Northflank security breach leads to abuse of customers' AI API keys

Summary

Northflank disclosed a security breach on October 30, 2026, after receiving a threat alert from Wiz. The cloud application hosting provider instructed customers to assume all environment variables had been decrypted and to disable or rotate their keys. Northflank subsequently acknowledged that multiple customers had reported unauthorized use of AI API keys stored on the platform. The evidence therefore establishes reported credential abuse, while the instruction to treat all environment variables as exposed represents a broader precautionary response rather than a confirmed accounting of every stolen secret.^[0]

According to Northflank's incident timeline as reported by BleepingComputer, Wiz delivered its alert at 11:43 UTC on October 30, and engineers reviewed it one minute later. Northflank deployed a network policy patch, followed by additional patches at 12:50 UTC and 13:05 UTC, and requested Wiz incident-response assistance. Customer-facing measures included enabling credential rotation for PostgreSQL, MongoDB, MySQL, and Redis and making audit logs available to all customers, including free accounts.^[0]

The central exposure is not limited to AI service credentials: Northflank's rotation guidance covers user-provided secrets in workloads, secret groups, and global secrets. However, the supplied reporting does not disclose the initial access method, the number of affected customers, or whether credentials other than the reported AI API keys were stolen or abused. It also provides no concrete vulnerability mechanics or affected software-version range. The reported patch deployments should not be interpreted as evidence that previously exposed customer credentials have been invalidated.^[0]

Wiz places Northflank among at least nine AI developer-platform incidents disclosed during October 2026 and describes a broader pattern of attackers seeking stored environment variables that grant AI access. That context does not establish a single Northflank-linked campaign: Wiz identifies no common vulnerability or dependency across the incidents, and BleepingComputer reports that Wiz had not confirmed common attackers across all nine. Attribution and the relationship between the incidents remain unresolved in the supplied evidence.^[0][3]

Attack chain

1. Platform breach and presumed secret exposure: Following the Northflank breach, the company instructed customers to assume all environment variables had been decrypted and that secrets stored in them were stolen. The reporting does not disclose how attackers entered the platform or obtained access to those secrets, so this phase reflects Northflank's exposure warning rather than a reconstructed technical intrusion sequence.^[0]
2. Unauthorized use of customer AI credentials: Northflank subsequently acknowledged reports from multiple customers of unauthorized use of AI API keys supplied to the platform. This is the reported downstream abuse following the breach; the evidence does not identify the specific API operations, abusing infrastructure, or Northflank-specific financial impact.^[0]

Disclosure timeline

Affected versions and patch status

Key takeaways

• Treat this as a credential-exposure response, not solely an AI-key incident. The reported unauthorized activity concerns AI credentials, but Northflank's instructions encompass all user-provided secrets stored on the platform.^[0]
• Platform patching and customer credential rotation address different parts of the response. Northflank reported deploying patches while continuing to instruct customers to disable or rotate secrets and investigate usage.^[0]
• The public evidence supports reported downstream credential abuse but not a technical reconstruction of initial access. It supplies neither actionable attacker infrastructure nor concrete vulnerability mechanics, and the affected-customer count remains undisclosed.^[0]
• The wider October cluster is relevant context, not established common attribution. Wiz describes repeated targeting of environment variables granting AI access, but no single vulnerability or dependency links the incidents, and common attackers across all nine were not confirmed.^[0][3]

Defensive actions

• Immediately disable or rotate all user-provided secrets stored in Northflank, covering workloads, secret groups, and global secrets rather than only AI API keys.: Northflank instructed customers to assume all environment variables had been decrypted. Although the reported abuse concerned AI API keys, the company's exposure warning and rotation guidance were broader.^[0]
• Use the newly enabled credential-rotation capabilities for Northflank-managed PostgreSQL, MongoDB, MySQL, and Redis credentials where applicable.: Northflank specifically enabled rotation for these services as part of its incident response, providing a way to replace database credentials potentially implicated by the secret-exposure warning.^[0]
• Review AI provider usage and billing logs for unexpected activity.: Multiple customers reported unauthorized AI API-key use. Northflank specifically recommended reviewing these logs to identify suspicious consumption or charges associated with customer credentials.^[0]
• Use Northflank audit logs to investigate suspicious activity, including on free-tier accounts.: Northflank enabled audit logs for all customers to support investigation of the incident, extending access to accounts that previously did not have that capability.^[0]
• Disable public access to Northflank add-ons where it is enabled.: This was an explicit Northflank customer-response recommendation accompanying its guidance to rotate platform-stored secrets. The evidence does not establish public add-on access as the initial intrusion vector.^[0]
• Report suspicious AI usage to both Northflank and the relevant AI provider.: Northflank's published customer guidance called for reporting suspicious usage to both parties following reports of unauthorized use of platform-stored AI API keys.^[0]