Braintrust AI platform suffers AWS account breach: What Was Reportedly Exposed & What To Do

Braintrust confirmed on May 6, 2026, that an unauthorized party accessed one of its Amazon Web Services accounts. The account contained API keys that customers had stored for use with external cloud AI models. The company reported that it contained the incident, rotated its internal secrets, and advised customers to replace any keys they had stored with the service. The number of affected customers or individuals has not been disclosed.

What happened

According to the company’s statement, the breach was limited to a single AWS account that held customer-provided API keys. No other systems or data stores were reported as compromised. Braintrust stated that it detected the unauthorized access, isolated the account, and completed rotation of its own secrets. Customers were notified directly and instructed to generate and deploy new keys for any AI services that had been configured through the platform. Public detail on the method of access, the duration of the intrusion, or the volume of keys involved remains undisclosed.

How a breach like this happens

Cloud accounts that store credentials or integration keys are frequent targets because the keys themselves grant access to paid services. Compromise can occur through stolen or reused credentials, overly permissive access policies, or supply-chain weaknesses that allow an attacker to reach the account without triggering immediate alerts. Once inside, an intruder can enumerate stored secrets and use them before the account owner detects the activity. Organizations typically respond by revoking the exposed credentials and reviewing access logs to determine scope.

Braintrust and its sector

Braintrust operates an evaluation platform used by teams building and testing AI applications. Such platforms commonly integrate with third-party AI model providers, which requires users to supply API keys so the service can run prompts and collect results. The keys are sensitive because they authenticate requests and are often tied to usage billing. A breach that exposes these keys therefore touches both the security of customer workflows and the financial controls of the underlying AI providers.

What was likely exposed

The only data type explicitly named in the incident report is customer-stored API keys for cloud AI models. No other categories of information, such as user accounts, evaluation datasets, or internal source code, have been confirmed as accessed. Organizations in this sector routinely hold API credentials, configuration details, and usage logs; however, the precise contents of the compromised AWS account beyond the reported keys have not been disclosed.

Why it matters

API keys that grant access to AI models can be used to issue queries at the account holder’s expense or to retrieve any data those models were previously authorized to process. Replacement of keys limits further misuse, yet any activity that occurred while the keys were valid may not be immediately visible to the affected customers. For the organization, the incident highlights the risks of storing third-party credentials in a shared environment even when that environment is intended only for evaluation purposes.

Were you affected?

If you stored API keys with Braintrust, rotate those keys immediately through the respective AI providers and review recent usage logs for unexpected activity. Monitor billing statements for the affected services over the coming weeks. Readers can also run a free exposure scan of their email address against known breach data sets to check whether their information appears in other public incidents.

AICompiled with AI assistance from public sources and published under our editorial standards.