Black October rolls into November — the AI infrastructure breach wave goes full agentic

On November 10, Railway published its full incident report — the anchor document of what may be the most consequential AI infrastructure breach wave yet recorded. That report landed in the middle of a 48-hour disclosure cluster: Phala confirmed in-flight request exposure for DeepSeek traffic routed through its platform by OpenRouter, NEAR AI disclosed an SGLang remote-code-execution breach that pierced its confidential computing mode, Fireworks AI disclosed its second breach of the month, Wiz published the Qubole cross-account abuse that hit downstream AWS environments, and German host Mittwald disclosed a 56-project compromise through its MCP server.

Wiz had already given October a name — “Black October”, a running catalog of at least nine AI developer platforms disclosing breaches in a single month, from Fireworks (Oct 6) and Lightning AI (Oct 15) through Railway (Oct 20), Warp (Oct 23) and Northflank (Oct 30), with more added into November, including a RunPod report that began circulating on social media. What the November cluster confirms is that the wave didn’t roll over at midnight on Halloween. It also confirms something worse, and much more specific: this is now an agentic AI attack wave, and the offense is running itself.

What happened: the AI infrastructure breach wave, incident by incident

Here’s the 48 hours in one view — each incident described only by what its own disclosure says:

Six companies, six different kill chains — no cross-contamination, which matters because attribution varies. Railway calls its incident “one of a series of attacks on platforms that hold AI keys” but notes Wiz’s Black October research “does not independently attribute the Railway incident.” Wiz has not identified ties between the Qubole activity and other publicly reported campaigns. The pattern — not confirmed attribution — is the story of this AI infrastructure breach wave; the linkage is mostly a vibe backed by one very repetitive playbook: steal env vars, find AI keys, check them with scripts, burn them at scale.

The economics explain the volume — and why every AI infrastructure breach wave since LLMjacking began has followed the same arc. Per BleepingComputer’s reporting, GTIG and Mandiant’s latest LLMjacking research logged victims ringing up cloud-AI charges as high as $1 million; Wiz documented two downstream abuse cases — one key used for ~800,000 Bedrock calls over 30 hours, another for ~1.7 million calls over 13 hours — running over $100,000 at list price alone, with traffic profiles matching resold coding-agent traffic. Stolen AI keys aren’t a nuisance. They’re wholesale inventory.

The Railway deep dive: 26 hours of agentic AI attack versus human defense

The Railway report is the most alarming document of the week — not for one clever exploit, but for the shape of the fight. The report describes the incident window as “a contest of agent speed, with Railway defending against abliterated models and a harness similar to ARTEX, according to Wiz.” Railway’s own forensics separately state that the attacker “was using abliterated models with no safeguards, with the ability to perform escalated actions in rapid succession.” Abliterated models are open-weight models with their safety training stripped out — a practice that makes odd neighbors to the quantified cyber-risk disclosure Moonshot published alongside Kimi K3.1 Pro’s open-weight release; the attacker was running them, and ARTEX — which Wiz separately says appeared as an “autonomous penetration testing console” landing page on infrastructure it connected to an LLM-resale operator — is an agentic attack harness.

Condensed to the timestamps the report gives, the fight looked like this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

OCT 20, 06:50 UTC  Attacker begins probing Railway's build infrastructure
OCT 20, 07:28      Partial escape from build filesystem isolation; build
                   credential stolen; Temporal APIs abused to read other
                   builds' stored histories (353 builds, variables included)
                   → attacker pulls a copy of Railway's internal monorepo
OCT 20, 13:58      Anomaly alert pages the on-call engineer
OCT 20, 17:28      Build credential revoked; builds re-enabled after fixes
OCT 21, 03:26      Attacker uses stolen source to find an erroneous OIDC
                   binding → short-lived cloud credential obtained
OCT 21, 04:07–05:21 Encrypted env-var envelopes pulled from production DB,
                   queries regex- prioritizing AI provider key names
OCT 21, 04:42–07:15 Per-environment keys and variables decrypted via KMS
OCT 21, 07:14      All cloud credentials disabled; decryption service off
OCT 21, 09:24/25   Attacker fully evicted; window ≈ 26 hours

Two things deserve your attention.

