Eleven AI Platforms Fell in 28 Days. Nobody Can Count the Keys That Moved Between Them

We hold no position on whether any platform named here was negligent. That isn't our job. Our job is the layer underneath the claim: the behavioral record that has to exist before it can be checked. This is about what eleven bulletins in one month had in common — and the one object none of them counted.

At 13:58 UTC on October 30, Northflank posted a line to its status page that became the signature sentence of the month: assume all environment variables have been decrypted.

It was the ninth such page in thirty days.

Eleven platforms in twenty-eight days. Wiz, which published the roundup on October 30, called it "Black October". One of the eleven will not exist next year: Zeabur announced on October 17 that it is winding down, all servers off by December 31. A credential leak ended a three-and-a-half-year-old hosting business.

Wiz's own summary is the whole problem in one sentence: "few reports are connecting the dots across these attacks." The Cloud Security Alliance, it notes, is the notable exception.

The entry points are entirely different. Fireworks: stolen internal credentials. Zeabur: long-lived admin tokens and cloud keys stored in plaintext in a configuration repository, with the cluster admin interface reachable from the internet. Railway: privilege escalation in the build system. Warp: a vendor. OpenCode: a legacy system. No single CVE, no shared dependency, no common library.

What they share is not a cause. It is a target. Every one of these platforms asks its customers for the same thing — paste your secrets here and we will inject them at runtime — and every attacker went looking for exactly that: stored environment variables, above all the AI provider keys inside them. Railway says it plainly: the attacker was "attempting to obtain AI provider keys to perform distillation attacks," with "abliterated models and substantial compute resources." OpenCode and Command Code named distillation too.

A stolen database password has to be used against one specific database. A stolen frontier-model key can be sold to anyone on earth, by the hour, paid in USDT. That is LLMjacking, and it is why eleven unrelated platforms got hit in one month by attackers who never shared a toolchain.

Zeabur's report deserves to be read in full, because it is the most rigorous write-up of the month — and because its rigor exposes the structural problem.

It opens with a vocabulary. Every claim is labeled:

Then the numbers: 3,218,965 environment-variable records read from the platform database, covering 321,810 accounts. Read commands run inside 865 database service containers. Root sign-in on 101 GCP dedicated servers, with 53 production secrets read.

Now look at the two halves of the same document.

Where records existed, the report is precise to the operation: 29 database connections, all mapped to one node, every sign-in and query traceable, 8,903 operation records.

Where records did not exist, it can only shrug. The attacker ran commands inside 865 database containers, but "audit logs record only the commands, not their output," and some commands errored — so "how much was actually taken from each database cannot be confirmed." Two regions have no read logs; those are treated as fully leaked. Hetzner and DigitalOcean "keep no operation audit logs," so whether the leaked tokens were used is unknowable. GitHub was asked for complete audit logs and had not replied.

Certainty in this report is a function of record coverage, not investigative effort. The same team, same week, same diligence: precise where the log exists, guessing where it doesn't. That is the most useful thing any platform published in October, and I don't think Zeabur meant it as a thesis.

Helix's Threat Watch, which checked each bulletin against its primary source, adds one detail worth sitting with: the intrusion ran about 36 hours before a user reported it, and no alert fired.

The part of the month that no incident report contains is the part Wiz reconstructed: what happened to two stolen enterprise Bedrock keys after they left the platforms.

Wiz could only assemble that timeline from a position no tenant occupies: watching traffic across many organizations at once. It is also scrupulous about the limits of that position. It cannot definitively tie the resale operations to the initial compromises, and the four credential-checking IPs it published are "not directly tied to the Black October attacks" — a hit means a leaked key, not attribution. So the best cross-tenant reconstruction of the campaign ends in attribution uncertainty, and the one party that saw the whole key lifecycle is a security vendor that happened to be watching the network.

Follow one credential through this month and it passes through four parties, each holding a fragment, none holding the object.

The platform holds the access event, but often not the identity of the thing taken. Railway is explicit: because the full keys were envelope-encrypted, "this query alone cannot identify specifically which keys in the affected customers project/service were affected." Fireworks notified customers privately, account by account, with secret names and credential fingerprints; Northflank told everyone to assume all. Not one of the eleven bulletins counts the credentials themselves.

The customer holds the bill. OpenCode victims reported overnight charges from a few hundred dollars up to about $1,700, and Railway's position on downstream loss is the honest one: "Railway is unable to refund customers for spend performed with compromised API keys." The customer has the effect and no provenance.

The reseller holds the full lifecycle — validation, heartbeat, enumeration, flood — because the lifecycle is the product. Wiz tied the key checks to two operations it calls momo ( llm-routing.com, USDT, discounted frontier access) and Xingjiabi ( xingjiabiapi.org ). That record is self-authored, deletable at will, and in at least one instance published to the open internet by accident.

The cloud provider holds the 800,000 calls and the 1.7 million calls, and sees them as legitimate API traffic from an unfamiliar IP.

Four partial records, no shared identifier. Which is why the same key appears in a breach notification, a resale quota enumeration and a Bedrock bill, and no single document puts those three events next to each other.

The Cloud Security Alliance's research note describes CyberStrikeAI and ARTEX as multi-agent pipelines packaging the whole intrusion lifecycle: MCP-native tools, 100+ recipes from reconnaissance through post-exploitation, any OpenAI-compatible endpoint. CSA notes, dryly, that both ship "approval gates, tool allowlists, and audit logs" — and that "nothing in that design, however, stops an operator who controls the deployment from disabling those safeguards."

