AI Platform Breaches Mount as Chainstack and WorkOS Disclose Attacks
Summary
A series of attacks on AI developer platforms appears aimed at monetizing stolen AI credentials. Chainstack and WorkOS disclosed separate incidents involving customer information; Chainstack urged customers to rotate potentially exposed node credentials.
Key points
- At least a dozen AI developer platforms were reportedly hit over the past month. The attacks do not appear related, and reported initial access methods varied.
- Attackers appeared to seek stored customer secrets and AI access tokens, with AI agents used to automate or accelerate intrusions.
- Chainstack said attackers accessed a development environment and parts of production on October 26 through a third-party component, including a database with customer account information and password hashes that may have been exposed.
- Chainstack said systems storing node credentials were accessible and prompted customers to rotate those credentials.
- WorkOS said attackers compromised an internal sales application on October 30 and accessed business contact details and summaries of customer communications.
- The article says the Chainstack and WorkOS attacks relied on the Artex open-source AI penetration-testing framework for automation.
Article Details
- Event Type
- Cybersecurity breaches disclosed by AI and developer-platform providers; attackers sought customer secrets and used the open-source AI penetration-testing framework Artex for automation.
- Impact
- Chainstack reported unauthorized access to a development environment and parts of production, including a database containing customer account information; password hashes and node credentials may also have been exposed. WorkOS reported access to an internal sales application and business contact details, customer histories, sales information, communications, and information about customers’ use of its products. The article says attacks across the industry sought monetizable AI access tokens, but does not attribute these specific breaches to a named threat actor.
Threat Actors
Vendors
ChainstackOver the past month, at least a dozen AI developer platforms were hit, with the most recent incidents involving CommandCode, Northflank, Trigger.dev, Chainstack, and WorkOS.NorthflankOver the past month, at least a dozen AI developer platforms were hit, with the most recent incidents involving CommandCode, Northflank, Trigger.dev, Chainstack, and WorkOS.Trigger.devOver the past month, at least a dozen AI developer platforms were hit, with the most recent incidents involving CommandCode, Northflank, Trigger.dev, Chainstack, and WorkOS.WorkOSOver the past month, at least a dozen AI developer platforms were hit, with the most recent incidents involving CommandCode, Northflank, Trigger.dev, Chainstack, and WorkOS.