VULNpocalypse
MediumBreach / campaignMonitoring

Nvidia Brev SSH keys possibly exposed, Nvidia tells users, ETCISO reports

ETCISO reports Nvidia told Brev users their VM SSH keys may have been exposed in October; check your instances use the rotated key.

Published
Exploitation
No, according to the Nvidia notice quoted by ETCISO, Nvidia is unaware of improper use of the keys

What happened

According to ETCISO, Nvidia has sent breach notifications to users of its Brev cloud development platform. The notice reports unauthorized activity affecting Brev from October 4 through October 20, 2026. ETCISO’s report cites coverage by Tom’s Hardware, which in turn cited the customer notice.

In the notice quoted by ETCISO, Nvidia says one piece of information was potentially exposed: the SSH key that Brev provisioned for each user’s Brev-provisioned VM. Nvidia says the key “has since been rotated, and your instances have been updated with the replacement key”. It also says it is “unaware of improper use of these keys”.

ETCISO also notes that on October 30, security firm Wiz published a report it called “Black October”. That report tracked incidents across at least nine AI developer platforms during the month. The source does not link the Brev incident to any specific actor or campaign.

The following details are not confirmed:

  • how the unauthorized access happened
  • who was responsible
  • how many users were affected
  • whether any data beyond the provisioned SSH keys was involved

There is only one independent outlet in the source data, and no Nvidia advisory is linked.

Am I affected?

  • You may be affected if you had a Brev-provisioned VM during the October 4 to October 20, 2026 window, according to the notice reported by ETCISO.
  • Nvidia notified affected users directly, so a notice from Nvidia in your inbox is the clearest indicator.
  • Whether SSH keys you supplied yourself, rather than Brev-provisioned keys, were affected is not confirmed.

What to do now

  1. Look for Nvidia’s breach notification in the email tied to your Brev account and follow its instructions.
  2. Confirm your Brev instances are using the replacement key, which Nvidia says it has already deployed.
  3. General hygiene, not from the source: if you copied the old Brev-provisioned key to other systems or tools, remove it there too.
  4. General hygiene, not from the source: review login and activity history on your Brev VMs for the October 4 to October 20 window.

Sources