Cloud application hosting platform Northflank has issued an urgent warning to all its customers, demanding that they change and rotate all credentials and secrets stored on the platform, following a security breach that resulted in unauthorized use of Artificial Intelligence API Keys (AI API Keys).
The platform is a cloud environment that allows developers to deploy and manage applications, containers, databases, and artificial intelligence applications without the need to manage the underlying infrastructure. The company disclosed the security incident on October 30, after receiving a security alert from cloud computing company Wiz, and immediately proceeded to implement network upgrades and rapid response procedures.
What has practically changed?
The company asked all subscribers to assume that their environment variables have been decrypted and the secrets saved within them—which typically include database passwords, authentication tokens, and sensitive programming interface keys—have been stolen. Northflank confirmed that several users have already reported unauthorized exploitation of their AI API keys.
As precautionary measures in response to the crisis, the platform activated the credential rotation feature for popular database services such as PostgreSQL, MongoDB, MySQL, and Redis. It also made audit logs available to all users, including free account holders, to help them monitor and investigate any suspicious activity.
A broader wave of attacks known as "Black October"
This breach is part of a series of security attacks monitored by Wiz targeting AI development platforms during October, which it published a report on titled "Black October for AI Development Platforms." The attacks included at least nine platforms and providers such as Railway, OpenCode, and Lightning AI.
These attacks target what is known as "LLMJacking," where attackers acquire valid credentials to exploit AI models using keys and resources of other organizations, resulting in massive usage bills or illegally reselling access to those models. In previous cases monitored by Wiz, similar breaches led to millions of API calls at a huge cost to victims.
What does this mean for users?
The company advises developers and companies to deal immediately with the warning through the following steps:
- Immediately change and rotate all secrets and environment variables stored on the platform.
- Review usage logs and invoices from AI providers to detect any unexpected activities.
- Revoke public access to plugins and auxiliary services wherever applicable.
- Report any suspicious usage to Northflank technical support and AI service providers.