Northflank Breach Exposes Hosted AI API Keys
Northflank confirmed that some AI API keys hosted on its platform were used without authorization and required customers to rotate sensitive credentials. Its preliminary investigation focused on sensitive data in the control plane, while the company said it had found no evidence that attackers accessed running customer workloads or related data. Wiz tracked two separate cases involving stolen credentials and large-scale Amazon Bedrock API calls, including about 800,000 calls in 30 hours and 1.7 million in 13 hours.
The incident demonstrates that compromised credentials stored on AI deployment platforms can lead to unauthorized model usage and potentially substantial API charges, making credential rotation and audit-log review important for affected teams.
文/王珮瑤|2026-11-05 發表
雲端資安業者Wiz近日調查10月接連發生的AI程式開發及部署平臺資安事件，發現其中部分事件的攻擊者曾存取客戶儲存在平臺的環境變數及敏感憑證。由於這些環境變數可能包含AI服務API金鑰等敏感資訊，一旦平臺遭入侵，攻擊者便可能利用遭竊金鑰，未經授權使用客戶的AI服務。
Wiz追蹤的兩起企業AI服務金鑰濫用案例顯示，在平臺業者通報的憑證遭存取時間後不到30分鐘，攻擊者便開始測試金鑰是否有效，數天後更大量呼叫AWS提供的AI模型服務Amazon Bedrock的API。其中一起案例，攻擊者在30小時內利用遭竊金鑰呼叫約80萬次API；另一起則在13小時內呼叫約170萬次。
研究人員還發現，部分遭竊金鑰與AI模型存取轉售活動有關。他們追查momo及Xingjiabi兩組活動，發現與這些活動有關的網路基礎設施曾被用來測試遭竊金鑰，並找到以折扣價格提供AI模型存取服務的網站。