Northflank breach leads to abuse of customers' AI API keys

Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets held on its platform after a security breach led to unauthorised use of customers' AI API keys, according to a report published by BleepingComputer on 31 October 2026.

An API key is a string of characters that identifies and authorises a caller to a service. In the case of AI providers, a key allows whoever holds it to send requests to a model and have the usage billed to the key's owner. Keys of this kind are commonly stored as secrets inside hosting platforms so that applications and automated agents can call models without a human being present.

According to BleepingComputer, the breach at Northflank resulted in attackers making unauthorised use of customers' AI API keys. The company is telling customers to rotate all credentials and secrets stored on the platform. Rotation means replacing an existing key or password with a new one and invalidating the old value, so that any copy an attacker holds stops working.

The advice to rotate everything, rather than a named subset of keys, is the broadest form of such guidance. Northflank's warning covers all credentials and secrets stored on its platform, not only those belonging to AI providers.

Several details are not established by the available reporting. The report does not state when the breach began, how long it lasted, how the attackers gained access, how many customers were affected, or how much unauthorised AI usage was incurred. It also does not say whether any customer application data beyond stored credentials was accessed. Readers should treat any figure or cause circulating elsewhere as unconfirmed until Northflank publishes more detail.

For teams running agents and automated workloads, the practical consequence of the warning is operational rather than theoretical. Secrets held in a hosting platform are typically referenced by many running services at once, so rotating them requires coordinating new values across deployments, build pipelines and any third-party integrations that reuse the same key. Keys that are shared between environments, or that were copied into configuration files outside the platform, can be missed in that process and continue to work for whoever still holds them.

Affected customers should follow Northflank's instructions directly and check usage records at their AI providers for requests they did not make. Where providers offer per-key usage logs and spending limits, those records are the most direct way to see whether a specific key was used by someone else. Northflank has not, in the reporting available so far, published a full incident timeline.