UK domain registrar 123 Reg, a GoDaddy company, began telling customers this week(opens in a new tab) that an intrusion on September 18 was what it calls its first known AI-driven cyberattack. The attacker read names, phone numbers, VAT numbers and account product data. The company says it found AI attack skills on Chinese infrastructure, including copies of skills Anthropic published openly, and it suspects the same actor that used the agentic pentest tool ARTEX against South Korean financial firms. Notice reached customers about forty days after the intrusion.
The same month, the plumbing that holds AI credentials broke twice. LiteLLM, the open-source gateway many companies use to route calls across model providers, shipped a backdoored release on October 21(opens in a new tab). The root cause was a master key committed to a public repository on May 27 and never revoked. In October an attacker used it to take a token tied to the GitHub organization owner, pull the project's own Anthropic, OpenAI and AWS keys, and publish a version that stole credentials from the machines that installed it. The same week, deploy platform Railway told its 4.8 million users to rotate every secret(opens in a new tab), saying the attack was part of a series aimed at AI inference providers.
Read together, these are not stories about clever new attacks. They are stories about old keys sitting in places nobody listed. A model key is no longer a developer setting. On metered pricing it is a line of credit, and a stolen one bills you, leaks your prompts, or both. Agentic tooling lowers the cost of finding and using a forgotten key, so the gap between a leak and its exploitation is shrinking.
The ROAI question is cost and blast radius. Every gateway, coding agent, deploy platform and notebook that stores a provider key is a vendor holding a spending instrument on your account. Few of them went through procurement as one.
For the CISO and the CAIO this week. Build one inventory of every system holding a model provider key. Replace shared production keys with scoped keys that carry a spending cap and an owner. Set a rotation clock, and add usage anomaly alerts at the provider. And ask each AI tooling vendor how fast it would tell you about a breach, because forty days is now on the record.
Action items
A registrar disclosed an AI-driven attack on customer data, and an AI gateway and a deploy platform both lost customer credentials in October. The common thread is model provider keys stored in places nobody inventoried, now cheaper than ever for attackers to find and use.
For the CAIO
Inventory every system that holds a model key, give each one a scoped key with a spending cap and an owner, and ask your AI tooling vendors how fast they disclose.
Researched and drafted by an automated workflow, then reviewed and edited by a human editor before publication. Every source is linked. See how we use AI here.
Also worth knowing
- The Register123 Reg discloses 'AI cyberattack' on customer data, suspects China nexus(opens in a new tab)
A mainstream registrar, not an AI company, says an AI-driven attacker read customer records, and notice came about forty days later. Ask your vendors whether their incident playbooks now cover agentic attackers and how fast they notify.
- The Hacker NewsLeaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline(opens in a new tab)
A key leaked in May and never revoked became a backdoored gateway release in October that stole model provider and cloud credentials. If you ran version 1.107.0, rotate every key it could reach, not just the gateway's.
- BleepingComputerRailway warns devs to rotate secrets after potential breach(opens in a new tab)
An attacker may have decrypted customer environment variables on a platform with 4.8 million users, in a campaign Railway ties to AI inference providers. Shadow deployments on hobby platforms often hold production model keys.
- FortuneMicrosoft's cloud growth accelerates, and so too does the spending(opens in a new tab)
Azure grew 48% and quarterly capex hit $45.2 billion, below forecasts because third-party capacity arrived late. Microsoft is still racing to bring capacity online, so do not expect AI capacity pricing to soften in your next renewal.
- The Motley FoolServiceNow (NOW) Q3 2026 Earnings Call Transcript(opens in a new tab)
ServiceNow says internal AI now yields over $1 billion in annualized value, much of it as hiring it no longer needs: sales operations is down while quota-bearing staff grew. Count avoided hires, not just cuts, in your own AI business case.