{
  "id": "tensorlake-github-workflows",
  "url": "https://ohshit.app/incidents/tensorlake-github-workflows/",
  "title": "Tensorlake reports malicious GitHub workflow runs after an upstream breach",
  "level": 4,
  "level_name": "septic-tank-blew",
  "date": "2026-11-08",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "Tensorlake",
    "GitHub Actions",
    "Secrets"
  ],
  "ecosystems": [],
  "summary": "Tensorlake says an attacker used engineering sandbox access to push malicious branch commits and trigger GitHub Actions to probe build and deployment secrets. The company removed the internal app, rotated secrets and asked customers to rotate their Tensorlake API keys as a precaution.",
  "splash": "Tensorlake engineering repositories reachable from its internal automation sandboxes and the workflows triggered from those branches.",
  "wipe": "Rotate Tensorlake API keys, update dependent workloads and revoke superseded keys. Review usage and follow the vendor’s updates.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Rotate Tensorlake API keys",
      "hint": "Sign in directly to the Tensorlake console, replace API keys, update secret stores and workloads using TENSORLAKE_API_KEY, verify the replacements work, and revoke the old keys. Apply the same rotation to CI and scheduled jobs."
    },
    {
      "title": "Check build and deployment records if you integrate Tensorlake",
      "hint": "Compare CI runs and deployed artifacts against expected commits and releases. Check when Tensorlake keys were used and investigate unexplained runs. Preserve relevant logs before changing affected automation."
    },
    {
      "title": "Review usage and watch for vendor follow-up",
      "hint": "Compare recent API usage and sandbox activity with your own deployment and job records. Save timestamps and identifiers for unexpected activity and contact Tensorlake through its official site. Check official customer email and the trust center for further incident details."
    }
  ],
  "sources": [
    {
      "name": "Tensorlake founder’s disclosure",
      "url": "https://x.com/diptanu/status/2119228351978328379",
      "says": "Confirms the repository and workflow activity, secret rotation, internal app removal and customer guidance.",
      "primary": true
    },
    {
      "name": "Tensorlake founder’s follow-up",
      "url": "https://x.com/diptanu/status/2119244751178551446",
      "says": "Attributes exposure to an upstream provider breach.",
      "primary": true
    },
    {
      "name": "Tensorlake Cloud console",
      "url": "https://cloud.tensorlake.ai/login",
      "says": "Official entry point for Tensorlake customers.",
      "primary": true
    },
    {
      "name": "October Tensorlake npm advisory",
      "url": "https://github.com/tensorlakeai/tensorlake/security/advisories/GHSA-8g63-53c9-65j2",
      "says": "Documents the separate October 8 malicious npm release.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "Tensorlake confirms malicious pushes and workflow runs probing for secrets.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 8, 00:39 UTC",
      "title": "Tensorlake discloses unauthorized branch pushes and workflow runs",
      "body": "Founder Diptanu Choudhury says the company rotated its secrets, removed the internal app and notified paying customers by email. Customers are asked to rotate their API keys."
    },
    {
      "date": "Nov 8, 01:44 UTC",
      "title": "Founder links the entry path to an upstream breach",
      "body": "In a follow-up, Choudhury attributes Tensorlake’s exposure to a provider breach."
    }
  ],
  "body_markdown": "Tensorlake says an internal automation app running on an upstream provider started sandboxes under engineering team accounts. Those sandboxes had access to Tensorlake GitHub repositories. An attacker pushed malicious code to branches and triggered GitHub Actions to probe for build and deployment secrets. Tensorlake says it found no evidence of access to critical systems beyond the probing and reports that customer API keys and sandboxes were unaffected. The company has not published affected branch names, workflow identifiers or evidence that particular secrets were retrieved.\n\nThe founder’s initial public post named Railway as the app host. In the edited statement, Choudhury referred to an upstream provider and said a prior breach there had exposed environment variables that Tensorlake had left unrotated for the internal app. The follow-up also attributes the exposure to the upstream breach. The initial post and follow-up are available in [the disclosure’s public copy](https://teapaw.org/diptanu/status/2119228351978328379) and [the reply’s public copy](https://teapaw.org/diptanu/status/2119244751178551446). A [public copy of the edited statement](https://pwn.watch/i/tensorlake-vendor-sandbox-github-access-nov-2026) preserves the later wording. The relationship to [Railway’s October incident](/incidents/railway-env-vars/) has not been independently verified. The earlier Tensorlake npm advisory covers a different event.\n\nTensorlake says it rotated its secrets and removed the app from the upstream host. It emailed paying customers and asked customers to rotate Tensorlake API keys as a precaution. Further details are expected by email and in the [Tensorlake trust center](https://trust.tensorlake.ai/)."
}