Northflank discloses secret exposure and AI API-key misuse

What the public record establishes

Northflank publicly warned customers on October 30 to rotate credentials and treat environment variables as decrypted. Its updates that day relayed multiple customer reports of unauthorized AI API-key use. October 30 dates the disclosure, not an established beginning of attacker access. [1][2]

On November 2, Northflank said evidence pointed to control-plane secrets and it had seen no sign that workloads or workload data were accessed. It said dedicated and forward-deployed control planes were unaffected. Independent forensic review continued; the warning to assume exposure did not establish theft of every secret. [1]