AI evaluation startup Braintrust disclosed a security breach affecting its Amazon cloud environment. The company is instructing all customers to immediately rotate their API keys.
Braintrust, which provides infrastructure for engineers building AI software, notified its customer base of unauthorized access to one of its cloud systems hosted on Amazon Web Services.
The startup has not disclosed the full scope of the breach or what data may have been accessed. However, the decision to mandate API key rotation across its entire customer base suggests the attackers gained access to sensitive authentication credentials.
API keys are critical authentication tokens that allow applications and users to access cloud services and APIs. Rotating these keys—essentially replacing old credentials with new ones—is a standard security practice to prevent unauthorized access if credentials are compromised.
Braintrust's breach comes amid increased scrutiny of AI company security practices. Startups in the space handle sensitive model data and customer information, making them attractive targets for attackers seeking to steal proprietary AI systems or access credentials.
The company has not disclosed when the breach occurred, how long attackers maintained access, or whether customer data beyond API keys was compromised. Details about the investigation and remediation efforts remain limited.
Customers using Braintrust's platform have been advised to prioritize API key rotation. The company has likely provided instructions for generating new credentials and updating their systems accordingly.
This incident underscores the security challenges facing emerging AI infrastructure companies. As these startups become more central to AI development workflows, they also become higher-value targets for cyber attacks.
Braintrust has not released a detailed incident report or timeline. Further details about the breach's extent and impact may emerge as the company completes its investigation.
Authorities have arrested two alleged members of TeamPCP, a hacking group responsible for infecting over 1,000 organizations through supply-chain attacks.
A Georgia police officer used Flock surveillance technology to track the movements of his ex-partner and another officer after their affair ended, according to internal investigation records.
McKesson, a major healthcare and pharmaceutical distributor, confirmed a cybersecurity incident involving unauthorized access to third-party applications. Extortion group ShinyHunters claims responsibility for stealing 284 million patient data records.
Fraudsters are exploiting Microsoft Teams and similar enterprise chat apps to deceive Chinese users into sending large sums of money. The trend has sparked a wave of complaints across the region.