#secrets

AI workflow platform Trigger.dev disclosed on November 1 that an attacker gained unauthorized access to environment variables for a subset of organizations. It says the exploit is blocked and affected owners were emailed, but has not said how it happened or how many customers were hit.

Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organizations including MSP clients, searching mail and downloading files. No Microsoft vulnerability is involved.

A symlink flaw in the Docker Sandboxes copy command, CVE-2026-103916, let an AI coding agent inside the sandbox read or write host files outside its allowlist, such as cloud credentials and SSH keys, when the operator ran a copy. Docker fixed it in v0.51.0 on November 3.

Google Threat Intelligence Group and Mandiant say LLMjacking intrusions ran up more than $100,000 in fraudulent AI charges in a day and $1 million in total at some organizations. The usual way in was a stolen service account key, access key, GitHub token or session token.

After a Wiz alert on October 30, cloud platform Northflank told customers to assume all environment variables were decrypted and rotate every key. Customers then reported unauthorized use of AI API keys stored on the platform. Wiz counts nine AI developer platform incidents in October.

A researcher scanned 7.25 million public repositories on Gitee, China's largest Git platform, and found 26,400 unique credentials that still worked, led by Alibaba Cloud access keys. One was an active organization-admin credential for a major enterprise AI platform.

Cequence's CQ Prime research team said on October 28 that a single actor rotated through about 32 claimed AI crawler and assistant identities, from OpenAI to Perplexity, to request .env files, cloud credential files and private SSH keys. On one day it reached 48% of monitored organizations that saw AI bot traffic.

At TechXchange 2026 on October 27, IBM made Agent Identity and HashiCorp Vault 2.2 generally available. Agent Identity records each AI agent's owner, lifecycle and granted authority, while Vault gives agents their own accounts, renews their credentials and revokes them on unauthorized actions.

Infisical announced a $40 million Series B on October 27 at a $600 million valuation, led by Elad Gil. The open-source secrets company says it will invest in secrets, certificate and privileged access management and in Agent Vault, which brokers AI agent access without exposing credentials.

Wiz reported on October 25 that the Gheist campaign used stolen GitHub tokens from infostealer logs and past supply-chain leaks to plant more than 13,500 ci-sync branches across 850+ accounts, printing every repository secret into Actions logs in base32 and deleting the runs.

LiteLLM's October 23 attack-chain report says an Agent Platform admin key committed to a public repo on May 27 was deleted but never revoked. On October 10 it returned a GitHub org owner's unscoped CLI OAuth token, which led to stolen maintainer tokens and the 1.107.0 release.

Railway's October 22 preliminary report says an attacker pulled encrypted customer environment variables, obtained CI credentials to decrypt a subset, and hunted for AI provider keys. At most 1.85% of workspaces, about 100,000, may be affected; all Railway API tokens were revoked.

LiteLLM said on October 21 that attackers published a malicious litellm 1.107.0 to PyPI, Docker Hub and GHCR, built from a lookalike Berri-AI/litellm repository. The package stole credentials and installed a backdoor; Wiz saw stolen AWS role credentials tested hours later.

Zeabur says an attacker used a shared-cluster admin token created in January 2024 with no expiry, plus internal AWS keys, all stored in plaintext in a private config repo, to read 3.2 million environment-variable records. The developer hosting platform will close by December 31, 2026.

OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed OpenAI, Anthropic and Google keys that 1.4% of OpenCode Console users had saved. Keys stored locally by the CLI and desktop apps were not affected. Some users report unexplained charges.

A worm that wipes your home directory when you revoke its stolen token, about 1,900 hijacked GitHub accounts, a publishing trust bound to a reclaimable name, and two coding agents talked into handing over credentials. In October 2026 the credentials that mattered were publishing tokens, CI secrets and agent roles, not user passwords.

GitGuardian counts more than 30,000 repositories and about 1,900 compromised GitHub accounts in GhostAction's October wave, which committed workflows that dump Actions secrets and scan git history for credentials. Some victims were hit in 2025 and never rotated.

Adversa AI showed GitHub Copilot CLI in autopilot mode reading a local .env.prod file and sending its contents to an attacker URL after fetching a page with encrypted instructions. GitHub validated the report but does not consider it a vulnerability.

CVE-2026-20316 is a low-privileged account with credentials hardcoded into Cisco Secure Firewall Management Center, giving unauthenticated remote attackers access to sensitive system data. CISA confirmed active exploitation and gave federal agencies until August 1 to patch.

Firmware security firm Lava found that 67 percent of 36,872 internet-exposed Baseboard Management Controllers hand over IPMI authentication hashes before a login attempt even completes, and over 30 percent crack in minutes against common wordlists.

844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian alerts went unanswered before a researcher reached a journalist instead.

Agents hold no secrets and get no standing privilege. Every action is authorised at the moment it happens, and the audit trail links the originating prompt to the policy decision and the executed command.