# Trigger.dev attackers accessed customer environment variables containing credentials

- URL: https://talkfuse.com/story/cloud-hosted-ai-workflow-tool-has-environment-variables-snatched-in-security-incident/
- Published: 2026-11-02T16:44:30+00:00
- Updated: 2026-11-02T17:08:20+00:00
- Original publisher: The Register
- Original article: https://www.theregister.com/security/2026/11/02/cloud-hosted-ai-workflow-tool-has-environment-variables-snatched-in-security-incident/5306998
- Topics: AI, Environment, Science, Technology

## Key points

- Trigger.dev reported unauthorised access to some customers’ environment variables.
- Exposed credentials could affect connected services and workflows.
- The company has blocked the access method and notified affected customers.

## Summary

Trigger.dev, a cloud-hosted AI workflow platform, said an attacker gained unauthorised access to environment variables belonging to some customer organisations. The incident matters because those variables can contain credentials that grant access to connected services and digital infrastructure.

Trigger said it had blocked the access method and notified affected customers about steps to reduce further risk, but did not name the organisations or explain how many were affected. Its platform supports long-running AI agents, retries and integrations such as Stripe, Supabase and Slack; the company says a fuller incident report will provide more information. Trigger is open source and can also be self-hosted.

---
Summarised by TalkFuse (https://talkfuse.com/). Quote the original publisher for the reporting and link this page for the summary and discussion.