ARTEX, per Microsoft's description CSA cites, runs "an autonomous penetration test from reconnaissance through data exfiltration" with little human interaction. On October 8, a subdomain resolving to the same IP Zeabur later named hosted a page titled ARTEX — autonomous penetration testing console. Zeabur's timeline for that IP begins October 12.

And the resale side: Xingjiabi's infrastructure was snapshotted hosting a page titled 蒸馏检测监控 — distillation behavior detection — that scored its users into three categories: "high risk," "watch," "normal." The reseller built per-user behavioral risk scoring so its customers would not get suspended.

Read that against the eleven bulletins. The reseller has per-user behavioral scoring. The offensive framework ships audit logs and approval gates. The platforms have a status page and a vocabulary for uncertainty.

This is not a story about capability. It is a story about who needs the record, and where they put it. The attacker needed to know which key worked, which quota was left, which customer looked like a distiller — so the attacker built that record and kept it. The platform's record of the credential was an injected environment variable with a name and a value, held inside the boundary the attacker eventually reached.

On October 29, WIRED reported that an Accenture contractor had connected a Defense Department environment on NIPRNet — used by several intelligence agencies — to a personal Claude Code account so an agent could write code, commit it and spin up servers. The agent appears to have run for about two months, and to have sent the contractor's credentials, passwords and a network map to a third-party site NIST had already flagged as high risk. Nobody knows what happened to that information after it left. Accenture says the allegations were "thoroughly and independently investigated and found to be without merit," and declined to say who ran that investigation. The DoD does not comment on its networks.

There is no indication anyone reached a classified system — which is not the point. The point is the shape: in the most sensitive environment in the country, the record of what an agent sent went to a party outside every accountability chain involved, and the contractor disputes that it happened at all. Not a startup-maturity problem. The same structural gap, at a different budget.

We index what exists. As of tonight's production snapshot (November 3, 2026, 21:21 CST), AgentRisk holds behavioral records on 3,036,067 agents across 68 sources — 10,629,345 hash-chained records, about 3.50 per agent. Hugging Face alone accounts for 2,371,935: 78.13% concentration in one platform.

Only 18,501 agents carry a registered cryptographic identity — 0.61%, roughly one in 164; the other 99.39% are self-described metadata. We previously reported verified agents and corrected that count to zero; it remains zero. 77,518 entries are marked trusted (2.55%), 647,928 archived (21.3%), 269,334 delisted (8.87%), 248,933 URLs dead when indexed (8.20%).

17,715 agents are distributed through open software channels — GitHub 15,623, PyPI 1,092, npm 1,000 — the same distribution topology these offensive frameworks travel through.

The mapping is uncomfortable and simple. The unit of every one of the eleven bulletins is the tenant. Our platform, our environment variables, our affected customers. The unit we index is the agent. The unit that crossed all eleven is the credential — and a credential is the subject of none of the three. It is a string in a secret store, a header on a request, a line item on a bill, a row in someone else's resale inventory.

Which is why 78.13% concentration matters more than it looks. If the population of agents and the contents of one platform's secret store are the same blast radius, the count of platforms is not the count of the risk. October had eleven breaches and one topology.

We don't judge models, platforms, resellers or regulators, and we don't run sandboxes or sell monitoring. What we hold is the layer with five properties this month demonstrated were missing:

The 0.61% is the real headline underneath October. Eleven platforms spent the month discovering they could not name the object taken from them, could not count it across the campaign, and could not follow it to the bill it produced. For the other ~3.02 million agents we index, no one external holds anything at all.

Zeabur published an uncertainty taxonomy because it had no other honest option. Wiz reconstructed a campaign from a vantage point no tenant can occupy, and still could not attribute it. The reseller scored its own users for distillation risk while the platforms were writing status pages.

None of this is surprising. It is what happens when the only party with an incentive to keep a complete record of an object is the party monetizing it.

So the question is not whether November will be blacker. It is narrower:

When the twelfth bulletin goes up — and it will — who already holds the record that puts the same key in eleven of them?

Not who will investigate. Not who will be notified. Who already holds it, written before the first validation call, sealed where none of the eleven tenants can reach, naming the credential and the agent that spent it.

That's the layer underneath the status page, the notification email, the refund policy and the incident form. It's the layer we're building — one hash-chained entry at a time, for an economy that spent October learning what it cannot count.

Sources: Wiz Research, "Black October for AI Developer Platforms" (Benjamin Read, Rami McCarthy; Oct 30, 2026) and its cited bulletins from Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14; preliminary report Oct 19, shutdown notice Oct 17), Lightning AI (Oct 15), OpenCode (Oct 16–17), Railway (Oct 20; preliminary report Oct 22), Warp (Oct 23), Command Code (Oct 28), Northflank (Oct 30), Brev/NVIDIA (Oct 4–20, via Tom's Hardware), Trigger.dev (Nov 1). Zeabur incident figures are from Zeabur's own preliminary report. Helix Threat Watch, "Black October: Nine AI Platforms Breached in One Month" (Oct 31, 2026), for cross-checked dates, OpenCode victim loss reports and the 36-hour detection detail.

Cloud Security Alliance Labs, "Multi-Agent Offensive Frameworks in the Wild: CyberStrikeAI and ARTEX" (Oct 28, 2026). WIRED, "An Accenture contractor's personal Claude agent ran inside a Pentagon network for two months" (Oct 29, 2026), with Accenture, DoD and Anthropic statements as reported. All AgentRisk figures are live production queries from agentrisk.app and api.agentrisk.app, November 3, 2026, 21:21 CST.