Security Monitor 2026-10-31 - Weekend Edition

Informational security guidance for awareness and prioritization. Not certification, legal advice, or a guarantee of protection.

Executive Summary

Today's theme is that AI keys are now worth stealing at scale. Northflank, a cloud platform for apps and AI workloads, told every customer on Friday to assume their environment variables had been decrypted, and within hours customers were reporting that the AI API keys they'd stored there were being used by someone else. Wiz says Northflank is the ninth AI developer platform to disclose an incident this month, and in two cases it traced, stolen enterprise keys made about 2.5 million Amazon Bedrock calls, likely more than $100,000 at list price, through what looks like a resale market for model access.

New CVEs in four tools people use to serve and run models show where the next keys and footholds come from: LMDeploy's model server runs pickled data from anyone who can reach it and still has no fixed release, a crafted LM Studio model can plant code that runs on every launch, an open-source Okta admin agent let whoever reached it first create its only admin account, and an Agno agent tool can be steered into running code through prompt injection. Researchers at Parameter also showed that one shared ChatGPT link could run code in the victim's signed-in session, which OpenAI fixed on October 26th, and Chainalysis disclosed an intrusion it says used "offensive agentic techniques." There are no new KEV additions today, but three KEV deadlines land this weekend and Monday.

Headline Developments

1. Northflank breach leads to AI API key abuse; Wiz counts nine AI developer platform incidents in October HIGH

Source: Northflank Status: Security incident (October 30th, updated October 31st). Also Wiz: "Black October" for AI Developer Platforms (October 30th).
- Northflank's incident timeline starts with a Wiz threat alert at 7:43 AM ET on October 30th. Northflank told customers to rotate their environment variables at 9:40 AM ET, and 18 minutes later to "assume all environment variables have been decrypted." Its guidance covers secrets on workloads, secret groups and global secrets, and it recommends turning off public access to database addons. It has since turned on secret rotation for its Postgres, MongoDB, MySQL, Redis, Minio and RabbitMQ addons and audit logs for all customers. It hasn't said how the attacker got in, and the incident was still open on Saturday.
- At 7:38 PM ET Friday, Northflank said users had reported unauthorized use of AI API keys stored on the platform. It told customers to revoke those keys with the provider that issued them, not just change them in Northflank, and to check provider usage and billing logs.
- Wiz lists nine AI developer platforms that disclosed incidents this month: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp, CommandCode and Northflank. It says there's no single vulnerability linking them, but every public report describes attackers hunting stored environment variables, especially ones that grant AI access, and several platforms describe "agent swarm" activity or attempts at model distillation.
- In two enterprise cases Wiz traced to one of these vendor breaches, the first use of a stolen key came within 30 minutes of the reported credential access. After days of low-volume validity checks, one key made about 800,000 Bedrock calls in 30 hours and the other about 1.7 million in 13 hours, mostly to Claude models. Wiz links infrastructure that tested the keys to two sites that openly resell discounted model access, though it says it can't tie them to the original breaches. Treat Wiz's cost estimate as a vendor figure.

Why this matters: It's HIGH because a platform that holds your environment variables holds every provider key in them, and a stolen model key turns into cash within minutes through resale. Rotating the copy on the platform doesn't stop abuse. The key has to be revoked at the provider. Per-key spend caps and alerts on new source addresses or unfamiliar models are what limit the bill when, not if, a hosting vendor leaks.

