Technology · Cybersecurity · AI · LLMJacking
Fireworks AI, Lightning AI, Railway, Warp, Northflank and four more disclosed incidents in a single month. Attackers hunted stored environment variables for AI keys, tested them within 30 minutes, and ran up over $100,000 at one enterprise victim. One company, Zeabur, is shutting down.
SAN FRANCISCO, October 31, 2026 — The LLMJacking Black October AI platforms story now has a name, a count and a body count of one company. Wiz Research, in an October 30 report titled “Black October for AI Developer Platforms,” counts at least nine platforms that disclosed security incidents during the month: Fireworks AI (October 6), Andromeda (October 9), Zeabur (October 14), Lightning AI (October 15), OpenCode (October 16–17), Railway (October 20), Warp (October 23), CommandCode (October 28) and Northflank (October 30). Wiz does not claim a single actor ran all nine — and the Cloud Security Alliance notes only Railway has used the word “campaign” — but the pattern across the disclosures is consistent enough to name: attackers broke into the platforms developers build on, and what they hunted, above everything else, was stored environment variables containing AI provider keys.
LLMJacking, explained
LLMJacking is the theft and abuse of credentials that unlock large language models. A stolen API key for a frontier model is instantly monetisable in three ways: the thief can burn the victim's quota for their own inference; resell access through “LLM broker” services that advertise discounted frontier-model access — Wiz linked one resale operation, around an actor calling themselves “momo,” to infrastructure that has hosted LLM resale sites since 2025 and accepts payment in USDT; or use the key for distillation, running a frontier model at scale to train a cheaper imitation — the motive OpenCode and CommandCode explicitly attributed to their incidents, and the one Railway's attacker payloads pointed to. Wiz observed the downstream abuse directly in two enterprise cases it could tie to a vendor breach: in both, the first unauthorised activity came within 30 minutes of the reported credential access, beginning with a single InvokeModel call from a residential IP address testing stolen keys. One case ran about 800,000 calls over roughly 30 hours, about 90% succeeding, with Opus-class models making up about three-quarters of successful calls; the other ran about 1.7 million calls in roughly 13 hours. Across the documented enterprise abuse, usage at list price exceeded $100,000 at a single victim. On the platform side, the numbers compound: Zeabur's write-up describes an attacker reading some 3.2 million environment-variable records across 321,810 accounts, and Railway puts its potential exposure at up to 100,000 workspaces — at most 1.85% of its total.
The environment-variable attack path
The month's mechanics deserve attention because they are ordinary. Modern AI platforms store customers' secrets — database URLs, payment keys, cloud credentials and AI provider keys — as environment variables, concentrated in build systems and control planes. Whoever reaches that store reaches every tenant at once, which is why attackers target the intermediary platform rather than the model provider or the end customer. The reported root causes vary: Fireworks, Zeabur and Lightning AI attribute theirs to credential access; Railway believes initial access came through privilege escalation in its build infrastructure, after which the attacker decrypted part of its environment-variable store with credentials found in its CI system; Warp has suggested a third-party vendor dependency; OpenCode blames a legacy system. Fireworks, OpenCode and Warp each reported indications of an “agent swarm” attack — automated, parallelised intrusion tooling — and Andromeda called its incident part of an “industry-wide attack.” Anecdotal reports compiled by Wiz include alleged cryptocurrency theft of about $371,000 using crypto keys stored in Railway. Zeabur, a Taiwanese hosting platform hit for the second time in two months, published the fullest post-incident write-up of the nine — and announced it will shut down, citing the incident as a contributing factor; its founder noted the system began as a project built quickly three and a half years ago.
