Key findings
- A compromised employee credential gave the attacker access to a temporary EC2 instance used in a control plane database migration. A backup on that instance held decrypted AI provider credentials.
- Braintrust and CrowdStrike found the attacker's activity limited to Anthropic API keys in the backup, with no wider access to customer data or systems.
- Braintrust shipped workload identity federation for Anthropic and Google Vertex AI in May 2026 and for OpenAI and Azure AI Foundry in June, plus assume-role for Bedrock. Each option needs a Braintrust-hosted organization, and workload identity federation covers organization-level providers only.
- Since May 2026, Braintrust warns on provider keys that have gone more than six months without rotation and records which users configure provider keys.
Connect model providers to Braintrust through short-lived credentials wherever it supports them, and put a provider-side spend limit on every key you still store. By May 29, 2026, 30 customers reported suspicious use of keys they had stored there, which sat decrypted in a migration backup. The same credential decisions apply to any eval platform.
What happened
Braintrust's final report dates the first suspicious behavior to Saturday, May 2. On May 3, Braintrust found unauthorized access to a temporary EC2 instance in an internal AWS account. On May 4, it confirmed one affected customer and brought in incident responders. On May 5, it rotated its own secrets and published a bulletin telling customers to delete and rotate their provider keys.
The attacker got in through a compromised employee credential and reached the backup while the control plane database migration was under way. Braintrust removed the affected IAM credentials, disabled IAM users, and shut down the instances involved.
Who was affected
The May 7 update counted one affected customer and three more investigating spikes in provider usage. By May 29, 30 customers had reported suspicious activity tied to stored keys, and Braintrust investigated each report with the customer and found no further access. Its May 29 report says the investigation with outside incident responders has concluded. The organization-level provider secrets at risk sit in the control plane, even for self-hosted customers. Project-level secrets sit in the data plane.
TechCrunch reported on May 6 that Braintrust's email asked every customer to rotate stored keys, while a spokesperson said there was no evidence of a breach at that time. Braintrust's May 29 report supersedes that statement and confirms the attacker reached the backup. Nudge Security's co-founder, Jaime Blasco, who received the email, told TechCrunch the incident could have downstream implications for affected customers.
What Braintrust changed
Braintrust's May 29 report lists its fixes: workload identity federation for Anthropic, assume-role for Bedrock, a record of who configures provider keys and when, and an incident distribution list. Its stated goal is to remove the need to store keys for supported providers. The changelog adds Google Vertex AI in May 2026 and OpenAI and Azure AI Foundry in June 2026, each for organization-level providers on Braintrust-hosted organizations.
Also in May 2026, the secrets manager page began flagging provider keys not rotated in over six months, and the bt CLI began warning daily about them. In October 2026, Braintrust let organization owners list every member's API keys through the API for audits. On September 23, 2026, it added a SOC 2 report from a year-long audit to its Trust Center.
What to decide on any eval platform
Eval and observability platforms hold provider keys so playgrounds, scorers, and gateways can call models for you. Ask these questions of each one.
- Which provider keys does the platform hold, at the organization or project level?
- Can each provider use short-lived credentials instead, such as workload identity federation or an assumed role?
- Does each stored key have a spend limit and usage alerts at the provider?
- Who rotates stored keys, how often, and who is told when a vendor reports an incident?
- Is your security contact on the vendor's incident distribution list?
Methodology
GILD reviewed Braintrust's Trust Center reports of May 5, May 7, and May 29, 2026, its security, architecture, and authentication docs, and TechCrunch's May 6, 2026 report, all opened on October 12, 2026. On October 25, 2026, GILD checked Braintrust's changelog for credential changes made after the incident. Customer counts are Braintrust's own figures from its reports.
Products in this piece
Sources
- Official documentation
- 7
- Public source
- 1
- Braintrust Trust Center: Updates, including the May 2026 security incident reports
- Braintrust Trust Center
- Braintrust docs: Authentication, API keys, and provider credentials
- Braintrust docs: Architecture (control plane and data plane)
- Braintrust docs: Security
- Braintrust docs: AI providers and built-in models
- TechCrunch: AI evaluation startup Braintrust confirms breach, tells every customer to rotate sensitive keys (May 6, 2026)
- Braintrust docs: Product updates (workload identity federation May and June 2026, key-rotation warnings May 2026, usage analytics by project Sep 2026, organization API key listing Oct 2026)