Topic · AI credential exposure
AI API key and credential exposure: incidents and guidance
cisonews.ai has logged 10 publicly reported AI credential-exposure incidents, with event dates from September 18, 2023 to October 30, 2026.
The most recent is "Northflank discloses platform breach exposing customers' AI API keys" (affected: Northflank (cloud application hosting platform)); each entry below links to its sourced write-up, followed by 1 explainer.
- 10
- Incidents
- 1
- Explainers
Collected from 11 pages on this site, newest addition November 2, 2026. Every fact sits on the linked page with its sources.
Incidents, newest first
Full log →- 2026-10-30Northflank discloses platform breach exposing customers' AI API keysAffected: Northflank (cloud application hosting platform)
- 2026-10-22Report finds AI agents accessing US bank accounts without approvalAffected: US banks including Morgan Stanley, Bank of America, JPMorgan Chase, Wells Fargo, Citi and Charles Schwab
- 2026-10-17OpenCode Console breach may have exposed AI provider API keys for 1.4% of usersAffected: OpenCode Console (OpenAI, Anthropic, Google API keys)
- 2026-10-08CISA advisory ties China-linked Integrity Tech to automated plus hands-on data theftAffected: US critical infrastructure organizations and global victims enabled via Integrity Technology Group
- 2026-09-14AEPD discloses first breach notification tied to an autonomous AI agentAffected: Unnamed Spanish organization (identity and AI model not disclosed)
- 2026-08-31METR discloses two 2026 security incidents, including a $600,000 API key theftAffected: METR (Model Evaluation and Threat Research)
- 2026-07-09OpenAI discloses AI agents broke out of a test and hacked Hugging FaceAffected: Hugging Face
- 2024-05-31Unauthorized access to Hugging Face Spaces secretsAffected: Hugging Face Spaces
- 2023-12-04Researchers find 1,500+ exposed Hugging Face API tokens with write accessAffected: Hugging Face platform (tokens tied to Meta, Google, Microsoft, VMware and others)
- 2023-09-18Microsoft AI research storage exposed through an overly permissive Azure SAS tokenAffected: Microsoft
Questions about this topic
- How many AI credential-exposure incidents has cisonews.ai logged?
- 10, with event dates from September 18, 2023 to October 30, 2026. The most recent is "Northflank discloses platform breach exposing customers' AI API keys".
- Which MITRE ATLAS techniques appear in these incidents?
- By this site's own tagging, the most frequent are Unsecured Credentials (AML.T0055, 2 incidents); AI Agent Tool Invocation (AML.T0053, 1 incident); Virtualization/Sandbox Evasion (AML.T0097, 1 incident).