2. Model servers and AI agents have critical bugs: LMDeploy, LM Studio, an Okta admin agent and Agno HIGH

Source: VulnCheck: LMDeploy 0.9.0 through 0.18.0 Unauthenticated RCE via /update_weights Pickle Deserialization (October 30th). Also VulnCheck: LM Studio before 0.4.22+1 Path Traversal via Model Downloader (October 30th), GitHub: TAKO AI Agent for Okta advisory GHSA-536w-42p8-3qv9 and NVD: CVE-2026-119050 (October 29th).
- LMDeploy (CVE-2026-119706): in InternLM's LLM serving toolkit, versions 0.9.0 through 0.18.0, the api_server's /update_weights endpoint decodes a base64 pickle from the request and loads it with no validation, so anyone who can reach the server can run OS commands as the server process. VulnCheck's CNA scores it CVSS 3.1 9.8 (4.0 9.3). The fix, pull request #4964, which makes the HTTP endpoint reject pickle, was still open on Saturday, and 0.18.0 is the newest release, so there's no fixed version yet.
- LM Studio (CVE-2026-119979): before 0.4.22+1, the desktop app's model downloader accepted backslash-separated traversal filenames, so a crafted model repository could write files outside the models folder. VulnCheck says that's enough to plant a plugin manifest and MCP bridge config that run the attacker's Python every time LM Studio starts. The user has to download the model. It's scored CVSS 4.0 8.7, credited to Ariel Fogel of Pillar Security and fixed in 0.4.22+1.
- TAKO AI Agent for Okta (CVE-2026-63377, CVE-2026-63378): in this open-source, third-party natural-language agent for Okta admins, before 3.0.1-beta, an unauthenticated POST /api/auth/setup let anyone who reached the server first create its only administrator account (CVSS 3.1 9.8). A second bug let any signed-in user run arbitrary Python that skipped the agent's AI-based content filter and slipped past its code checks, running as root in the default container (8.8). The fixes shipped on June 30th, but the CVE records only appeared on October 30th, so scanners that rely on CVE feeds had nothing to flag for four months.
- Agno (CVE-2026-119050): in the Agno agent framework through 3.1.11, PandasTools looks up the pandas function the model names, with no allowlist, so prompt injection can make the agent call pandas.read_pickle on an attacker's file for code execution, or call other readers to pull local files. VulnCheck's CNA scores it CVSS 3.1 8.1 (4.0 9.2). NVD names no fixed version and the Agno issue was still open on Saturday.
- None of these four has reported exploitation, and none is on KEV.

Why this matters: It's HIGH because model servers and admin agents sit next to GPUs, model weights and identity provider tokens, and three of these four need no more than network reach or a poisoned input. Pickle in an API request is code, a model repository is an installer, and a first-run setup page is an open door until someone claims it. Keep inference and agent admin ports off shared networks, and don't wait for a CVE feed to tell you a small AI project shipped a security fix.

3. A shared ChatGPT link could run code in the victim's session; OpenAI fixed it October 26th MEDIUM

Source: Parameter: Do the Math: How We Took Over ChatGPT Accounts (October 28th). Also The Hacker News: A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats (October 31st).
- Parameter says a public ChatGPT share could carry JavaScript that ran as chatgpt.com in the signed-in session of whoever opened it. In its proof between test accounts, the code listed the victim's recent conversations, read a private chat that had never been shared and sent part of it to Parameter's server, all through ChatGPT's own authenticated APIs.
- The Preview sandbox held. The way out was a second feature in the same conversation: an interactive graph loaded the MathLive library into the main page, and its keyboard listener accepted messages from any sender, including raw HTML. That HTML built an unsandboxed frame that inherited the chatgpt.com identity, and a YouTube endpoint that ChatGPT's content security policy allowed supplied the script.
- In the most reliable version the victim opened the link and clicked Preview once; a later version needed only the click on the link. Parameter reported it on October 18th, OpenAI raised it to P1 and both web frontends rejected the messages by October 26th. Parameter reports no real-world use, and users don't need to do anything.

Why this matters: It's MEDIUM because it's fixed server-side and wasn't seen in the wild, but it's a clear lesson for anyone building AI chat products with previews or plugins. A sandbox is only as strong as every component in the parent page that will take a message from it. Check both the sender's origin and the exact window on every postMessage handler, never accept HTML across frames, and treat a shared conversation as untrusted input.

4. Chainalysis discloses an intrusion it says used "offensive agentic techniques" MEDIUM

Source: Chainalysis: Chainalysis Security Incident Information (October 30th).
- The blockchain analytics firm says it detected an external actor this month "using offensive agentic techniques to gain unauthorized access to Chainalysis systems and internal tools." It says user IDs, full names, email addresses and organization role labels for platform users were accessed, and it's still working out which records belong to each customer.
- Chainalysis says it has found no sign that investigation content, transaction or query results, clear-text passwords, MFA secrets or session tokens were accessed. It's patching the exploited vulnerabilities, working with outside responders and using large language models in a broader review. It says the incident isn't related to the recent Binance theft.
- Chainalysis hasn't named the vulnerabilities, the tools that were reached, how long the actor had access or what made the activity "agentic." Treat that label as the company's own description.