First, the escalation loop. The first foothold — a previously unknown vulnerability in Railway’s multi-tenant build infrastructure — handed the attacker a credential that Railway’s own Temporal instance accepted as a trusted client, which yielded stored build histories, which yielded the internal monorepo. The report is blunt about what that meant: the codebase gave the attacker “a privileged view into how Railway works, enabling them to run agent fanouts, find any exploit, and move laterally with significant speed.” When Railway patched the first escape, their own internal “hardening” team derived a second exploit from the same vector within an hour — a live demonstration that an agent pointed at a codebase finds things fast, even defensively. It is the first public incident report to document an agentic AI attack end to end, timestamps and all. When the attacker re-entered via the stolen source, Railway only noticed because the agents started probing endpoints dead for weeks, months, or years.

Second, the blast radius, framed deliberately as upper bounds: at most 1.85% of workspaces — about 100,000 — could have had environment variables decrypted. Database logs show the attacker prioritizing AI provider keys by regex-matching variable names. 1,852 users’ linked-account tokens (BYOK agent keys and GitHub OAuth tokens) were reset. Unauthorized spend on stolen keys is estimated at ~$740,000, and Railway is coordinating refunds or backstopping costs itself — including OpenRouter keys, after OpenRouter enforced its no-refund terms — Railway published a separate recommendation for OpenRouter key holders. Railway also notified eight providers — GitHub, GitLab, Anthropic, OpenAI, OpenRouter, SpaceXSI, Google, Stripe — with key hashes before it could even determine which keys were exposed: in this threat model, the right response to “maybe stolen” is revocation at scale.

Where did the keys go? Railway’s forensics suggest AI provider credentials were sold to “distributed transfer stations” for use in distillation — the practice Anthropic has documented of harvesting frontier-model outputs to train competitors’ models. Unauthorized usage ranged “from coding agents to AI training pipelines.” In other words: your API key, subsidized by your credit card, possibly becoming somebody else’s training run.

The new attack surface: in-flight LLM requests are a secret store

Railway’s incident is about secrets stored in env vars. The Phala disclosure, also on November 10, is about something newer and weirder: secrets that only existed inside a prompt.

Here’s the mechanism as Phala’s own report lays it out. An attacker chained a legacy internet-facing service whose management interfaces “relied on loopback access for trust and did not independently authenticate callers” — reaching internal control surfaces from the outside. That granted the ability to create unauthorized CVMs — confidential virtual machines — and grab application credentials. Days later, the same access pattern took control of an inference VM on a new GPU server that was “serving production traffic without our full production security hardening. The attacker used a similar access pattern to take control of the inference VM, making in-flight request data visible during processing.”

The exposure window is the sting in the tail: Phala advises anyone whose DeepSeek V4 Flash 0731 requests were routed to Phala by OpenRouter, between October 21 at 00:00 UTC and November 8 at 05:35 UTC, to treat request contents as exposed and rotate every API key, token, or password in them.

The proof of misuse is the part to pin to the wall: a third-party researcher spent July 1 through November 7 planting unique, per-request canary credentials into requests sent to Phala and monitoring them. Only canaries from requests sent October 21 and 22 were subsequently used. That’s a canary-credential proof done exactly right — per-request uniqueness to date the exposure, continuous monitoring to confirm misuse, and honest acknowledgment that because the test sampled requests, the wider precautionary window stays. If you route prompts through third-party inference and you’re not running canaries, this is the experiment that shows whose job you left undone.

NEAR AI’s disclosure, the day before, is the mirror image. An attacker exploited a remote code execution vulnerability in SGLang, got code execution on one inference server, and on November 8 “could also have observed user requests being processed on the accessed server, including requests running in confidential mode.” NEAR’s verdict on TEEs deserves to be quoted in full, because it’s the most honest sentence any confidential-computing vendor has written this year:

“Confidential computing protects data from the operator and the host. It does not protect against a vulnerability in the software running inside the environment.”

