Fireworks AI agentic AI attack — Oct 2026

In October 2026, a coordinated security campaign dubbed 'Black October' targeted the AI infrastructure stack, resulting in security disclosures from nine different developer platforms. The incidents highlighted a systemic vulnerability in how AI platforms manage stored environment variables, which attackers leveraged to gain unauthorized access to enterprise AI credentials.

What happened

The campaign involved the exploitation of stored environment variables that granted access to AI services. Platforms including Fireworks AI, Lightning AI, Railway, Warp, Northflank, OpenCode, CommandCode, and Zeabur reported security incidents during the month. Some platforms, such as Fireworks, OpenCode, and Warp, specifically identified the use of 'agent swarms' in the attacks. OpenCode and CommandCode noted that the attackers were attempting to perform model distillation.

Once attackers obtained the stolen credentials, they utilized automated agent swarms to rapidly scale their operations. Wiz Research observed that unauthorized activity often began within 30 minutes of the initial credential access. These agents tested stolen keys across multiple organizations and directed traffic toward LLM Broker resale markets, which provided immediate liquidity for the stolen access.

The impact on downstream enterprises was significant and quantifiable. In two documented cases, attackers generated millions of API calls to Amazon Bedrock, resulting in over $100,000 in usage costs at list price. One case involved approximately 800,000 calls over 30 hours, while another generated 1.7 million calls over 13 hours. The token usage patterns in these instances were consistent with resold coding-agent traffic. Additionally, social media reports alleged that approximately $371,000 in cryptocurrency was stolen using keys that had been stored in the Railway platform. Following the incident, Zeabur announced it would shut down operations, citing the breach as a contributing factor.