A Stolen Key Ran 1.7M Claude Calls in 13 Hours After Breach

A single stolen cloud key made approximately 1.7 million calls to Amazon Bedrock in thirteen hours, spread across a dozen Claude models, according to a report Wiz Research published on 30 October. By our arithmetic that is about 36 calls a second.

Wiz ties the key to one of a run of breaches at AI developer platforms. Its report opens: “At least nine AI Developer Platforms have disclosed incidents over the course of the month”, from Fireworks AI on 6 October to Northflank on 30 October.

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege. It teaches the general idea only and does not discuss the companies in this story.

What Wiz Counted

Wiz lists the nine with their disclosure dates: Fireworks AI (6 October), Andromeda (9 October), Zeabur (14 October), Lightning AI (15 October), OpenCode (16–17 October), Railway (20 October), Warp (23 October), CommandCode (28 October) and Northflank (30 October).

It says the public reports share one target: “All public reports highlight targeted exploitation, explicitly hunting stored environment variables, with a focus on those granting AI access”. It adds that Fireworks, Zeabur and Lightning attribute their root causes to credential access, and that Zeabur “will be shutting down due to this incident”.

Wiz says the picture is “strongly aligned with recent reports on two fronts”: “Agentic Attacks” and “the rise of LLMJacking”, with resellers that make “the theft easily monetizable”.

What Was Posted on X

Spenser Skates, chief executive of Amplitude, posted on 30 October that four of the top five posts on Hacker News at that moment were about cybersecurity incidents, and wrote that ‘We’ve officially entered a new era’.

What Two Stolen Keys Did

Wiz describes two enterprise keys it says were compromised in one of the vendor breaches. Both were first tested “within 30 minutes” of the reported credential access. The first test “asked for Claude Fable 5.1, failed, and fell back to Opus 5.5, which worked”.

In Case A, over thirty hours, “the actor made approximately 800k Bedrock calls, and about 90% of them succeeded”. In Case B, over thirteen hours, a single address “made approximately 1.7 million Bedrock calls, with over a million successful”, and “Opus 5.5, Sonnet 4.5 and Opus 5 made up three quarters of successful calls”.

Wiz puts the bill at: “At list price, these two cases alone likely ran up over $100k in usage”. It says the traffic “resembles resold coding-agent traffic”, and it names two resale operations that had access to the keys, while stating that it is “not able to definitively establish the relationship” between them and the initial compromise.

Northflank, the Ninth

Northflank’s status page lists a “Security incident” with the update: “Users have reported unauthorised use of AI API keys supplied to the Northflank platform.” Its guidance to customers is to “assume all environment variables have been compromised and rotate all secrets and credentials immediately”.

The page’s timeline starts “11:43 UTC: Wiz threat alert” and lists “12:02 UTC: Initial network policy patch”, 19 minutes later by our arithmetic. Its latest update says Northflank has “enabled audit logs for all customers, including free users”.

The Rest of the Week

On 30 October we reported that Cursor disclosed a tampered copy of the Claude Code extension on its marketplace, in our Cursor piece.

The same day we covered Polymarket’s loss of at least $2.7 million through a compromised third-party script, and Railway’s report that its attackers were hunting AI provider keys, in our Polymarket piece. The $6.36 billion Binance hack is in our Binance piece.

Wiz also reports that an address used to test the stolen keys hosted a page titled “ARTEX — 自主渗透测试控制台” (“ARTEX — autonomous penetration testing console”) on 8 October. CrowdStrike’s ARTEX findings are in our ARTEX piece; Wiz does not tie the two.

Spenser Skates, chief executive of Amplitude, wrote on X on 30 October: “4 of the top 5 posts on HN right now are about cybersecurity incidents”.

The Ivanti Deadline

Separately, CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on 30 October. One, CVE-2026-111357, is a privilege escalation flaw with a due date of 2 November, three days later by our arithmetic; the other, CVE-2026-118527, is due 13 November. CISA says each “can be chained” with CVE-2026-104935, which it added on 13 October.

Volexity, which found the chain in the wild, says Ivanti published a patch for the privilege escalation flaw on 29 October. It also says Ivanti’s Integrity Checker Tool “does not detect any modifications” from this chain, so “forensic investigation is required to identify evidence of exploitation”. On 30 October we reported that Red Hat and Ubuntu had no fix for a Linux flaw an unreleased Claude model exploited, in our Linux flaw piece.

The Structural Read

As we read Wiz’s report, the loot in these breaches was usage: Wiz says the stolen keys were tested within 30 minutes and puts its two cases at over $100,000 of usage at list price.

As we read Northflank’s status page, its guidance puts the work on customers: it tells them to assume every environment variable was compromised and to rotate all secrets and credentials.

As we read the CISA catalog, the Ivanti deadline is short: CVE-2026-111357 was added on 30 October with a due date of 2 November, three days later by our arithmetic.

Three Implications

FOR PLATFORMS THAT STORE CUSTOMER SECRETS Wiz says all public reports describe attackers hunting stored environment variables, with a focus on those granting AI access.

FOR COMPANIES HOLDING AI KEYS Northflank tells its customers to revoke credentials with their issuing providers and to review AI provider usage and billing logs for unexpected activity.

FOR IVANTI CONNECT SECURE OWNERS Volexity says Ivanti’s Integrity Checker Tool does not detect this chain and that forensic investigation is required to find evidence of exploitation.

The Business Engineer Lens

This story maps onto the Business Engineer framework The CFO’s Guide to the Token Economy.

The framework describes the token this way: “It is simultaneously the unit of cognition the model produces, the unit of compute the data center serves, the unit of price the lab charges, and the unit of value the enterprise extracts.”

As we read it, a stolen AI key is a claim on those units, billed to the key’s owner. The framework does not discuss these breaches.

What Is Not Established

Wiz says most of the incidents “are still being analyzed, and detailed technical information is not available”, and it does not link the resale operations to the original breaches. Northflank’s status page does not say how many customers were affected. A Hacker News user posted what they said was a Scribd breach notice dated 26 October; we have not seen a Scribd statement.

The Bottom Line

Wiz counts at least nine AI developer platforms that disclosed incidents in October, and says the attackers hunted stored keys that grant AI access. In one case it documents, a single stolen key made approximately 1.7 million Bedrock calls in thirteen hours, about 36 a second by our arithmetic, and Wiz puts its two cases at over $100,000 of usage at list price.