One stolen key, roughly 1.7 million AI requests, about 13 hours. That is one of the cases security firm Wiz described after a wave of breaches at AI developer platforms in October 2026. If your company stores AI or cloud keys in a hosting platform, API key security is no longer a developer detail. It is a business risk that can show up as a surprise bill, leaked data or a hijacked account.
Here is what happened during what Wiz calls “Black October”, why it matters for businesses in the USA and the UAE, and the practical steps to take now.
What happened in Black October
In a report first published on October 30, 2026 and updated into early November, Wiz said at least nine AI developer platforms disclosed security incidents during October. The list included Fireworks AI (October 6), Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank (October 30). Further disclosures followed in early November, including Trigger.dev on November 1, plus Chainstack, kernel.sh, Brev and Blacksmith.
According to Wiz, the public reports point to attackers targeting the environment variables that customers store on these platforms, with a focus on values that grant access to AI services. Environment variables are where apps usually keep secrets such as API keys, database passwords and cloud credentials.
Railway: environment variables accessed
On October 21, Railway said an unauthorized third party may have accessed encrypted environment variables and, for some, obtained the decrypted contents. It paused deployments, told all users to roll every environment variable, and said it believed the attack was part of a series aimed at compromising AI inference providers.
Northflank: “assume all environment variables have been decrypted”
On October 30, Northflank told customers to assume all environment variables had been decrypted and to disable or rotate all keys. Later that day, its status page said multiple users had confirmed their AI keys had been used. Northflank said the exploit was patched and the attack was contained, and that it had no evidence customer workloads or workload data were accessed.
How stolen AI API keys were abused
Wiz described two enterprise cases where stolen credentials were used to call AI models on Amazon Bedrock, a practice often called LLMjacking: running AI workloads on someone else’s account and leaving them with the bill.
- The first use came within about 30 minutes of the reported credential access at the vendor.
- In one case, attackers made roughly 800,000 calls in about 30 hours before the key was shut down.
- In the other, a single address made roughly 1.7 million calls in about 13 hours.
- Wiz estimated these two cases alone likely ran up more than $100,000 in usage at list prices.
- Wiz also linked some activity to sites that appear to resell access, which means a stolen key can be passed on to many users.
The lesson is simple: a leaked AI or cloud key is a payment card with no limit until someone notices.
Why API key security matters for US and UAE businesses
Most companies now use AI somewhere: a chatbot on the website, a WhatsApp assistant, automated reports or a custom app. Each of these depends on keys. In the USA and the UAE, many of these projects are built quickly by agencies or freelancers and hosted on developer platforms, often with keys that were never rotated after launch.
- Cost risk: stolen keys can generate large AI or cloud bills in hours.
- Data risk: database and storage credentials in the same environment can expose customer data, which brings regulatory and reputational damage in both markets.
- Supply chain risk: you can do everything right and still be exposed when a platform you rely on is breached.
How to rotate API keys and protect secrets: next steps
- Make a list of every secret. Record each AI, cloud, payment and database key, where it is stored and who owns it.
- Rotate API keys on affected platforms now. If you use any platform named above, follow its advice: rotate all secrets even if you see nothing suspicious. Northflank suggested starting with AI provider keys, cloud credentials, payment keys, private keys and database credentials.
- Revoke, don’t just replace. Delete the old key with the provider that issued it, so a copied key stops working.
- Check logs and bills. Review usage at your AI and cloud providers for unexpected spikes, new regions or unfamiliar models, and contact the provider quickly if you find unauthorised spend.
- Set budget limits and alerts. Spending caps and alerts turn a huge loss into a small one.
- Restrict keys. Use IP restrictions, least-privilege permissions and separate keys per app and environment, so one leak does not open everything.
- Use a secrets manager. Store secrets in a dedicated vault with short-lived credentials where possible, instead of long-lived keys copied between tools.
- Write a 1-page incident plan. Decide who rotates which key and who talks to customers if something goes wrong.
Our cybersecurity team can audit where your secrets live and how they are protected, while our cloud and DevOps engineers can set up secrets managers, key rotation and budget alerts. If you are building chatbots or automations, our AI and automation service designs them with security from day one. For a wider starting point, see our cybersecurity checklist for small businesses in the UAE.
Frequently asked questions
What should I do if my API key was stolen?
Revoke the key with the provider that issued it, create a new one, update your apps, then review usage logs and billing for unusual activity. Contact the provider if you see charges you did not make, and rotate any other secrets stored in the same place.
How often should you rotate API keys?
Rotate immediately after any suspected leak or platform breach, when a team member or vendor leaves, and on a regular schedule set by your security policy. Short-lived credentials from a secrets manager reduce the need for manual rotation.
What is LLMjacking?
LLMjacking is when attackers use stolen cloud or AI credentials to run AI models on a victim’s account, leaving the victim to pay. In the cases Wiz described, stolen keys were used for hundreds of thousands to over a million AI calls within hours.
Protect your keys before someone else uses them
Not sure where your AI and cloud keys are stored or who can use them? TASCO IT Solutions helps businesses in the USA, UAE and Pakistan secure their apps and cloud. Message us on WhatsApp at +971 58 661 3940 or email info@tascoit.com.