# How to protect AI API keys after the Black October breaches

> How to protect AI API keys after Black October: what LLMjacking is, why hosting platforms were hit, and the rotation and spend-limit steps to take this week.

- Published: Nov 9, 2026
- Topic: AI for business
- Author: RDR Digital
- Original: https://rdr.digital/blog/protect-ai-api-keys

To protect AI API keys after the Black October breaches, assume any key stored on an affected platform is already in someone else's hands. Rotate it, limit what each key can do, and put a spend limit and a usage alert on every AI account, so a stolen key costs you an email instead of a five-figure bill.

Between early October and early November 2026, attackers broke into more than a dozen AI developer and hosting platforms, mostly to take the API keys customers had stored there. Here is what happened, what LLMjacking is, and what to check this week.

## What happened in Black October?

On October 30, 2026, the security company Wiz [started a running list](https://www.wiz.io/blog/black-october-for-ai-developer-platforms) of incidents at AI developer platforms, the services teams use to host apps and run AI agents. Its summary: "A series of agentic attacks on AI Developer Platforms has been leading to LLMJacking at scale."

| Disclosed (2026) | Platform                          | What Wiz or the platform reported                                         |
| ---------------- | --------------------------------- | ------------------------------------------------------------------------- |
| October 6        | Fireworks AI                      | Internal credentials misused, some customer environment variables exposed |
| October 20       | Railway                           | Encrypted environment variables queried, a subset decrypted               |
| October 23       | Warp                              | Limited agent data reached through a third-party infrastructure provider  |
| October 30       | Northflank                        | Customers told to assume all environment variables were decrypted         |
| November 2       | Brev, Trigger.dev                 | Added to the list                                                         |
| November 3 to 7  | Chainstack, kernel.sh, Blacksmith | Added as the post was updated                                             |

Source: [Wiz](https://www.wiz.io/blog/black-october-for-ai-developer-platforms), updated through November 7, 2026. The full list also includes Andromeda, Zeabur, Lightning AI, OpenCode, and CommandCode, plus social media reports about RunPod.

There was no single shared vulnerability. Fireworks AI reported misuse of internal credentials and Warp pointed to a third-party infrastructure provider, according to [an Anadolu Agency timeline](https://www.aa.com.tr/en/world/timeline-ai-at-center-of-october-cyberattack-wave-targeting-tech-giants-developer-platforms/4108775) of the October attacks, while [Railway's own report](https://blog.railway.com/p/preliminary-report-october-security-incident.md) points to privilege escalation in its build infrastructure. What the incidents have in common is the target: stored secrets, especially keys for paid AI models.

### How big were the Railway and Northflank incidents?

Railway's [preliminary report](https://blog.railway.com/p/preliminary-report-october-security-incident.md) says an attacker obtained CI credentials on October 21 and decrypted a subset of customers' environment variables. Up to 1.85% of workspaces, about 100,000, may have been affected. Because Railway could not tell exactly which variables were decrypted, it asked providers such as GitHub, Anthropic, and OpenAI to revoke every key it stored, not only the affected ones. Railway says the attacker appeared to be after AI provider API keys.

Northflank told customers on October 30 to assume all environment variables had been decrypted and to rotate every key, according to [Qovery's summary of Northflank's status updates](https://www.qovery.com/blog/northflank-security-incident-secrets-own-cloud). Within hours, users reported unauthorized use of AI keys they had stored there. As of its November 6 update, Northflank had not said how the attackers got in, though it had patched its network policies and promised a root cause analysis.

## What is LLMjacking?

LLMjacking is the theft of access to a large language model: someone steals your API key or cloud credentials and runs AI requests on your account, so you pay for their usage. The stolen access is often resold as cheap model access, or used for distillation, where outputs from a strong model are collected to train another one.

Wiz documented two cases on Amazon Bedrock. In both, the stolen key was first tested within 30 minutes of the breach. In one, it went on to make about 800,000 calls in roughly 30 hours. In the other, the key turned up in a reseller pool seven days later and made about 1.7 million calls in 13 hours. Wiz estimates the two cases alone likely ran up more than $100,000 in usage at list price.

| Wiz case | Calls             | Time window | Successful calls |
| -------- | ----------------- | ----------- | ---------------- |
| Case A   | About 800,000     | About 30 h  | About 90%        |
| Case B   | About 1.7 million | 13 h        | Over 1 million   |

In case A, Claude Opus models, among the most expensive per token, made up about three quarters of the successful calls. A stolen key is worth the most where the price is highest.

## Why AI agents make leaked keys more dangerous

Leaked keys are an old problem, but abuse now follows faster. On November 5, [Microsoft Threat Intelligence reported](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/) that attackers were using ARTEX, an agentic AI penetration-testing framework, to search public GitHub repositories for secrets and then sign in to Azure and Microsoft 365 with them. In one case, an agent went from searching GitHub to taking data out of Azure Key Vault in five minutes.

The supply of leaked keys is large. GitGuardian's [State of Secrets Sprawl 2026](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/) counted 28.65 million new hardcoded secrets in public GitHub commits in 2025, up 34%, and leaks of AI service keys grew 81%. More than 64% of valid secrets it found in 2022 were still valid in January 2026. A key that leaked years ago can still work today.

