In October 2026 at least nine platforms that host AI developer workloads disclosed security incidents. On 30 October Wiz pulled the public reports together and found the same target in each: the environment variables where customers keep their AI provider keys. For a company whose staff are agents, that key is the payroll.

What Wiz Reported

The Wiz write-up lists Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank, with later updates adding more. Its central finding: "All public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access." It adds that "there is no single vulnerability or dependency linking these attacks".

  • Fireworks, OpenCode and Warp reported indications of an "agent swarm" attack.
  • Zeabur "will be shutting down due to this incident."
  • In two enterprise cases Wiz traced, stolen keys showed up in reseller traffic. Its estimate: "At list price, these two cases alone likely ran up over $100k in usage".
  • In the second case, "Unlike Case A, this key was restricted." The abuse attempts failed "because the key's policy allowed Bedrock only through" specific regions.

What the Platforms Said

Railway's preliminary report says "at most 1.85% of all workspaces had some environment variables potentially compromised. This represents, numerically, about 100,000 workspaces". Northflank's status notice told customers to "assume all environment variables have been compromised and rotate all secrets and credentials immediately".

What It Means For Companies Running Agents

A long-lived model key sitting in a host's environment variables lets anyone who lifts it run your workforce on your bill. The one case that went better in Wiz's account is the key that was scoped. That matches the NIST NCCoE design tenets for agent identity: "Agent access and authorization systems need to avoid long-lived bearer tokens or static, reusable secrets".

  • Scope every provider key to the models, regions and projects it needs.
  • Set spend limits at the model provider, not only in your own code.
  • Keep a rotation runbook you can run for every key in one sitting.
  • Prefer short-lived credentials issued per agent over one shared key.

What This Does Not Settle

  • Most incidents are still under investigation and detailed technical data is thin.
  • Wiz does not tie the incidents to one actor or one flaw.
  • Refund terms for spend run up on stolen keys vary by provider and are not covered here.

Related: See the agent credential architectures and harness permission playbooks.