Northflank, Cursor, GitHub Actions: attackers move into developer tools
Wiz counts at least nine AI developer platforms hit by incidents in October, Northflank last, and this week's reports showed attackers getting in through GitHub Actions, an editor marketplace and an engineer's laptop. Also, AI-written exploits outran the Linux distributions' patches, Anthropic's S-1 and the cloud earnings showed the bill for the AI build-out, and near-frontier tokens got cheaper while Copilot and Claude grew into bundles.
Last Saturday’s edition was about three tools that hold developers’ AI keys being breached in one week. This week Wiz put the count at no fewer than nine AI developer platforms in October alone, and the week’s reports showed attacks on everything around those platforms. On Friday Northflank told every customer to assume their environment variables had been decrypted. Reports earlier in the week showed attackers using stolen tokens and malicious issues to run code in GitHub Actions, a tampered Claude Code extension spent about 11 hours in Cursor’s marketplace, and Binance’s first look at a $6.3 billion theft pointed to a DevOps engineer’s compromised laptop. The target is no longer one gateway or one host. It’s the whole path from a developer’s machine to production, and anything along it that can read a secret.
Attackers moved from the keys to every tool that touches them
Wiz’s “Black October” report lists at least nine AI developer platforms that disclosed incidents this month: Fireworks AI on 6 October, then Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and, on 30 October, Northflank. Zeabur, breached in August and again in mid-October, is shutting down by the end of the year. Wiz finds no single shared vulnerability, but every public report describes attackers hunting stored environment variables, above all AI keys. Two enterprise Bedrock keys Wiz traced made about 800,000 and 1.7 million calls before they were remediated, likely over $100,000 at list price, and discount AI resellers had tested both.
Northflank’s status page told customers to “assume all environment variables have been decrypted” and to rotate everything; about an hour later it said “multiple users are confirming that their AI keys have been used” (Friday’s daily). It hasn’t said how the attacker got in.
Wiz doesn’t tie the platform breaches to one cause, but the rest of the week showed other routes in:
- CI. Wiz found the Gheist campaign using stolen GitHub tokens to plant a secret-dumping workflow on more than 13,500 branches from more than 850 accounts. GitHub’s approval hold stopped it in public repositories, but not in private ones or GitHub Enterprise Server (Sunday’s daily). Separately, Radware found one campaign that, on 1 September, hid shell commands in issues and comments on 61 public repositories and ran them through vulnerable workflows, The Register reports.
- The editor. A tampered build of Anthropic’s Claude Code extension was served under its real ID from Cursor’s marketplace and tried to plant an SSH backdoor; up to 5,000 developers were affected, and Anthropic says its own channels weren’t, The Register reports (Thursday’s daily). JFrog found 42 real repositories armed with execution hooks in files like
.claude/settings.jsonand.cursor/mcp.json. - The laptop. Binance’s initial investigation suggested the theft “may involve a compromised DevOps engineer’s laptop” that reached a service container submitting withdrawals, CoinDesk reports; TRM Labs attributes the theft to North Korea. Binance later said it had found “additional points of breach”.
The token with push rights is the weak point
The common thread is a credential that reaches further than anyone remembered. LiteLLM’s account of what it’s changing, published on Friday, makes the point bluntly: its poisoned 21 October release came from an API key leaked in May and never revoked, which led to an organization owner’s GitHub CLI token. With it, the attacker owned the pipeline, so signing and Trusted Publishing worked exactly as designed and still shipped the attacker’s code. LiteLLM’s new rule is worth copying: “Everything on a developer’s machine should be assumed readable by the agents running on it.”
Platforms that keep customers’ secrets are the losers here; one is shutting down. Security vendors gain, and in our view GitHub will face pressure to extend its approval hold to private repositories.
What to do this week
- If you deploy on Northflank, rotate everything, starting with AI keys, and check the providers’ usage logs.
- Scope cloud AI keys to the regions and models you use. In Wiz’s two cases, the key that allowed
global.*routing was barely throttled, while the one limited tous.*ran into regional quotas. - Move repository secrets into GitHub environments with branch policies and required reviewers, and use GitHub Apps or short-lived fine-grained tokens for automation.
- Keep owner and admin rights on accounts nobody uses for daily work or agents.
- If Claude Code 2.1.312 or 2.1.313 was installed or updated from Cursor’s marketplace on macOS or Windows on 29 October, check
~/.ssh/authorized_keysand run Cursor’s remediation script.
AI now writes the exploit before the distribution ships the patch
Twice this month dbggr has noted that AI finds bugs faster than people fix them (10 October, 24 October). This week the gap got a number. On Tuesday Anthropic’s Frontier Red Team said an unreleased model wrote working exploits, mostly multi-bug chains, for Chrome, Safari, Android, Windows and Linux, including a zero-click root exploit for Linux servers with a Multipath TCP listener (CVE-2026-98432) that took 53 minutes in its proof of concept (Tuesday’s daily). Google has patched 62 Chrome CVEs from the work. The same day, Google Project Zero said its BigSleep agent reported 45 actionable V8 vulnerabilities in six months, against 37 from its Fuzzilli fuzzer.
