Northflank Security Incident: Control-Plane Secrets, Reported AI Key Abuse, and What to Rotate

Northflank, a cloud platform for deploying apps and databases, is telling every customer to rotate all of their secrets after what it calls a security incident, with some customers reporting unauthorized use of AI provider keys. The company's status page says the attack "focused on secrets held in our control plane," that running workloads were unaffected, and that it will publish a root cause analysis once findings are confirmed. If you stored an OpenAI, Anthropic or other AI key in a Northflank secret group, treat it as exposed and rotate it now.

This is the third platform-level incident in two weeks where the stolen asset is the same thing: stored environment variables that hold AI provider credentials. We covered the earlier ones in the Railway breach and the second Zeabur breach, and Wiz documented the wider pattern in its Black October analysis. For people who run coding agents, the angle is practical: agents, MCP servers and CI jobs are exactly the workloads that carry these keys.

TL;DR

What Northflank has said

The status page entry, last updated November 2, 2026 at 11:09 UTC, is the primary source for everything below. Where a detail comes only from a news report, that is flagged.

• Containment: Northflank says it believes "the attack vector was contained within an hour of the first alert" and that its investigation "shows no sign that the attacker was in our environment after the attack."

• Review: independent forensic auditors began reviewing the attack with Northflank over the weekend and are still working.

• Scope: running workloads were unaffected, and Northflank has seen no sign that workloads or workload data were accessed. Evidence suggests the attack was focused on secrets in the control plane. Customers on forward-deployed or dedicated control planes are unaffected.

• Customer reports: "Some customers have reported unauthorised use of AI secrets."

• Actions on customers' behalf: where it could, Northflank revoked its own access tokens and sessions, version control integrations, and cross-account IAM roles and service accounts. You may need to sign in again and reconnect those integrations.

• Platform impact: intermittent degradation over several days while Northflank rotated its own keys and hardened the platform.

• Rotation tooling: the page records that secret rotation became available for MySQL, Redis, MinIO and RabbitMQ add-ons on October 31.

• Timeline: the status page lists a Wiz threat alert at 11:43 UTC on October 30, engineer review a minute later, a network policy patch at 12:02 and further patches through 13:05, and a request for Wiz's incident response team at 13:00. Audit logs were enabled for all customers, including free users, on October 31.

• Decryption: the page tells customers to assume all environment variables were decrypted and to rotate everything.

A Cyber Security News report repeats this timeline and adds that Northflank pointed to IP addresses similar to those in Wiz's October analysis. We did not find that IP statement on the status page, so read it as reported rather than verified.

What is not known

Plenty remains open, and it is worth being precise about it:

• The entry point. Northflank has not said how the attacker got in.
• How secrets were read. The company has not said how many secrets were taken or how they were accessed, only that customers should assume environment variables were decrypted.
• Who is affected. There is no published count of affected customers or workspaces. Railway, by comparison, eventually published a figure in its preliminary report.
• The attacker. Nobody is named, and there is no confirmed link to the Railway or Zeabur incidents.
• Whether source code was reached. Northflank's page says no sign of workload access, which is not the same statement as "no source code access" for repositories connected through version control integrations. Check your Git provider's audit log regardless.

The BYOC note and CVE-2026-98432

The status page also says Northflank "patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration," and asks customers whose bring-your-own-cloud cluster is no longer connected to contact support. The page lists this as a separate item. It does not say the CVE was the entry point, and we are not claiming it was. CVE-2026-98432 is a Linux kernel TCP use-after-free; see the Beam CVE entry and our patch-status write-up. If you run a self-managed BYOC cluster, check that its kernel is patched independently of what Northflank did.

Why AI keys are the target

AI provider keys are among the easiest secrets to monetize. A stolen key needs no further access: the attacker calls the provider API and the victim pays, a pattern known as LLMjacking. We have documented how this plays out in Symantec's agent-driven LLMjacking research and in the Wiz GCP billing hijack write-up. Railway said its attackers were searching for AI key names in the variables they read, and the Northflank report that AI secrets are the ones being abused matches that.

The platform is a useful chokepoint for an attacker because many teams put every secret in the same place. A single control plane holds the model key, the database password, the payment key and the Git token. One read of that store gives a menu.

What this means if you run AI coding agents

Even if you do not host on Northflank, the lesson holds for any platform that stores your secrets. The steps below are the ones Northflank itself recommends, plus checks that matter specifically for agent setups.

