Lightning AI takes Studio platform offline after customer credentials compromised
Lightning AI Studio (hosted ML platform)
On Oct 15 2026 at 23:00 UTC Lightning AI identified unauthorized access to credentials on its Lightning Studio platform and revoked all user access two hours later. Lightning believes certain customer credentials were used to reach customer environments and connected third-party services. Studio, Deployments, Pipelines and Drive are affected; GPU cluster rental and managed Kubernetes/SLURM are not. As of Oct 25 the platform is still inaccessible while an external firm investigates. Lightning tells all users to rotate secrets stored in Studios (such as GitHub credentials) and third-party credentials used by their VMs.
Why this severity: Vendor-confirmed credential compromise with access to customer environments and connected services; no CVE - platform incident
- Started
- Oct 15, 2026
Affected
- Lightning AI Studio platform services (Studio, Deployments, Pipelines, Drive); secrets, API keys and third-party credentials stored in AI Studios environments
Fixed in
No fixed release yet
Timeline4
Platform still inaccessible; status page incident unresolved. Lightning says certain customer credentials were used to reach environments and connected third-party services, identified credentials are revoked, and an external cybersecurity firm is investigating.
Lightning AI revokes all user access to the Lightning Platform (Studio, Deployments, Pipelines, Drive); GPU cluster rental and managed Kubernetes/SLURM are not affected.
Status page changes the 'emergency maintenance' notice to 'Service is down to address a security incident' and links the incident notice.
Lightning AI identifies unauthorized access to credentials on the Lightning Studio platform.
Advisories2
Posts1
@GeorgeFounwg7a The Lightning Studio platform is currently down for emergency maintenance - we will keep you updated as we bring services online. Apologies for the inconvenience. t.co/0uZLS9BUDd Read more about it here: t.co/fMQXF2gKio
Notes & caveats
Facts come from Lightning AI's own incident notice and status page. How the credentials were accessed and how many customers are affected are undisclosed; Lightning says affected customers were notified. Kept live/partial while the platform stays offline and the investigation continues.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
