Northflank told every customer to assume that all environment variables stored on its platform had been decrypted and to rotate every key. The October 30 warning followed a threat alert from cloud security company Wiz. Northflank later confirmed that customers had reported unauthorized use of AI API keys supplied to the cloud application hosting platform. Those keys can turn a breach of deployment infrastructure into direct access to metered AI services, with the bill landing on the customer.
According to Northflank's published timeline, Wiz alerted the company at 11:43 UTC on October 30. Northflank engineers reviewed the alert one minute later, applied a network policy patch, and deployed additional patches at 12:50 UTC and 13:05 UTC. The company also requested help from Wiz's incident response team.
Northflank has not disclosed how the attackers obtained access, how many customers were affected, or whether credentials other than the reported AI API keys were stolen or abused. Its instructions nevertheless set the working scope clearly: rotate user-provided secrets in workloads, secret groups, and global secrets. Customers should also disable public access to add-ons where it is enabled.
Environment variables are a common interface between deployment systems and applications. They often contain database passwords, cloud credentials, authentication tokens, and third-party API keys. A platform that can decrypt those variables sits on a dense collection of credentials spanning many customers and services. Once an attacker reaches that layer, each secret can provide another route into a customer's infrastructure or an account capable of generating charges.
AI credentials are particularly easy to monetize because the service is consumed through authenticated API requests. Wiz calls the abuse of stolen AI credentials "LLMJacking": attackers use another organization's keys to invoke models, accumulate charges, or resell access. In two cases investigated by Wiz, compromised enterprise credentials made about 2.5 million Amazon Bedrock API calls and generated approximately $100,000 in usage.
The Northflank incident was one of at least nine October incidents involving AI development platforms identified by Wiz. The list included Railway, OpenCode, Warp, and Lightning AI. Railway also faced potential exposure of decrypted customer environment variables, OpenCode disclosed exposed AI API keys, and Warp reported exposure of AI agent logs and user telemetry. Wiz has not attributed all nine incidents to the same attackers, although many involved attempts to obtain AI API keys.
For Northflank customers, replacing a secret in the platform is only part of the response. The old credential must be revoked or disabled at its issuer. Otherwise, removing it from a workload leaves the captured value usable. Rotation should cover every credential that passed through the affected secret stores, including database passwords and cloud or service tokens, rather than stopping after the visibly abused AI keys.
Usage and billing logs at AI providers should be reviewed for unexpected calls. Northflank specifically advised customers to report suspicious usage to both Northflank and the relevant AI provider. Investigation windows should begin before the October 30 disclosure where retained logs allow it, because the alert time establishes when Northflank learned about the incident rather than when access necessarily began.
The incident also exposes an operational dependency that credential inventories often obscure. A key may belong to an AI provider, but its effective custody includes the deployment platform that stores and injects it. Rotation procedures therefore need to account for provider-side revocation, platform-side replacement, application rollout, and verification that old instances or jobs no longer carry the previous value.
Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis as part of its response. It also enabled audit logs for all customers, including free accounts. Those logs can help identify suspicious platform activity, while provider logs show whether stolen credentials were used elsewhere. Both views are needed when a deployment-layer breach crosses into external services.
Top comments (0)