Over a Dozen AI Platforms Breached in One Month for API Keys in LLM-Jacking Operations

Between late September and early November, at least a dozen AI developer platforms were compromised by the same class of attacks. The targeted organizations include Andromeda, NVIDIA Brev, CommandCode, Fireworks AI, Lightning AI, Northflank, OpenCode, Railway, Trigger.dev, Warp, Zeabur, and the recently disclosed Chainstack and WorkOS. These platforms function as an intermediate layer that hosts AI inference services, model evaluation environments, and developer consoles while managing credentials for downstream customers.

Stolen AI Access Tokens Gain Market Value

The primary target across all incidents was AI access tokens. These platforms store credentials on behalf of many clients, so a single breach yields multiple inference accounts. Cloud Security Alliance analysis indicates that attackers are specifically interested in credentials held by managed platforms and evaluation services. Wiz research links the thefts to rising LLM-jacking operations and the growth of LLM broker infrastructure, where stolen tokens are resold. Demand is further driven by model distillation, in which outputs from stronger models train cheaper alternatives. Multiple threat groups have been observed sharing the same leaked tokens, indicating established resale channels.

Chainstack and WorkOS Disclosures Reveal Attack Pattern

Chainstack disclosed its incident on 26 October. Attackers gained access through a third-party component and reached development and partial production environments. Exposed data included organization names, account holder details, member emails, password hashes, and potentially node credentials, prompting mandatory rotation. WorkOS reported its breach on 30 October after attackers compromised an internal sales application. Although the data appeared less sensitive at first glance, it contained names, emails, phone numbers, job titles, customer account history, and communication summaries.

Both incidents followed a similar short dwell path: entry via non-core systems, rapid location of credential stores, and immediate exit without destructive activity. Neither company is considered security-naive; WorkOS specializes in enterprise identity, yet its sales system was still breached.

Artex Framework Automates the Attack Chain

Both recent disclosures reference the open-source AI penetration testing framework Artex. Although designed for legitimate use, Artex allows operators to automate enumeration, path selection, and exploitation. Attacks attributed to the Chinese APT group Storm-0940, including operations against ConnectWise customers, have been linked to the tool. The framework reduces the time and expertise required for reconnaissance and lateral movement, enabling less experienced actors to test many vectors quickly while generating traffic that blends with normal logs.

Recommended Defensive Actions

• Treat AI keys as first-class assets: isolate them by environment, enforce usage quotas, and implement enforced rotation schedules.
• Inventory all third-party components with external access and credential storage privileges, especially those lacking active ownership or updates.
• Apply baseline controls to non-technical systems such as sales, support, and HR platforms, including mandatory SSO, MFA, restricted export permissions, and separate review of third-party integrations.

Incident Response Must Accelerate

The campaign shows a clear upward curve, with new disclosures continuing into early November. Wiz observed unauthorized activity on stolen credentials occurring within 30 minutes of disclosure in multiple cases. Organizations must therefore maintain pre-planned revocation procedures rather than relying on standard ticketing workflows, as the window between detection and abuse has collapsed to minutes.