Nine AI Developer Platforms Now Admit Security Incidents in Ongoing 'Black October' Campaign
Wiz's running tally added Northflank on October 30 as the ninth vendor, with attackers systematically hunting stored environment variables that grant AI API access.
Security firm Wiz is tracking what it calls "Black October": nine AI developer and inference platforms that disclosed security incidents during October 2026. The tally runs from Fireworks AI on October 6 through Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp and CommandCode, ending with Northflank, whose status page update on October 30 made it the ninth vendor.
The attack pattern is consistent across victims: intruders search for stored environment variables, especially those holding credentials with AI access. Several vendors referred to "agent swarms" or distillation-driven attacks. Wiz has verified abuse of enterprise credentials downstream of one vendor breach; social media posts additionally describe roughly $371,000 in cryptocurrency theft via Railway and consumer bills of hundreds of thousands of dollars from stolen OpenCode access — figures that remain unverified anecdotes.
The campaign is still active as of the end of October, and the list is unlikely to be exhaustive since other vendors may not yet have disclosed. For any company using third-party inference platforms, the incident wave puts API credential hygiene, network segregation for model traffic and access auditing back on the immediate agenda.