At least nine AI developer platforms disclosed security incidents in October, and Wiz Research says credentials stolen in that wave are already being burned at industrial scale. In a report it calls "Black October", Wiz followed two stolen enterprise keys that together made roughly 2.5 million calls to Amazon Bedrock AI models within days, likely running up more than $100,000 in usage at list price.
The affected platforms, in order of disclosure, are Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Zeabur says it will shut down because of its incident.
No single bug, one shared appetite
Most investigations are still open, and the root causes differ. Fireworks, Zeabur and Lightning attribute theirs to credential access. Railway believes initial access came through privilege escalation in its build infrastructure, Warp points to a third-party vendor dependency, and OpenCode to a legacy system. Fireworks, OpenCode and Warp report signs of an "agent swarm" attack, while OpenCode and CommandCode attribute their incidents to attempted distillation, the practice of training a model on another model's outputs.
What links them, according to Wiz, is what the attackers went looking for: stored environment variables, especially those granting access to AI services. Wiz ties the wave to two trends, faster agent-driven intrusions and LLMjacking, where stolen AI credentials are resold through broker services. A ready resale market makes the theft easy to monetize.
From one test call to a million
Wiz traced keys whose compromise it attributes to one of the vendor breaches. Both showed an identical first move within 30 minutes of the reported theft: a single model call from a residential IP address, part of a one-minute sweep testing stolen keys across several organizations. It asked for Claude Fable 5.1, failed, and fell back to Opus 5.5, which worked. Days of low-volume validity checks followed.
In the first case, a rotating proxy pool probed dozens of models, a script mapped Bedrock and EC2 quotas, and bulk traffic began 22 seconds later. Over 30 hours the actor made about 800,000 Bedrock calls, roughly 90% of them successful, routed through global cross-region inference profiles that kept throttling to about 6%. In the second, a key restricted to US-only routing surfaced in an apparent reseller pool. Once a checker found working model IDs, a single address made about 1.7 million calls in 13 hours, more than a million of them successful. Wiz says the traffic pattern resembles resold coding-agent usage from many different end users.
Two resale hubs held the keys
Wiz linked both keys to overt resale operations, while stressing that it cannot definitively tie those operations to the original breaches or to the floods. One actor, who appears to call themselves "momo," operates around 23[.]106[.]46[.]239, an address Zeabur publicly named in its compromise and which has hosted the LLM resale site llm-routing[.]com, which accepts payment in USDT. A subdomain on that address hosted an "ARTEX" autonomous penetration testing console on October 8, four days before Zeabur's timeline shows the IP targeting its infrastructure. A second operation, xingjiabiapi[.]org, ran permission checks on both keys after the abuse had begun, and has even hosted a page designed to score its own customers for distillation behavior.
Rotate exposed keys and pin AI traffic to your regions
Organizations whose AI provider keys were stored on any of the nine platforms should treat them as exposed, rotate them, and review Bedrock and other model-provider logs for the burst patterns above. Wiz's second case shows region limits can blunt the damage: without global routing, most of the failed traffic ran into the account's regional quotas, though over a million calls still got through. Wiz suspects these addresses of testing stolen keys for LLM token abuse and resale, while noting it has no evidence tying them directly to the Black October breaches:
- 23[.]106[.]46[.]239
- 38[.]246[.]114[.]118
- 104[.]243[.]32[.]50
- 31[.]57[.]201[.]201
Earlier this month IntelFusions reported on phishers hijacking Google Cloud billing to run up AI bills. Black October is the same economics at wholesale: the platforms developers trust to hold their keys have become the cheapest place to steal them.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.