{ "api_version": "1", "updated": "2026-10-31", "latest_event": "2026-10-30", "rights": "© Frontier Log, all rights reserved.", "story": { "slug": "ai-key-holder-breaches", "title": "Eight AI Platforms Breached in October", "description": "Eight AI platforms disclosed breaches in October, most of them involving users' stored keys or credentials. Three tied their incidents to distillation.", "url": "https://frontierlog.ai/stories/ai-key-holder-breaches", "date": "2026-10-31", "image": "https://frontierlog.ai/og/story-ai-key-holder-breaches.png", "event": null, "tags": [ "cybersecurity", "distillation" ], "steps": [], "tables": [], "records": [ { "date": "2026-10-06", "party": "Fireworks AI", "what": "identifies a breach of customer environment variables", "by": "Fireworks AI", "source": "https://fireworks.ai/security/bulletins/october-2026-security-incident", "quote": "An unauthorized third party accessed environment variables used in evaluation jobs in a limited number of customer accounts." }, { "date": "2026-10-09", "party": "Andromeda", "what": "says the activity it found on Oct 13 began this day, it believes as part of an industry-wide attack", "by": "Andromeda", "source": "https://andromeda.ai/security-updates/october-2026-security-incident", "quote": "We believe the activity began as part of an industry-wide attack on or about October 9th. It affected a limited number of customer accounts and involved exposure of certain Andromeda and customer credentials." }, { "date": "2026-10-14", "party": "Zeabur", "what": "is breached through leaked internal credentials", "by": "Zeabur", "source": "https://zeabur.com/blogs/october-2026-security-incident", "quote": "From October 14, 01:36, the attacker used Zeabur internal AWS keys" }, { "date": "2026-10-15", "party": "Lightning AI", "what": "identifies a credential breach and revokes all user access", "by": "Lightning AI", "source": "https://lightning.ai/blog/oct-2026-incident", "quote": "On October 15, 11:00 PM UTC we identified a security incident on the Lightning Platform involving unauthorized access to credentials. We revoked all user access to the Lightning Platform on October 16 at 1:00 AM UTC to address the issue." }, { "date": "2026-10-16", "party": "OpenCode", "what": "is breached; 1.4% of Console users affected", "by": "OpenCode", "source": "https://x.com/opencode/status/2111519637049319818", "quote": "We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users" }, { "date": "2026-10-20", "party": "Railway", "what": "is breached, up to 1.85% of workspaces possibly exposed", "by": "Railway", "source": "https://blog.railway.com/p/preliminary-report-october-security-incident", "quote": "we can validate that at most 1.85% of all workspaces had some environment variables potentially compromised. This represents, numerically, about 100,000 workspaces." }, { "date": "2026-10-21", "party": "LiteLLM", "what": "'s release pipeline ships a credential-stealing version", "by": "LiteLLM", "source": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "quote": "A malicious litellm==1.107.0 package was published to PyPI and was live for approximately 2 hours (11:39 UTC to 13:23 UTC)." }, { "date": "2026-10-23", "party": "Warp", "what": "detects exploitation of a vendor in its infrastructure", "by": "Warp", "source": "https://x.com/zachlloydtweets/status/2114800787716972873", "quote": "As of today, we believe an upper bound of roughly 1% of Warp users may have been impacted." }, { "date": "2026-10-26", "party": "OpenRouter", "what": "finds no evidence for a third party's claim that its users and keys were for sale", "by": "OpenRouter", "source": "https://x.com/OpenRouter/status/2114589161499828372", "quote": "We have investigated this and have not found evidence of unauthorized access to our data, or validation of any of the claims in the post." }, { "date": "2026-10-28", "party": "Command Code", "what": "detects and stops an incident and revokes all its API keys", "by": "Command Code", "source": "https://x.com/CommandCodeAI/status/2115583532055826770", "quote": "Earlier today we detected and stopped a security incident linked to a large-scale distillation attack targeting Anthropic and OpenAI models." }, { "date": "2026-10-30", "party": "Northflank", "what": "tells all users to assume their environment variables were decrypted", "by": "Northflank", "source": "https://status.northflank.com/", "quote": "Assume all environment variables have been decrypted. Disable/rotate all keys." } ], "statements": [ { "party": "Zeabur", "by": "Zeabur", "quote": "the attacker was mainly looking for API keys they could use directly, especially keys for AI services", "source": "https://zeabur.com/blogs/october-2026-security-incident", "date": "2026-10-19" }, { "party": "Zeabur", "by": "Zeabur", "quote": "Revoked all 566 zSend API keys", "source": "https://zeabur.com/blogs/october-2026-security-incident", "date": "2026-10-19" }, { "party": "OpenCode", "by": "OpenCode", "quote": "it was a subset of users who had external providers linked", "source": "https://x.com/opencode/status/2111519637049319818", "date": "2026-10-17" }, { "party": "Railway", "by": "Railway", "quote": "Early