Fireworks AI breach also exposes billing data and model weights
Later access on October 23 through a third-party cloud host reached R&D machines; card numbers were not stored.
Stories per day · 30 days
3 RSS
Relatedcredential-theft6opencode6openai5llmjacking4railway4cloud3data-breach3secrets3ai-agents2anthropic2cloud-credentials2console2credential-exposure2deepseek2fofa2model-distillation2ai-coding1apache-answer1
42 stories, newest first · one card per story
Stories tagged #api-keys
Railway says stolen customer AI keys drove $740,000 in unauthorized charges
An attacker decrypted secrets in at most about 100,000 workspaces; Railway will cover some charges providers will not refund.
Claude Code approvals leak passwords and API keys to GitHub
Apiiro found 2,539 secrets in 1,994 public repositories from routine Claude approvals.
Agent steals OpenAI and DeepSeek keys and 5,132 student records
VECERT says the operator used 1,438 FOFA accounts to find exposed secrets and run a campus-card fraud bot.
Truffle Security launches program to revoke 1.4 million live secrets
Program helps API key issuers revoke 1.4 million exposed secrets using TruffleHog verification and webhooks.
2
Stolen LLM API tokens driving illicit charges above $100,000 a day
Mandiant says some victims reached about $1 million before cutting access; one intruder made over 500,000 calls in under eight hours.
1
Northflank breach leads to abuse of customers' AI API keys
Customers must assume environment variables were decrypted; Northflank has not said how attackers got in or how many were affected.
1
Attacker impersonates 32 AI bots while scanning for credentials
CQ Prime says the scanner has run since late September, reached many Cequence customers in one day, and almost all requests failed.
1
Attackers hijack exposed Cairn panels to plant backdoors and steal API keys
NorForge saw injected tasks on at least 17 panels add SSH keys, run Poseidon, and harvest model API keys.
Railway says attacker reached internal systems and some customer secrets
Customers who signed up before October 21 are told to rotate stored keys; Railway says attacker access ended on October 22.
1
Railway urges all users to rotate keys after secrets were accessed
Hackers may have decrypted environment variables for a subset of users; Railway paused deployments while it investigates.
OpenCode says breach hit 1.4% of Console users
The company ties the October 17 incident to a distillation attack on users with external providers, but has not confirmed stolen API keys.
2
Attackers breach OpenCode Console and charge users’ AI API keys
About 1.4% of Console users had stored API keys exposed; the open-source app itself was not affected.
OpenCode breach exposes API keys for 1.4% of Console users
Some linked-provider users report overnight charges up to $1,700 and Google Cloud project suspensions.
OpenCode Console breach may have exposed provider API keys
OpenCode says 1.4% of Console users with linked external providers were affected; the OpenCode product itself was not.
OpenCode Console breach may have exposed OpenAI, Anthropic and Google keys
OpenCode emailed 1.4% of Console users on October 17 to revoke provider keys; local app keys were not involved.
OpenCode breach may have exposed Console users’ API keys
OpenCode says 1.4% of Console users who linked external providers were emailed on October 17.
CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication
Apache Answer through 2.0.2 logs full API keys in plaintext; 2.0.3 stops the leak.
GhostAction Hackers Compromise 500+ GitHub Accounts to Steal Cloud and AI API Credentials
GhostAction compromised 500-plus GitHub accounts and planted workflows that steal cloud and AI API credentials.
8
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
Carbonato installs Hermes Agent on hacked Docker hosts to run Telegram commands and steal AI API keys.
AI Accounts Are Becoming the New Target for Infostealers
SOCRadar found infostealer logs exposing AI sessions and API keys at 482 companies, mostly ChatGPT.
6
80,000+ Organizations Had AI Logins Stolen: From Shadow AI to LLMjacking
SOCRadar analysis of over one million infostealer records found stolen AI logins across 80,000+ corporate domains, with ChatGPT sessions dominating LLMjacking exposure.
1
Zero Trust for AI Agents Starts With Fixing Zero Visibility
Guidance says AI-agent Zero Trust needs inventory first, citing shadow agents and a $600,000 METR token theft.
4
Critical Bifrost AI Gateway Flaw Lets Attackers Run Commands Without Credentials
Unauthenticated Bifrost flaw CVE-2026-90898 lets attackers run commands and steal provider API keys.
3