At least a dozen AI developer platforms breached in a month as attackers hunt AI access tokens, SecurityWeek tallies
WorkOS, Northflank and Trigger.dev are the latest to disclose intrusions; Wiz links the wave to resale of stolen AI keys, and WorkOS and Chainstack say attackers used the open-source AI pentest tool Artex.
Why it matters
Hosting platforms, evaluation services and developer consoles hold AI provider keys for many customers at once, so one intrusion can expose many inference accounts, as the Cloud Security Alliance points out. Wiz says it saw stolen enterprise credentials abused within 30 minutes of vendor breaches and several actors reusing the same keys. The attacks do not appear to be linked and entry points vary. Watch for more disclosures and for AI providers tightening key rotation and scoping.
Key facts
- At least a dozen AI developer platforms hit in a month
- Latest: CommandCode, Northflank, Trigger.dev, Chainstack, WorkOS
- WorkOS breached on 30 October; Chainstack on 26 October
- Wiz saw credentials abused within 30 minutes of breaches
- Attackers used the open-source AI pentest tool Artex