Stolen AI keys used to run 1.7 million calls in 13 hours

A surge in AI platform breaches

A report by Wiz Research reveals a significant spike in security incidents involving AI developer platforms. During the month of October 2026, at least nine different platforms disclosed breaches involving unauthorized access. These incidents range from Fireworks AI to Northflank, showing a widespread vulnerability in the AI development ecosystem.

The research indicates that attackers are not just looking for any data; they are specifically hunting for stored environment variables. These variables often contain the keys required to access powerful AI models. By targeting these specific credentials, hackers can hijack the compute power of the victim's accounts.

This trend aligns with what researchers call 'LLMJacking,' where the goal is to steal the ability to generate AI outputs. The theft is made easily monetizable because these keys can be sold to other parties. As a result, the victims are often left to foot the bill for the massive amount of usage generated by the attackers.

The scale of the unauthorized usage

The scale of these breaches is significant, with one specific case showing a single stolen key making approximately 1.7 million calls to Amazon Bedrock. This activity occurred in a span of only 13 hours, which averages out to about 36 calls every second. The traffic was spread across a dozen different Claude models.

Wiz Research identified two specific enterprise keys that were compromised in one of these vendor breaches. In one instance, the actor made about 800,000 calls over 30 hours, with a 90% success rate. In the second instance, the actor made over a million successful calls using models like Opus 5.5, Sonnet 4.5, and Opus 5.

At list price, these two cases alone likely ran up over $100k in usage costs. The traffic patterns observed by researchers resemble the type of traffic used by resold coding-agent services. This suggests that the stolen keys are being used to power commercial products without the owner's consent.

How the attacks are executed

The attackers appear to be highly methodical in how they test and exploit stolen credentials. In the cases documented by Wiz, the stolen keys were tested within 30 minutes of the initial credential access. The actors even performed fallback tests, such as trying one model and switching to another when the first one failed.

The primary method of entry involves exploiting platforms that store customer secrets. Because these platforms are designed to manage complex AI workflows, they are prime targets for harvesting environment variables. Once a key is obtained, the attacker can immediately begin high-volume requests to providers like Amazon Bedrock.

While the specific technical details of many incidents are still being analyzed, the pattern is clear. Attackers are looking for the path of least resistance to gain access to high-value AI compute. The speed at which they move from initial access to massive usage highlights the need for faster detection and automated responses.

Impact on developers and platforms

The fallout from these breaches varies depending on the platform involved. For example, Zeabur reported that it would be shutting down entirely due to one of its incidents. Other platforms, like Northflank, have issued urgent guidance to their users to assume all environment variables have been compromised.

Northflank instructed its customers to rotate all secrets and credentials immediately to prevent further unauthorized use. They have also enabled audit logs for all customers, including those on free plans, to help track the extent of the unauthorized activity. This move highlights the difficulty of monitoring for malicious use once a key has been leaked.

For companies holding AI keys, the risk is both financial and operational. A stolen key can drain a budget in a matter of hours, as seen in the $100k example. Beyond the immediate cost, these breaches can also lead to the exhaustion of rate limits, potentially disrupting legitimate business operations and development cycles.

Security best practices for AI

The recurring theme in these reports is the danger of storing sensitive keys in insecure environments. To mitigate this risk, security experts often recommend the principle of least privilege. This concept ensures that any given key or user only has the minimum level of access required to perform its specific job.

Companies using AI models should review their AI provider usage and billing logs for any unexpected spikes in activity. Monitoring these logs can serve as an early warning system for a compromised key. If a sudden jump in calls is detected, the key should be revoked and rotated immediately to stop the bleeding.

Moving forward, the focus will likely shift toward more robust secret management. Developers need to be vigilant about where they store environment variables and how they share them across different platforms. As AI models become more integrated into business workflows, securing the keys that power them becomes a critical priority for every organization.

Next steps for AI users

The rapid succession of these incidents suggests that AI developer platforms are a high-priority target for cybercriminals. As more companies adopt agentic workflows—where AI models perform multi-step tasks—the value of a stolen key increases. This makes the security of the underlying credentials a foundational requirement for AI adoption.

Platform owners will need to improve how they handle customer secrets to prevent mass exploitation. This may include offering more granular permissions or moving away from long-lived environment variables. The goal is to make it harder for an attacker to gain broad access to a customer's entire AI infrastructure from a single point of failure.

For the average user, the takeaway is to treat AI keys with the same level of security as financial credentials. Never hardcode keys in scripts or share them in insecure environments. By adopting proactive rotation and monitoring, organizations can protect themselves from the escalating costs of LLMJacking.