Eight AI Platforms Breached in October

Eight AI platforms disclosed breaches in October, each on its own blog, status page or X account (Warp through its CEO), with incidents from Fireworks AI on Oct 6 to Warp on Oct 23. Five of them say stored customer keys, credentials or environment variables were exposed, and OpenCode says its breach hit Console users who had linked external providers. LiteLLM's release pipeline shipped a credential-stealing version, and Warp's CEO names agent trace and telemetry data. Three platforms tied their incidents to distillation: OpenCode and Railway, both breached, and Command Code, which says it stopped its incident and has found no user affected. Northflank is still investigating an incident found on Oct 30, and OpenRouter found no evidence for a third party's claim that its users and keys were for sale.

Three platforms name distillation

OpenCode said on Oct 17 that it had a security breach “related to a large scale distillation attack that impacted 1.4% of OpenCode Console users,” those who had linked external providers. Railway's preliminary report of Oct 22 says the attack “was attempting to obtain AI provider API keys to perform distillation attacks,” and that at most 1.85% of its workspaces, about 100,000, had environment variables potentially compromised. Railway gave providers more keys than that to revoke, and says a revocation notice from a provider “does not imply that their credentials were impacted.”

Command Code said on Oct 28 that it had detected and stopped an incident “linked to a large-scale distillation attack targeting Anthropic and OpenAI models.” It revoked all of its API keys as a precaution and said it had found no evidence that any users were impacted.

Keys and environment variables

Fireworks AI's bulletin says a third party accessed environment variables in a limited number of customer accounts. Andromeda says it believes the activity began “as part of an industry-wide attack on or about October 9th,” and that it has not yet established the root cause. Zeabur's preliminary report says the attacker read the environment variables in its platform database and was mainly looking for keys, “especially keys for AI services,” which it calls only an observation of the attacker's intent. It revoked all 566 of its zSend API keys. Lightning AI says certain customer credentials were compromised, and it revoked all user access to its platform on Oct 16.

A malicious LiteLLM release was live on PyPI for about 2 hours on Oct 21, and in its Docker images until 14:20 UTC, and LiteLLM's root-cause post says the attacker first got in on Oct 10, using an administrative key committed to a public repository on May 27, and focused on “upstream inference API tokens.” Warp's CEO Zach Lloyd wrote on X that up to roughly 1% of Warp users may have been impacted. On Oct 30, Northflank's status page, which calls it a security incident under investigation, told every user to assume their environment variables had been decrypted, and said users had reported unauthorised use of AI API keys supplied to the platform.

No evidence of a leak

On Oct 26, OpenRouter posted on X that it had “not found evidence of unauthorized access to our data, or validation of any of the claims in the post,” and that it would notify customers if a leak were verified.