“Black October” for AI Developer Platforms

Summary

A series of agentic attacks has hit at least nine AI developer platforms in October, including Fireworks AI, Zeabur, Lightning AI, OpenCode, Railway, Warp, and Northflank, leading to LLMJacking at scale. Fireworks, Zeabur, and Lightning attribute their incidents to credential access, while Railway cites privilege escalation in its build infrastructure and Warp points to a third-party vendor dependency. Wiz reports downstream abuse of enterprise credentials stolen in these vendor breaches, beginning with a single InvokeModel call from a residential IP address within 30 minutes of the reported credential access.

Related items

• MediumCritical Linux kernel flaw allows remote root attacks on MPTCP serversSame vendor · BleepingComputer
• MediumA Supply Chain Attack Put Malicious Anthropic Claude Extensions on Thousands of DevicesSame vendor · Wired (Security)
• InfoThe biggest names in AI are backing a new way to opt out of scrapingSame vendor · The Verge (AI)
• MediumDevs Hit by Trojanized Claude Code Extension for CursorSame vendor · Dark Reading
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database