Kernel reports security incident involving a compromised API key, logging provider access and 4 GPU-enabled servers

A dim server room where a key in an open rack door sends thin streams of light to a log cabinet and four glowing server racks. — AI-generated illustration created for TribeAI with Google Flow (model nano2); text-to-image, no third-party image used as input.

Kernel says an unauthorized party used compromised credentials to reach its logging provider and servers

Kernel says it detected a data security incident on November 2, 2026. The company describes the incident in Kernel's public notice of the security incident.

What Kernel says happened

According to the notice, on October 24 an unauthorized party used a compromised KERNEL API key to probe for access. The notice does not state the year for this date or for the next one.

On October 27, the same party used the compromised key to gain access to a staff login to Kernel's logging provider.

Kernel says data downloaded from the logging provider contained a small number of Kernel API keys and third-party secrets from app deployments.

On November 3, 2026, the same party used a compromised hosting provider account credential to gain access to 4 GPU-enabled servers, according to the company.

Scope reported by Kernel

Kernel says the breach affected 0.28% of its customers.

Kernel's response

According to the notice, Kernel revoked the compromised credentials, removed the party's access to the logging provider, blocked the IP addresses involved and took the affected servers offline.

Limits of this article

This article is educational information based on the company's own public notice. It is not investment advice. It does not independently verify the incident, identify the unauthorized party or assess the impact on any specific customer. It does not give guidance on how affected users should respond.

Sources & evidence

November 4, 2026 Public Notice of Security Incident (KERNEL) ↗
Kernel says it detected a data security incident on November 2, 2026.; On October 24, an unauthorized party used a compromised KERNEL API key to probe for access.; On October 27, the same party used the compromised key to gain access to a staff login to Kernel's logging provider.; Data downloaded from the logging provider contained a small number of kernel API keys and third-party secrets from app deployments.; On November 3, 2026, the same party used a compromised hosting provider account credential to gain access to 4 GPU-enabled servers.; The breach affected 0.28% of Kernel's customers.; Kernel revoked the compromised credentials, removed the party's access to the logging provider, blocked the IP addresses involved and took the affected servers offline.
November 5, 2026