investigations tell us this attack was attempting to obtain AI provider API keys to perform distillation attacks.", "source": "https://blog.railway.com/p/preliminary-report-october-security-incident", "date": "2026-10-22" }, { "party": "Lightning AI", "by": "Lightning AI", "quote": "We believe that certain customer credentials were compromised to gain access to environments and connected third-party services.", "source": "https://lightning.ai/blog/oct-2026-incident" }, { "party": "LiteLLM", "by": "LiteLLM", "quote": "Reviewing the actor's activity on these other systems shows attempts to identify and exfiltrate additional keys and tokens, with a primary focus on upstream inference API tokens.", "source": "https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain", "date": "2026-10-23" }, { "party": "Warp", "by": "Warp", "quote": "The attack appears to have come from an agent swarm using a very sophisticated penetration and escalation technique, likely starting with a hole in a vendor dependency, and ultimately accessing a limited amount of agent trace and telemetry data.", "source": "https://x.com/zachlloydtweets/status/2114800787716972873", "date": "2026-10-26" }, { "party": "OpenRouter", "by": "OpenRouter", "quote": "We will continue the investigation and monitor for any signs of abuse. If a leak is verified or abuse is detected we will take action and notify customers.", "source": "https://x.com/OpenRouter/status/2114589161499828372", "date": "2026-10-26" }, { "party": "Command Code", "by": "Command Code", "quote": "So far, we've found no evidence that any users were impacted.", "source": "https://x.com/CommandCodeAI/status/2115583532055826770", "date": "2026-10-28" }, { "party": "Command Code", "by": "Command Code", "quote": "As a precaution, we've revoked all API keys.", "source": "https://x.com/CommandCodeAI/status/2115583532055826770", "date": "2026-10-28" }, { "party": "Northflank", "by": "Northflank", "quote": "Users have reported unauthorised use of AI API keys supplied to the Northflank platform.", "source": "https://status.northflank.com/", "date": "2026-10-30" } ], "cites": [ { "url": "https://fireworks.ai/security/bulletins/october-2026-security-incident", "by": "Fireworks AI", "medium": "security bulletin", "date": "2026-10-09" }, { "url": "https://andromeda.ai/security-updates/october-2026-security-incident", "by": "Andromeda", "medium": "security update", "date": "2026-10-20" }, { "url": "https://zeabur.com/blogs/october-2026-security-incident", "by": "Zeabur", "medium": "preliminary report", "date": "2026-10-19" }, { "url": "https://lightning.ai/blog/oct-2026-incident", "by": "Lightning AI", "medium": "blog post" }, { "url": "https://x.com/opencode/status/2111519637049319818", "by": "OpenCode", "medium": "X post", "date": "2026-10-17" }, { "url": "https://blog.railway.com/p/preliminary-report-october-security-incident", "by": "Railway", "medium": "preliminary report", "date": "2026-10-22" }, { "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "by": "LiteLLM", "medium": "blog post", "date": "2026-10-21" }, { "url": "https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain", "by": "LiteLLM", "medium": "root-cause post", "date": "2026-10-23" }, { "url": "https://x.com/zachlloydtweets/status/2114800787716972873", "by": "Warp", "medium": "CEO Zach Lloyd's X post", "date": "2026-10-26" }, { "url": "https://x.com/OpenRouter/status/2114589161499828372", "by": "OpenRouter", "medium": "X post", "date": "2026-10-26" }, { "url": "https://x.com/CommandCodeAI/status/2115583532055826770", "by": "Command Code", "medium": "X post", "date": "2026-10-28" }, { "url": "https://status.northflank.com/", "by": "Northflank", "medium": "status page", "date": "2026-10-30" } ], "sources": [ "https://fireworks.ai/security/bulletins/october-2026-security-incident", "https://andromeda.ai/security-updates/october-2026-security-incident", "https://zeabur.com/blogs/october-2026-security-incident", "https://lightning.ai/blog/oct-2026-incident", "https://x.com/opencode/status/2111519637049319818", "https://blog.railway.com/p/preliminary-report-october-security-incident", "https://docs.litellm.ai/blog/security-incident-oct-21-2026", "https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain", "https://x.com/zachlloydtweets/status/2114800787716972873", "https://x.com/OpenRouter/status/2114589161499828372", "https://x.com/CommandCodeAI/status/2115583532055826770", "https://status.northflank.com/" ], "body": [ { "figure": "main" }, { "p": "Eight AI platforms disclosed breaches in October, each on its own blog, status page or X account (Warp through its CEO), with incidents from Fireworks AI on Oct 6 to Warp on Oct 23. Five of them say stored customer keys, credentials or environment variables were exposed, and OpenCode says its breach hit Console users who had linked external providers. LiteLLM's release pipeline shipped a credential-stealing version, and Warp's CEO names agent trace and telemetry data. Three platforms tied their incidents to distillation: OpenCode and Railway, both breached, and Command Code, which says it stopped its incident