Limit each key’s reach
Use narrow permissions and isolate customer secrets from broadly accessible workloads.
What this does—and does not—establish
A stored secret still needs protection wherever it is copied or backed up.
AI as a targetCASE STUDY / Zeabur
Stolen platform credentials exposed AI keys
Zeabur says intruders read customer secrets while seeking AI-service keys.
Source: ZeaburDisclosed October 15; preliminary report October 19.
THE 10-SECOND TAKEAWAY
Track where access keys are stored and what they can unlock.
HOW IT WORKED
Follow the chain.
Leaked credentials
→
Platform access
SIMPLIFIED VIEW · 1 / 3Platform database
→
Customer secrets
SIMPLIFIED VIEW · 2 / 3Revoke keys
→
Restrict access
SIMPLIFIED VIEW · 3 / 3Move through the story at your own pace.
1 / 3
THINK OF IT THIS WAY
Editorial analogy: losing a key can expose more than the building where it was stored.
An analogy for the mechanism; not an additional claim about the incident.KEEP THE EVIDENCE IN VIEW
What we know.
What we don’t.
Reported outcomes
Zeabur confirmed access to its platform database and customer environment variables. Zeabur
Important limits
How the credentials first leaked remains unresolved. An August connection is a hypothesis.
Attempted Bedrock use failed; other reported AI usage was not conclusively linked. Attacking AI is unestablished.
Submitting a claim does not establish that compensation has been paid.
The lesson beyond
this one case.
Editorial lesson: access keys can authorize spending and unlock information across several services.
What happened in response? +
Zeabur’s later notice sets November 30 for claims from the October incident. Services close by December 31; data on dedicated servers may be deleted earlier, when their plans expire. Zeabur
What could help
an organization?
Editorial defense connections for organizations operating or using platforms that hold AI credentials; not proof of prevention or a product endorsement.
Isolate exposed applications
Restrict routes from customer applications into platform administration and secret storage.
What this does—and does not—establish
This is an editorial control connection, not a claim that one product would have prevented the incident.
Revoke and verify together
Coordinate access removal, issuer-side revocation, replacement, and review of usage logs.
What this does—and does not—establish
Replacing keys alone neither removes persistent access nor recovers exposed data.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkTRACE IT TO THE SOURCE
Read the evidence.
Explore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Zeabur October incident statusZeabur · Oct 15, 2026 · Affected party incident disclosure
02Zeabur October 2026 security incident (preliminary report)Zeabur · Oct 19, 2026 · Affected party incident disclosure
03Zeabur is shutting downZeabur · Oct 17, 2026 · Affected party incident disclosure
04Zeabur service migration, refunds, and security incident claimsZeabur · Oct 22, 2026 · Affected party response notice
Read this case’s update history →
Reviewed Nov 1, 2026 · Editorial methodology · Structured data