "source_name": "Socket: LiteLLM compromise",
          "url": "https://socket.dev/blog/litellm-compromise"
        },
        {
          "source_name": "Wiz: LiteLLM compromised, steals credentials",
          "url": "https://www.wiz.io/blog/litellm-compromised-steals-credentials"
        },
        {
          "source_name": "Endor Labs: LiteLLM 1.107.0",
          "url": "https://www.endorlabs.com/learn/litellm-1-107-0-compromised-python-startup-hooks-steal-cloud-ai-and-proxy-credentials"
        },
        {
          "source_name": "Fireworks October 2026 security incident",
          "url": "https://fireworks.ai/security/bulletins/october-2026-security-incident"
        },
        {
          "source_name": "LAVA: Fireworks AI incident",
          "url": "https://lava.security/blog/fireworks-ai-security-incident"
        },
        {
          "source_name": "OpenCode statement on X, Oct 17",
          "url": "https://x.com/opencode/status/2111519637049319818"
        },
        {
          "source_name": "Optimus Labs briefing #13: OpenCode Console",
          "url": "https://optimuslabs.io/research/briefings/opencode-console-breach-provider-key-exposure"
        },
        {
          "source_name": "Optimus Labs briefing: Salesloft Drift OAuth supply chain",
          "url": "https://optimuslabs.io/research/briefings/salesloft-drift-oauth-supply-chain"
        },
        {
          "source_name": "Optimus Labs briefing: arrayref poisoned Rust crate",
          "url": "https://optimuslabs.io/research/briefings/arrayref-rust-crate-build-time-rce"
        },
        {
          "source_name": "Optimus Labs briefing: Coder registry hijack",
          "url": "https://optimuslabs.io/research/briefings/coder-registry-infrastructure-hijack"
        },
        {
          "source_name": "Cloud Security Alliance: TeamPCP and AI infrastructure",
          "url": "https://labs.cloudsecurityalliance.org/research/csa-research-note-teampcp-ai-infra-supply-chain-20260406-csa/"
        },
        {
          "source_name": "Ars Technica: terabytes of credentials leaked",
          "url": "https://arstechnica.com/security/2026/08/terabytes-of-credentials-leaked-in-massive-supply-chain-attack/"
        },
        {
          "source_name": "Anthropic threat report, Sep 2026",
          "url": "https://www.anthropic.com/threat-intelligence-report-september-2026"
        },
        {
          "source_name": "OWASP Top 10 for Agentic Applications 2026",
          "url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/"
        },
        {
          "source_name": "OWASP Top 10 for LLM Applications 2026",
          "url": "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/"
        }
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--d13ae5a0-0108-4745-82fc-d6d1bd2435ce",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "sha256: 1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e",
      "description": "Docker tags on Oct 21: v1.107.0, latest, main-latest, main-stable (digest sha256:1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e)",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:hashes.'SHA-256' = '1bbcb1443bc962e45f5aad53fe3d2c30600e0379715fb6c664cdd3ac126c339e']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--77a7bbb1-0102-4bfb-86a5-704a78aa87ac",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "file: cook.py",
      "description": "Files in site-packages: cook.pth, cook.py, sitecustomize.py",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'cook.py']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--6a5a0f64-0103-445c-8b59-db386b5de3c0",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "file: sitecustomize.py",
      "description": "Files in site-packages: cook.pth, cook.py, sitecustomize.py",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[file:name = 'sitecustomize.py']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--4c199828-0105-4216-8d1c-5a3e4d1f5a3e",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "url: http://www.litellm.dev/healthcheck",
      "description": "Exfiltration: hxxp://www[.]litellm[.]dev/healthcheck. Dead drop: raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[url:value = 'http://www.litellm.dev/healthcheck']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--ddfa2058-0105-45b5-8230-0fa13deff460",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "domain: raw.githubusercontent.com",
      "description": "Exfiltration: hxxp://www[.]litellm[.]dev/healthcheck. Dead drop: raw[.]githubusercontent[.]com/letters9813/pythonclient-test/main/domain.txt",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[domain-name:value = 'raw.githubusercontent.com']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--c61fa28a-0102-4115-838e-29c61c722639",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "ipv4: 23.106.46.239",
      "description": "Key-checking addresses reported by Wiz (not tied directly to the original breaches): 23[.]106[.]46[.]239, 38[.]246[.]114[.]118, 104[.]243[.]32[.]50, 31[.]57[.]201[.]201",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '23.106.46.239']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--857b4830-0102-4ebb-87b8-67975867e16e",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "ipv4: 38.246.114.118",
      "description": "Key-checking addresses reported by Wiz (not tied directly to the original breaches): 23[.]106[.]46[.]239, 38[.]246[.]114[.]118, 104[.]243[.]32[.]50, 31[.]57[.]201[.]201",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '38.246.114.118']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--9c08831c-0102-4de9-862f-5c10b9d0b410",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "ipv4: 104.243.32.50",
      "description": "Key-checking addresses reported by Wiz (not tied directly to the original breaches): 23[.]106[.]46[.]239, 38[.]246[.]114[.]118, 104[.]243[.]32[.]50, 31[.]57[.]201[.]201",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '104.243.32.50']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--7585d4e4-0102-4d48-8487-69ac7688922c",
      "created_by_ref": "identity--b106305c-0100-414a-84ff-91eeab20701a",
      "created": "2026-10-21T00:00:00.000Z",
      "modified": "2026-10-21T00:00:00.000Z",
      "name": "ipv4: 31.57.201.201",
      "description": "Key-checking addresses reported by Wiz (not tied directly to the original breaches): 23[.]106[.]46[.]239, 38[.]246[.]114[.]118, 104[.]243[.]32[.]50, 31[.]57[.]201[.]201",
      "indicator_types": [
        "compromised",
        "malicious-activity"
      ],
      "pattern": "[ipv4-addr:value = '31.57.201.201']",
      "pattern_type": "stix",
      "valid_from": "2026-10-21T00:00:00.000Z",
      "labels": [
        "ai-provider-key-custodians-breached-oct-2026",
        "credential",
        "inference"
      ]
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--58392834-0102-4ddd-893b-95e9593be611",
      "name": "Fireworks AI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--9157ed70-0102-4c1e-86fa-a7e92925a598",
      "name": "OpenCode"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--4e18a728-0102-48fa-8f1a-efd24f1af022",
      "name": "LiteLLM"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--a57096cc-0102-4fc6-85b8-d36f6a672f69",
      "name": "Railway"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--b4a90ef8-0102-4881-84a5-4e987b5ab277",
      "name": "Warp"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--091b2f20-0102-496b-8819-a64b0a1db88b",
      "name": "Andromeda"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--e94f7fb0-0102-4653-817b-2c61dea51c60",
      "name": "Zeabur"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--76daf973-0102-485e-87d8-412d77ddb1d1",
      "name": "Lightning AI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--4c422a93-0102-43c1-8d40-99524d44de54",
      "name": "CommandCode"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--686a4e69-0102-49ff-8968-e796696cf868",
      "name": "Northflank"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--59c8ddc2-0102-4690-88ca-5b525acb6452",
      "name": "NVIDIA Brev"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f4d92c28-0102-4fdc-8a24-5c0cf5dbbc04",
      "name": "Anthropic"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--051e80c8-0102-4549-841c-b5810620b611",
      "name": "OpenAI"
    },
    {
      "type": "software",
      "spec_version": "2.1",
      "id": "software--f0fbc6c7-0102-43b3-8e06-7a8cf1fe0a7a",
      "name": "Google"
    }
  ]
}