In October, attackers didn't need to break into your tenant to get your keys. They broke into the platforms your developers had given them to. Researchers counted eleven AI and developer platforms breached in 28 days, and the pattern was the same each time: the platform held customers' API keys, cloud credentials and environment variables, and the attacker took them from there.
What happened
The incidents were different in detail and alike in outcome. A few examples from the public disclosures:
- One deployment platform told customers on 30 October to assume every environment variable had been decrypted. The first alert came at 11:43 UTC. By 23:38 the same day, customers were reporting that AI API keys they had stored there were being used by someone else.
- A background-jobs platform disclosed on 1 November that an attacker had accessed environment variables for a subset of organisations.
- An identity platform said on 3 November that an attacker had reached an internal sales application, exposing customer contacts and communications, using an AI-driven penetration testing suite.
- Cloud security researchers described two stolen enterprise AI keys being used for millions of model calls within two days.
The entry points varied: stolen internal credentials, a privilege escalation in build infrastructure, a compromised third-party vendor, long-lived admin tokens in a configuration repository. None of the victims' customers did anything wrong. They had simply stored a secret somewhere that was breached.
Our view: these are suppliers, so manage them like suppliers
Most organisations have a process for a new payroll provider or a new IT partner. Very few have one for a developer signing up to a hosting or AI platform with a company card and pasting in a cloud key. Yet the second can hold more access than the first.
The keys involved are often powerful. An AI provider key can run up a large bill and, depending on the account, read stored prompts and files. A cloud access key or an Entra app secret can reach production data. And unlike a user's password, nobody gets an MFA prompt when one of these is used from a new place.
Three things make it worse:
- Nobody knows the full list. Ask "which platforms hold our secrets?" and the answer usually comes from memory.
- Rotation is slow. When a platform says "rotate everything", teams have to work out what "everything" was. The disclosure above gave customers about two hours' notice before the keys were in use.
- Secrets are long-lived. A key created two years ago for a proof of concept is still valid, still stored in the platform, and still has the permissions it was given on day one.
A routine that works: register, reduce, rotate, watch
Register
Keep a list of every external platform that holds a company credential, what credential, who owns it, and where it was issued. Start with your finance data, because company-card subscriptions are the quickest way to find platforms nobody declared. Our guide to shadow AI covers finding the rest.
Reduce
- Give each platform its own credential, scoped to the least it needs, never a shared admin key.
- Prefer short-lived, federated credentials over stored secrets wherever the platform supports them. In Azure, managed identities and workload identity federation remove the secret entirely for your own workloads.
- Set spending limits and quotas on AI provider keys so a stolen one has a ceiling.
Rotate
Write the runbook before you need it: for each credential on the register, how to revoke it at the issuer, how to issue a new one, and where to update it. When the next platform disclosure lands, the job becomes running the runbook instead of an all-hands search. Rotate at the issuer, not just in the platform. Changing the value stored on a breached platform does nothing to the copy the attacker already has.
Watch
Monitor the issuing side. For Entra app registrations, that means service principal sign-ins from unexpected IP addresses and new credentials added to apps. For AI and cloud providers, it means usage and billing alerts. A key being used from a new place is the earliest signal you will get. We showed how stolen app secrets look in Entra ID in Your Provider Has A Key To Your Tenant.
Put it in the contract too
For platforms that hold anything sensitive, ask the questions you would ask any supplier: how secrets are encrypted and who can decrypt them, how quickly they will tell you about an incident, and whether they support short-lived credentials. The answers don't make a platform safe, but they tell you which ones deserve a stored secret at all.
How Wizard Cyber helps
Our third-party risk management service brings developer and AI platforms into the same assessment process as your other suppliers. Our vCISO service can set the policy and the rotation runbook. And our SOCs, staffed 24/7, watch for the signals above in Microsoft Sentinel, such as an app credential used from an unfamiliar network, so a breach at a supplier is noticed in your logs as well as in their disclosure.
If you'd like help finding out which platforms hold your secrets, talk to our team.