That’s the threat model reset in one sentence. An enclave keeps the host out; it does nothing about a bug in the code inside — and with inference engines like SGLang now carrying exploitable bugs, the in-enclave software is itself attack surface. NEAR’s response is telling: fix deployed across all servers, vulnerability reported to the SGLang project, and enclave-adjacent software now treated “with the same rigor as the enclave itself.” Blast radius: roughly 100 users’ account details, 18 legacy agents (not running in TEE) read, and two customers’ Cloud API keys exposed in logs and revoked.

What operators should actually do

Read the six reports back-to-back and the agentic AI attack wave writes its own defensive checklist — not generic advice, but each item pointed at a mechanism in one of these incidents:

Rotate, per exposure model. Railway’s env vars and linked tokens: rotation plus provider-side revocation. Phala: rotate everything you put in routed prompts during the exposure window. NEAR: affected keys already revoked; watch for phishing referencing your account.

Put canary credentials in your most-exposed channels. The Phala researcher’s method — unique per-request canary keys, continuously monitored — is reproducible at basically any traffic volume, and converts “we believe exposure may have occurred” into “we know which requests were misused and when.” For any platform holding AI keys, this is the cheapest tripwire you can build.

Treat env-var decryption as a monitored, scoped, auditable event. Railway’s post-incident hardening is a template: decrypt operations centrally audit-logged; only the secrets service can obtain keys that decrypt data-encryption keys; each calling service restricted to the credentials it needs. If your provisioning path lets an orchestration machine decrypt customer secrets because it’s convenient, you have Railway’s October 21 on disk, waiting.

Treat routed prompts, agent settings, and MCP servers as credential stores. What flows through a prompt is as sensitive as what sits in an env var — the attackers watched in-flight requests, not databases. Mittwald’s MCP-server compromise is the server-side echo of the supply-chain attack on AI coding assistants documented earlier this year; the trusted tool is now the entry point. Apiiro’s research (published November 5) is the developer-side version of the same failure: 104,185 public copies of Claude Code’s .claude/settings.local.json on GitHub, 1,122 of them holding at least one secret (1,379 distinct values), including 379 database passwords and 23 AWS keys, because “Yes, and don’t ask again” saves the full approved command, secrets included. It’s the developer-side sequel to the vibe-coding data-leak pattern — trusted AI tools quietly writing secrets into the wrong places. Rotate first, then clean up; git history remembers.

Honest threat models beat impressive ones. NEAR wrote the sentence the whole TEE industry should adopt.

Tighten third-party trust before the attacker audits it for you. The actor in Wiz’s Qubole report assumed customer-created integration roles trusting Qubole’s AWS account — roles so idle that in a majority of environments the attacker’s requests were “the only AssumeRole activity from the vendor account in October.” Wiz’s recommendations: delete unused integration roles, pin vendor principals with aws:SourceIp conditions (which alone would have blocked every role assumption Wiz observed), and treat the External ID as non-secret — it “is logged in plaintext in CloudTrail.”

Implications: an agentic AI attack wave met by slow-motion defense

Strip the vendor names and one structural change remains. In every incident above, the human-exploitable bottleneck is gone. Railway describes an attacker running agent fanouts against a stolen codebase, probing many routes in parallel while Railway hardened them in parallel. Mittwald’s managing director Robert Meyer told the Record that logs showed the attacker “worked his way through our system extremely quickly,” with “seconds passed between steps that would take significantly longer for a human attacker” — and Mittwald disclosed it had “no other evidence of AI involvement,” so the AI-assisted attribution stays an allegation, pending the full postmortem promised for “next week.” Chainalysis’s disclosure in the same period said its attackers used “offensive agentic techniques” too; that saga closed this week with Data Solutions restored November 10 after password resets and API-key rotations.

