News · Security · November 12, 2026

Black October: 16 AI platforms disclosed incidents

Black October is a press label for two separate stories: a cluster of critical flaws, and 16 AI platforms hit since Oct 4. What is proven, and what is not.

DRIVE 369 DAO · 6 min read

Also in: Русский · 中文

"Black October" is a label, not an event. The press and security agencies use it for the cluster of critical disclosures in mid to late October 2026 (INCIBE lists items dated October 16 to 23), and Wiz uses it for something different: a wave in which at least 16 AI developer platforms have disclosed incidents since October 4, with attackers going after stored environment variables that open access to AI services. No source we found shows one coordinated campaign. Facts below were checked on November 12, 2026.

Two stories under one name

Nobody has identified who first used the name. The CyberGuy column on Fox News describes it as "a series of cybersecurity emergencies rather than a single coordinated hacking campaign". INCIBE says the advisories "coincided" in time and does not link them. Wiz states that no single vulnerability or dependency connects the platform incidents.

Story one: critical flaws

The CISA entries are in the official catalogue. INCIBE's list covers PHP, the second GitLab flaw and Node.js; we added the first GitLab flaw and SonicWall as maximum-severity flaws of the same weeks. The LiteLLM case is not a flaw but a poisoned release, covered below.

Story two: AI platforms and their keys

What happened. Wiz lists incidents at 16 platforms from October 4 to November 9. Fireworks, Zeabur and Lightning attribute theirs to credential access. Railway cites privilege escalation in its build infrastructure, Warp a third-party vendor dependency, OpenCode a legacy system. Wiz says every public report describes targeted hunting of stored environment variables, especially those that grant AI access. Railway believed its attacker wanted AI provider keys, possibly to distil models. Some platforms mention an "agent swarm" pattern, which we could not verify.

The best-documented case, Railway. The attack window ran from October 20 (13:58 UTC) to October 22 (03:32 UTC). The attacker reached internal CI credentials and decrypted a subset of customers' encrypted environment variables. Railway's preliminary report says at most 1.85% of workspaces, about 100,000, may have had variables exposed, and that it asked AI providers to reset keys for more than 100,000 users out of caution. It has not ruled out that source code was accessed.

What stolen keys were used for. Wiz describes two cases of enterprise Amazon Bedrock keys stolen in vendor breaches. One key made about 800,000 model calls in roughly 30 hours, the other about 1.7 million in roughly 13 hours. At list price that is more than $100,000 of usage. Each began with a single validation call within 30 minutes of the reported theft. Wiz ties the use to two reselling operations and says several actors are using the keys, which suggests a market for them.

Supply chain, LiteLLM. On October 21 a malicious litellm 1.107.0 was live on PyPI from 11:39 to 13:23 UTC and on Docker Hub until 14:20 UTC. It was built from a lookalike repository, and the code stole credentials and loaded remote-code tools. The maintainers say to pin 1.106.2, delete the files they list, rotate every reachable credential and assume exfiltration if it ran with outbound internet (LiteLLM). Its initial access is not confirmed, and the maintainers say enterprise private-registry customers were not affected.

What is proven, and what is not

Do this week

1. List every AI key you keep as an environment variable at a platform or in a build system, and what each can spend.
2. Rotate keys a platform stored for you, especially those created before the platform's incident, and revoke the old ones.
3. Give each key the narrowest scope and a spending cap. Set an alert on unexpected usage at your AI provider.
4. Check usage logs for calls you did not make, from addresses you do not use. Railway cannot refund spend from compromised keys.
5. Patch GitLab and Node.js if you run them, including the second GitLab release.
6. If you ran litellm 1.107.0, follow the maintainers' steps above.

More: where AI keys should live.

Where Ghostdrive stands

Ghostdrive is not a platform you host your keys on, and we say that plainly. What we can offer is a place to keep them off a platform in the first place: Pass stores API secrets as sealed items on your device. The honest limit is that a key you paste into a service is that service's key. Our agents use grants and scopes, and a connected AI gets its own token with no permission to send, pay, sign or publish (Crew).

Academy: start here · Provider-held keys · Secrets and rotation