Three reports from 30 and 31 October show artificial intelligence turning up at every stage of an attack. Hosting platform Northflank told customers to treat every secret they stored with it as stolen after attackers ran up usage on their AI API keys. Chainalysis said an outside actor broke into its internal tools using what it calls "offensive agentic techniques". And Cisco Talos described an infostealer that hands its haul to a language model to decide which victims are worth the most.
For people who build and host web applications, the common thread is practical: the keys to paid AI services have become a prize worth breaking into a platform for, and the attackers are using the same models to do the work faster.
Northflank: assume every environment variable is exposed
According to BleepingComputer, Northflank disclosed the incident on 30 October after cloud security firm Wiz alerted it at 11:43 UTC. Engineers looked at the alert a minute later and pushed a network policy patch, then further patches at 12:50 and 13:05 UTC, and brought in Wiz's incident response team. Shortly afterwards it warned every customer to treat their environment variables as decrypted and to disable or rotate all keys.
Northflank later confirmed that several customers had seen unauthorized use of the AI API keys they had supplied to the platform. It has not said how the attackers got in, how many customers are affected, or whether other credentials were abused. It has since turned on credential rotation for PostgreSQL, MongoDB, MySQL and Redis, and enabled audit logs for every account, free ones included.
Wiz places the breach inside a wider pattern. In a report it titled "Black October for AI Developer Platforms", it counted at least nine incidents at AI development platforms during the month, among them Railway, OpenCode, Warp and Lightning AI. Some attackers went specifically after environment variables holding AI service credentials, a practice known as LLMJacking, where stolen keys are used to run up charges or resold. In two cases Wiz examined, compromised enterprise credentials drove roughly 2.5 million Amazon Bedrock calls worth about $100,000. Wiz has not confirmed that one group is behind all nine incidents.
Chainalysis: an intrusion run by AI agents
Chainalysis, whose blockchain analytics tools are used by police, government agencies, exchanges and banks, published its disclosure on the evening of 30 October. It says it detected the intrusion earlier in October and has been patching and hardening its systems since. The accessed data covers user IDs, full names, email addresses and organizational role labels for people provisioned on its platform. The company says it has found no sign that investigation content, authentication credentials or session tokens were reached.
Chainalysis has not explained which flaws were used, which tools were accessed, or how long the attackers stayed. BleepingComputer notes it is unclear whether the attackers relied on an existing offensive agent framework or built their own agents to find, exploit and chain vulnerabilities with little human input. The company advises customers to turn on two-factor authentication and to watch for unexpected password resets, login prompts, and scammers posing as Chainalysis, especially ones offering fund recovery or jobs.
VOLTA: an infostealer with a model as its analyst
Talos describes VOLTA as a mature, self-deleting Windows stealer that collects browser passwords and cookies, payment cards, wallet seed phrases, chat and gaming sessions, Microsoft OAuth tokens, SSH and cloud provider keys, and Wi-Fi passwords. It then uses the stolen sessions to dig further, for example searching the victim's Gmail for shopping receipts to confirm a home address. The resulting profile is sent through OpenRouter to a model told to write a "target assessment" that ranks the victim's assets by how easily they can be turned into money and judges their security habits.
If a model refuses, VOLTA checks the reply for refusal phrases and moves down a chain of up to three models, which Talos says ran from Claude to Kimi to Gemini. The code has six slots filled in at build time, which Talos reads as a builder sold to customers, meaning the profiling feature is available to buyers of any skill level. Talos frames the shift as effort displacement: the model takes over the step that used to need the most human attention.
What to do
- If you host anything on Northflank, rotate every secret stored in workloads, secret groups and global secrets, and disable public access to add-ons where it is enabled.
- Check your AI provider usage and billing logs for unexpected activity and report anything suspicious to both the platform and the provider.
- Talos suggests restricting which processes may launch Chrome with --headless, or at least alerting on it, since VOLTA relies on that path to get past App-Bound Encryption.
- Chainalysis customers should enable two-factor authentication and treat unexpected reset requests or recovery offers as likely phishing.
Sources
- Chainalysis discloses data breach from "offensive agentic techniques" BleepingComputer
- Malware uses LLMs to rank victims by how much they're worth blog.talosintelligence.com
- Northflank security breach leads to abuse of customers' AI API keys BleepingComputer