OpenAI, Anthropic Keys Among Targets in 14 October Incidents

On 21 October 2026, a widely shared X post by the account @juampitech listed 15 software security incidents under the line “October has been an absolute nightmare for software”. We checked each one against the vendor’s own notice or, where the vendor had not published one, a security firm, a news outlet or the project’s own GitHub issue tracker. We could confirm 14 of the 15, all disclosed between 5 and 21 October 2026.

By our count, 11 of the 14 have a link to AI that the sources themselves state. In seven, AI provider keys or AI tool data were among what the attackers sought or could reach, including OpenAI and Anthropic keys, by the sources’ own account. In two, Microsoft says AI was used in the attack or TeamUpdraft says the evidence suggests it was, and in two more, the PHP flaws and eMudhra’s weak keys, the finders used AI-assisted research or tooling, by the sources’ account.

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege: giving software or an AI agent only the access its task needs. It teaches the general idea only and says nothing about any company or incident in this piece.

The 14 Incidents We Could Verify

Each row comes from the source named in it. The AI column records only what that source says; the grouping into rows and the order are ours. The list is the X post’s, not a census of October incidents.

We dropped one item from the list. We found no Tailscale advisory tying it to the eMudhra incident, and the only mention of Tailscale in our sources is Zeabur’s note that its internal network runs on it. The X post’s Zeabur line says “infrastructure breached”; Zeabur’s own report is more specific, and we use its wording.

What Was Posted on X

The post by @juampitech on 21 October lists 15 software security incidents under the line ‘October has been an absolute nightmare for software’, from Railway and LiteLLM to PHP, Node.js and eMudhra. It is the list this piece checks: we confirmed 14 of the 15 from the vendors’ own notices or security firms and outlets.

The post by @kimmonismus on 22 October rounds up what is happening right now, from Microsoft’s report on AI agents targeting hundreds of organisations to CrowdStrike’s four AI-agent operators, PHP2Shell, LiteLLM, Zeabur and a maximum-severity GitLab flaw, and says it feels like a turning point. The piece’s 22 October Update adds the CrowdStrike and GitLab items after checking them against the vendors’ own posts.

Where AI Shows Up

As we read the sources, AI appears in three different roles, and they should not be added together as one trend. The largest group is AI as the target: the keys that let software call OpenAI, Anthropic or Google models are valuable, and Railway, Zeabur and the GhostAction workflows describe attackers looking for them, while OpenCode says keys saved in its Console may have been exposed.

The second role is AI as the attacker’s tool. Microsoft says Storm-0940 used ARTEX, and TeamUpdraft says the speed of the follow-up exploits suggests AI was used. Neither claim has been confirmed by a second, independent source.

The third role is AI as the finder. Wiz Research says it found the PHP flaws using its tool Wiz Atlas together with Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol, and eMudhra says the researcher who found its weak keys reportedly used AI-assisted tooling. For PHP, the PHP Foundation says it has published 15 CVEs since 1 July, while “a person makes every call and works on every patch”. Cloudflare’s chief executive, Matthew Prince, wrote on 21 October: “Models will keep finding bugs like this in software everyone runs.”

What the Vendors Ask Customers to Do

The advice repeats across the notices. Zeabur: “Replace every password and key stored on Zeabur”. OVHcloud’s Klaba: “If you are affected, please change all the secrets on your disk.” LiteLLM: “please pin your version to 1.106.2 or any explicit version published prior to now”.

Railway asks users to roll every environment variable and review logs, but says “All deployments are paused while we investigate” and that until builds are restored, users “will not be able to roll out new versions”. Rank Math says sites that activated an affected copy should be treated as compromised, as The Hacker News reports its notice.

As we read it, the common thread for buyers is that the risk sits in software they trust rather than code they write: package versions, release binaries, plugins and hosted consoles. LiteLLM’s advice to pin an explicit version and Zeabur’s to replace every key stored on its platform both address that dependence.

The Structural Read

As we read it, the incidents differ in method but share a route: they arrive through software customers already trust, such as a hosting platform, a package release, an official plugin download or a certificate authority, rather than through code the customer wrote.

As we read it, the keys matter because each one can be spent: Railway says it believes the attacks aim at compromising AI inference providers, and Zeabur says the attacker was mainly looking for API keys they could use directly.

As we read it, AI also appears on the finding side: Wiz Research says it found the PHP flaws using Gemini 4 Argon and GPT-5.6 Sol, and the PHP Foundation says that, with AI-assisted research, a person still makes every call.

Three Implications

FOR DEVELOPERS LiteLLM says to pin an explicit version, and the GitHub issue on SubQuery asks the maintainers to rotate CI secrets: both point at version pinning and secret rotation in build pipelines.

FOR COMPANIES USING AI TOOLS OpenCode’s affected users were told to revoke keys with each provider and replace them, as The Hacker News reports; Railway asks all users to roll every environment variable.

FOR SECURITY TEAMS Microsoft’s report on Storm-0940 and TeamUpdraft’s notice both describe AI being used, or suspected, on the attacking side, a claim neither has had confirmed by a second source.

The Business Engineer Lens

This story maps onto the Business Engineer framework The State of The Inference Economy.

The framework argues: “Inference is a revenue engine: continuous, distributed across millions of applications and agents, incurring marginal cost with every query.”

As we read it, that is why an AI provider key is worth stealing: it is a credential that turns directly into paid inference. The framework was published in March 2026 and does not discuss these incidents.

What Is Not Established

The 14 incidents are a list one X account compiled, not a full count of October incidents, and our count of 11 with an AI link is our own grouping of what each source says. We did not independently confirm any vendor’s claim about AI use. Several investigations, including Railway’s, Zeabur’s and LiteLLM’s, are described by the vendors as ongoing. Nothing here shows that any of the incidents are connected to each other, apart from the links the vendors themselves draw.

Connecting the Coverage

On 21 October our PHP piece reported the PHP security team’s fixes and early attacks seen by Cloudflare, and our Node.js piece covered the 10 flaws Node.js fixed the same day. Microsoft’s Storm-0940 report and its 11-step checklist for ConnectWise customers followed. On 22 October we covered Japan’s prime minister asking PHP sites to patch fast or go offline. What’s new here is the wider list: the same weeks also hit hosting platforms, package registries, a plugin store and a certificate authority.

The Bottom Line

As we read it, the October list is less about one attack than about where value now sits in a software stack: in the keys that call AI models. In seven of the 14 incidents, those keys or AI tool data were among what attackers sought or could reach, by the sources’ own account.