A platform you trust gets breached. Hours later, someone is running millions of model calls on your account, and you find out when finance asks about the invoice.
That's the pattern behind recent incidents on AI development platforms. Northflank told customers to assume their environment variables had been decrypted and to rotate everything. Users reported unauthorized use of AI API keys stored on the platform. Wiz identified at least nine security incidents affecting AI development platforms in October, and in two cases it investigated, compromised enterprise credentials drove roughly 2.5 million Amazon Bedrock API calls and about $100,000 in usage. The practice has a name: LLMJacking.
The attackers aren't clever in a novel way. They're collecting a currency that's easy to spend. Here's where teams leave it lying around.
Why These Mistakes Keep Happening
AI adoption moved faster than governance. Developers get a key from a model provider, paste it into an environment variable, and ship. There's no procurement review, no vault integration, no budget alert. The key behaves like a credit card with no limit, but it's treated like a config value.
Add the platform layer. Teams assume the hosting provider's encryption protects their secrets. When the provider is the point of compromise, that assumption fails entirely. Northflank's guidance, to assume all environment variables were decrypted, is the honest default for any platform-stored secret.
Mistake 1: Treating Environment Variables as a Secrets Vault
Why it happens: Environment variables are the path of least resistance. Every framework supports them, every platform offers a field for them, and they work on day one.
Consequence: Anything placed in a variable is readable by the platform, its operators, and anyone who compromises either. Database passwords, cloud credentials, tokens, and AI keys sit together in one place. One breach exposes all of them.
Fix: Move high-value secrets into a dedicated secrets manager with access policies, audit logging, and short-lived retrieval. Where a platform must hold a key, scope it narrowly and assume it's disclosable. Inventory which secrets live in platform variables today; most teams are surprised by the count.
Mistake 2: Long-Lived, Unscoped AI Keys
Why it happens: Rotation is friction, and a key that never expires never breaks a deployment. Teams also reuse one key across projects because creating separate ones feels like overhead.
Consequence: When a breach hits, you can't tell which workloads are affected, and rotating one key breaks everything that shares it. That slows your response at the moment speed matters. Northflank's customers faced exactly this: rotate everything, immediately.
Fix: Issue one key per application and environment. Set expirations. Use provider-side controls such as project-level keys, model restrictions, and rate limits wherever offered. Practice rotation on a schedule so that emergency rotation is a routine operation, not a first attempt. This aligns with credential lifecycle expectations in NIST SP 800-53 and the access control guidance in CIS Controls v8.1.
Mistake 3: No Spend Ceiling on AI Services
Why it happens: Finance owns budgets, engineering owns keys, and nobody owns the connection between them. AI usage is also variable by design, so a spike looks like success.
Consequence: Stolen keys convert directly to cash burn. The roughly $100,000 in usage Wiz documented across two cases shows how fast abuse scales. Resale of access, which Wiz found infrastructure for, means attackers can monetize quickly and quietly.
Fix: Set hard quotas and budget alerts at the provider level, per key where possible. Treat a spend threshold as a security signal. Define who gets paged when it trips. Include AI spend in your Total Cost of Risk modeling; a FAIR-style analysis of key theft makes the loss magnitude concrete for your board.
Mistake 4: Monitoring Usage Like a Finance Report, Not a Detection Source
Why it happens: Billing dashboards are reviewed monthly. Provider logs often aren't piped into the SIEM, and nobody has written detections for model-API anomalies.
Consequence: Mean Time to Detect stretches to the next invoice cycle. Northflank advised customers to review provider usage and billing logs for unexpected activity, which is useful advice only if those logs exist, are retained, and are readable.
Fix: Ingest AI provider audit and usage logs into your detection pipeline. Baseline normal call volume, models used, regions, and source IPs per key. Alert on new models, new geographies, and sudden volume changes. Enable platform audit logs everywhere; Northflank turned them on for all customers, including free accounts, only after the incident.
Mistake 5: Having No Incident Response Plan for Third-Party Platform Compromise
Why it happens: Most Incident Response Plans assume the breach is yours. A provider-side compromise, where you learn through an advisory email, falls between vendor management and incident response.
Consequence: Teams burn hours deciding who rotates what. Northflank's own timeline shows how fast a provider can move, with patches issued within about an hour of the alert. Your response has to be equally fast, and it can't be if you're still locating the secrets.
Fix: Add a third-party platform compromise scenario to your Incident Response Plan and run it as a Tabletop Exercise. Map every platform to the secrets it holds, the owner who can rotate them, and the provider contact for abuse reports. Align the plan with NIST SP 800-61. Add contractual notification and log-access requirements to vendor agreements, and check whether a platform's SOC 2 report covers secrets handling.
Prevention Checklist
- Inventory every secret stored in third-party platforms and assign an owner.
- Move high-value secrets to a dedicated secrets manager.
- Issue unique, scoped, expiring keys per application and environment.
- Test rotation quarterly so emergency rotation is rehearsed.
- Set provider-side quotas, rate limits, and budget alerts on every AI key.
- Route AI provider logs into your detection pipeline with per-key baselines.
- Enable audit logging on all platforms, including free tiers.
- Write and exercise a third-party platform compromise playbook.
- Include AI key theft in your Total Cost of Risk and board reporting.
- Review vendor contracts for breach notification timelines and log access.
The lesson from October isn't that one platform failed. It's that AI keys are now high-value targets, and attackers know where teams keep them. Assume the next advisory will say "rotate everything." The only question is whether your team can do it in an hour.