## How to protect your AI API keys this week

These steps draw on Microsoft's guidance, the platforms' instructions to customers, and [Anthropic's API key best practices](https://support.claude.com/en/articles/9767949-api-key-best-practices-keep-your-keys-safe-and-secure). They apply to any AI or cloud provider.

### 1. Make a list of where your keys live

List every AI and cloud key your business uses, where it is stored, and who created it, including automation tools and anything a freelancer set up. You cannot rotate what you do not know exists.

### 2. Rotate anything stored on an affected platform

If a key was stored on any platform in the Wiz list, create a new key, deploy it, then delete the old one. Do the same for any key that ever appeared in a repository, chat message, or support ticket. Microsoft's report puts it simply: "Publicly exposed credentials remain usable until revoked or rotated." Deleting the file or rewriting Git history does not switch a key off.

### 3. Set spend limits and usage alerts

Anthropic recommends spend limits and workspace rate limits in its Console or, on standard plans, carefully chosen auto-reload limits, as a safeguard against usage from leaked keys or faulty scripts. Set the equivalent budgets and alerts with every AI and cloud provider, and send alerts to someone who reads them.

### 4. Give each key one job

Use separate keys for development, testing, and production, and for each app or automation. If one leaks, you disable that key without stopping everything else. Where a provider supports it, restrict what a key can reach, the same least-privilege idea we cover in [roles and permissions in business software](https://rdr.digital/blog/roles-and-permissions-in-business-software).

### 5. Keep keys out of code and turn on scanning

Store keys in your platform's encrypted secret storage or a secrets manager, never in code or shared documents. On GitHub, [secret scanning and push protection](https://docs.github.com/en/code-security/getting-started/github-security-features) are free for public repositories; for private repositories they come with GitHub Secret Protection, a paid add-on. Anthropic also takes part in GitHub's secret scanning partner program and automatically deactivates Claude keys found in public repositories.

### 6. Check the logs and the bill

Look at usage pages for spikes, unfamiliar models, or calls from new regions since October. Railway also asks customers to review GitHub audit logs, installed GitHub apps, and container registry logs. Plan what happens to your product when a key is revoked mid-day; our guide to [when an integration fails](https://rdr.digital/blog/when-an-integration-fails) covers designing for that.

## Should you stop using hosted AI platforms?

Not necessarily. Hosting platforms save real time, and both platforms responded: Railway rotated its own credentials and invalidated sessions, and Northflank revoked sessions and turned on audit logs for every customer. The lesson is that any place that stores your keys is part of your security, so pick providers that offer audit logs, scoped keys, and quick disclosure, and design so that one stolen key has a small blast radius and a capped cost.

## Frequently asked questions

### What should I do if my API key was leaked?

Delete the key with the provider straight away, create a new one, and update every place that uses it. Then check usage logs and your bill for activity you do not recognize, and contact the provider about charges you did not make.

### How often should I rotate API keys?

Rotate immediately after any suspected exposure, and on a regular schedule otherwise. Anthropic's best practices give 90 days as an example interval, with old keys deactivated once the new ones are in place.

### Was my Railway or Northflank key stolen?

Neither platform has said exactly which customer secrets were taken, which is why both asked customers to rotate. If you stored keys on either platform before the incidents, treat them as compromised.

### Can a spend limit stop a stolen key?

A spend limit does not stop the theft, but it caps the cost. Combined with usage alerts, it turns a stolen key into a problem you notice within hours instead of at the end of the month.

## Where to start

If you only have an hour, list your AI keys, rotate any stored on the affected platforms, and set a spend limit and an alert on each AI account. Those three steps close the most direct path from a stolen key to a large bill, and they are worth keeping as a routine long after this month's headlines move on.

## Sources

- [Wiz: Black October for AI Developer Platforms](https://www.wiz.io/blog/black-october-for-ai-developer-platforms)
- [Microsoft Security: Threat actors use agentic AI tooling to find and abuse exposed secrets](https://www.microsoft.com/en-us/security/blog/2026/11/05/threat-actors-use-agentic-ai-tooling-to-find-and-abuse-exposed-secrets/)
- [Railway: Preliminary report on the October security incident](https://blog.railway.com/p/preliminary-report-october-security-incident.md)
- [Qovery: Northflank Security Incident (October 30, 2026): What Happened and How to Protect Your Secrets](https://www.qovery.com/blog/northflank-security-incident-secrets-own-cloud)
- [GitGuardian: The State of Secrets Sprawl 2026](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/)
- [Claude Help Center: API key best practices, keeping your keys safe and secure](https://support.claude.com/en/articles/9767949-api-key-best-practices-keep-your-keys-safe-and-secure)
- [Anadolu Agency: TIMELINE - AI at center of October cyberattack wave targeting tech giants, developer platforms](https://www.aa.com.tr/en/world/timeline-ai-at-center-of-october-cyberattack-wave-targeting-tech-giants-developer-platforms/4108775)
- [GitHub Docs: GitHub security features](https://docs.github.com/en/code-security/getting-started/github-security-features)