Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env vars
Tensorlake (AI sandbox platform)
Sponsored
Brought to you byTinkerer Club
The private club for people who own their servers, run their own AI, and pay $0/month for software.
On Nov 8 2026 Tensorlake founder Diptanu Choudhury disclosed a security incident. He said an application running on an upstream provider spun up sandboxes in Tensorlake engineering-team accounts that had access to the company’s GitHub repositories; an attacker pushed malicious code to branches and triggered GitHub Actions to probe for secrets those workflows can access. The first published version of the post named the provider as Railway; later edits of the same post say “an upstream provider” and add that the provider had a security breach a couple of weeks earlier that exposed environment variables, that Tensorlake had not rotated those env vars because the application was not critical for production, and that this was an oversight. He said there was no impact to customer information such as API keys or sandboxes, that Tensorlake has no evidence any critical systems were accessed beyond probing for secrets, that it has rotated all secrets and undeployed the internal application, and that paying customers have been notified by email. Out of abundant caution he asked customers to rotate Tensorlake API keys. Further details are promised by email and on Tensorlake’s trust center. This is separate from the October 2026 tensorlake npm Shai-Hulud worm.
Why this severity: Founder disclosure; customer API keys and sandboxes reportedly not accessed; attacker reached engineering GitHub and probed Actions secrets via leftover vendor env vars
- Started
- Nov 8, 2026
Affected
- Tensorlake cloud customers (founder asks everyone to rotate API keys; says customer API keys and sandboxes were not impacted)
Fixed in
No fixed release yet
Timeline2
Tensorlake founder Diptanu Choudhury discloses a security incident: an internal application on an upstream provider spun up sandboxes in engineering-team accounts that had access to Tensorlake GitHub repositories; an attacker pushed malicious code to branches and triggered GitHub Actions to probe workflow secrets.
The same post says there was no impact to customer API keys or sandboxes, no evidence that critical systems were accessed beyond secret probing, that Tensorlake rotated all secrets and undeployed the internal application, emailed paying customers, and asks all customers to rotate Tensorlake API keys. Later edits add that the upstream provider had a security breach a couple of weeks earlier that exposed environment variables, that Tensorlake had not rotated those env vars because the app was not critical for production, and that this was an oversight. The first published version named the provider as Railway.
News & write-ups1
Posts1
We had a security incident on Tensorlake today. There was no impact to customer information such as API keys or sandboxes. An application running on an upstream provider spins up sandboxes in our engineering team’s accounts and runs automation workflows. These sandboxes had access to our GitHub repositories. The attacker pushed malicious code to branches and triggered GitHub Actions to probe for secrets that workflows can access to build and deploy code. The upstream provider had a security breach a couple of weeks ago that exposed our environment variables. We had not rotated those env vars, as this is not a critical application for our production environment. This was an oversight, we should have acted on this immediately. We have no evidence that any critical systems were accessed beyond probing for secrets. We have rotated all secrets and undeployed the internal application from the upstream provider. Out of abundant caution, please rotate your Tensorlake API keys. We will share more information with customers over email and post updates in our trust center. We have already notified all paying customers by email, and we will follow up with additional details.
Notes & caveats
Primary source is the founder’s X post, edited several times on Nov 8. The first published text named Railway; later edits say “upstream provider” and add the unrotated env-var / prior provider-breach detail plus an admission that not rotating immediately was an oversight. No independent vendor advisory or trust-center write-up was public when this entry was added. Distinct from tensorlake-npm-shai-hulud-worm (Oct 8).
Get an email when a new major security incident drops. No spam, unsubscribe any time.
