The "Black October" of AI development platforms
“Black October” for AI Developer Platforms
Wiz Research reports that in October 2026 at least nine AI development platforms disclosed security incidents in succession, including Fireworks AI, Zeabur, Lightning AI, OpenCode, Railway, Warp and others; attackers targeted stored environment variables, focusing on credentials that can access AI services. Fireworks, OpenCode and Warp reported signs of "agent swarm" attacks; OpenCode and CommandCode attributed the incidents to "distillation" attempts; Zeabur will shut down due to the incident. Wiz also observed downstream abuse of stolen keys from two enterprises, the theft attributable to one of the platform intrusions: the first unauthorized calls occurred within 30 minutes after the platform disclosed the credential theft, and the two keys were subsequently used to make approximately 800,000 and 1.7 million Bedrock calls respectively, with usage at list prices potentially exceeding $100,000.
At least nine AI development platforms disclosed security incidents in the same month; Wiz tracked stolen enterprise keys being rapidly validated and abused at scale, with links to publicly known LLM resale organizations.