Loading story…
Braintrust, an AI evaluation startup, confirmed unauthorized access to one of its Amazon Web Services accounts that stored customer secrets and urged all customers to revoke and rotate organization-level AI provider API keys kept on the platform. The company said it detected suspicious activity on May 4, locked down the affected account, restricted access across related systems, rotated internal secrets, and brought in incident response specialists while the root cause remains under investigation.
Braintrust said one customer has been confirmed affected, while three others reported suspicious spikes in AI provider usage that are still being investigated. The company shared indicators of compromise and remediation guidance with customers and said it plans to add controls such as timestamps and user attribution for API key changes. The incident highlights the downstream risk of stolen AI service credentials, which can let attackers consume cloud-based AI models as apparently legitimate users and deepen concerns about AI supply-chain and SaaS exposure.
See attribution, scope, and your downstream exposure.
7 events from the most recent confirmed update back to the earliest known activity.
Braintrust said it had confirmed one affected customer following the breach. It also noted that three additional customers had reported suspicious spikes in AI provider usage that were still under investigation.
Dragos publicly analyzed the January 2026 Monterrey water utility intrusion, concluding that generative AI accelerated reconnaissance and targeting but did not provide novel offensive capability. The report highlighted that segmentation and password hygiene appeared to prevent compromise of the OT interface.
Braintrust disclosed the security incident to customers and advised them to revoke and rotate any organization-level AI provider API keys stored with the platform. The company also shared indicators of compromise and remediation guidance.
After detecting the intrusion, Braintrust locked down the affected AWS account, audited and restricted access across related systems, rotated internal secrets, and engaged incident response experts. The root cause remained under investigation.
Braintrust detected suspicious activity in one of its Amazon Web Services accounts on May 4, 2026. The affected account stored customer secrets, including organization-level AI provider API keys.
During the January 2026 intrusion, the attacker used Claude and ChatGPT to analyze the environment and identify a vNode industrial gateway as a high-value OT-related target. The subsequent password-spraying attempt failed, and the campaign resulted in data theft rather than operational disruption.
In January 2026, an unidentified attacker compromised the enterprise IT environment of Servicios de Agua y Drenaje de Monterrey in Mexico. The intrusion preceded attempts to identify and reach OT-adjacent assets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcegovinfosecurity.com
Open sourcetechcrunch.com
Open source5943619.hs-sites.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers are stealing AI platform API keys and using them to consume paid model services on victims’ accounts, a practice Unit 42 describes as **AI token jacking**. The activity has generated nearly **$1 million in fraudulent charges** before some victims detected the abuse, with malicious infrastructure in some cases driving **tens of millions of API calls per day**. Stolen credentials are being monetized directly and also funneled through gray-market **"transfer stations"** that resell access to legitimate AI services using compromised or discounted accounts. The stolen keys are being obtained through **phishing**, **infostealer malware**, exposed file shares, public code repositories, and poisoned software packages, including self-propagating `npm` packages that can steal credentials and taint later releases. Defenders are being urged to revoke exposed keys immediately, monitor billing and usage for anomalies, enforce spending caps and short-lived tokens, tighten privileged-account controls, restrict network access, and strengthen software supply-chain hygiene; reporting also points to indicators of compromise such as suspicious user-agent strings, malicious IP addresses, and domains linked to transfer-station infrastructure.
Aug 19, 2026
Security research and incident response reporting highlighted how **AI-enabled tactics** are accelerating cloud compromise and expanding the blast radius into ML systems. Sysdig described an incident in which attackers used **exposed credentials in public AWS S3 buckets** to escalate from initial access to **full administrative privileges in under 10 minutes**, then moved laterally across identities, exfiltrated data from multiple AWS services, and **injected malicious code into AWS Lambda**. The activity also included attempts to monetize access by running AI workloads through **Amazon Bedrock** and attempting **GPU hijacking in EC2**, creating potential for significant cloud cost impact; AWS characterized the root cause as **S3 misconfiguration/credential exposure** rather than an AWS infrastructure flaw. Mitiga reported a separate real-world investigation where a threat actor exploited a **path traversal** flaw in an AI-enabled file upload/summarization web application to overwrite production training data in an S3 bucket feeding an automated **SageMaker retraining pipeline**. The poisoned dataset introduced subtle label inconsistencies and a trigger pattern that, after retraining and deployment, enabled the attacker to reliably induce anomalous model behavior with crafted inputs—effectively a persistent **training data poisoning** compromise of a production AI endpoint. In contrast, Kiuwan’s post is primarily a **general advisory** on AI development supply-chain visibility risks (e.g., unvetted dependencies introduced by LLM coding assistants) and does not describe the same specific incidents or provide incident-specific indicators.
Jun 29, 2026
Organizations are facing escalating security exposure from employee and developer use of public AI services without adequate controls. A viral social-media trend prompting ChatGPT to “create a caricature of me and my job based on everything you know about me” is being cited as a visible indicator of **shadow AI** and potential **data leakage**, because users may be sharing work context and sensitive details into non-sanctioned LLM accounts and then posting outputs publicly. The public sharing can also aid **social engineering** by revealing roles, access, and other targeting cues; if an attacker compromises an employee’s LLM account, they may be able to review prompt history for sensitive information. Separately, Cyble Research and Intelligence Labs (CRIL) reported widespread **credential mismanagement** involving OpenAI/ChatGPT API keys, identifying **5,000+ public GitHub repositories** with hardcoded credentials and roughly **3,000 production websites** exposing active keys in client-side assets (e.g., JavaScript). CRIL noted that secrets often persist in commit histories, forks, and archived projects, and that automated scanning/indexing can shrink the time from exposure to abuse to minutes—enabling unauthorized API usage, cost fraud, and potential downstream compromise where those keys are tied into broader application workflows.
Jun 29, 2026