and has found no user affected. Northflank is still investigating an incident found on Oct 30, and OpenRouter found no evidence for a third party's claim that its users and keys were for sale." }, { "h": "Three platforms name distillation" }, { "p": "OpenCode said on Oct 17 that it [had a security breach](https://x.com/opencode/status/2111519637049319818) “related to a large scale distillation attack that impacted 1.4% of OpenCode Console users,” those who had linked external providers. Railway's [preliminary report](https://blog.railway.com/p/preliminary-report-october-security-incident) of Oct 22 says the attack “was attempting to obtain AI provider API keys to perform distillation attacks,” and that at most 1.85% of its workspaces, about 100,000, had environment variables potentially compromised. Railway gave providers more keys than that to revoke, and says a revocation notice from a provider “does not imply that their credentials were impacted.”" }, { "p": "Command Code said on Oct 28 that it had [detected and stopped](https://x.com/CommandCodeAI/status/2115583532055826770) an incident “linked to a large-scale distillation attack targeting Anthropic and OpenAI models.” It revoked all of its API keys as a precaution and said it had found no evidence that any users were impacted." }, { "h": "Keys and environment variables" }, { "p": "Fireworks AI's [bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident) says a third party accessed environment variables in a limited number of customer accounts. Andromeda [says](https://andromeda.ai/security-updates/october-2026-security-incident) it believes the activity began “as part of an industry-wide attack on or about October 9th,” and that it has not yet established the root cause. Zeabur's [preliminary report](https://zeabur.com/blogs/october-2026-security-incident) says the attacker read the environment variables in its platform database and was mainly looking for keys, “especially keys for AI services,” which it calls only an observation of the attacker's intent. It revoked all 566 of its zSend API keys. Lightning AI [says](https://lightning.ai/blog/oct-2026-incident) certain customer credentials were compromised, and it revoked all user access to its platform on Oct 16." }, { "p": "A malicious LiteLLM release was [live on PyPI for about 2 hours](https://docs.litellm.ai/blog/security-incident-oct-21-2026) on Oct 21, and in its Docker images until 14:20 UTC, and LiteLLM's [root-cause post](https://docs.litellm.ai/blog/security-incident-oct-21-2026-attack-chain) says the attacker first got in on Oct 10, using an administrative key committed to a public repository on May 27, and focused on “upstream inference API tokens.” Warp's CEO Zach Lloyd [wrote on X](https://x.com/zachlloydtweets/status/2114800787716972873) that up to roughly 1% of Warp users may have been impacted. On Oct 30, Northflank's [status page](https://status.northflank.com/), which calls it a security incident under investigation, told every user to assume their environment variables had been decrypted, and said users had reported unauthorised use of AI API keys supplied to the platform." }, { "h": "No evidence of a leak" }, { "p": "On Oct 26, OpenRouter [posted on X](https://x.com/OpenRouter/status/2114589161499828372) that it had “not found evidence of unauthorized access to our data, or validation of any of the claims in the post,” and that it would notify customers if a leak were verified." }, { "table": { "cols": [ "Date", "Platform", "Impact, as the platform states it", "Cause or aim, as the platform states it", "Status" ], "rows": [ [ "Oct 6", "Fireworks AI", "Env vars and API keys likely taken from some accounts", "Internal credentials misused", "Confirmed" ], [ "Oct 9", "Andromeda", "Its own and customers' credentials exposed", "Root cause not yet established", "Confirmed" ], [ "Oct 14", "Zeabur", "Attacker read stored env vars, 566 zSend API keys revoked", "Leaked credentials, sought keys, especially for AI services", "Confirmed" ], [ "Oct 15", "Lightning AI", "Customer credentials used to reach users' environments", "Unauthorized access to credentials", "Confirmed" ], [ "Oct 16", "OpenCode", "Breach hit 1.4% of Console users who linked external providers", "A “large scale distillation attack”", "Confirmed" ], [ "Oct 20", "Railway", "Env vars of up to 1.85% of workspaces possibly exposed", "AI keys “to perform distillation attacks”", "Confirmed" ], [ "Oct 21", "LiteLLM", "A credential-stealing release was on PyPI for ~2 hours", "Focus on “upstream inference API tokens”", "Confirmed" ], [ "Oct 23", "Warp (CEO on X)", "Up to ~1% of users may be affected", "Likely an “agent swarm” via a vendor", "Confirmed" ], [ "Oct 26", "OpenRouter", "Finds no evidence for a third party's sale claim", "Investigation continues", "Claimed, no evidence found" ], [ "Oct 28", "Command Code", "Revoked all its API keys, no affected users found", "A “large-scale distillation attack”", "Under investigation" ], [ "Oct 30", "Northflank", "Users report their stored AI keys were used", "May fit a wider pattern of attacks on AI credentials", "Under investigation" ] ] } } ] } }