NVIDIA says Brev platform breach may have exposed customer SSH keys

NVIDIA has told customers that someone got into its Brev cloud development platform without permission between October 4 and October 20, 2026. ¹²

The company’s notification says the activity may have exposed one thing: the SSH key that Brev provisioned for each customer’s Brev-provisioned virtual machine. ² An SSH key is the credential developers use to log into a remote server, so it is the front-door key to the machine. NVIDIA says it has rotated the keys and pushed replacements to customers’ instances. ²³

What is confirmed, and what is the company’s statement. The unauthorized activity and the potential key exposure come from NVIDIA’s own notice to affected users. The claim that the keys were not misused is also NVIDIA’s: in the notice, the company says it is “unaware of improper use of these keys.” ² That is a statement of what it has found so far, not proof that nothing happened. Someone holding a stolen key could, depending on the machine’s permissions and other controls, potentially control that virtual machine. ³

The company has not said how the attackers got in. It has not said whether customer data or workloads were touched, or whether anyone tried to use the exposed keys. ³ Those are the questions that decide how serious this turns out to be.

What you should do. NVIDIA says it already swapped the keys, so the immediate fix is on its side. Still, if you run Brev instances, a few cheap steps are reasonable. Confirm your instances accept the new key. Look at login history on those machines for October 4 through October 20 and for anything unfamiliar afterward. Rotate any other credentials that were stored on or used from those VMs.

Seen it before: a key was swapped, a log was checked, and an “unaware of misuse” line was issued. It is the standard first draft of a breach notice.

Context. The incident lands amid a run of attacks on AI developer platforms. Security firm Wiz published a report on October 30 calling the month a “Black October” for AI developer services, tracking incidents across at least nine platforms. ²

Our read: Prompt notification and key rotation are the right first moves, and a 16-day window is long enough that the unanswered questions matter. What would change this reading is any word on how the intruders entered and whether the keys were ever used. Until NVIDIA says more, the claim of no misuse rests on NVIDIA’s own review.

Footnotes

1. Tom’s Hardware, “NVIDIA Brev security breach may have exposed SSH keys used to access customer VMs — investigation finds unauthorized activity spanning 16 days, but no evidence of misuse”. Retrieved November 2, 2026. ↩

2. Times of India, “Hackers hit Nvidia’s cloud development platform: What the company said in notification sent to affected customers”. Retrieved November 2, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

3. Mezha, “NVIDIA replaces Brev SSH keys after unauthorized activity; no evidence of key misuse”. Retrieved November 2, 2026. ↩ ↩² ↩³