Observed incident

Northflank reports unauthorized use of customers’ AI API keys

Reported

Published here

What happened

Northflank warned customers to assume all stored environment variables were compromised. It subsequently confirmed customer reports of unauthorized use of AI API keys supplied to the platform.

Parties and reporting

AI tools and systems: AI-provider API keys, Northflank workloads and secret groups

Outcome

Investigation remains open. Northflank deployed patches, enabled audit logs for all customers and expanded add-on credential rotation through October 31. It continues to require revocation and replacement of every stored secret.

Operating lesson

Revoke exposed credentials at their issuing providers, rotate workload secrets and inspect AI usage, billing and connected services.

Evidence and limits

October 30 is disclosure; Wiz alerted Northflank at 11:43 UTC. Root cause, affected-customer count and full downstream impact remain undisclosed. Wiz’s two anonymous Bedrock-abuse cases and estimated costs are not attributed to Northflank. Shared infrastructure does not prove a shared attacker.

Sources