In Black October, Attackers Skipped the Models and Went After Their Keys.
AI found the bugs first. Attackers went after the keys.
|
FENCIO BRIEF · ISSUE 14
|
In Black October, Attackers Skipped the Models and Went After Their Keys.
|
|
On October 21, AI-assisted researchers got two critical PHP flaws patched before attackers could use them.
The same day, attackers got into LiteLLM and Railway, two places where AI teams keep their keys.
The first story got the headlines. The second one is about your stack.
|
|
THE PATTERN
Willie Sutton is credited with explaining why he robbed banks: because that's where the money is. He later denied ever saying it. The logic outlived the denial.
Black October followed it. LiteLLM sits between apps and their model providers, so it sees every key. Railway stores the environment variables apps run on, which is where keys usually live. Railway said it believes the attack was part of a series aimed at platform companies, with the goal of compromising AI inference providers.
Last week, we wrote about agents walking in with valid keys. This week, someone went looking for the key rack.
None of these attacks touched a model. They hit the plumbing around it, which is where the trust sits.
|
|
BLACK OCTOBER, DAY BY DAY
| OCT 17 |
OpenCode. Stored AI provider keys were exposed for 1.4% of Console users. Some reported more than $1,700 in overnight charges. |
| OCT 17 |
eMudhra. A researcher showed that keys for eight of the Indian CA's intermediate certificates had too little randomness to be safe. Chrome and Firefox blocked them. |
| OCT 21 |
PHP2Shell. Two unauthenticated RCE flaws in PHP's core, found with AI help, were demonstrated against WordPress, Drupal and Joomla. The NSA urged immediate patching. |
| OCT 21 |
LiteLLM. A credential-stealing release went out on PyPI and Docker Hub. |
| OCT 21 |
Railway. Encrypted environment variables were accessed, and some were decrypted. Every customer was told to rotate everything. |
| OCT 21 |
GitLab. A CVSS 10.0 flaw in self-managed instances was patched. |
| OCT 22 |
eMudhra exited the global SSL/TLS certificate business. |
|
|
THIS WEEK'S FINDING
Everything passed through it
A trusted AI gateway shipped a credential stealer for 104 minutes.
| CAUSE |
Attackers obtained developer credentials and altered the release workflow |
| TASK GIVEN |
Route an app's requests to its LLM providers |
| ACTUALLY EXECUTED |
Version 1.107.0 harvested browser credentials, cloud secrets, developer tokens and AI API keys |
| WHAT CHANGED |
The component trusted with every key became the fastest way to lose them |
|
|
|
🔐 YOUR TURN
Do you know every key your agents can reach?
Point Fencio at your own agent and see what its access actually adds up to. If Black October showed anything, it's that someone else will map it eventually.
Test your agent →
|
|
|
THE SANDBOX
Our community for people who build, break, and defend AI agents. Members share what their agents actually did, findings like these included, before they make it into the Brief.
Join The Sandbox →
|
|
|
That's this week. Reply and tell us: how many keys did your team rotate this month?
|
|
