Inference providers as spoils: platform-chain attacks against AI inference services

In October 2026, three platforms that store customer keys—Fireworks AI, OpenCode, and Railway—disclosed intrusions within about two weeks of each other, each exposing credentials used for AI inference services. CSA calls this type of attack, which reaches inference accounts through third-party platforms that hold keys, a platform chain, and notes that platforms holding keys on behalf of customers means a single intrusion can leak the keys of multiple inference accounts at once; no vendor has yet attributed the incidents to the same actor, and the related claim comes only from Railway. The malicious LiteLLM 1.107.0 release in the same period also stole similar cloud and LLM keys and is listed as related rather than confirmed to be connected. CSA recommends rotating keys at the issuer, issuing separate keys per platform and application with spending caps, and switching to short-lived, narrowly scoped credentials.