Northflank reports AI key abuse, urges secret rotation

Northflank says customers have reported unauthorized use of AI API keys supplied to its platform, and is urging users to revoke credentials with their issuing providers, generate replacements and update the affected applications. Its warning covers secrets in workloads, secret groups and global secrets, not just AI keys.

The company's security incident notice (opens in new tab) tells all customers to assume their environment variables have been decrypted. That is broad precautionary guidance, not a published forensic finding that every customer's secret values were stolen. As of 20:48 UTC on October 31, the notice did not state the initial access method or an affected-customer count.

For teams running AI applications on Northflank, the immediate problem is that credentials stored with a hosting provider can authorize spending and access elsewhere. Updating a value in Northflank does not by itself revoke the old credential at the service that issued it. The company's October 30 instructions explicitly call for both provider-side revocation and replacement in Northflank.

What Northflank has reported

Northflank's timeline starts with a Wiz threat alert at 11:43 on October 30. Engineers reviewed it at 11:44, according to the company, followed by an initial network-policy patch at 12:02 and additional patching at 12:50 and 13:05. Northflank says it requested Wiz incident-response support at 13:00. These times, and the updates below, are UTC.

The public incident record (opens in new tab) then shows the warning expanding into explicit customer recovery instructions:

• October 30, 13:40: Northflank posted the security incident and told users to rotate environment variables immediately.
• 13:58: It told customers to assume all environment variables had been decrypted and to disable or rotate all keys.
• 15:12: The company said Postgres and MongoDB secret rotation had been enabled for all users. The same update said multiple users were confirming that their AI keys had been used.
• 19:28: Northflank said its investigation was ongoing and it had no further confirmed findings to share. It reiterated rotation across workloads, secret groups and global secrets, and advised disabling public access to add-ons where enabled.
• 23:38: It explicitly reported unauthorized AI API-key use and added instructions to revoke credentials with issuing providers and review AI usage and billing logs.
• October 31, 01:04: Audit logs were enabled for all customers, including free users.
• 13:34: Northflank said MySQL and Redis secret rotation was available to all customers.

The patch entries describe Northflank's response. They do not, on their own, explain how access was gained or prove that a particular network-policy defect caused the incident. Likewise, newly available rotation controls are a recovery capability, not evidence that customer credentials have already been replaced.

Rotation includes the issuing provider

Northflank's credential guidance (opens in new tab) is more specific than changing environment-variable text: revoke existing credentials with their issuing providers, generate new ones, then update the affected secrets and workloads in Northflank.

That distinction matters for an AI API key that remains valid outside a deployment. Replacing the stored value can move an application onto a new key while leaving the old one usable by someone else. Revocation addresses that remaining access. Teams also need to account for applications that consume a shared secret, rather than treating one updated service as proof that all its dependants have moved.

The vendor's scope includes three places to review: workload secrets, secret groups and global secrets. Its recommendation is to rotate all secrets and credentials in that scope, even though the specific abuse it has publicly described concerns AI API keys. Restricting the response to the provider with an unexpected AI bill would miss the broader precaution Northflank is asking customers to take.

Database recovery now has additional platform support. Northflank announced rotation availability for Postgres and MongoDB on October 30, then MySQL and Redis on October 31. It also recommends disabling public exposure for add-ons where customers have enabled it. That is separate from replacing database credentials: reducing internet reachability does not invalidate a previously issued password.

Review activity beyond Northflank

The 23:38 update (opens in new tab) asks customers to review AI-provider usage and billing logs for unexpected activity and report suspicious usage to both Northflank support and the relevant provider. Northflank's newly opened audit logs give free-tier users access to another investigation surface. The announcement does not specify historical retention or guarantee that those logs can reconstruct every action relevant to the incident.

One customer has published a narrower account of its own response. In an October 31 statement (opens in new tab), Josh Pollara said Terrateam and Stategraph run on Northflank and rotated every secret they kept there. The statement says their databases were not internet-reachable and that a review of logs and the database found no sign of secret misuse or customer-data access.

That is the customer's assessment of its own environment, not a clean bill of health for Northflank's customer base. It does show why a broad rotation warning and evidence of abuse must be considered separately for each organization.

A wider pattern is not a confirmed attack chain

Northflank links to Wiz's “Black October” report (opens in new tab), saying the customer reports may fit a broader pattern of attacks on AI credentials and pointing to similar IP addresses. Wiz lists nine AI developer platforms that disclosed incidents during October, including Northflank, but says there is no single vulnerability or dependency linking those attacks.

Wiz also describes downstream abuse of enterprise credentials in two cases involving Amazon Bedrock. Those examples explain the potential for stolen AI access to generate substantial usage, but the report does not identify them as Northflank customer cases. Their request volumes and estimated costs should not be read as Northflank's losses.

The unresolved questions remain consequential: how the intruder gained access, which secrets were actually accessed and how many customers were affected. Until Northflank publishes those findings, its actionable guidance is broader than the reported AI-key abuse: revoke and replace credentials across the named secret stores, reduce public add-on exposure, and investigate provider-side activity as well as platform logs.