THE CRUNCH
At least a dozen AI developer platforms have been breached over the past month, with attackers mainly hunting stored customer secrets and AI access tokens they can resell, SecurityWeek reports. The most recent incidents involve CommandCode, Northflank, Trigger.dev, Chainstack and WorkOS. Companies hit in the broader wave include Andromeda, Brev (NVIDIA), Fireworks AI, Lightning AI, OpenCode, Railway, Warp and Zeabur. The attacks are not believed to be related, and entry routes vary from compromised credentials to third-party dependencies and vulnerability exploitation.
Chainstack disclosed an attack on October 26 in which intruders reached a development environment and parts of production through a third-party component. A database with customer account information was accessed, potentially exposing organisation and member names, email addresses and password hashes. Node credentials may also have been exposed, and the company asked customers to rotate them.
WorkOS said hackers compromised an internal sales-team application on October 30, accessing business contact details and summaries of customer communications, including names, emails, phone numbers, job titles, account histories and product usage information.
Both Chainstack and WorkOS said their attackers used Artex, an open source AI penetration testing framework, to automate the intrusions. Multiple companies have linked Artex to Storm-0940, a Chinese hacking group attributed with a recent campaign against ConnectWise customers.