Phala's confidential AI infrastructure breached, some request data may be exposed
Understand this story
Phala released a preliminary incident report stating that its confidential AI infrastructure was breached. Requests to DeepSeek V4 Flash 0731 routed to Phala via OpenRouter between 00:00 UTC on October 21, 2026 and 05:35 UTC on November 8 should be considered exposed. Phala stated that affected users need to rotate the API keys, tokens, and passwords in their requests; users who have not received a notification do not need to take action based on the current investigation findings. Phala said a full root cause analysis will be released later.
AI overview based on source reports · Updated 3 days ago
Coverage timeline
Follow the coverage to explore different perspectives.
- Hacker News AIFeaturedPhala Confidential AI Compromised
Phala published preliminary findings on a security incident in which an attacker chained a legacy internet-facing service with management interfaces that trusted loopback access, creating unauthorized CVMs and obtaining application credentials, and also took control of an inference VM serving DeepSeek V4 Flash 0731, exposing in-flight request data. Requests routed to Phala by OpenRouter between October 21, 2026 00:00 UTC and November 8, 2026 05:35 UTC should be treated as exposed, and affected CVM owners were contacted directly with rotation guidance. Phala contained the incident on November 8, rotated its KMS root key on November 6, restored the model service with added protections, and says a full root cause analysis is still in progress.
Activity for this story
- Current comparable activity
- 3
- Peak comparable activity
- 10Nov 11 19:00
- Change in the past 24 hours
- -49%
Trends compare the same fully observed participants, which may cover fewer participants than current activity. Move the pointer or tap the chart to inspect hourly activity; use the left and right arrow keys with a keyboard.