Stolen AI keys: companies end up paying for other people's compute
Wiz counts nine break-ins at AI developer platforms since 6 October, Fireworks reported a second incident on 9 November, and Apiiro found 2,539 secrets from Claude Code files on GitHub.
Access keys to AI models have become loot: attackers hunt for stored keys and resell the computing power, and the bill lands with the owner. At the same time AI coding tools store passwords where they can become public.
What happened
Wiz, a security firm, lists nine incidents at platforms for AI developers between 6 and 30 October, including Fireworks AI, Lightning AI, Railway, Warp and Northflank; more reports followed by 9 November. What the cases share, according to Wiz, is a targeted search for stored environment variables, especially those granting access to AI services. In two cases it examined, stolen corporate keys for Amazon Bedrock were tested within 30 minutes; around 800,000 and 1.7m requests followed, together probably more than $100,000 at list prices. Fireworks found a break-in via internal credentials on 6 October in which API keys and tokens were taken from customer accounts. On 9 November it reportedly told customers of a second intrusion, on 24 October, via a cloud provider. Separately, Apiiro shows that Claude Code saves approved commands, including any passwords in them, in plain text in a project file: 1,122 public copies contained secrets, among them 379 database passwords, spread across 63 organisations.
What follows
Risk is shifting from data loss to cost: whoever loses an AI key pays for someone else's usage, often before the abuse is noticed. A second consequence is that secrets now sit scattered across developer platforms, agent settings and chat logs, outside the usual protected zones. According to The Hacker News, the widely used scanners gitleaks and TruffleHog missed 215 of the 1,122 affected files. Assessment: companies should treat AI-tool configuration files like .env files in secret scanning. Self-protection means rotating affected keys at once, setting spending limits and alerts for AI services and keeping agent files out of repositories.
What changes in practice
- IT departments
- Keys held on affected platforms should be rotated; AI-agent configuration files belong in secret scanning.
- Developers
- Keep passwords out of commands an agent approves permanently; do not commit .claude/settings.local.json to the repository.
- Finance chiefs
- Stolen AI keys generate bills; spending limits and alerts contain the damage.
What to watch
- Further entries on the Wiz list and final reports from the affected platforms
- Whether Anthropic changes how Claude Code stores commands containing secrets
- Unusual cost spikes for AI services in cloud bills
Sources
- Wiz: "Black October" for AI Developer Platforms, 30.10.2026, aktualisiert bis 9.11.2026
- Fireworks AI: October 2026 security incident, 9./10.10.2026
- RuntimeWire: Fireworks AI discloses second security breach, 9.11.2026
- The Hacker News: Claude Code's 'Don't Ask Again' File Exposes Passwords and Keys in 1,122 Public Copies on GitHub, 7.11.2026
- iTWire: Claude Code approval files found exposing company secrets on GitHub, 7.11.2026