Black October for AI Developer Platforms

In October 2026, nine AI developer platforms suffered security breaches involving credential theft that allowed attackers to abuse AI model access. Platforms affected include Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode, and Northflank. Attackers exploited vulnerabilities to access stored environment variables containing AI credentials and monetized this access through LLM broker infrastructure. Follow-up activities included validation sweeps, quota enumeration, and large-scale token abuse resembling resold coding-agent traffic. Documented cases show hundreds of thousands to over a million unauthorized API calls generating over $100,000 in fraudulent usage. Multiple reseller operations were identified selling discounted access to frontier AI models using stolen credentials.

• From Phishing to LLMjacking: Threat Actors Targeting Cloud Billing Accounts for LLM UsageCampaign2026-10-21
• Pretty Themes, Hidden Loaders: GlassWorm-Linked Extensions Span VS Code Marketplace and Open VSXCampaign2026-10-03
• Hackers Use Fake ChatGPT Plus Billing Emails to Steal Credit Card Details and OTP CodesCampaign2026-11-02
• Shutting the Door on the XCPE BotnetMalware2026-11-02
• Appraisal by AI: Model-driven victim prioritization in the VOLTA infostealerMalware2026-10-31