THE CRUNCH
Trigger.dev, a cloud-hosted platform for building AI agents and workflows in TypeScript, has disclosed a security incident in which an attacker gained unauthorised access to environment variables belonging to a subset of its customer organisations. The company announced the exposure on Sunday, saying its investigation had identified the breach and that affected customers have been notified of steps to take. It has not said how many organisations were affected or which ones.
Environment variables often hold the credentials that connect a service to everything else, so exposed ones can hand an attacker working access to connected services and infrastructure. That risk is sharpened by what Trigger.dev is built to do: it advertises durable execution, meaning it keeps long-running tasks going through crashes and redeployments, with automated retries, elastic scaling and the ability to run many concurrent operations without timeouts. Depending on what the stolen credentials allow, those same features could compound the consequences of a compromise.
The platform's recent addition of webhooks, supporting services such as Stripe, Supabase and Slack, potentially widens the range of integrations whose credentials could be affected. Trigger has not publicly identified the affected organisations, and a company spokesperson declined to give The Register further details, saying instead to wait for a full incident report. The company says whatever exploit was used has been blocked.