In October, nine companies that run AI for developers were broken into. Nine. Wiz, the cloud security firm, calls it Black October. Fireworks on October 6, Northflank on the 30th, seven more in between, then three more in November. Twelve platforms, one month, no single flaw. Every report says the same thing: the attackers were after the stored environment variables, the keys that let software use AI. Two stolen keys were tested within thirty minutes. One ran 800,000 model calls in thirty hours, the other 1.7 million in thirteen: over a hundred thousand dollars of someone else's compute. Zeabur lost 3.2 million records across 321,810 accounts, its admin credentials in plaintext, unrotated since January 2024. It is shutting down. Fireworks widened its disclosure on November 9 to billing data and, for some accounts, datasets and unfinished models. And it did not stop in October: on November 8, NEAR AI was breached through a flaw in the engine serving its models, and even confidential-mode requests may have been seen. Here is the lesson. There is no one hole to patch. The keys are the product now, and deleting a stored secret does not cancel it. It has to be revoked where it was issued. Until then, every platform holding your AI keys is a vault with the combination written on the door. That's your SignalWatch, from Ashfires Press. Sources: Wiz, Black October (Oct 30, 2026): https://tsnmedia.org/black-october-ai-developer-platforms/ The Record, AI company Fireworks says hackers stole data, billing info during October breaches (Nov 10, 2026): https://therecord.media/ai-company-fireworks-says-hackers-stole-data-in-oct-attacks NEAR AI incident report (Nov 9, 2026): https://aicyberbrief.com/article/near-ai-breached-through-an-sglang-code-execution-flaw-even-confidential-mode-requests-may-have-been-seen That's your SignalWatch, from Ashfires Press.
続きを読む
一部表示