Guide · Keys

Northflank breach: what to do about your OpenAI, Anthropic and OpenRouter keys

On October 30, 2026, Northflank told users to assume environment variables were decrypted, and later said users had reported unauthorised use of AI API keys. Revoke those keys at the provider.

Rotated the key? Start free with one key, no card. BillCurfew polls usage about every five minutes and emails you when a key passes a daily cap or spikes. A manual kill works on every plan, including Free. It is not a proxy, so it does not block the next request, and it does not sit in Northflank's path.

Last checked . The timeline below is only what Northflank's status page and Wiz's Black October post say.

What Northflank said

The incident is on the Northflank status page. Times are UTC. When this page was checked, that status page still showed a major outage from 1:40 PM to 12:00 AM, affecting the Northflank platform, and a partial-outage banner. [1]

  • October 30, 1:40 PM. Investigating. "Rotate environment variables immediately." The same update lists 11:43, a Wiz threat alert; 11:44, Northflank engineers review it; 12:02, an initial network policy patch; 12:50, additional patching; 13:00, Wiz CIRT support requested; 13:05, additional patching deployed. [1]
  • October 30, 1:58 PM. Identified. "Assume all environment variables have been decrypted. Disable/rotate all keys." [1]
  • October 30, 3:12 PM. Secret rotation on Postgres and MongoDB is enabled for all users. Disable public expose on addons if you turned that on. "All users should assume their environment variables are decrypted and begin rotation immediately," including secrets on workloads, secret groups, and global secrets. "Multiple users are confirming that their AI keys have been used." [1]
  • October 30, 7:28 PM. The investigation is ongoing, with no further confirmed findings. The guidance is unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including workloads, secret groups, and global secrets. Disable public access to addons where it is enabled. [1]
  • October 30, 11:38 PM. "Users have reported unauthorised use of AI API keys supplied to the Northflank platform." If you have not rotated user-provided secrets, do it immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads. Review AI provider usage and billing logs, and report suspicious usage to Northflank support and the relevant provider. Northflank says these reports may match a broader pattern, and that similar IP addresses are in Wiz's Black October article. [1]
  • October 31, 1:04 AM. Audit logs are enabled for all customers, including free users. [1]
  • October 31, 1:34 PM. Secret rotation for MySQL and Redis is available to all customers. Rotate all secrets if you have not already. [1]

Revoke at the provider first

Pasting a new value into Northflank leaves the old key alive. Northflank's 11:38 PM update says to revoke the credential with the provider that issued it, then generate a replacement and update Northflank. [1] The console paths are in the leaked-key guide. The one-page version is the first 15 minutes checklist.

  • OpenAI. Delete the project API key. That deletion is permanent. Create the replacement before you delete if the app still needs to run.
  • Anthropic. Disable the key. Disable is reversible. The Admin API that does this is for organization accounts. Delete is permanent.
  • OpenRouter. Disable the key. Disable is reversible. Archiving is permanent.

Check usage from October 30

Review per-key usage and billing at OpenAI, Anthropic, and OpenRouter from October 30, 2026 onward. Keep the export. If the spend is not yours, report it to that provider and to Northflank support. Northflank asked for both. [1] Do not send the secret. These sources do not say a provider will issue a credit.

Keep a spare key ready

Create the replacement, point the app at it, and update the Northflank secret and workload before you revoke the old key. Revoking first takes the app down until the new value is deployed. Northflank still requires the revoke at the provider. Updating Northflank is not that revoke. [1]

Black October

Wiz's Black October post, dated October 30, 2026, says at least nine AI developer platforms disclosed incidents this month: Fireworks AI (Oct 6), Andromeda (Oct 9), Zeabur (Oct 14), Lightning AI (Oct 15), OpenCode (Oct 16–17), Railway (Oct 20), Warp (Oct 23), CommandCode (Oct 28), and Northflank (Oct 30). Wiz says most of these incidents are still being analyzed and that detailed technical information is not available. It does not give a root cause for Northflank. [2]

Wiz describes two Bedrock keys, abused after a vendor breach it does not name in those cases, with on the order of 800,000 and 1.7 million calls. This page does not treat those keys as Northflank's. BillCurfew does not watch AWS Bedrock. [2]

Related notes already on this site:

What BillCurfew does not do

It watches OpenAI, Anthropic, and OpenRouter. It does not watch AWS Bedrock, and it does not watch the other providers named only in the Wiz post. It polls about every five minutes. It emails you on a daily cap or a spike. A manual kill works on every plan, including Free. Auto-kill is paid-only and stays off until you turn it on. None of that is a proxy, and none of it blocks the next request or detects the Northflank incident itself.

FAQ

Did Northflank say every environment variable was exposed?

On October 30 at 1:58 PM UTC the status page said to assume all environment variables have been decrypted, and to disable or rotate all keys. At 3:12 PM UTC it said all users should assume their environment variables are decrypted and begin rotation immediately, including secrets on workloads, secret groups, and global secrets. At 7:28 PM UTC it said the guidance was unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately. [1]

Did Northflank confirm the AI keys were used?

Not as its own finished finding. At 3:12 PM UTC it said multiple users were confirming that their AI keys had been used. At 7:28 PM UTC it said the investigation was ongoing and it had no further confirmed findings. At 11:38 PM UTC it said users had reported unauthorised use of AI API keys supplied to the platform, and that those reports may be consistent with a broader pattern. Similar IP addresses, it said, are in Wiz’s Black October article. [1]

Does pasting a new value into Northflank revoke the old key?

No. Northflank’s 11:38 PM UTC update says to revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Replacing the value in Northflank does not revoke the copy that already left. [1]

Which days should I review?

Review per-key usage from October 30, 2026 onward. That is the day Northflank opened the incident. The status page lists a Wiz threat alert at 11:43 UTC and the first customer update at 1:40 PM UTC. These two sources do not give an earlier start. [1]

Can BillCurfew cover AWS Bedrock or stop the next request?

No. BillCurfew watches OpenAI, Anthropic, and OpenRouter. It does not watch AWS Bedrock. It polls about every five minutes and emails you when a daily cap or a spike trips. A manual kill works on every plan, including Free. It is not a proxy, and it does not block the next request.

Sources

  1. Northflank status, Security incident. https://status.northflank.com/cmvv0rn5a092f14rutwccodpp
  2. Wiz, “Black October” for AI Developer Platforms. https://www.wiz.io/blog/black-october-for-ai-developer-platforms