SANTA CLARA, United States — Nvidia has notified affected customers about a security incident involving its Brev cloud development platform after identifying unauthorized activity that occurred between October 4 and October 20, 2026. The incident, reported on November 2, raises concerns about the security of credentials used by developers to access cloud-hosted virtual machines. Nvidia said its investigation determined that SSH keys provisioned by Brev may have been exposed and confirmed that replacement keys had been issued to affected customer instances.
Unauthorized Activity Detected on Brev
Brev is a cloud development environment designed to help developers access computing resources for software and AI-related workloads. The platform can provide virtual machines and associated infrastructure without requiring users to manage every element of the underlying environment themselves.
According to the customer notification described in reporting by Tom’s Hardware, Nvidia identified unauthorized activity affecting the platform over a 16-day period. The company said information stored on Brev systems may have been accessed by malicious actors. The specific details of how the activity began have not been fully disclosed.
SSH Credentials Were Potentially Exposed
The investigation identified SSH keys provisioned by Brev as potentially affected information. Secure Shell keys are used to authenticate connections between computers and remote systems. Developers and administrators rely on them to access virtual machines, manage software environments, transfer files, and perform maintenance tasks.
If an unauthorized party obtains a valid SSH key, it may create a route to systems that trust that credential. The risk depends on the key’s permissions, the systems it can access, and whether additional security controls are in place.
Nvidia said it had rotated the potentially exposed keys and updated affected customer instances with replacement credentials. The company also stated that it had found no evidence of improper use of the keys at the time of its notification.
Cloud Customers Should Review Access Controls
Replacing potentially exposed credentials is an important response, but organizations should also examine the systems that used those credentials during the incident period. Customers may need to review access logs, verify account permissions, and check for unfamiliar authentication activity.
Security specialists commonly recommend removing unauthorized access mechanisms, rotating related credentials, and reviewing systems for signs of persistence. Organizations should also confirm that backup authentication methods and service accounts have not been overlooked.
AI Infrastructure Security Faces Greater Scrutiny
The incident comes as cloud infrastructure providers compete to supply computing resources for artificial intelligence development. These environments often hold valuable workloads, source code, credentials, and access to customer data. A security weakness in a development platform can therefore have implications beyond the platform itself.
For Nvidia, the immediate priority is to communicate with affected customers and maintain confidence in Brev’s security controls. The company has not publicly provided a complete account of the intrusion or identified the responsible party.
The case reinforces the importance of credential management and monitoring across cloud development services. As AI workloads become more dependent on managed infrastructure, providers and customers will need to treat access keys as critical security assets rather than routine configuration details.
This website uses cookies.