An exposed AI credential is a sequence of permissions, not one breach number

A key that authorizes an AI service can be exposed while a program is merely starting, deploying or reporting its status. It can then be used from a different machine to consume paid inference long after the original application is no longer under attacker control. But a leaked temporary image-registry token, a stored model API key and a cloud access credential have different privileges. Combining their incidents into a single theft figure obscures the work required to revoke them and establish an actual effect.

At the platform: Northflank instructed customers to rotate environment secrets following a reported platform security incident, and its status disclosures include customer reports of unauthorized AI provider key usage. The public material does not identify one complete path for every affected tenant or prove that every exposed key was actually used.

In verbose deployment output: A LangGraph CLI advisory describes a temporary image push token printed through subprocess logging in verbose mode. The token was limited to an image repository and lasted no more than twelve hours. It was not a general LangSmith administrator secret, and an image push would not automatically become a running deployment when the service used digest-pinned images.

Through a desktop application's local API: Presenton issue reports describe a desktop authentication default and an application-data route from which stored AI provider material could be retrieved in a controlled test. The request-authentication report and file-mount report establish two implementation conditions. They do not show a confirmed mass theft from every operating system.

Wiz's Black October analysis documents two separate customer credentials used for unauthorized Amazon Bedrock requests. The first generated about 800,000 calls in roughly thirty hours, while the second generated about 1.7 million over thirteen hours as the actor adapted to available regional profiles. These are request counts, not unique compromised accounts or a quantified invoice. The reported observations do not establish that either credential came from Northflank, LangGraph or Presenton, and similar model-testing behavior does not by itself identify a common actor.

Rotating a platform secret does not necessarily invalidate a copied provider key until its issuer revokes it. Removing a sensitive line from future logs does not retract a token from past captures. Conversely, the presence of a token in a researcher reproduction cannot be counted as a successful provider compromise. A useful incident report keeps exposure, possession, authorization, use and material impact as separate states.