“Black October” for AI Developer Platforms

Edit - Two additional incidents are publicly reported: Brev (NVIDIA) (Oct 4-20), and Trigger.dev (Nov 1). Neither has shared any TTPs or IOCs yet. Wiz customers can refer to our relevant Threat Intel Center advisories for more information on the Railway Platform Breach, Lightning AI Security Incident and the overall campaign. Fireworks, OpenCode, and Warp have all reported indications of an “agent swarm” attack. Andromeda’s incident report calls it part of an "industry-wide attack." OpenCode and CommandCode have explicitly attributed their incidents to an attempt at “distillation.” Any other month, and this would be the top security story. However, with all the ongoing incidents, few reports are connecting the dots across these attacks (Cloud Security Alliance as a notable exception). Currently, most of these security incidents are still being analyzed, and detailed technical information is not available. Zeabur has shared a full write-up, and the company will be shutting down due to this incident. Railway has released a preliminary report and timeline. However, there are some indicative details. Fireworks, Zeabur, and Lightning all attribute their incident root causes to credential…