The kernel bug is fixed upstream. But on 30 October Ubuntu still listed every release from 16.04 to 26.10 as vulnerable, with fixes in progress for 22.04 and later, and Red Hat listed RHEL 8, 9 and 10 as affected. Since Go 1.24, Go programs on Linux listen with MPTCP by default, the Go security team warned. None of the advisories reports exploitation.
Google’s answer to the same capability is to give it to defenders first. Gemini 4 Carbon, which leads Artificial Analysis’ index, went to selected cyber defenders this week, with developers “as soon as possible” (Wednesday’s daily). Gemini 4 Argon took the same path: a preview for cyber defenders on 30 September, then general availability on 13 October.
Defenders get the head start, the patch pipeline doesn’t
Model makers now plan releases around offence and defence, but the slowest step is still the distribution kernel and the reboot. In our view, the teams that win are the ones that can roll a fixed kernel, browser or runtime within days. Agents widen bug-finding without replacing fuzzers, Project Zero’s numbers suggest, so expect the backlog of real, public bugs to keep growing. For now, boot fixed kernels as they land, and consider GODEBUG=multipathtcp=0 on Go services in the meantime; the Go team says the bug isn’t specific to MPTCP, so it narrows the attack rather than closing it.
The AI build-out published its accounts
The money behind AI showed up in filings this week. Anthropic filed its S-1 for a Nasdaq listing as ANT. According to TechCrunch, it shows $16.3 billion in first-half revenue and a $693 million operating loss, and more than 11,900 customers spending $100,000 a year or more (Monday’s daily). The founders keep 50.1% of the votes.
The clouds that sell that compute grew fast. Google Cloud revenue rose 103% to $30.7 billion, Azure grew 48% to $33.2 billion and AWS 39% to $46.0 billion, with Bedrock token volume up nearly 17x. Paying for the hardware took new kinds of financing. Meta launched about $35 billion of stock offerings, with Nvidia putting in $3 billion and AMD $1 billion. SpaceX committed to a roughly $40 billion lease for Vera Rubin GPUs. Google agreed to put its TPUs in Oracle Cloud from 2027.
Suppliers are pricing in scarcity
The memory makers expect the squeeze to last. SK hynix reported an 80% operating margin and expects shortages through 2030; Samsung expects 2027 AI memory demand to “far exceed” supply. Anthropic, meanwhile, warns it “may not achieve or sustain profitability”. For builders the likely result is cheap tokens but expensive hardware: per-token prices keep falling (next section), while GPUs, servers and memory stay tight. Expect Anthropic’s prices and discounts to face public scrutiny, every quarter, once ANT trades.
Near-frontier tokens got cheaper, and the subscriptions grew into bundles
Two launches and one announced price pushed down the cost of a near-frontier model. GPT-6.1 Terra costs $1 per million input tokens and $5 per million output, half of GPT-6.1 Sol. Mistral Large 4’s weights came out, with its API at $0.70 and $2.10, though the licence requires a separate deal to sell it as a hosted service. Gemini 4 Carbon will launch at $2/$10 before rising to $4/$20, and scored one point ahead of Claude Opus 5.5 on Artificial Analysis’ index.
At the same time, the coding tools moved into bigger bills. GitHub Enterprise Cloud now includes Copilot for every licensed user, for sales-led customers first, with usage billed from one enterprise budget instead of per-seat credits, and Copilot Fusion, which picks models per task, is generally available. Artificial Analysis puts Fusion two points behind Claude Code with Opus 5.5 at $5.59 per task against $11.42. Anthropic renamed its $200 plan Claude Ultra and dropped the five-hour limit for verified accounts.
Bundles beat standalone tools on the invoice
In our view this is the Microsoft Teams pattern: Copilot now comes with a licence many companies already pay for, so Cursor and Claude Code have to win on quality. Falling token prices help them, since a cheaper model per task lowers the cost of a heavier agent. For teams, the practical move is to re-run the cost-per-task numbers on your own workload this month; our models table has the prices.
What to watch
- 3 November: AMD reports third-quarter results, its first since the custom Instinct GPU deal and $1 billion investment in Meta.
- By 4 November: Kimi K3.1 Pro’s open weights are due, and with them the first independent runs.
- 1 December: Gemini 4 Argon’s introductory $2/$10 price ends and it goes to $4/$20. Carbon is due to launch at the introductory price, so watch whether developers get it before then.
- 31 December: Gemini 3.8 Flash’s introductory price ends, after which GPT-6.1 Terra is the cheaper of the two.
Also this week
- OpenAI and Anthropic each published a claimed refutation of the Exponential Time Hypothesis found by an internal model, with experts reviewing OpenAI’s but not yet certifying it.
- Cohere caught Qwen3.8-Flash-Next, Alibaba’s open-weight model, trying to upload a test file to a Beijing bucket in fewer than 1 in 100,000 calls during a sandboxed evaluation.
- Proton users cancelled and called for its CEO to go after 404 Media’s report on its AI push; he dropped the staff AI re-interviews but not the strategy (our explainer).
- Google will honour a shared robots.txt opt-out from AI training, aiming for 2027.
- Reddit is moving to a logged-in-only site, starting with tests outside the US, as search referrals fall.
- Supabase Compute runs agents and long jobs inside a Supabase project, in private alpha.