decrypted · 1 november 2026 · vulnerabilities and patching · supply chain · ai and llm security

Northflank tells customers to assume every secret was read, and AI keys are then abused

Northflank, a cloud platform that hosts other firms' applications, told customers on Friday to "assume all environment variables have been decrypted" and to rotate every key. By Friday night, customers were reporting strangers spending their AI provider credits. None of this was in this morning's post, and it is one of a run: the security firm Wiz counts at least nine AI developer platforms that disclosed incidents in October.

What happened

Northflank's own status page gives the timeline. Wiz sent a threat alert at 11:43 UTC on Friday, engineers reviewed it a minute later, and network policy patches followed within the hour. By 13:58 the advice was blunt: disable and rotate all keys. At 15:12 users were already confirming that AI keys stored on the platform had been used. The page states no root cause, and does not say how many customers are affected.

Why the keys go first

Think of an environment variable as a sticky note on the back of a locked office door. It holds the key to some other building. Platforms like Northflank keep thousands of those notes so that customers' applications can reach databases and AI services, which means one break-in collects keys to many buildings, none of them the thief's to enter.

Wiz describes two separate enterprise cases where stolen AI keys were tested within 30 minutes of the credential theft, using a single call from a residential internet address. Bulk traffic followed: about 800,000 calls over 30 hours in one case, and about 1.7 million over 13 hours in the other. Wiz puts the combined usage above $100,000 at list price. The practice is called LLMjacking: borrowing someone else's access to a large language model, the kind of AI behind chatbots, and leaving them the bill.

The detail that bought time

One of those two keys was restricted to a single region's routing. The thieves' resale pool asked for broader routing, so thousands of calls failed for hours until a script found the permitted route. Wiz also says it cannot tie the nine incidents to one gang, and the companies cite different causes: credential access, privilege escalation in build systems, a third-party vendor, a legacy system.

The Secure by Design lesson

The design decision is where long-lived, broad secrets sit. A key that works from anywhere, for anything, indefinitely, is a bearer cheque. Secure by Design asks suppliers to make the safe state the default: short-lived credentials, keys bound to a workload or a network range, and spending caps with alerts switched on from the start.

Northflank enabled audit logs for every customer, free accounts included, only at 01:04 UTC on Saturday, after the incident began.

The cost of applying this is modest. Ask every platform supplier where your secrets live, who at the supplier can decrypt them, and how quickly you can rotate every one. Set billing alerts with your AI provider today. If you cannot rotate within an hour, that is your finding.

Also this week

A third-party script, a wallet-draining payload. Polymarket, a crypto prediction market, said one of its third-party providers was compromised. Hudson Rock found wallet-draining logic in a script served from the website performance firm DebugBear, which said it was affected by an ongoing security incident and urged customers to remove its embed code. Hudson Rock says the script looked for wallets holding funds and asked each user's own signer to approve transfers, so the page itself did the draining. It sees about $2.19 million in the recipient wallet but stresses that is not a verified theft total. Polymarket removed the code on Thursday and says it is reimbursing affected traders. The lesson is old and cheap: keep third-party scripts out of pages where people log in or sign anything, and use Subresource Integrity, which pins a script to a known fingerprint, with a strict content security policy.

Binance and the engineer's laptop. Binance says about $6.3 billion left its wallets on Thursday after a DevOps engineer's laptop was compromised, and that it has found no evidence of a leaked private key. TRM Labs and Chainalysis attribute the theft to North Korea's TraderTraitor; the totals differ slightly between them ($6.36 billion and $6.4 billion). TRM counts about $2.7 billion frozen by stablecoin issuers and others, and says the attacker still holds more than 420,000 ETH and 18,270 BTC, about $2.4 billion beyond any issuer's reach. Binance says it will cover all losses. TRM thinks the signing infrastructure itself was compromised, which is its assessment, not Binance's. The design question for any UK firm is the same: should one laptop ever be a short path to production money?

Sources

If you want help working out where your platform secrets live and how fast you could rotate them, get in touch.