If you use the hosted Trigger.dev platform, check your email. The company disclosed on Sunday that an attacker got into environment variables belonging to “a subset of organizations.”
Trigger.dev is a TypeScript platform for building AI agents and long-running workflows, with retries, queues and scaling. That makes it a place where a lot of API keys live.
What we know
- Trigger says the access path is blocked and affected customers got instructions.
- It hasn’t said how the attacker got in or who was hit. A full incident report is coming.
- Trigger recently added webhooks for services like Stripe and Supabase, so those secrets could be in play too.
What to do
If you’re a customer, rotate every secret stored there, even if you didn’t get a notice. Then check your AI provider bills for usage you don’t recognize. After this weekend’s LLMjacking news, stolen keys get used fast.
Trigger is open source and can be self-hosted, if you’d rather hold the keys yourself.
God Bless, and Needs Garlic!
