Northflank breach exposes AI API keys as attackers target developer platforms

Developer-focused cloud platform Northflank has instructed its user base to immediately refresh all stored credentials and secrets following a breach that resulted in attackers gaining access to customers' artificial intelligence API keys.

Northflank operates as a cloud infrastructure service enabling software teams to deploy applications, containers, databases, and AI workloads without direct management of underlying compute resources.

On October 30, Northflank disclosed the incident after receiving a security alert from Wiz, a cloud security firm. The platform subsequently notified all users to treat their environment variables as compromised and to assume the secrets contained within them had been extracted.

Assume all environment variables have been decrypted. Disable/rotate all keys.

Northflank, October 30 update

Environment variables commonly hold sensitive data such as database credentials, cloud authentication tokens, and API keys. Exposure of these materials enables attackers to compromise downstream services, trigger unauthorized charges, or extract customer information.

Northflank subsequently confirmed that multiple customers had experienced unauthorized activity tied to their AI API keys stored on the service.

Users have reported unauthorised use of AI API keys supplied to the Northflank platform. If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately.

Northflank

The platform advised customers to examine their AI provider billing and usage records for anomalous activity and to report any suspicious behavior to both Northflank and their AI service vendors.

According to Northflank's published timeline, Wiz notified the company of the breach at 11:43 UTC on October 30. Northflank's technical team reviewed the alert within one minute and deployed a network policy fix, with additional patches applied at 12:50 UTC and 13:05 UTC. The company also engaged Wiz's incident response specialists.

Northflank has not revealed the attack vector, the number of affected customers, or whether attackers accessed credentials beyond the reported AI API keys.

In response, Northflank activated credential rotation capabilities for PostgreSQL, MongoDB, MySQL, and Redis databases. The company also activated audit logging across all customer accounts, including those on free tiers, to enable investigation of unauthorized access.

The platform continues recommending that customers rotate secrets across workloads, secret groups, and global secrets, and disable public access to add-ons where applicable.

Broader wave of AI platform attacks

The Northflank incident is part of a larger pattern of attacks targeting AI development infrastructure. Security researchers view these platforms as high-value targets because they house API credentials that grant access to expensive AI services.

Wiz published research titled "Black October for AI Developer Platforms" documenting at least nine security incidents affecting AI development services during the month. Affected platforms included Northflank, Railway, OpenCode, Warp, and Lightning AI.

The Railway breach similarly involved potential exposure of decrypted environment variables belonging to customers. OpenCode disclosed compromised AI API keys, while Warp reported a breach exposing AI agent logs and user telemetry.

Wiz researchers identified a pattern in which attackers deliberately targeted environment variables storing AI service credentials through a technique called LLMJacking. This practice involves leveraging stolen credentials to make API calls to AI models using another organization's account, resulting in substantial charges or enabling resale of the compromised access.

In two incidents analyzed by Wiz, stolen enterprise credentials were used to execute approximately 2.5 million Amazon Bedrock API calls, accumulating roughly $100,000 in charges. Researchers also uncovered infrastructure offering resold access to AI models, though they could not definitively connect these operations to the initial breaches or widespread abuse.

Wiz has not established that a single threat actor orchestrated all nine incidents, though many shared the objective of obtaining AI API keys. Northflank referenced Wiz's findings in its own incident communications, suggesting that customer reports of unauthorized AI key usage align with the broader attack campaign documented by researchers.