Why this matters: the enterprise readiness gap
Black October's real lesson is not that nine startups had bad months; it is where the keys were sitting. Enterprises connected their own AI provider accounts to these platforms to build faster, and the platforms became concentrated vaults of other companies' credentials — a supply-chain shape the security industry has seen before with code hosts and CI services, now repeated at AI speed. The readiness gap is measurable in the response gap: most of the nine incidents are still being analysed, detailed technical information is mostly not public, and no platform has published how many customer keys were taken in total. Meanwhile the abuse clock runs at 30 minutes from theft to first fraudulent call. The Cloud Security Alliance's first recommendation is procedural and unglamorous: rotate AI provider keys at the issuing provider, not only on the platform — a key changed in the platform's console but not revoked at the provider remains live. Railway has told customers to rotate any sensitive environment variable set before October 21, remove public network access to databases and review GitHub audit logs. That advice, issued platform by platform, is what an industry without a shared incident playbook looks like. The same week, this newsroom reported Chainalysis's disclosure of an agentic intrusion — a different technique with the same signature: AI-speed offence, human-speed disclosure.
Context: from cryptojacking to LLMJacking
LLMJacking is cryptojacking's successor, and the succession is instructive. Cryptojackers stole compute — electricity and CPU cycles — to mine coins, and the theft was denominated in hardware wear and power bills. LLMJackers steal metered intelligence: inference priced per token on someone else's account, resalable at a discount through broker storefronts, or convertible into a distilled model that keeps its value after the key is revoked. The resale market is what makes the crime scale: as Wiz puts it, brokers create a market that makes theft easily monetisable, and distillation demand — notably alleged against some AI labs — pulls from the other side. October's cluster is what a maturing theft economy looks like from outside: specialised targets (platforms holding many keys), specialised tooling (agent swarms hunting environment variables by name — Railway's logs show the attacker searching for AI key names specifically), and specialised fences (resale sites taking USDT).
Multiple angles: who failed whom
Platform customers reasonably ask why their provider-held keys were reachable in bulk and, in Railway's account, decryptable with CI credentials. Platforms reasonably answer that they were hit by an industry-wide campaign with agentic tooling, that they disclosed, and that the end customers who stored production keys with broad permissions share the exposure. Model providers sit in a third position: the keys are theirs to revoke and their models are the loot, yet the abuse in Wiz's cases ran for 13 to 30 hours before it was characterised — detection of anomalous InvokeModel volume is a provider-side control that plainly has room to improve. The uncomfortable consensus across all three positions is that everyone treated AI keys as configuration, when in value terms they had already become cash.
What happens next
Rotation is the immediate order: any team that held keys on the nine platforms should treat them as compromised, revoke at the provider, and audit usage for October. After that comes the structural reckoning — short-lived, scoped credentials instead of permanent keys in environment stores; provider-side anomaly detection that kills a key after its ten-thousandth call from a residential IP; and disclosure norms that publish key counts, not just incident notices. More disclosures may still come: Wiz's list is of platforms that have disclosed, and the month may not have finished confessing. Zeabur's shutdown is the first corporate death attributed to the campaign; whether it remains the only one depends on how many of the nine can convince enterprise customers that the vault has been rebuilt. Black October will be cited for years — the open question is whether it is cited as the month AI security grew up, or as the first month of a longer season.
Related coverage: Chainalysis Confirms Breach After Attacker Used 'Offensive Agentic Techniques' to Reach Internal Tools · Armadin’s $255.5M Bet: Kevin Mandia Raises a Fortune to Let AI Agents Attack First
Sources
- Wiz Research (October 30, 2026) — 'Black October' for AI Developer Platforms — the nine disclosures and dates; the environment-variable pattern; agent swarm indications at Fireworks, OpenCode and Warp; Zeabur's shutdown; the 'momo' resale infrastructure; keys first abused within 30 minutes.
- The Futurum Group (October 31, 2026) — LLMJacking wave analysis: nine platforms in a single month, downstream enterprise credential abuse over $100k in usage at list price, and the credential-access root causes at Fireworks, Zeabur and Lightning AI.
- The Injection, summarising Wiz and the Cloud Security Alliance (October 30, 2026) — Railway's exposure of up to 100,000 workspaces (1.85%); the two Amazon Bedrock abuse cases of about 800,000 and 1.7 million calls; the CSA recommendation to rotate keys at the issuing provider.
- DEV Community analysis of the Wiz report (October 2026) — The nine-incident table with disclosure dates; Railway's privilege-escalation account; Lightning AI's earlier Mini-Shai Hulud supply-chain compromise.