Attacker got environment variables of some Trigger.dev customers

Trigger.dev is a cloud platform where companies make AI agents and workflows in TypeScript, a programming language. It told of a security incident on Sunday. The company tells that an attacker got access to the environment variables of some organizations without permission. Environment variables are kept values that frequently hold secret keys. Trigger tells that it blocked the exploit and told the customers in the incident what to do.

What happened

Trigger gave only a short report. It did not tell how the attacker got in, how many organizations are in the incident or which ones. A spokesperson can give no more information. The spokesperson told reporters to wait for a full incident report.

Why it is risky

If the variables hold sensitive credentials, an attacker can use connected services. Trigger operates long tasks with automatic retries and many tasks at one time. This can increase the damage from stolen API keys (access codes for a service). Trigger added webhooks for services such as Stripe and Slack, which can increase the range of connected services.

What is not known

No use of the stolen data is reported at this time. Its site names large brands as customers. The company has not told that one of them is in the incident. Trigger is open source and customers can host it, which is possibly an alternative to the hosted service.

Insight: Stolen AI keys are the target across many platforms

Wiz, a cloud firm, reports breaches at 9 or more AI developer platforms from 6 to 30 October 2026. Attackers went for environment variables and tested each stolen key in 30 minutes or less. This reads as a market for stolen AI keys, where the first user of a key wins. A late key change comes after the test.