“Black October” for AI Developer Platforms

What it is

Wiz Research's account of October 2026 breaches at AI developer platforms (Fireworks, OpenCode, Warp, Zeabur, Railway, Lightning, CommandCode and others). Wiz observed two enterprise AWS Bedrock keys stolen in those vendor breaches and abused within hours. Fireworks, OpenCode and Warp report signs of an "agent swarm" attack. OpenCode and CommandCode attribute their incidents to attempted "distillation". Zeabur is shutting down because of its breach.

Root causes reported by vendors

• Fireworks, Zeabur and Lightning name credential access. Lightning was earlier hit in the Mini-Shai Hulud supply chain campaign.
• Railway believes initial access was "privilege escalation in our build infrastructure".
• Warp points to a third-party vendor dependency, and OpenCode to a "legacy system".
• All public reports describe targeted hunting for stored environment variables that grant AI access. No single vulnerability links the incidents.

Abuse timeline on the two keys

Both keys had been heavily used from the compromised vendor's infrastructure. Within 30 minutes of the reported credential access, each saw one InvokeModel from a residential IP, part of a one-minute sweep across multiple organizations. The call asked for Claude Fable 5.1, failed, then fell back to Opus 5.5. For days afterwards each key got 14 to 120 calls a day from a small Go client, in lockstep about a minute apart, which Wiz reads as a validity checker.

Case A (unrestricted key). Four days after validation, a rotating proxy pool sent one call per model across vendors. Every call worked except Fable. A boto3 script then enumerated Bedrock and EC2 quotas, and bulk traffic began 22 seconds later. Over 30 hours the key made about 800k calls, roughly 90% successful. The policy allowed global.* cross-region inference profiles, so only about 6% were throttled. Opus models were three quarters of successful calls (Opus 5 36%, Opus 5.5 22%, Opus 4.8 10%).

Case B (restricted key). The key's policy allowed Bedrock only through us.* inference profiles. Seven days after validation, a reseller pool made thousands of failed calls over four hours because it requested global.*. A checker on a shared VPN exit then found the working us.* model IDs. Two hours later, the same boto3 script (identical version string) that probed Case A retested both profile types and enumerated quotas. A single Level 3 address then made about 1.7 million calls in 13 hours, over a million successful. Nearly all the rest were throttled by regional quotas.

At list price the two cases likely ran up over $100k. Token profiles look like resold coding-agent traffic: a few uncached input tokens per call (prompt caching), a few hundred output tokens, and a tail of calls with tens of thousands of uncached input tokens.

Actors that tested the keys

• "momo", centered on 23.106.46.239. Linked to llm-routing.com (discounted frontier models, USDT payment) and to an "ARTEX" autonomous penetration testing console page on 8 October 2026. Zeabur named this IP in its compromise, with activity 12 to 14 October. In late October it ran API key checks on both keys and tried PutAccountDataRetention with the Case B key.
• "Xingjiabi", at xingjiabiapi.org (38.246.114.118, s3 subdomain resolving from 10 September 2026). It listed inference profiles and paged through every Bedrock quota on the Case A key, and manually tested the Case B key, both after bulk abuse had begun. Its site carried a distillation-detection page that scored users as "high risk", "watch" or "normal".

Detection signals the page gives

• A global.* or us.* inference-profile mismatch against the key's policy, appearing as bursts of failed calls.
• A fallback from a Fable 5.1 request to Opus 5.5 within minutes of a vendor breach.
• Lockstep low-volume calls on several keys from one small Go client.
• Bedrock and EC2 quota enumeration immediately followed by bulk calls.
• PutAccountDataRetention attempts.

Caveats

Wiz cannot tie momo or Xingjiabi to the original compromises or to the "flood" traffic, only to having had and tested the keys. The listed IPs are not linked directly to the Black October breaches. Most vendor investigations are still open, and the fetched text gives no remediation steps. Its IOC lists were not present in the fetched text beyond the two IPs above.