Hackers gained unauthorized access to an AWS account used by Braintrust, leading to the compromise of AI provider API keys stored within the platform. These keys enable customers to access AI models, and their exposure potentially affects multiple organizations using Braintrust. Braintrust responded by locking down the compromised account, auditing systems, restricting access, rotating secrets, and notifying customers with remediation instructions. The company has not identified broader exposure beyond a limited number of customers but continues to investigate. Customers are urged to delete or revoke existing AI provider secrets and configure new ones to mitigate risk.

The breach exposed org-level AI provider API keys, which could allow unauthorized use of AI services billed to affected customers. At least one customer was impacted, and others showed suspicious usage patterns. The compromise poses a supply chain risk as the exposed credentials could affect multiple downstream AI service users relying on Braintrust for API key management. However, no broader customer exposure has been confirmed to date.

Braintrust has already locked down the compromised AWS account, rotated internal secrets, and restricted access. Customers are advised to immediately rotate any org-level AI provider API keys stored in Braintrust by deleting or revoking existing secrets and generating new ones. This precautionary step is critical to prevent unauthorized access using potentially exposed credentials. The investigation is ongoing, and customers should follow any further guidance from Braintrust.