Trigger.dev discloses security incident involving exposed environment variables

Trigger.dev, a cloud-hosted AI workflow platform, recently experienced a security incident that resulted in the unauthorized exposure of environment variables for a subset of its customers, according to a recent report by The Register.

The company confirmed that an attacker gained access to sensitive environment variables, which often contain critical credentials for cloud services and digital infrastructure. While Trigger.dev stated that the exploit has been blocked and affected customers have been notified, the company has not publicly identified the specific organizations impacted. The platform is used to build durable AI agents and workflows, featuring capabilities like elastic scaling and automated retries. Security experts warn that because these workflows often integrate with services such as Stripe, Slack and Supabase, compromised credentials could allow unauthorized access to a wide range of connected systems. Trigger.dev counts several high-profile entities among its clients, including Emporio Armani and Cal.com. The company declined to provide further details regarding the breach, advising users to await a comprehensive incident report. Given the risks associated with hosted services, some industry observers suggest that self-hosting the open-source platform may offer a more secure alternative for organizations managing sensitive AI operations.