Black October: stolen platform-stored AI keys fuel Bedrock LLMjacking across at least nine platforms
Severity: high · Patch status: no-fix-needed · Since 2026-10-30 · CVE-2026-40217
On 30 October 2026 Wiz researchers Benjamin Read and Rami McCarthy counted at least nine AI developer platforms that disclosed incidents during October 2026: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Public reports describe targeted hunting of stored environment variables, especially those granting AI access. Wiz found no single shared vulnerability or dependency linking the incidents, and it does not state a shared initial-access route. Several victims described agent-swarm attacks, and two (OpenCode and CommandCode) attributed their incidents to distillation. Downstream, Wiz followed two stolen enterprise AWS Bedrock keys. Each was first tested within 30 minutes of the vendor's reported credential access, by one InvokeModel call from a residential IP, and was then checked 14 to 120 times a day by one Go client. The unrestricted key (Case A) served about 800,000 Bedrock calls over roughly 30 hours, with every call routed through global. cross-region inference profiles. The key limited to us. profiles (Case B) surfaced in a reseller pool, failed on global. for hours, then served about 1.7 million calls over roughly 13 hours. Wiz says the two cases likely ran up over $100,000 at list price. It ties the key checks to two LLM reseller operations, momo (llm-routing.com) and Xingjiabi (xingjiabiapi.org), but says it cannot show that they ran the initial compromises. Rotate every AI, cloud, database and registry key stored on these platforms at the issuer, because deleting the secret from the platform does not revoke it.
What to do
- Rotate, at the issuing provider (IAM, Anthropic, OpenAI and others), every AI-provider, cloud, database and registry key that was stored on Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode or Northflank; deleting the secret from the platform does not revoke it
- In CloudTrail, search bedrock InvokeModel / InvokeModelWithResponseStream / Converse calls by your access keys from source IPs outside your own egress ranges, especially a single call from a residential IP followed by days of low-volume (14–120 calls a day) checks from one client, the validation pattern Wiz observed
- In CloudTrail, also look for Bedrock and Service Quotas enumeration (listing models, inference profiles and quotas) and for PutAccountDataRetention calls from unfamiliar IPs or boto3 user agents. Wiz saw boto3 scripts enumerate Bedrock and EC2 quotas before each flood, and one IP attempted PutAccountDataRetention with a stolen key. The specific API operation names are this record's selection, not Wiz's wording
- Scope Bedrock credentials tightly: allow only the inference profiles and models you use (deny the global. inference-profile prefix if you do not need it) and add aws:SourceIp / aws:SourceVpc conditions so a leaked key fails off your network; Wiz shows a us.*-only key was still abused heavily, so restrictions slow abuse but do not replace rotation
- Alert on the credential-check IPs Wiz published (23.106.46.239, 38.246.114.118, 104.243.32.50, 31.57.201.201) in CloudTrail; Wiz says it has no evidence linking them directly to the Black October attacks, so treat a hit as a leaked-key signal, not attribution
- Set AWS Budgets and Cost Anomaly Detection alarms on the Bedrock service, lower Bedrock service quotas to expected usage, and prefer short-lived role credentials over long-lived IAM user keys
- Review Bedrock invocation logs and billing back to mid-September 2026 (the earliest shared-pool activity Wiz lists is 10 September) for unfamiliar models, regions and volume spikes
Sources
All live incidents on Threat Watch
