Trigger.dev says an attacker accessed environment variables of a subset of customer organisations

TLDR

• Trigger.dev says an attacker gained unauthorised access to environment variables for a subset of customer organisations.¹²
• The company says it blocked the exploit and emailed all impacted account owners with steps to mitigate.¹²
• The Register reports Trigger declined to elaborate and pointed to a forthcoming full incident report.³

Trigger.dev, a cloud platform for building AI agents and workflows in TypeScript, disclosed a security incident on Sunday 1 November.¹²³ Its post, written by CTO Eric Allam and dated 1 November 2026, says the company has blocked the exploit used in the attack, but that its investigation identified "exposure across a subset of organizations".¹ The attacker gained unauthorised access to environment variables for those organisations, and Trigger says it has emailed all impacted account owners with steps to mitigate.¹² The status page entry is timestamped 10:50pm UTC on 1 November and lists the incident as resolved.²

The two Trigger posts give no further detail.¹² The blog post says updates will be published on the status page, and the status entry says Trigger will follow up with more details.¹² Neither post gives the number or share of organisations affected, the types of environment variable involved, or how the attacker gained access.¹² The Register reports that Trigger has not publicly identified which organisations were affected, and that a company spokesperson declined to provide any additional information and told the outlet to wait for a full incident report.³

The Register notes that environment variables in SaaS and cloud services can hold sensitive credentials, and that if they do, an attacker could gain access to connected services and infrastructure.³ It adds that Trigger's elastic scaling, automated retries and support for many concurrent operations could compound the consequences of compromised API keys, depending on what the credentials allow, and that Trigger recently added webhooks supporting services such as Stripe, Supabase and Slack.³

The Register also points out that Trigger is open source and can be self-hosted, which it suggests might be a better alternative than relying on a hosted service.³

Why it matters: environment variables in hosted platforms can hold customers' credentials, the Register notes, and with Trigger yet to publish a cause or the number of organisations affected, impacted customers are working from its emailed mitigation steps and a promised incident report.¹²³