Wiz said on 30 October that at least nine AI developer platforms reported security incidents this month. Fireworks, OpenCode and Warp reported signs of an "agent swarm" attack, meaning many AI agents working together. OpenCode and CommandCode tied theirs to distillation, meaning copying a model's skills from its answers. Zeabur said it will shut down.
Most cases are still being analysed. Fireworks, Zeabur and Lightning point to credential access. Railway cites its build systems, Warp a third-party vendor, and OpenCode a legacy system. Wiz says no single flaw links them. Public reports say attackers hunted stored environment variables, especially those granting AI access.
In two cases Wiz traced, the first misuse of a stolen key came within 30 minutes of the vendor's reported credential access. It was one test call from a home IP address, in a one-minute sweep. Light checks followed, then a model probe, a quota check and bulk traffic. One key made about 800,000 calls in thirty hours. The other key allowed only US routing profiles, so it hit regional quotas, yet made about 1.7 million calls in thirteen hours. Wiz found resale operators held both keys, pointing to a market. Which AI keys sit on third-party platforms, how tightly are they scoped, and who gets spend alerts?