Black October: stolen platform-stored AI keys fuel Bedrock LLMjacking across nine platforms
Severity: high · Patch status: no-fix-needed · Since 2026-10-30
On 30 October 2026 Wiz researchers Benjamin Read and Rami McCarthy published an analysis counting at least nine AI developer platforms that disclosed incidents during October 2026: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. The intrusions appear targeted at stored environment variables, especially AI provider keys, and Wiz found no single shared vulnerability or dependency; several victims described agent-swarm attacks and two blamed distillation. Downstream, Wiz followed two stolen enterprise AWS Bedrock keys: each was validated within 30 minutes of the reported vendor credential access by a single InvokeModel call from a residential IP, then checked 14 to 120 times a day by a small Go client. The unrestricted key (Case A) later took about 800,000 Bedrock calls in roughly 30 hours, much of it through global. cross-region inference profiles; the key limited to us. profiles (Case B) surfaced in a reseller pool, failed on global. for hours, then took about 1.7 million calls in around 13 hours. Wiz estimates the two cases ran up over $100,000 at list price and ties key checks to two LLM reseller operations, momo (llm-routing.com) and Xingjiabi (xingjiabiapi.org), without proving they ran the initial compromises. Anyone who kept AI or cloud keys on these platforms should rotate them at the issuer, not just delete them from the platform, and hunt Bedrock CloudTrail for the patterns below.
What to do
- Rotate, at the issuing provider (IAM, Anthropic, OpenAI and others), every AI-provider, cloud, database and registry key that was stored on Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode or Northflank; deleting the secret from the platform does not revoke it
- In CloudTrail, search bedrock InvokeModel / InvokeModelWithResponseStream / Converse calls by your access keys from source IPs outside your own egress ranges, especially a single call from a residential IP followed by days of low-volume (14–120 calls a day) checks from one client — the validation pattern Wiz observed
- In CloudTrail, also look for bedrock ListFoundationModels, ListInferenceProfiles, service-quotas GetServiceQuota and ListServiceQuotas (Bedrock and EC2 quotas) and bedrock PutAccountDataRetention from unfamiliar IPs or user agents such as boto3 scripts, which Wiz saw as pre-flood enumeration
- Scope Bedrock credentials tightly: allow only the inference profiles and models you use (deny the global. inference-profile prefix if you do not need it) and add aws:SourceIp / aws:SourceVpc conditions so a leaked key fails off your network; Wiz shows a us.*-only key was still abused heavily, so restrictions slow abuse but do not replace rotation
- Alert on the credential-check IPs Wiz published (23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201) in CloudTrail; Wiz says they are not directly linked to the platform breaches, so treat a hit as a leaked-key signal, not attribution
- Set AWS Budgets and Cost Anomaly Detection alarms on the Bedrock service, lower Bedrock service quotas to expected usage, and prefer short-lived role credentials over long-lived IAM user keys
- Review Bedrock invocation logs and billing back to mid-September 2026 (the earliest shared-pool activity Wiz lists is 10 September) for unfamiliar models, regions and volume spikes
Sources
All live incidents on Threat Watch
