NVIDIA Rotates SSH Keys After Unauthorized Access to Brev AI Cloud Platform
NVIDIA disclosed that unauthorized intrusion activity occurred within its Brev cloud-based AI development platform between October 4 and October 20, 2026. The intrusion potentially exposed SSH keys configured for client virtual machines, which attackers could have used to access customer instances, exfiltrate proprietary source code, model weights, or corporate access tokens. NVIDIA responded by rotating all customer SSH credentials across affected environments, and its internal forensic investigators have found no evidence of active misuse of the exposed keys to date. The company is urging all Brev account holders to audit their VMs for signs of backdoor persistence or unauthorized access.
Detalhes técnicos
Brev is NVIDIA's specialized cloud platform providing GPU instances across third-party hyperscalers with pre-configured CUDA, Python, and Docker environments for AI/ML development. The exposure centers on SSH keys used by developers to administer instances and transfer files, which if compromised could allow direct access to client systems.
Remediação
NVIDIA recommends customers: review authentication logs for unrecognized login origins or anomalous timestamps; inspect the authorized_keys directory for rogue public keys or unauthorized admin accounts; audit active processes, services, and anomalous outbound network connections; and rotate all third-party API credentials, database secrets, and cloud authentication tokens stored on instances. Administrators finding suspicious activity should isolate affected instances, preserve volatile memory and forensic logs, and report findings to NVIDIA support.
Linha do tempo
-
NVIDIA Rotates SSH Keys After Unauthorized Access to Brev AI Cloud Platform
ler a análise desta fonte ocultar
NVIDIA disclosed that unauthorized intrusion activity occurred within its Brev cloud-based AI development platform between October 4 and October 20, 2026. The intrusion potentially exposed SSH keys configured for client virtual machines, which attackers could have used to access customer instances, exfiltrate proprietary source code, model weights, or corporate access tokens. NVIDIA responded by rotating all customer SSH credentials across affected environments, and its internal forensic investigators have found no evidence of active misuse of the exposed keys to date. The company is urging all Brev account holders to audit their VMs for signs of backdoor persistence or unauthorized access.
Technical Details
Brev is NVIDIA's specialized cloud platform providing GPU instances across third-party hyperscalers with pre-configured CUDA, Python, and Docker environments for AI/ML development. The exposure centers on SSH keys used by developers to administer instances and transfer files, which if compromised could allow direct access to client systems.
Remediation
NVIDIA recommends customers: review authentication logs for unrecognized login origins or anomalous timestamps; inspect the
authorized_keysdirectory for rogue public keys or unauthorized admin accounts; audit active processes, services, and anomalous outbound network connections; and rotate all third-party API credentials, database secrets, and cloud authentication tokens stored on instances. Administrators finding suspicious activity should isolate affected instances, preserve volatile memory and forensic logs, and report findings to NVIDIA support.