Lightning AI: unauthorized access to credentials forced the Studio platform offline
Severity: high · Patch status: partial · Since 2026-10-15
Lightning AI says it identified a security incident involving unauthorized access to credentials on its Lightning Platform at 23:00 UTC on 15 October 2026, and cut off all user access at 01:00 UTC on 16 October while it investigated. The services in scope are Studio, Deployments, Pipelines and Drive; GPU cluster rental and managed Kubernetes and SLURM are said to be out of scope. The company believes certain customer credentials were compromised to reach customer environments and connected third-party services. It says it has revoked every credential identified as used in the attack, and has revoked identified keys tied to customer cloud accounts used on the platform. It has not disclosed the root cause, the number of affected customers, or what data was accessed, and says an independent external security firm is assisting. Customers it identified as potentially affected have been notified, and customers were told to rotate secrets and review third-party access logs. On 28 October read-only Drive access returned through the CLI; the web UI and Studio, Jobs and Deployments had no return date. Wiz's 30 October roundup lists credential access as the root cause and counts Lightning among at least nine AI developer platforms with October 2026 incidents. Wiz also notes Lightning's earlier supply-chain compromise of its PyPI lightning package (versions 2.6.2 and 2.6.3 on 30 April 2026, part of the Mini Shai-Hulud campaign) and does not say whether the two events share a cause.
What to do
- If you used Lightning Studio, rotate every secret, API key and token stored in your Studios — GitHub credentials, cloud provider keys, model-provider keys, database passwords — from a machine outside the platform
- Rotate credentials for any third-party service your Lightning virtual machines could reach, then review that service's access logs for the incident window starting 15 October, 23:00 UTC
- Check your cloud providers for keys issued to or used from Lightning, disable them if the platform has not already, and audit billing and API activity for unusual calls
- Treat anything the compromised environments could read or exfiltrate as exposed, including source code, datasets and internal network access
- Watch for follow-on phishing and lateral attempts that use information taken from the platform
Sources
All live incidents on Threat Watch
