Customers of Northflank report misuse of AI keys after a breach

On 30 October 2026, Northflank, a cloud platform where developers make apps and databases, told customers about a breach after Wiz, a cloud security company, told it about the risk at 11:43 UTC. Northflank then told that customers see use of their AI API keys that they did not start. The owner of a key pays the bill.

What happened

Northflank told customers to think that all environment variables are decrypted. Apps keep database passwords, cloud logins and API keys in them. Northflank made a network patch in about one hour, and two more patches after that. It also turned on audit logs for all customers, free accounts too.

The numbers

Wiz reports nine or more breaches at AI developer platforms in October 2026. In two of its tests, logins of a company made about 2.5 million calls to Amazon Bedrock, an AI service. That is about 100,000 dollars of use. Wiz did not make sure that one group did all nine attacks.

What is not known

Northflank has not told how the attackers got in. It has not told how many customers are affected. It has not told if attackers got other secrets than AI keys. It did not answer questions from reporters.

Insight: AI platforms hold your keys, so thieves go there first

Wiz counts the Northflank breach and eight more at AI developer platforms, with Railway and Warp. One more Wiz report tells that attackers tested each key in 30 minutes. One key then made 1.7 million calls. This reads as a toll gate. One platform holds the keys of many firms, and one breach pays the thief many times. A vendor that holds your keys is a risk that your controls cannot close.