AI evaluation startup Braintrust disclosed a security breach affecting its Amazon cloud environment. The company is instructing all customers to immediately rotate their API keys.
Braintrust, which provides infrastructure for engineers building AI software, notified its customer base of unauthorized access to one of its cloud systems hosted on Amazon Web Services.
The startup has not disclosed the full scope of the breach or what data may have been accessed. However, the decision to mandate API key rotation across its entire customer base suggests the attackers gained access to sensitive authentication credentials.
API keys are critical authentication tokens that allow applications and users to access cloud services and APIs. Rotating these keys—essentially replacing old credentials with new ones—is a standard security practice to prevent unauthorized access if credentials are compromised.
Braintrust's breach comes amid increased scrutiny of AI company security practices. Startups in the space handle sensitive model data and customer information, making them attractive targets for attackers seeking to steal proprietary AI systems or access credentials.
The company has not disclosed when the breach occurred, how long attackers maintained access, or whether customer data beyond API keys was compromised. Details about the investigation and remediation efforts remain limited.
Customers using Braintrust's platform have been advised to prioritize API key rotation. The company has likely provided instructions for generating new credentials and updating their systems accordingly.
This incident underscores the security challenges facing emerging AI infrastructure companies. As these startups become more central to AI development workflows, they also become higher-value targets for cyber attacks.
Braintrust has not released a detailed incident report or timeline. Further details about the breach's extent and impact may emerge as the company completes its investigation.
Visa is enabling expired payment cards to continue processing contactless transactions through a new feature. The move allows cardholders to keep using their old cards for tap-to-pay purchases even after expiration.
A Texas-based student discovered and reported an unauthorized AI system being used for cyberattacks. The disclosure prompted immediate investigation and security responses from affected organizations.
A supply-chain attack is exploiting legitimate device-update apps to infect Android-based car head units with malware. The compromised devices are being enlisted into proxy botnets or used for ad fraud schemes.
Apollo Global Management disclosed a data breach in July resulting from a social engineering attack that exposed personal information. The incident joins a recent wave of cyberattacks targeting major hedge funds.