Tensorlake says engineering GitHub incident led to API-key rotation request

Tensorlake says an attacker used vendor-hosted engineering sandboxes to reach GitHub repositories and probe Actions secrets; customers are asked to rotate API keys as a precaution.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

Reader ratings require JavaScript; the article remains fully readable without it.

Dark operations room with a monitor showing generic workflows, shields, a warning symbol, and an amber key rotating to a cyan key.
AI-generated editorial illustration of an engineering workflow incident and credential rotation; not an official Tensorlake image or real interface.

Tensorlake founder Diptanu Choudhury said an attacker used vendor-hosted engineering sandboxes to reach the company’s GitHub repositories, push malicious branch code, and trigger GitHub Actions to probe workflow secrets.12 Tensorlake asked customers to rotate API keys as a precaution.12

Company-disclosed incident • Reporting cutoff: November 8, 2026, 3:24:20 a.m. EST / November 8, 2026, 8:24:20 a.m. UTC

The bottom line

Tensorlake said customer API keys and sandboxes were not impacted and said it had no evidence that critical systems were accessed beyond secret probing.12 Evidence note: those are attributed company statements; pwn.watch is used here only as a secondary incident record and edit-history source, not as independent confirmation.12

What Tensorlake reported12

Engineering accessThe company statement says vendor-hosted sandboxes in engineering-team accounts had access to Tensorlake GitHub repositories.12
Attacker activityThe statement says the attacker pushed malicious code to branches and triggered GitHub Actions to probe workflow secrets.12
Company responseTensorlake said it rotated its secrets and undeployed the internal application from the provider.12

What happened

The captured primary statement originally named Railway, while the later wording recorded by pwn.watch says “upstream provider.”12 The secondary record says the edited post added that the provider had suffered a breach weeks earlier that exposed environment variables and that Tensorlake had not promptly rotated them, calling that an oversight.2 Because the wording changed, this report does not present Railway as Tensorlake’s final current attribution.2

Why it matters

The company statement says the attacker probed secrets that GitHub Actions workflows could access to build and deploy code, while Tensorlake said it found no evidence of critical-system access beyond that probing.12

Rotate a Tensorlake API key in the documented order3

Practical guidance: Tensorlake’s current authentication documentation gives this three-step sequence and says it avoids downtime during rotation.3

  1. Create a new API key first.3
  2. Update your applications to use the new key.3
  3. Then delete the old key from the dashboard.3

What this means for readers

The founder framed the rotation request as “out of abundant caution” while saying customer information such as API keys and sandboxes was not impacted.12

Incident boundary

pwn.watch identifies this engineering-GitHub event as separate from the October 2026 malicious Tensorlake npm incident.2

Evidence limits12

Evidence limit: the captured primary statement and the secondary incident record report Tensorlake’s impact assessment; neither is independent verification of that assessment.12

Sources

  1. Tensorlake founder incident statement — canonical reader-facing primary-source URL. The statement text was captured on November 8, 2026; an automation recheck returned HTTP 403, so the package preserves the captured primary-source text and the access limitation.
  2. Tensorlake incident record and edit history — pwn.watch, secondary source, accessed November 8, 2026, 8:11:13 a.m. UTC. It reproduces the full current post text and records the edit history; it is not treated as corroboration or independent confirmation.
  3. Authentication and API-key rotation documentation — Tensorlake Documentation, accessed November 8, 2026, 8:23:11 a.m. UTC.

Browse Articles

Latest Articles