Observed incident

Kernel reports exposed credentials and access to four GPU servers

Reported

Published here

What happened

Kernel says an intruder downloaded logging-provider data containing some API keys and third-party secrets. The same party accessed four GPU servers, three of which ran customer browser sessions. A cryptominer ran on a development server.

Parties and reporting

AI tools and systems: Kernel browser infrastructure, Logging and hosting provider credentials, ARTEX, suspected by Kernel

Outcome

Kernel says 0.28% of its customers were affected. It took the servers offline, withdrew access to its logging provider, rotated credentials accessible to those servers and notified affected organizations.

Operating lesson

Keep secrets out of third-party logs, scope infrastructure keys to the services that need them and rotate credentials reachable from a compromised server.

Evidence and limits

The notice dates the first known activity to October 24. Kernel believes the operator used ARTEX for cryptomining. It did not establish how the hosting credential was obtained or confirm successful mining on a server that handled customer sessions.

Sources