# Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env vars · pwn.watch > On Nov 8 2026 Tensorlake founder Diptanu Choudhury disclosed a security incident. He said an application running on an upstream provider spun up sandboxes in Tensorlake engineering-team accounts that had access to the company’s GitHub repositories; an attacker pushed malicious code to branches and triggered GitHub Actions to probe for secrets those workflows can access. The first published version of the post named the provider as Railway; later edits of the same post say “an upstream provider” and add that the provider had a security breach a couple of weeks earlier that exposed environment variables, that Tensorlake had not rotated those env vars because the application was not critical for production, and that this was an oversight. He said there was no impact to customer information such as API keys or sandboxes, that Tensorlake has no evidence any critical systems were accessed beyond probing for secrets, that it has rotated all secrets and undeployed the internal application, and that paying customers have been notified by email. Out of abundant caution he asked customers to rotate Tensorlake API keys. Further details are promised by email and on Tensorlake’s trust center. This is separate from the October 2026 tensorlake npm Shai-Hulud worm. Page: https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026 · generated 2026-11-08T02:39:23.697Z ## Status - Severity: high · status: live · patch: partial - Product: Tensorlake (AI sandbox platform) - Started: 2026-11-08 - Affected: Tensorlake cloud customers (founder asks everyone to rotate API keys; says customer API keys and sandboxes were not impacted) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026.json - This file: https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026/llms.txt ## Updates (newest first) - 2026-11-08: Tensorlake founder Diptanu Choudhury discloses a security incident: an internal application on an upstream provider spun up sandboxes in engineering-team accounts that had access to Tensorlake GitHub repositories; an attacker pushed malicious code to branches and triggered GitHub Actions to probe workflow secrets. (https://x.com/diptanu/status/2119228351978328379) - 2026-11-08: The same post says there was no impact to customer API keys or sandboxes, no evidence that critical systems were accessed beyond secret probing, that Tensorlake rotated all secrets and undeployed the internal application, emailed paying customers, and asks all customers to rotate Tensorlake API keys. Later edits add that the upstream provider had a security breach a couple of weeks earlier that exposed environment variables, that Tensorlake had not rotated those env vars because the app was not critical for production, and that this was an oversight. The first published version named the provider as Railway. (https://x.com/diptanu/status/2119228351978328379) ## Fix brief # Security brief: Tensorlake: attacker reached engineering GitHub via vendor-hosted sandboxes after unrotated env vars Source: https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026 · status: live · severity: high · updated Nov 8, 2026, 01:27 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is On Nov 8 2026 Tensorlake founder Diptanu Choudhury disclosed a security incident. He said an application running on an upstream provider spun up sandboxes in Tensorlake engineering-team accounts that had access to the company’s GitHub repositories; an attacker pushed malicious code to branches and triggered GitHub Actions to probe for secrets those workflows can access. The first published version of the post named the provider as Railway; later edits of the same post say “an upstream provider” and add that the provider had a security breach a couple of weeks earlier that exposed environment variables, that Tensorlake had not rotated those env vars because the application was not critical for production, and that this was an oversight. He said there was no impact to customer information such as API keys or sandboxes, that Tensorlake has no evidence any critical systems were accessed beyond probing for secrets, that it has rotated all secrets and undeployed the internal application, and that paying customers have been notified by email. Out of abundant caution he asked customers to rotate Tensorlake API keys. Further details are promised by email and on Tensorlake’s trust center. This is separate from the October 2026 tensorlake npm Shai-Hulud worm. Severity detail: Founder disclosure; customer API keys and sandboxes reportedly not accessed; attacker reached engineering GitHub and probed Actions secrets via leftover vendor env vars - Product: Tensorlake (AI sandbox platform) ## Affected versions - Tensorlake cloud customers (founder asks everyone to rotate API keys; says customer API keys and sandboxes were not impacted) ## Check whether you're affected Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions: ```sh npm ls tensorlake grep -n 'tensorlake' package-lock.json pnpm-lock.yaml yarn.lock bun.lock 2>/dev/null ``` ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you use Tensorlake: rotate your Tensorlake API keys as the founder requested. Tensorlake says customer API keys and sandboxes were not accessed, that it rotated its own secrets, and that it undeployed the internal vendor-hosted application. Watch email and the Tensorlake trust center for the promised follow-up. This is separate from the October npm tensorlake@0.5.144 Shai-Hulud worm (tensorlake-npm-shai-hulud-worm). ## Latest updates - Nov 8, 2026: Tensorlake founder Diptanu Choudhury discloses a security incident: an internal application on an upstream provider spun up sandboxes in engineering-team accounts that had access to Tensorlake GitHub repositories; an attacker pushed malicious code to branches and triggered GitHub Actions to probe workflow secrets. - Nov 8, 2026: The same post says there was no impact to customer API keys or sandboxes, no evidence that critical systems were accessed beyond secret probing, that Tensorlake rotated all secrets and undeployed the internal application, emailed paying customers, and asks all customers to rotate Tensorlake API keys. Later edits add that the upstream provider had a security breach a couple of weeks earlier that exposed environment variables, that Tensorlake had not rotated those env vars because the app was not critical for production, and that this was an oversight. The first published version named the provider as Railway. ## Write-ups & news - [Tensorlake founder discloses November 8 security incident](https://x.com/diptanu/status/2119228351978328379) ## Caveats Primary source is the founder’s X post, edited several times on Nov 8. The first published text named Railway; later edits say “upstream provider” and add the unrotated env-var / prior provider-breach detail plus an admission that not rotating immediately was an oversight. No independent vendor advisory or trust-center write-up was public when this entry was added. Distinct from tensorlake-npm-shai-hulud-worm (Oct 8). --- Machine-readable: https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.