NVIDIA rotates SSH keys after breach of its Brev platform

NVIDIA has disclosed a security breach affecting its Brev cloud development platform for AI, with intruder activity detected within the Brev infrastructure between 4 and 20 October 2026. The incident potentially exposed SSH keys configured for client virtual machines, prompting NVIDIA to rotate all customer SSH credentials across impacted environments. For now, internal forensic investigators have not observed active misuse of the exposed credentials.

Brev is described as NVIDIA’s cloud development platform that provisions high-performance GPU instances across third-party hyperscalers, offering pre-configured CUDA, Python, and Docker environments for AI model training and inference. The use of secure shell tunnels is reiterated as essential for administering and transferring data to remote GPU instances.

The article notes that if an attacker gains access to private SSH keys, they could penetrate client environments and potentially exfiltrate proprietary source code, model weights, and corporate access tokens. The breach is underscored by a referenced technical incident notification shared by HowDevelop on X, which emphasises the importance of credential hygiene in cloud development contexts.

In response, NVIDIA urges affected account holders to audit their virtual machines and verify administrative integrity. Recommended immediate actions include reviewing authentication records in system logs, inspecting the authorized_keys directory for rogue keys or new administrative users, auditing running services and unusual outbound connections, and rotating third-party API credentials and cloud tokens stored within instances.

If suspicious activity is found, administrators should isolate affected instances and preserve volatile memory and logs for analysis, liaising with NVIDIA customer support as needed.