Cloud security firm Wiz published a report on October 30 that strings together this month's run of security incidents at AI developer platforms and calls it “Black October.” Nine companies are on the list: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank.
Wiz's conclusion is more restrained than its headline. It says no single vulnerability or dependency ties these incidents together; the overall pattern simply fits three trends: agentic attacks, LLMJacking (hijacking someone else's model quota), and a credential market that has grown up around demand for “distillation.” Most of the incidents are still under analysis, and many claims about their impact come from social media.
Attackers went hunting for environment variables
The incidents in the report break down roughly as follows:
| Platform | Disclosed | Publicly known leads |
|---|---|---|
| Fireworks AI | Oct 6 | Credential access, signs of an “agent swarm” |
| Zeabur | Oct 14 | Credential access; the company will shut down as a result |
| Lightning AI | Oct 15 | Credential access; previously hit by a supply-chain attack |
| OpenCode | Oct 16-17 | Legacy system breached; the company links it to distillation |
| Railway | Oct 20 | Currently believed to be privilege escalation in build infrastructure |
| Warp | Oct 23 | A third-party dependency is suspected |
| CommandCode | Oct 28 | The company links it to distillation |
The report says little about Andromeda and Northflank. Social media has circulated a claim that about $371,000 in cryptocurrency was stolen from Railway; Wiz marks it as unconfirmed.
What the incidents share is that attackers searched specifically for the environment variables stored on the platforms, especially those that can call AI services. That also explains why the targets cluster among hosting and development platforms: break into one, and you get a whole batch of customers' keys.
The 30 hours before and after a stolen key
The most detailed part of the report covers two cases of downstream abuse. Both enterprise keys were used for the first time within 30 minutes of the vendor leak: a residential IP made an InvokeModel call, swept the keys of several organizations within a minute, requested Claude Fable 5.1 and failed, then fell back to Opus 5.5 and succeeded.
A quiet period of a few days followed, with only 14 to 120 calls a day from the same small Go client, which Wiz reads as periodic checks that the key was still valid. In Case A, the attacker waited four days; a script then enumerated Bedrock and EC2 quotas, and 22 seconds later the volume ramped up, producing about 800,000 calls over roughly 30 hours, around 90% of them successful and three quarters landing on the Opus family. In Case B, the attacker waited seven days before the key entered what looks like a resale pool, then made about 1.7 million calls in roughly 13 hours, more than a million of them successful, across a dozen or so Claude models.
At list prices, the two keys may have racked up more than $100,000 in usage. That is Wiz's estimate; it does not say how much the victim companies were actually billed. The call patterns also look like resale: most requests carry a small amount of uncached input and a few hundred output tokens, which matches the shape of prompt caching, while the long tail of requests carries tens of thousands of input tokens, as if a large number of end users were behind them.
Where the supply for cut-price relay APIs comes from
For Chinese-speaking developers, the part of the report that hits closest to home is the resale chain. Wiz names two actors: “momo,” linked to the resale site llm-routing.com, and “Xingjiabi,” whose site is xingjiabiapi.org. IP addresses from both touched the keys in the cases above, and the latter's site once hosted a “distillation detection monitoring” page that sorted users into high-risk, watch and normal tiers.
The evidence stops there. Wiz states plainly that it cannot establish how the resale operations relate to the original intrusions, cannot directly tie momo's operation to that wave of large-scale abuse, and that the indicators of compromise it lists have likewise not been linked by evidence to the nine incidents. It also does not say that every relay service uses stolen keys. Still, the report at least shows that some unusually cheap model quota may have a questionable origin, and that buyers may be handing their prompts to an unknown intermediary.
The report body offers no defense checklist. For teams that have used any of the listed platforms, the most direct steps are to rotate the model keys stored there and to check cloud logs for low-frequency InvokeModel calls from unfamiliar IPs. The key in Case B could only use the us.* profile and was still found a usable model, so narrowing permissions does not stop this kind of abuse; it can only shrink its scope.
Sources: Wiz Research blog; CocoLoop; costs are Wiz's list-price estimates, and some reported theft amounts are unconfirmed.