A platform that runs your code has to be able to decrypt your secrets.
Wiz counted at least nine AI developer platforms that disclosed incidents in October 2026, from Fireworks AI on October 6 to Northflank on October 30. The public reports all describe attackers hunting stored environment variables, especially AI provider keys. Railway said an attacker accessed encrypted variables and, for some, obtained the decrypted contents. Northflank told every customer to assume theirs were decrypted.
The part most people miss: the platform can't fully clean this up for you. Deleting or replacing a secret there doesn't invalidate it. Only the issuer can revoke it. In two cases Wiz analyzed, stolen enterprise keys were first tested within 30 minutes of the reported vendor breach.
Those cases also show where the blast radius was decided. One key's policy allowed global cross-region inference, and only about 6% of the abusive calls were throttled. The other was limited to US routing and kept hitting regional quotas. My read: settings usually treated as cost and capacity config ended up working as security controls.
So for every key you hand a platform: one key per platform, a narrow policy, deliberate quotas and spend alerts, and a revocation path you've actually rehearsed. Where federation is supported, no static key at all.
That inventory is one of the first things I'd ask for in any new architecture review.
If a platform you deploy on disclosed a breach tonight, how fast could you name every key it held?
Sources
- https://www.wiz.io/blog/black-october-for-ai-developer-platforms
- https://thehackernews.com/2026/10/railway-says-intruder-may-have-accessed.html
- https://status.northflank.com/cmvv0rn5a092f14rutwccodpp
- https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/
- https://tsnmedia.org/black-october-ai-developer-platforms/