# Lightning AI takes Studio platform offline after customer credentials compromised · pwn.watch > On Oct 15 2026 at 23:00 UTC Lightning AI identified unauthorized access to credentials on its Lightning Studio platform and revoked all user access two hours later. Lightning believes certain customer credentials were used to reach customer environments and connected third-party services. Studio, Deployments, Pipelines and Drive are affected; GPU cluster rental and managed Kubernetes/SLURM are not. As of Oct 25 the platform is still inaccessible while an external firm investigates. Lightning tells all users to rotate secrets stored in Studios (such as GitHub credentials) and third-party credentials used by their VMs. Page: https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026 · generated 2026-10-25T19:12:56.506Z ## Status - Severity: high · status: live · patch: partial - Product: Lightning AI Studio (hosted ML platform) - Started: 2026-10-15 - Affected: Lightning AI Studio platform services (Studio, Deployments, Pipelines, Drive); secrets, API keys and third-party credentials stored in AI Studios environments ## Follow this incident - RSS (one item per update): https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026.json - This file: https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-25: Platform still inaccessible; status page incident unresolved. Lightning says certain customer credentials were used to reach environments and connected third-party services, identified credentials are revoked, and an external cybersecurity firm is investigating. (https://status.lightning.ai/) - 2026-10-16T20:34Z: Status page changes the 'emergency maintenance' notice to 'Service is down to address a security incident' and links the incident notice. (https://status.lightning.ai/) - 2026-10-16T01:00Z: Lightning AI revokes all user access to the Lightning Platform (Studio, Deployments, Pipelines, Drive); GPU cluster rental and managed Kubernetes/SLURM are not affected. (https://lightning.ai/security-incident/) - 2026-10-15T23:00Z: Lightning AI identifies unauthorized access to credentials on the Lightning Studio platform. (https://lightning.ai/security-incident/) ## Fix brief # Security brief: Lightning AI takes Studio platform offline after customer credentials compromised Source: https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026 · status: live · severity: high · updated Oct 25, 2026, 18:27 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Oct 15 2026 at 23:00 UTC Lightning AI identified unauthorized access to credentials on its Lightning Studio platform and revoked all user access two hours later. Lightning believes certain customer credentials were used to reach customer environments and connected third-party services. Studio, Deployments, Pipelines and Drive are affected; GPU cluster rental and managed Kubernetes/SLURM are not. As of Oct 25 the platform is still inaccessible while an external firm investigates. Lightning tells all users to rotate secrets stored in Studios (such as GitHub credentials) and third-party credentials used by their VMs. Severity detail: Vendor-confirmed credential compromise with access to customer environments and connected services; no CVE - platform incident - Product: Lightning AI Studio (hosted ML platform) ## Affected versions - Lightning AI Studio platform services (Studio, Deployments, Pipelines, Drive); secrets, API keys and third-party credentials stored in AI Studios environments ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you used Lightning AI Studio: rotate every secret, API key and token stored in your Studios (GitHub credentials included), rotate credentials your Lightning VMs used for third-party services, and review those services' access logs from 2026-10-15 onward. Lightning revoked keys tied to cloud accounts used on the platform. ## Latest updates - Oct 25, 2026: Platform still inaccessible; status page incident unresolved. Lightning says certain customer credentials were used to reach environments and connected third-party services, identified credentials are revoked, and an external cybersecurity firm is investigating. - Oct 16, 2026: Lightning AI revokes all user access to the Lightning Platform (Studio, Deployments, Pipelines, Drive); GPU cluster rental and managed Kubernetes/SLURM are not affected. - Oct 16, 2026: Status page changes the 'emergency maintenance' notice to 'Service is down to address a security incident' and links the incident notice. - Oct 15, 2026: Lightning AI identifies unauthorized access to credentials on the Lightning Studio platform. ## Advisories - [October 2026 Security Incident](https://lightning.ai/security-incident/) (Lightning AI) - [Lightning AI Status: Service is down to address a security incident](https://status.lightning.ai/) (Lightning AI) ## Write-ups & news - [Lightning.ai October 2026 Security Incident (discussion)](https://news.ycombinator.com/item?id=50234296) ## Caveats Facts come from Lightning AI's own incident notice and status page. How the credentials were accessed and how many customers are affected are undisclosed; Lightning says affected customers were notified. Kept live/partial while the platform stays offline and the investigation continues. --- Machine-readable: https://pwn.watch/i/lightning-ai-studio-credential-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.