Northflank hack joins 9 AI platform breaches

Cloud platform Northflank told customers to treat every stored secret as stolen after a break-in, BleepingComputer reported on the 31st of October 2026. Some customers then found strangers using their AI keys.

An AI key is a password that lets an app use a paid AI service. Anyone holding it can run up the owner's bill.

What Northflank said

Northflank first warned customers on the 30th of October, after an alert from security firm Wiz. It then told them to assume all stored settings had been decoded.

Users have reported unauthorised use of AI keys, Northflank said. It told customers to change every key and check their AI bills.

How it responded

Wiz raised the alert at 11:43 UTC and Northflank reviewed it one minute later, its timeline says. It added fixes and turned on activity logs for all customers.

Northflank has not said how attackers got in or how many customers were hit, BleepingComputer said.

Part of a wider wave

Wiz counted at least 9 attacks on AI developer platforms in October, including Railway and OpenCode. Attackers often hunt for AI keys to use or resell, Wiz said.

In two cases Wiz studied, stolen keys made about 2.5 million AI calls on Amazon Bedrock. Those calls cost about 100,000 dollars.

Below we break down the cost

100,000 dollars over 2.5 million calls is about 4 cents a call, by our arithmetic.

What is confirmed and what is not

Northflank confirmed misuse of AI keys. Wiz has not said the 9 attacks came from the same group.

Key facts

Northflank told customers on the 30th of October 2026 to change all stored keys.

Customers reported strangers using their AI keys.

Wiz counted at least 9 attacks on AI platforms in October.

Northflank has not said how many customers were hit.