On October 30, Northflank told its customers: "Assume all environment variables have been decrypted. Disable/rotate all keys." Workload secrets, secret groups, global secrets, all of it. The root cause hasn't been published.
Northflank is not the story. It's the latest entry on a list. When the platform is breached, every key you stored there is breached with it, and the only part you control is what each key can do once it's out.
Nine Platforms, No Shared Bug
Wiz has been tracking this as "Black October": Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank, between October 6 and October 30. Wiz says there is no single shared vulnerability or dependency behind them. What they share is the target: the public reports describe attackers going after stored environment variables, especially the ones that grant AI access.
That's the class. An environment variable store on a hosting platform is a vault you didn't choose, run by people you can't audit, holding keys it has to be able to decrypt. That's how they reach your process at runtime.
And AI keys are the best loot in that vault, because they turn into money with no extra steps. Wiz describes two abuse cases that "likely ran up over $100k in usage" at list price, and describes broker services that resell stolen model access. OpenCode and CommandCode attributed their incidents to distillation. My bet is that open models catch up with the frontier that way, and stolen keys are the cheapest way to pay for it.
You Will Rotate. Rotation Is After the Fact.
Northflank's advice was the standard one: rotate. Correct, and it changes nothing about the time between the breach and your rotation. Northflank's own timeline ran about two hours from the first alert to "assume decrypted," and nobody knows how long the attacker was in before that. Whatever a key can do in that window, it does before you rotate.
So set the price of every key before you hand it over. The providers already ship the controls; most teams just don't turn them on.
- One key per platform, in its own scope. Anthropic keys live in workspaces, OpenAI has projects. A key that only lives on Northflank should be the only key in its workspace or project, so when Northflank posts an incident you know exactly what to revoke, and nothing else breaks.
- A hard cap on that scope. Anthropic workspaces take a monthly spend limit and their own rate limits. OpenAI's spend limits work at the organization or project level and return a 429 once you hit them. Note OpenAI's own distinction: spend alerts only notify, they "do not enforce a cap." An alert tells you about the $100k afterwards.
- No stored cloud keys at all where you can avoid it. If the platform can assume a role in your cloud account through OIDC, it doesn't need a long-lived access key in its env store. Northflank itself supports workload identity into AWS and GCP. A credential that expires within the hour is worth far less to someone reselling access.
Then ask one question of every key in every platform you use: if this leaked tonight, what's the most it could cost by morning? If the answer is "whatever the provider's limit is," you've set no limit at all.
The Tradeoff
A hard cap is an outage you scheduled yourself. When a launch spikes traffic, the 429 hits your users before it hits an attacker, so caps need headroom and an alert well before the limit. One key per platform per scope means more keys to track, and more places to rotate. Anthropic doesn't allow spend limits on the default workspace, so keys created there are uncapped until you move off it. And workload identity only covers the cloud provider; your model API key is still a stored secret on most platforms today.
None of that is a reason to skip it. Supply chain failures are rarely about missing tools. They're about nobody acting until it's their incident. Nine platforms in 25 days is enough notice.
You don't get a vote on your platform's next breach. You do get to decide what it costs you.