Skip to content
HACKTECH
Cloud & identityReported Published 4 sources

Northflank breach: control-plane secrets decrypted, customers report AI API key abuse

Cloud application hosting platform Northflank told customers on 30 October 2026 to assume all environment variables had been decrypted and to disable or rotate all keys, after receiving a threat alert from Wiz at 11:43 UTC. In a 6 November update, Northflank said the first known decryption of secrets occurred between 02:39 and 03:08 UTC that day, that the exploit was patched within 60 minutes of notification, and that it had found no evidence customer workloads or workload data were accessed. Customers reported unauthorised use of AI API keys stored on the platform. Wiz listed Northflank among at least nine AI developer platforms that disclosed incidents in October, while noting that no single vulnerability or dependency links them.

  • Northflank
  • PaaS
  • secrets management
  • environment variables
  • LLMjacking
  • AI API keys
  • control plane

What the sources report

  • Northflank said evidence suggests the attack focused on secrets held in its control plane, that customers on forward-deployed or dedicated control planes were unaffected, and told users to rotate secrets in workloads, secret groups and global secrets.
  • Where it was able to act on customers' behalf, Northflank revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts; it enabled audit logs for all customers, including free users, on 31 October.
  • Northflank said it had separately patched CVE-2026-98432, which its CVE record describes as a Linux kernel IPv4 vulnerability, across its fleet including BYOC clusters with an active integration, and that it intends to share a root cause analysis once findings are confirmed; BleepingComputer reported the company had not disclosed how attackers gained access or how many customers were affected.
  • Wiz's 'Black October' report lists Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank, and says public reports show attackers 'explicitly hunting stored environment variables, with a focus on those granting AI access'.
  • Wiz updated the report between 2 and 7 November with further publicly reported incidents at Brev (NVIDIA), covering 4 to 20 October, Trigger.dev (1 November), Chainstack (29 to 31 October), kernel.sh (disclosed 4 November, covering 24 October to 3 November) and Blacksmith (disclosed 5 November), and noted social media reports of a RunPod incident; it said Brev, Trigger.dev and Chainstack had shared no TTPs or IOCs.
  • In two LLMjacking cases Wiz investigated, compromised keys were used for approximately 800,000 and 1.7 million Amazon Bedrock calls, which Wiz said likely ran up over $100,000 in usage at list price.
  • Northflank urged upstream providers to offer API endpoints for credential revocation, IP restrictions and enforceable budget limits.

What it means for your organisation

When a hosting platform holds customer secrets centrally, its control plane is a shared point of failure: Northflank told all users to assume their environment variables were decrypted, and customers then reported their AI API keys being used by someone else. Northflank's own timeline places the first known decryption hours before its first security alert, so the outcome depended on how quickly each customer could revoke and replace keys at the issuing providers. Static keys without IP restrictions or spending limits are the weak point Northflank itself asked upstream providers to address.

What we check

  • Inventory which secrets live in PaaS and CI environment variables, and check whether high-value ones (cloud, payment and AI provider keys) can move to short-lived federated credentials or a dedicated secrets manager.
  • Time an end-to-end rotation drill: confirm every secret held by a hosting platform can be revoked at the issuing provider and replaced within hours, in a documented order.
  • Check that AI provider and cloud API keys carry IP allow-lists, least-privilege scopes and budget or quota limits, and that use from unfamiliar networks or sudden volume spikes raises an alert.
  • For Amazon Bedrock and similar services, review IAM policies for broad model and cross-region inference access (such as global.* profiles) and confirm invocation logging is enabled.
  • In vendor reviews of hosting and CI platforms, ask about control-plane isolation options (dedicated or BYOC), customer-visible audit logs and breach notification commitments.

Sources

Services that cover these checks

  • Cloud configuration review

    An IAM-first review of AWS, Azure or GCP. We map what an attacker reaches after compromising one workload or one developer laptop, then rank those paths by the data at the end of each and write the Terraform or policy change that cuts it.

    Duration: 4 to 8 working days

  • Incident response

    Hands-on help when an attacker is already inside: triage on the first call, containment that does not destroy evidence, forensic scoping of what was touched, and recovery that we verify before calling it complete. Outside a crisis we run retainers, tabletop exercises and compromise assessments, so your team has practised the first hour before it happens.

    Duration: Live incidents until recovery is verified; readiness work in days

  • AI & LLM application testing

    Adversarial testing of features built on large language models: chat assistants, retrieval-augmented search, agents with tool access, and generated output that reaches users or other systems. We test whether the model can be steered into leaking data, taking actions it should not, or passing untrusted output into the rest of your stack.

    Duration: 4 to 10 working days

  • Application security audit

    A white-box review of your application: source code, architecture, dependencies and build pipeline. Automated analysis finds the candidates; reviewers confirm each one by reading the code path, and only confirmed defects reach the report, each with a file and line reference.

    Duration: 5 to 15 working days, depending on codebase size

Run these checks against your own systems

We pick the checks that apply to your systems. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Scope an engagementHow the scoping call works