Black October: At Least Nine AI Dev Platforms Disclose Incidents in a Month

At least nine AI developer platforms disclosed security incidents in October 2026, and several point to credentials stored on the platform. Wiz Research uses the name “Black October” for them in a post dated 30 October. Wiz says Cloud Security Alliance has also connected the incidents (we did not open that piece). Whether one actor is behind them is not established.

Who disclosed what

Wiz lists the platforms with dates (its list does not label them; for Fireworks the date matches when it identified the activity, its bulletin was published on 9 October, and Zeabur’s date matches the start of the attacker’s activity): Fireworks AI (6 October), Andromeda (9 October), Zeabur (14 October), Lightning AI (15 October), OpenCode (16 to 17 October), Railway (20 October), Warp (23 October), CommandCode (28 October) and Northflank (30 October).

Root causes, as the vendors state them and as Wiz relays them, vary. Fireworks, Zeabur and Lightning AI point to credential access. Railway’s preliminary view is privilege escalation in its build infrastructure. Warp points to a third-party vendor dependency, and OpenCode to a legacy system. OpenCode and CommandCode attribute their incidents to attempted distillation. Wiz notes that most incidents were still under analysis when it wrote.

What the public reports share, per Wiz, is targeted exploitation that hunts stored environment variables, especially ones that grant access to AI services. Wiz found no single vulnerability or dependency common to all of them.

Two platforms with more detail

Two vendors have published enough to check.

Fireworks AI’s bulletin says it detected “unauthorized use of internal Fireworks credentials” on 6 October. A third party accessed environment variables used in evaluation jobs in a limited number of customer accounts, and Fireworks believes API keys and tokens stored as secrets were captured. Fireworks says it has not detected evidence of unauthorised access to customer models, datasets, training data, inference traffic or personal information within its security perimeter. It also says that review of calls made with the exposed credentials is still ongoing. The bulletin’s status was “active monitoring”, last updated 10 October.

Zeabur went further, though we read it only through BleepingComputer (20 October), not Zeabur’s own write-up. It reports that Zeabur is shutting down after a second breach in two months: from 1 December renewals are disabled and shared-cluster services paused, and by 31 December 2026 dedicated servers expire and shared clusters stop. Per Zeabur, an attacker used leaked internal credentials on 14 and 15 October and “eventually read the platform database.” Zeabur says more than 3.2 million environment-variable records were stolen and information for 321,810 accounts was exposed. It also says its admin tokens “had no expiry” and had not been rotated since January 2024. Zeabur says the attacker likely obtained the credentials in the August breach, which it has not confirmed.

What Wiz saw directly

Wiz observed two enterprise cases where stolen AWS keys were used against Amazon Bedrock. Wiz says the first unauthorised activity came within 30 minutes of the credential access reported in the vendor breach.

• Case A: about 800,000 Bedrock calls, roughly 90% successful, over more than 30 hours.
• Case B: about 1.7 million calls, over a million successful, over more than 13 hours.

Wiz’s estimate is that the two cases together likely ran up more than $100,000 in usage at list price, and it says the traffic profile fits resold coding-agent traffic. Separately, an alleged theft of about $371,000 in cryptocurrency using keys stored in Railway comes from a social media post, which Wiz describes as anecdotal. We have not verified it.

Wiz also lists four IP addresses and several hosting networks seen checking stolen keys. It states it has no evidence directly linking them to the Black October attacks, though it notes one was publicly named by Zeabur as part of its compromise and that the operator behind it had access to the keys in both cases. Wiz says it cannot definitively tie that operation to the abuse. We are not reproducing the IPs here. Check Wiz’s post for the list before blocking anything.

What to take from it

Wiz does not include a recommendations section, so the following is our assessment, anchored on Fireworks’ guidance. If you keep provider keys as secrets on a hosted AI platform, treat them as exposed when the platform reports a credential incident. Deleting a stored secret does not revoke the underlying credential, so rotate at the issuer. Then pull that issuer’s logs for the exposure window. For AWS Bedrock specifically, review CloudTrail for unexpected InvokeModel calls and cross-region inference profile usage.

One caution on the framing. The “Black October” label and the “agent swarm” language come from Wiz and, per Wiz, some affected vendors. The evidence assembled so far shows a shared target, stored AI credentials, and not yet a shared actor.

Some details are single-source. The Bedrock case figures and the $100,000 estimate rest on Wiz alone, and the Zeabur numbers rest on Zeabur’s own account as relayed by BleepingComputer. A third-party summary from Futurum largely repeats Wiz’s post, so we do not count it as independent.

References

• Wiz — “Black October” for AI Developer Platforms (30 October 2026)
• Fireworks AI — October 2026 Security Incident bulletin
• BleepingComputer — Zeabur shutting down after second security breach in two months (20 October 2026)
• Futurum Group — Black October: LLMJacking Wave Exposes AI Infrastructure’s Credential Crisis (31 October 2026, derivative of Wiz)