A month, nine platforms, one pattern
Cloud security firm Wiz published a report on October 30 documenting what it called a Black October for AI developer platforms: nine separate companies disclosing security incidents within the same month, each one centered on credentials tied to AI services. Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank all reported breaches between October 6 and October 30. Several, including Fireworks and OpenCode, described the intrusion pattern as an agent swarm, meaning the attacker used automated AI agents of its own to scan for and exploit exposed credentials at scale rather than working targets by hand.
The incidents did not stop when the report published. Trigger.dev disclosed on November 1 that an attacker had accessed environment variables for a subset of customer organizations, and Chainstack reported a separate incident spanning late October into early November. Nvidia-owned Brev also disclosed exposure of SSH keys used to access customer virtual machines earlier in October. Wiz's researchers, Benjamin Read and Rami McCarthy, stopped short of attributing all nine incidents to a single actor, but the clustering in both timing and target type, platforms that let developers deploy AI-connected workloads, points to attackers who have found a repeatable playbook rather than nine unrelated coincidences.
What LLMjacking actually looks like in the logs
The mechanics are specific enough to be worth understanding rather than treating as a generic credential theft story. In one case Wiz documented, a validation call arrived from a residential IP address within 30 minutes of the credential being exposed, an InvokeModel request for Claude Fable 5.1 that failed and immediately fell back to Opus 5.5, which succeeded. That fallback behavior, trying a cheaper or newer model first and dropping to a known-good one on failure, reads like an attacker testing a stolen key's limits before committing to heavier use.
The heavier use followed fast. In one case, Wiz recorded roughly 800,000 Bedrock calls over about 30 hours, with roughly 90 percent succeeding. In a second, larger case, stolen credentials generated approximately 1.7 million calls in just 13 hours, with more than a million succeeding. In both cases, Anthropic's Opus models accounted for roughly three-quarters of the successful calls, split across several Opus versions alongside Sonnet 4.5. Wiz estimated the two cases alone likely ran up more than $100,000 in usage at list price, billed to the compromised organizations' own cloud accounts.
Why attackers want your model access, not just your data
LLMjacking is a useful term because it names a monetization path that doesn't require exfiltrating anything from the victim at all. The attacker isn't after the compromised company's customer records or source code, at least not primarily. They're after a live, funded path to frontier model inference that someone else is paying for. That access gets resold on criminal marketplaces or used directly to run workloads the buyer doesn't want traced to their own accounts, anything from automated content generation to, plausibly, running the same kind of AI-driven reconnaissance that let the attackers find these credentials in the first place.
The preference for Opus-tier models over cheaper options is the detail worth sitting with. If attackers only wanted volume, they'd burn through the cheapest available model and maximize call count per dollar of risk. Instead they're paying, in stolen credit, for the most capable models available. That suggests the resale market values capability over throughput, which in turn suggests buyers on the other end are running workloads sophisticated enough to need frontier-grade output, not just spam generation.
The common thread is where the key lives, not how it leaked
Each of the nine platforms had a different proximate cause: Zeabur and Lightning AI pointed to credential access, Railway cited privilege escalation in its build infrastructure, Warp suspected a third-party vendor dependency, and OpenCode and CommandCode both used the vague term distillation to describe how the exposure happened. Those differences matter for each individual postmortem, but they obscure the structural commonality that matters more to everyone watching from outside: all nine platforms stored live AI API keys as plaintext environment variables accessible to anyone who achieved code-level or infrastructure-level access, with no additional authentication step between gaining a foothold and exfiltrating a usable credential.
That is the same failure mode that has haunted cloud credentials for a decade, now playing out against a new, highly liquid asset class. A stolen AWS key sitting in a misconfigured bucket was always valuable, but reselling raw cloud compute access is clunkier than reselling a key that lets a buyer run GPT- or Claude-class inference on demand. AI API keys compress the time between theft and monetization to under 30 minutes, based on Wiz's own validation-call evidence, which is faster than almost any other credential theft-to-cashout pipeline currently tracked.
What belongs on the roadmap now
Treat every AI API key with the handling rigor of a production database credential, not a developer convenience. That means short-lived, scoped tokens instead of long-lived account-wide keys, mandatory secrets-manager storage instead of plaintext environment variables, and automatic rotation on any platform-level security disclosure from a vendor you use, not just your own incidents. If your organization uses any of the nine platforms named in the Black October report, or any similar AI deployment service, rotating affected credentials should already be done; if it isn't, it is overdue.
Just as important, instrument for the specific signature Wiz documented: a burst of successful Bedrock, Azure OpenAI, or equivalent API calls from an unfamiliar IP range, concentrated on your most expensive models, arriving in the minutes after any credential exposure event. That pattern is now well-documented enough to build a detection rule around, and the cost of missing it is not theoretical. It is a six-figure bill arriving on an invoice nobody on your finance team was expecting, for usage nobody on your engineering team authorized.
