Northflank Breach 2026: How Customers’ AI API Keys Were Abused After Environment Variables Were Exposed

On 30 October 2026, the cloud application platform Northflank told customers to rotate their environment variables immediately after cloud security company Wiz alerted it to a breach. Within about two hours, Northflank's status page advised: "Assume all environment variables have been decrypted." Later that day Northflank said multiple users had confirmed unauthorised use of AI API keys they had stored on the platform, and asked customers to check AI provider usage and billing logs. Northflank patched its network policies, called in Wiz's incident response team, enabled self-service secret rotation for its database and messaging add-ons and turned on audit logs for every customer. It has not disclosed how the attacker got in, how many customers were affected or whether credentials other than AI keys were abused, according to BleepingComputer. Wiz lists Northflank as the ninth AI developer platform to disclose an incident in October 2026.

At a glance

What happened

Northflank lets developers deploy applications, databases and jobs, and stores their configuration, including secrets such as API keys, as environment variables and secret groups. On 30 October 2026 at 11:43 UTC, Wiz sent Northflank a threat alert. According to Northflank's status page, engineers reviewed it a minute later, deployed an initial network policy patch at 12:02 UTC, asked Wiz's incident response team for support at 13:00 and applied more patches at 12:50 and 13:05. At 13:40 UTC Northflank posted its first public warning: "Rotate environment variables immediately."

The guidance hardened quickly. At 13:58 UTC Northflank wrote: "Assume all environment variables have been decrypted." It told customers to disable and rotate all keys. By 15:12 UTC it had enabled secret rotation for PostgreSQL and MongoDB add-ons, recommended turning off public exposure of add-ons and noted that multiple users had confirmed their AI keys had been used. A late update at 23:38 UTC said users had reported unauthorised use of AI API keys supplied to the platform, and asked them to revoke keys with their providers, issue new ones, update workloads, and review AI provider usage and billing logs, reporting anything suspicious to Northflank and the provider.

On 31 October Northflank enabled audit logs for all customers, including free accounts, and over the day added rotation for MySQL, Redis, MinIO and RabbitMQ add-ons. "Secret rotation for MySQL and Redis is now available to all customers," one update reads. BleepingComputer, reporting on 31 October, said Northflank had not disclosed how attackers breached its systems, how many customers were affected, or whether credentials other than AI API keys were stolen or abused, and that Northflank had not replied to a request for comment by publication.

Northflank's updates refer to Wiz's report "Black October for AI Developer Platforms", published on 30 October. Wiz lists at least nine AI developer platforms that disclosed incidents that month, among them Railway, Zeabur, OpenCode, Fireworks AI and Northflank. It describes two cases it investigated where stolen keys drove about 800,000 and about 1.7 million Amazon Bedrock calls, which "likely ran up over $100k in usage". Wiz is careful to add that "there is no single vulnerability or dependency linking these attacks" and that most of the incidents are still being analysed.

Timeline

How it happened: the identity attack path

1. Initial access, not disclosed. Northflank has not said how the attacker got in. Its first remedial step was a network policy patch, followed by further patching.
2. Customer secrets exposed. Northflank told customers to assume that all environment variables, including workload secrets, secret groups and global secrets, had been decrypted.
3. AI keys selected. Customers' AI provider API keys were among the secrets stored on the platform, and they are easy to turn into money or free model access.
4. Keys abused at the provider. Multiple users confirmed unauthorised use of their AI keys, outside Northflank's environment, which is why billing and usage logs at the AI provider are the main evidence.
5. Containment by mass rotation. Northflank enabled rotation for database and messaging add-ons, turned on audit logs and told every customer to revoke and replace keys with their providers.

Impact

• Confirmed by Northflank: multiple users reported unauthorised use of AI API keys stored on the platform; all customers advised to treat every environment variable as decrypted.
• Not disclosed: the initial access vector, the number of affected customers, the volume of secrets taken and whether other credentials, such as database passwords or cloud keys, were misused.
• Customer cost: Northflank has not given figures. Unauthorised AI usage is billed to the key owner, which is why Northflank asked customers to check usage and billing logs.
• Operational: every customer had to rotate secrets across workloads, secret groups, global secrets and add-ons, and to revoke and reissue keys with external providers.
• Wider: Wiz links Northflank to a month of incidents at AI developer platforms but has not confirmed a shared attacker.

