Hackers are using AI keys developers entrusted to hosting provider Northflank

On October 30 at 11:43 a.m. (UTC), an alert from security vendor Wiz goes off at Northflank, a UK platform that hosts developers' applications. One minute later, its engineers are looking into it. By 1:58 p.m., the instruction posted on the company's status page leaves no room for doubt: assume that all your environment variables have been decrypted, and disable or change all your keys.

That afternoon, several customers report that the access keys to AI services they had entrusted to Northflank are being used by someone else. The hosting provider acknowledged this on its status page. It has not said how the attackers got in, how many customers are affected, or whether other secrets were exploited. BleepingComputer, which contacted the company, had received no answer as of October 31.

What Northflank is asking its customers to do

The network fix was deployed on October 30. But secrets that have already been read remain valid until their owner changes them. The status page, updated through the evening of October 31, recommends that customers:

• immediately change all secrets entered on the platform: those of applications, secret groups and global secrets;
• for AI keys, revoke them with the provider that issued them, create new ones, then update the applications;
• cut public access to add-ons (databases, message queues) that had it;
• review usage logs and billing at their AI providers, and report any anomaly to Northflank and to the provider.

Northflank has opened up credential rotation for PostgreSQL, MongoDB, MySQL, Redis, MinIO and RabbitMQ. It has also enabled audit logs for all its customers, including free accounts.

Why are hackers targeting AI keys?

Northflank is not an isolated case. In a report published on October 30 and titled “Black October,” Wiz lists nine incidents at AI developer platforms since the start of October: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Cyberiack has already covered the Railway and OpenCode incidents.

The common thread, according to Wiz: attackers hunt for environment variables, especially those that give access to AI models. The practice has a name, “LLMjacking.” It consists of making the victim pay for calls to expensive models. In the cases Wiz studied, a stolen key is tested with a first call within 30 minutes, then checked from time to time, before being exploited at scale or resold.

The numbers give an idea of the bill. In two cases it analyzed, Wiz counted about 800,000 calls to Amazon's Bedrock service in roughly thirty hours in the first, and about 1.7 million in thirteen hours in the second. In both cases, the calls mostly targeted Anthropic's Claude models: Opus versions accounted for three-quarters of successful calls in the first, and a smaller share in the second. The cost would exceed $100,000 at list price for the two cases combined.

Wiz remains cautious on attribution. It does not claim that a single group is behind all nine intrusions, and it cannot firmly link the key resellers it spotted to the initial hacks.

The right reflex: treat every AI key like a credit card

An AI key is spent like a credit card with no limit. Set spending caps and billing alerts with your providers. Prefer one key per application and per environment, so you know which one leaked. If your hosting provider announces an incident, revoke without waiting for the final assessment.

One question remains: how did the attackers get into Northflank? The company has not yet published its analysis. With nine incidents in a month, other platforms in the sector would do well to read it closely.

Update of November 13, 2026

Northflank, the UK hosting provider whose customers saw their AI keys hijacked in late October, has clarified the sequence of the attack on its status page. According to its November 6 update, the first known decryption of secrets took place on October 30 between 2:39 a.m. and 3:08 a.m. (UTC), more than eight hours before the first alert, received at 11:43 a.m. According to the company, the attack appears to have targeted secrets stored in its control plane, the part of the platform that manages deployments. Customers with a dedicated or self-hosted control plane are not affected. Northflank says it found no evidence of access to its customers' applications or to those applications' data.

On November 2, the hosting provider said it had revoked access tokens, sessions, connections to code-hosting services, and cross-account access roles and service accounts, wherever it could act on behalf of its customers. It has also handed the review of the incident to independent auditors. It says it has patched the Linux kernel vulnerability CVE-2026-98432 across its entire fleet, reported by Anthropic, the maker of Claude, without presenting it as the hackers' point of entry. The attack vector and the number of affected customers have not been made public: Northflank promises a root-cause analysis “once available.”