Wiz traces stolen AI credentials to 2.5 million unauthorized Bedrock calls

Credentials exposed through an AI developer platform breach later powered approximately 2.5 million unauthorized Amazon Bedrock requests, according to Wiz Research’s new Black October investigation. Across two enterprise cases, Wiz estimates usage likely exceeded $100,000 at list prices—a measure of how stolen access can turn into substantial consumption on someone else’s account.

Published October 30, the investigation brings together disclosures from at least nine AI developer platforms during October 2026. They include Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. Wiz found no single vulnerability or dependency connecting all the attacks.

From stored secrets to working AI access

Attackers targeted stored environment variables—software settings that can contain credentials for other services. Public incident reports describe attackers searching for these values, especially keys that grant AI access. A breach at a developer tool can thus open the door to an enterprise’s separate AI account.

In both enterprise cases, the keys had previously been heavily used from a compromised vendor’s infrastructure. The first unauthorized activity arrived within 30 minutes of reported credential access there. A residential internet address tested stolen keys across multiple organizations in a one-minute sweep, using a request to invoke an AI model.

The large bursts did not start immediately. For several days, both keys received just 14 to 120 calls daily from the same small software client. Their requests ran about a minute apart. Wiz interprets that synchronized activity as a continuing check that the stolen access still worked.

Permissions shaped the flood

In Case A, attackers checked available models four days after testing the key, then checked usage quotas for Bedrock and EC2. Heavy traffic began 22 seconds later. The key allowed requests to use global cross-region inference profiles, which route traffic across regions. That spread the load; only about 6% of calls were throttled, or limited, Wiz says.

Case B’s key allowed only US cross-region profiles. Seven days after validation, an apparent reseller pool tried global profiles and generated thousands of failures. A later check identified working US model identifiers. A script then inspected quotas using the same version string seen in Case A, and heavy usage followed within minutes.

The regional restriction did cause Case B to hit account quotas: nearly all unsuccessful calls were throttled. But it did not prevent substantial consumption. Wiz says both cases’ usage resembled resold coding-agent traffic, combining many small requests with a long tail of much larger inputs consistent with different end users behind a reseller.

Different entry points, an unresolved resale link

First-party disclosures from two platforms in Wiz’s investigation show why credential exposure should not be mistaken for evidence of one shared exploit:

• Railway’s preliminary report says the attacker may have escalated privileges in its build infrastructure. The attacker later decrypted stored environment variables in some workspaces without logging into individual customer accounts. Railway asked providers to revoke keys that may have been compromised.
• Zeabur’s preliminary report identifies long-lived administrator credentials stored in plaintext and usable from the public internet. It says the October incident used credentials not covered by its August rotation. How the attacker originally obtained those credentials remains unconfirmed.

Recovery also leaves a financial question for customers. Railway says it cannot refund fraudulent AI spending made with compromised keys and directs users to the AI providers. Separately, Wiz’s $100,000-plus figure is an estimate at list prices, not a confirmed tally of bills paid by the two affected enterprises.

Wiz found two apparent AI resale operations whose systems checked the compromised keys. One advertised discounted model access and accepted USDT payments. The findings show access to stolen credentials, but Wiz could not link either operation with certainty to the initial breaches or the heavy use. The investigation reveals a resale path but does not identify who carried out every step.