What this means for NHI and AI agent security

Northflank's customers did not lose their keys through their own mistakes. They stored them where a hosting platform told them to, as environment variables and secret groups, and the platform was breached. That makes this a third-party non-human identity incident: the customer's AI key is a machine credential, and its safety depended on the platform's controls. Our OWASP NHI Top 10 NHI3 Vulnerable Third-Party NHI Guide covers this risk.

The target is the same one seen across October. Railway said its attacker wanted AI provider keys, OpenCode's console breach involved stored LLM API keys, and Wiz traced stolen keys to Bedrock abuse worth an estimated $100,000 or more. AI keys are attractive because they can be used at once, from anywhere, and the bill goes to the victim. The defence is to make each key worth less: one key per platform, spending caps, narrow model permissions and alerts on unusual usage, as set out in our LLMjacking Guide.

Northflank's instruction to assume every variable was decrypted is the right default when scope is unknown, and it echoes Railway's response a week earlier. Teams that can rotate quickly come through this kind of incident far better, which is why the Leaked Credential Response Playbook should be ready before a provider sends the warning.

Recommendations

• Rotate every secret stored on Northflank. Revoke and replace keys with the issuing provider, then update workload secrets, secret groups, global secrets and add-on credentials, as Northflank advises. See our Secrets Rotation Runbook Template.
• Check AI provider usage and billing. Review usage logs for every AI key held on the platform from late October 2026 and report anything unexpected to Northflank and the provider. See our LLMjacking Guide.
• Use a separate, capped key for each platform. Give every hosting platform its own AI key with spending limits and only the models it needs, so one platform breach cannot drain a shared key.
• Turn off public exposure of add-ons. Disable public access to databases and other add-ons unless it is essential, as Northflank recommends, and review the new audit logs for unexpected access.
• Ask platforms how they protect stored secrets. Include encryption, decryption rights and incident notification in vendor due diligence. See our guide to Third-party NHI due diligence questions drawn from real breaches.
• Prepare for provider-triggered rotation. Keep an inventory of which secrets live on which platform and who owns them, so you can rotate within hours. See our Leaked Credential Response Playbook.

Frequently asked questions

What happened in the Northflank security breach?

On 30 October 2026, after a threat alert from Wiz, Northflank told customers to assume all environment variables stored on its platform had been decrypted and to rotate every secret. Multiple customers then reported unauthorised use of AI API keys they had stored there. Northflank has not disclosed how the attacker got in or how many customers were affected.

Is the Northflank breach linked to Railway and other October 2026 incidents?

Wiz lists Northflank among at least nine AI developer platforms that disclosed incidents in October 2026, including Railway, Zeabur and OpenCode, and the target in several was customers' AI keys. However, Wiz says there is no single vulnerability or dependency linking the attacks, and it has not confirmed a shared attacker.

What should Northflank customers do?

Revoke and replace every secret stored on Northflank, starting with AI provider keys, then update workloads, secret groups and add-ons. Review AI provider usage and billing logs for unexpected activity, disable public exposure of add-ons and use the newly enabled audit logs to check for unusual access.

Related NHI Mgmt Group resources

Railway breach 2026 · OpenCode Console breach 2026 · Fireworks AI breach 2026 · LLMjacking Guide · Leaked Credential Response Playbook

How NHI Mgmt Group can help

When a hosting platform is breached, customers have to find every key they stored there, rotate it fast and check for misuse at the provider. We help organisations map secrets held by third parties, limit what each AI key can do and build playbooks that make mass rotation routine. See our NHI and AI agent security training.

References

• Northflank: Status page, security incident updates (30 October 2026)
• Wiz: Black October for AI Developer Platforms (30 October 2026)
• BleepingComputer: Northflank security breach leads to abuse of customers' AI API keys (31 October 2026)