Northflank security breach leads to abuse of customers' AI API keys

Northflank, a platform for deploying applications and AI workloads, disclosed a security incident on October 30. After receiving an alert from cloud security company Wiz, it told customers to assume that environment variables had been decrypted and their stored secrets stolen. Those secrets can include database passwords, cloud credentials, authentication tokens, and API keys.

The warning mattered because attackers could reuse exposed credentials against other services. Northflank later confirmed that multiple customers reported unauthorized use of AI API keys stored on the platform. Such misuse can generate large bills or enable access to connected systems. The company advised customers to rotate secrets in workloads, secret groups, and global secrets.

Northflank has not disclosed how attackers entered, how many customers were affected, or whether credentials besides AI keys were abused. It patched network policies, enabled audit logs, and enabled credential rotation for several databases. Customers were told to inspect provider usage and billing logs and report suspicious activity.

Environment variables are named settings made available to an application while it runs. Developers commonly use them for values that change between environments, such as database passwords, cloud credentials, authentication tokens, and API keys. This avoids placing those values directly inside application code or configuration files.

For example, an application might read an AI provider’s API key from an environment variable whenever it sends a request. The key stays outside the program’s main code, while the application can still authenticate to the provider. Northflank warned that these variables had potentially been decrypted during the breach, meaning attackers could have obtained the values they contained.

Environment variables are useful, but they are not automatically safe. Anyone who gains access to the platform, workload, logs, or configuration holding them may obtain the secrets. Northflank advised customers to rotate secrets stored in workloads, secret groups, and global secrets, then review usage and billing for suspicious activity.

The exact Northflank impact remains unknown. The company has not disclosed how many customers were affected or how many AI API keys may have been accessed. It confirmed only that multiple customers reported unauthorized use of AI API keys supplied to the platform. It also has not said whether attackers abused other types of credentials.

The article provides a larger warning about possible scale through two Wiz investigations. In those cases, compromised enterprise credentials were used to make approximately 2.5 million Amazon Bedrock API calls. The activity generated approximately $100,000 in AI usage. Those figures were not identified as Northflank-specific losses.

The potential cost depends on the permissions and billing limits attached to a stolen key. Northflank told customers to inspect AI provider usage and billing logs for unexpected activity. Its audit logs, now enabled for all customers, can help investigate suspicious requests. The company continues advising immediate secret rotation.

An AI API key is a credential that lets software access an AI provider’s service under an account. If attackers obtain it, they may be able to submit requests using that account’s access. The immediate danger is unauthorized model usage, which can produce unexpected charges. Northflank specifically told customers to review AI provider usage and billing logs.

The broader risk can extend beyond AI bills. The article says exposed credentials may be used to breach other customer services, potentially causing data theft or unauthorized charges through API keys. In two Wiz investigations, compromised enterprise credentials produced approximately 2.5 million Amazon Bedrock API calls and about $100,000 in AI usage.

The exact outcome depends on which credential was exposed and what access it permits. Customers should report suspicious activity to Northflank and their AI providers. Rotating or disabling affected keys cuts off the known credential, while audit and billing logs help identify misuse that already occurred.

LLMJacking is a form of abuse in which attackers use stolen credentials to access AI models through another organization’s account. The victim’s API key supplies the access, while the attacker avoids paying directly for the service. Wiz identified this practice while investigating attacks against AI development platforms.

The mechanism is straightforward. Attackers target environment variables containing AI service credentials, extract a usable key, and send model requests through the associated provider account. They may use the access themselves, generate large bills, or offer access to others. Wiz also found infrastructure linked to services reselling AI model access, though it could not connect those operations to the initial breaches.

The scale can be substantial. In two investigated cases, compromised enterprise credentials generated approximately 2.5 million Amazon Bedrock API calls and about $100,000 in usage. Wiz has not confirmed that the nine reported incidents shared one attacker, but many involved attempts to steal AI keys.

Cloud application-hosting and AI development platforms manage many customer workloads, containers, databases, and applications. They also commonly hold environment variables containing cloud credentials, authentication tokens, database passwords, and AI API keys. That concentration makes them valuable targets because one breach may expose secrets belonging to many customers.

AI credentials are especially attractive because they can be used to access costly models. Wiz reported that attackers specifically targeted environment variables containing AI service credentials. In two cases, compromised enterprise credentials supported approximately 2.5 million Amazon Bedrock calls and about $100,000 in usage. Stolen keys can also be used for data theft or unauthorized access to other services.

The October incidents show the continuing risk. Wiz identified at least nine security incidents affecting AI development platforms, including Northflank, Railway, OpenCode, Warp, and Lightning AI. Northflank has not disclosed its entry method or total impact. It enabled audit logs and urged customers to rotate stored secrets.

An API key is a provider-issued credential that software presents when requesting an online service. The service checks the key and associates the request with an account or project. This lets applications use AI models, databases, or other hosted services without a person signing in for every request.

If attackers copy a key, they can present the same credential from their own systems. The provider may then treat their requests as authorized. Rotating a key replaces the old value with a new one. Revoking or disabling it removes the old value’s ability to authenticate, stopping future misuse through that credential. Any legitimate application must then be updated with the replacement key.

Northflank advised customers to disable or rotate all keys after warning that environment variables may have been decrypted. It also enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis. Rotation cannot undo requests or charges already made, so customers were told to inspect audit, usage, and billing logs.