1. Rotate in Northflank's recommended order. AI provider keys first, then cloud provider credentials, payment provider keys, private keys, then database and other service credentials. Rotate integration secrets and project secrets, not only the ones that look suspicious. Do the rotation at the provider (revoke the old key), then update the value in Northflank. Updating Northflank without revoking at the source leaves the stolen value working.
2. Check provider logs. For each AI provider, look at usage since October 30, 2026 for unfamiliar models, regions, IP addresses or spend. If you find unexpected usage, Northflank says to contact the provider directly, for example OpenAI or Anthropic.
3. Reconnect integrations. Northflank revoked tokens, VCS integrations and IAM roles where it could. Sign in again and reconnect, and verify the cross-account roles you recreate follow least privilege.
4. Audit your Git provider and registry. Look at deploy keys, app installations and token creation events around the incident window. A stolen Git token is how a secrets incident becomes a code incident.
5. Close public add-on access. Northflank advises restricting public network access to databases and add-ons where enabled; a rotated password on an internet-facing database is still an exposed database.
6. Search for the same key elsewhere. The key you stored on the platform probably also lives in a developer's .env, a CI secret and an agent's configuration. Rotating one copy is not enough if the others stay valid. Our guide on how API keys leak through logs and environment variables covers the common hiding places.
7. Use narrower keys going forward. Per-project provider keys with spend limits turn a stolen key from an open-ended bill into a capped one. Where the provider supports it, restrict keys by model or by IP.

What Beam can and cannot do here

Beam cannot protect secrets that sit inside someone else's control plane. The exposure here happened on Northflank's servers, and no local tool on your laptop can see or reverse it. What Beam can do is reduce the number of places your keys travel on your own machine, and help you find stragglers during a rotation.

Beam is a local collector for AI coding assistants. Per its documentation, it normalizes agent events, redacts recognized secrets before storing them, and flags risky patterns for review. During a rotation that is useful in two ways: you can check whether an agent session ever echoed one of the old keys into a prompt, a tool call or a log, and you can review flagged risky commands that handle credentials. Redaction covers recognized credential formats, not every sensitive string, and scanning is heuristic. Enforcement is hook-based (Claude Code and Codex PreToolUse), not a sandbox. Beam also does not know which keys you have stored on a hosted platform, so the rotation checklist above stays your job.

Timeline

Summary

Northflank's message is short and consistent: its control plane's secrets were the target, running workloads look untouched, and everyone should rotate, AI keys first. What it has not given yet is the how. Until the root cause analysis lands, do the rotation, check provider logs, and make sure the same keys are not still valid in some other file. We will update this post when Northflank publishes more.

Frequently asked questions

What happened in the Northflank security incident?

Northflank reports on its status page that an attacker targeted secrets held in its control plane, and that some customers reported unauthorized use of AI secrets. The company says it believes the attack vector was contained within an hour of the first alert and that it saw no sign the attacker remained in its environment afterwards. Independent forensic auditors are reviewing the incident.

Were my running Northflank workloads compromised?

Northflank says running workloads were unaffected and that it has seen no sign that workloads or workload data were accessed. It says evidence suggests the attack focused on secrets held in its control plane, and that customers on forward-deployed or dedicated control planes are unaffected. The root cause is not yet published, so treat that as the company's current assessment.

Which secrets should I rotate first?

Northflank recommends rotating all integration and project secrets, starting with AI provider keys, then cloud provider credentials, payment provider keys, private keys, and database and other service credentials. Rotate even if you have seen no suspicious activity, then review provider logs for usage you did not make.

How do I check whether my AI keys were abused?

Open the usage and billing pages of each AI provider whose key was stored on Northflank, look for requests from unfamiliar IP addresses, models you do not use, or spend spikes since October 30, 2026, and revoke the key at the provider. If you see unexpected AI usage or spend, Northflank advises contacting providers such as OpenAI and Anthropic directly.

Is this related to the Railway and Zeabur breaches?

Not confirmed. Northflank has not named an attacker or tied the incident to a campaign. The pattern is similar, though: Railway and Zeabur also told customers to rotate stored environment variables, and Wiz documented stolen AI keys across AI developer platforms in October. Treat the link as a hypothesis until a root cause analysis is published.

Related reading

• Railway breach: environment variables accessed, rotate every secret
• Zeabur second breach and shutdown
• Black October: Wiz on AI developer platforms and stolen keys
• GitBook says AI agents attacked it: rotate tokens and re-authenticate MCP
• October 2026 attacks timeline
• Beam on the landing page: what it watches

Details are as published by Northflank on November 2, 2026 and may change as the investigation continues. This is a developing incident; check the Northflank status page for the latest.