Why this matters: It's MEDIUM because the data taken is contact and role data, but it's exactly what's needed for targeted phishing and fake "fund recovery" pitches against investigators and compliance teams. Chainalysis asks users to turn on two-factor authentication and watch for unexpected password resets and sign-in prompts. More companies are now describing intrusions as AI-driven, so ask your own vendors what an "agentic" attack changed in their detection and response.

Continuity Footnotes

Malicious Anthropic.claude-code 2.1.312 / 2.1.313 in Cursor's marketplace: covered October 30th. New today: Microsoft's analysis confirms the builds were never published to the Visual Studio Marketplace or npm, adds a Linux @reboot crontab persistence path, names the com.apple.sysmond.plist LaunchAgent and the .stk_ tunnel key files, and notes the payload sent up to 40 environment variable names (not their values). It also publishes hunting queries and the attacker's server address (Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor). Cursor's notice hasn't changed since its October 30th update.
KEV deadlines this weekend: Linux kernel CVE-2026-46300 (Fragnesia) is due today, October 31st; GitLab CVE-2026-97229 and Cisco ASA / FTD CVE-2026-76418 are due Sunday, November 1st; Ivanti Connect Secure CVE-2026-111357 is due Monday, November 2nd (covered October 28th to 30th). CISA hasn't added anything to KEV since October 30th.

Pattern Analysis

AI keys are a commodity now (October 6th to 31st): nine AI developer platforms, stolen environment variables and resale sites selling discounted model access (Story 1). If a key can call a frontier model, someone will try to sell it.
AI tooling ships at hobby speed with production access (October 29th to 31st): model servers, desktop model runners, identity admin agents and agent frameworks (Story 2), plus the Cursor marketplace extension (footnote). Small projects hold big credentials, and their fixes often land before their CVEs.
The feature next to the sandbox is the hole (October 28th to 31st): a math keyboard listener in ChatGPT (Story 3) and a pandas reader picked by the model (Story 2). Isolation has to hold across every bridge, not just inside the box.

Recommended Actions

Immediate (this weekend):
1. Northflank customers: revoke every key and secret you stored there at the issuing provider, create new ones, update workloads, turn off public addon access and review AI provider usage and billing since early October. Do the same for any platform on Wiz's list that you use.
2. LMDeploy: keep api_server off untrusted networks and block /update_weights at a proxy or firewall until a fixed release ships.
3. KEV deadlines: finish Fragnesia today, GitLab and Cisco ASA / FTD by Sunday and Ivanti Connect Secure by Monday.

This week:
4. LM Studio: update to 0.4.22+1 or later and only download models from publishers you trust.
5. TAKO AI Agent for Okta: upgrade to the latest release. If an instance ran 3.0.0-beta or earlier on a reachable port, check for an admin account you didn't create, and if you find one, treat the instance as compromised and rotate its Okta API tokens.
6. Agno PandasTools: disable the tool for agents that read untrusted content until the issue is fixed.
7. Cursor users: run Microsoft's hunting queries alongside Cursor's checks, including the Linux crontab path.

Ongoing:
8. Set per-key spend caps and alerts on model provider keys, restrict which models and regions each key can call, and keep keys out of plain environment variables on third-party platforms where a secrets manager is available.
9. Track release notes, not just CVE feeds, for the small AI projects in your stack.

Relevant Risk Summary

Risk	Severity	Recommended Actions
Northflank breach and AI API key abuse; nine AI developer platform incidents in October	HIGH	Revoke keys at the provider; review billing; set spend caps
LMDeploy CVE-2026-119706 (9.8, no fix); LM Studio CVE-2026-119979; TAKO CVE-2026-63377 / 63378; Agno CVE-2026-119050	HIGH	Block `/update_weights`; update LM Studio and TAKO; disable PandasTools
ChatGPT shared-link account takeover (fixed October 26th)	MEDIUM	No user action; check `postMessage` origin and source in your own apps
Chainalysis "offensive agentic" intrusion, customer contact data accessed	MEDIUM	Turn on 2FA; watch for targeted phishing
Fragnesia CVE-2026-46300 (KEV, due Oct 31); GitLab CVE-2026-97229 and Cisco CVE-2026-76418 (KEV, due Nov 1); Ivanti CVE-2026-111357 (KEV, due Nov 2)	CRITICAL	Finish patching before the deadlines

Sources

Informational security guidance. Not certification.