- Wiz says at least nine AI developer platforms disclosed incidents in October, and public reports point to theft of stored environment variables, especially those granting AI access.
- Wiz traced two stolen enterprise keys to roughly 2.5 million model calls. It says the first test came within 30 minutes, but the heavy abuse began days later.
- Leaders should ask which AI keys sit in third-party platforms, and how fast they can detect and rotate them once a vendor reports an incident.
A stolen AI key is cash with a login screen
Security teams are used to thinking of stolen credentials as a way into a network. Wiz's October research shows how a different model plays out: a stolen AI key is a way to spend someone else's money. Wiz ties this to the existing trend it calls LLMJacking, where brokers make stolen access easy to sell. The thief does not need to break in further. Others can test the access, and the victim is left exposed to the bill.
That is the idea worth taking from Wiz's analysis of what it calls "Black October". The company counts at least nine AI developer platforms that disclosed incidents during the month. Wiz says few reports connect them. One limit matters up front: Wiz says it has no evidence linking the resale infrastructure it found directly to the Black October attacks.
What the platforms have said so far
Most of the incidents are still being analysed, and Wiz says detailed technical information is limited. The root causes named so far differ. Fireworks, Zeabur and Lightning attribute theirs to credential access. Railway says it believes initial access came through privilege escalation in its build infrastructure. Warp points to a third-party vendor dependency. OpenCode cites a "legacy system".
Wiz does not find one flaw or shared dependency behind all the incidents. What the public reports share is the target. Wiz says attackers hunted stored environment variables, especially those granting AI access. Zeabur has said it will shut down because of its incident.
The reported losses so far come from social media posts, which Wiz treats as anecdotal. They include alleged cryptocurrency theft of about $371,000 using cryptocurrency keys stored in Railway. They also include consumer bills of hundreds to thousands of dollars after stolen OpenCode access was abused.
How two enterprise keys were used
Wiz says it went further and saw misuse of company keys that it links to one of these vendor breaches. It describes two cases. In both, the keys had earlier been used heavily from a compromised vendor's systems.
The first test of each key came fast. Less than half an hour after the reported credential access, Wiz saw a single InvokeModel call, the basic request to run an AI model on Amazon Bedrock. The call came from a home internet address. It was part of a one-minute run that tried stolen keys belonging to several organisations.
The heavy abuse came later. For days, each key saw only 14 to 120 calls a day, which Wiz reads as a job checking the keys stayed valid. In the first case, a proxy pool probed the available models four days after the first test. Bulk traffic followed within hours.
In that first case, the key's policy let the actor route requests through global inference profiles, which spread load across regions. Wiz says the actor made about 800,000 Bedrock calls over thirty hours, and about 90% succeeded. Only about 6% were throttled.
The second key was restricted to US-region profiles. Seven days after the first test, it appeared in an apparent reseller pool. For four hours, that pool failed against it, because it asked for global profiles. Later a checker found the working US model IDs. Then a single address made about 1.7 million calls over thirteen hours, with over a million succeeding. Nearly all the rest hit the account's regional quotas.
The restriction did not stop the abuse. It did make the actors work to find a way in, and quotas capped the throughput.
A resale market, in Wiz's words
Wiz says the token usage resembles resold coding-agent traffic: small uncached inputs, short outputs, and a tail of much larger calls. At list price, it estimates the two cases together probably cost more than $100k.
Wiz also tied two resale sites to the keys. Operators of both had access to the keys and tested them. One ran its permission checks after heavy abuse had already begun from other addresses. Wiz says that suggests an active resale market. It adds a limit: it cannot establish how these operators relate to the initial compromise or to the flood of calls.
What leaders should ask
The lesson here is that the cost of an AI key is the damage someone can do before you notice. In both cases the cheap warning came early, and the large usage came days later. That gap is the part a defender can use. Ask your teams four questions.
First, which AI provider keys are stored as environment variables on platforms you rent, and who owns each one? Second, once a vendor reports an incident, how fast can you detect and rotate those keys? Wiz saw the first test within 30 minutes, but the flood began days later. Third, do policies limit models and regions, and do quotas cap spending? Fourth, would anyone notice a trickle of 14 to 120 calls a day from an unfamiliar address?
A key held by a vendor is only as safe as that vendor's worst month. The days between the first test and the flood are the time you have to act.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wiz.