The defense is re-tooling, visibly, but at organizational speed, not agent speed. Railway accelerated a new generation of build infrastructure (dedicated ephemeral VM per build, separate storage and cache) into production in days, rebuilt CI with 2FA and biometric gating, shipped new PKI. Fireworks pulled in Unit 42 and disabled self-serve dataset uploads. NEAR is putting enclave-adjacent code through enclave-grade review. Phala has undisclosed hardening pending its full RCA. And as I covered in my report on the OpenCode API-key breach and distillation attack, the resale side of this market is already industrialized — Wiz’s Black October research documents LLM-resale sites and key-checking infrastructure, including one operator whose domain hosted a page titled “Distillation behaviour detection”: resale infrastructure building its own anti-abuse tooling for stolen keys.

The uncomfortable summary of this agentic AI attack wave: attackers now find exploits, verify keys, and burn quota at machine speed, while defenders hold incident-response bridges staffed by humans in shifts. Railway’s 26-hour eviction is genuinely good incident response. It’s also a preview of every incident to come.

Meanwhile, on the roadshow

One final juxtaposition, no conspiracy required. The same day Railway published its report, Anthropic launched the roadshow for its IPO, per Reuters reporting: up to $64.4 billion raised at $70–78 a share, Nasdaq debut November 19 under “ANT,” valuation up to about $1.4 trillion. Reuters also reports investors pushing back on valuation and the sustainability of the spend cycle, and the prospectus itself carries a risk factor in which Anthropic flags that its increasing use of AI systems to accelerate its own research and development could cause the capabilities of its models to “advance more rapidly than our ability to develop, validate, and implement corresponding safety, alignment, and security measures.”

That warning is now falsifiable at invoice level. Nobody on a roadshow video is pricing in “Black October,” and there’s no evidence the IPO book is discounting AI-infrastructure breaches as such — I won’t pretend otherwise. But consider the loop these disclosures close: platforms holding AI keys robbed of $740k at a clip; stolen keys believed, per Railway’s forensics, to be headed to distillation — a practice Anthropic has an entire page about; and the company whose models are being distilled underwriting a trillion-dollar valuation on ~$81 billion of run-rate revenue as of October 31, per its filing. If the prospectus can name the risk, the incident reports can show the receipts. Black October rolls into November — rotation lists in tow. Put your canaries in the water.

References and further reading

• Railway — Incident Report: October 21st Security Attack
• Railway — Security Disclosure Recommendation: Check for Unexpected OpenRouter Usage
• Railway Status
• Wiz — “Black October” for AI Developer Platforms
• Wiz — Trusted by Default: Qubole Cross-Account Access Abused in the Wild
• Phala — November Preliminary Incident Report
• OpenRouter — Security Center: manage and de-risk your API keys
• NEAR AI — Security Incident Report: SGLang Vulnerability
• Fireworks AI — Update on October 2026 Security Incident (with Unit 42 forensics)
• Fireworks AI — Security Bulletins
• Mittwald — Sicherheitsvorfall am MCP-Server
• The Record — Alleged AI-aided cyberattack exploits assistant interface to breach German web host
• Chainalysis — Security Incident Information (updated Nov 10)
• BleepingComputer — Railway breach leads to $740,000 in fraudulent AI charges
• BleepingComputer — Google: LLMjacking attacks rack up $1 million in cloud AI charges
• GTIG/Mandiant — The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources
• Apiiro — Claude Code secrets exposure on GitHub
• The Hacker News — SGLang RCE Exploit Breaches NEAR AI
• CNA (Reuters) — Anthropic IPO to raise up to $64.4 billion as AI boom faces growing scrutiny
• CNA (Reuters) — AI backlash could threaten Anthropic IPO timing, potential investors say
• Anthropic — Launches roadshow for proposed initial public offering
• Anthropic — Detecting and preventing distillation attacks
• SEC EDGAR — Anthropic, PBC Form S-1/A (Amendment No. 2, filed November 10, 2026)

• Next Post →