THE CRUNCH
NVIDIA has told customers of a security incident on its Brev cloud development platform in which some accounts may have been exposed. According to a notification sent to affected users, the company identified unauthorized activity between 4 and 20 October and said information stored on the platform, including the SSH keys set up by Brev, may have been exposed to malicious actors. SSH keys are credentials used to open secure connections to remote virtual machines, so someone holding them could potentially take control of a customer's instance, depending on its permissions and other security controls.
NVIDIA says it has already rotated the affected SSH keys and updated customer machines with replacements, and that its investigation found no evidence of improper use. "This SSH key has since been rotated, and your instances have been updated with the replacement key," the notification reads.
The company has not explained how attackers gained access, whether anyone attempted to use the exposed data, or whether customer data or workloads were accessed. That leaves open questions even though the immediate remediation is complete.
The incident fits a wider pattern. On 30 October, cybersecurity firm Wiz published research calling October a 'Black October' for AI developer platforms, identifying at least nine platforms with security incidents during the month, including Zeabur, Fireworks AI, Lightning AI and Warp. Wiz said the reports showed attackers explicitly hunting stored environment variables, particularly those granting AI access, and documented two cases where compromised Amazon Bedrock credentials were used to generate hundreds of thousands to over a million API calls, costing about $100,000 at list prices combined.