{"slug": "phala-confidential-ai-compromised", "title": "Phala Confidential AI Compromised", "summary": "Phala disclosed a security incident in which a single attacker compromised its confidential AI infrastructure, exposing in-flight request data for DeepSeek V4 Flash 0731 requests routed through OpenRouter between October 21, 2026 at 00:00 UTC and November 8, 2026 at 05:35 UTC, and potentially exposing secrets derived from Phala's key management system on affected confidential virtual machines. Phala detected unauthorized activity on one server on November 5, rotated its KMS root key on November 6, and completed containment on November 8 after a third-party researcher provided evidence that request data had been exposed; the earliest observed misuse of stolen data was October 22 at 05:41 UTC and the most recent was November 9. Phala told affected users to treat request contents as exposed and rotate any API keys, tokens, passwords or other secrets included in those requests, and said it is withholding exploit-specific details until a full root cause analysis is published.", "body_md": "We are publishing preliminary findings from a security incident affecting Phala infrastructure. Two groups of users may need to take action:\n\n- **Users whose DeepSeek V4 Flash 0731 requests were routed to Phala by OpenRouter.** For requests sent between October 21, 2026 at 00:00 UTC and November 8, 2026 at 05:35 UTC, treat request contents as exposed. Rotate any API keys, tokens, passwords, or other secrets included in those requests.\n- **Owners of affected confidential virtual machines (CVMs).** The attacker obtained application credentials. Affected CVMs may also have had secrets derived from Phala's key management system (KMS) exposed. We have contacted the affected tenant directly with rotation guidance.\n\nWe contained the incident on November 8. The affected model service has been restored with additional protections and monitoring. The attacker made further attempts after our KMS root key rotation on November 6, and we have observed no successful unauthorized access since containment.\n\nOur investigation and comprehensive verification of the remediation remain in progress. We are limiting exploit-specific details until this work is complete. We will then publish a full root cause analysis (RCA).\n\nWe are sorry this happened, and we appreciate the patience of everyone checking their systems and rotating credentials.\n\n## What happened\n\nOn November 5, we detected unauthorized activity on one server. The attacker chained a legacy internet-facing service with management interfaces that relied on loopback access for trust and did not independently authenticate callers. This allowed the attacker to create unauthorized CVMs and obtain application credentials. We blocked the identified access paths that day. On November 6, we rotated the KMS root key used to derive application secrets.\n\nOn November 8 UTC, a third-party security researcher provided evidence that request data sent to DeepSeek V4 Flash 0731 had been exposed. We traced this evidence to an inference deployment on a new GPU server. It was serving production traffic without our full production security hardening. The attacker used a similar access pattern to take control of the inference VM, making in-flight request data visible during processing. We took the deployment and its model offline.\n\nThe attack sequences and associated infrastructure overlap. Our current assessment is that a single actor conducted both intrusions, and we are treating them as one incident.\n\n## Timeline\n\nAll times are UTC. This is a condensed operational timeline, not an exhaustive forensic log.\n\n- **Oct 21, 00:00** — Start of the precautionary exposure window for DeepSeek V4 Flash 0731 request data. The attacker reached internal management interfaces on one server and inserted malware.\n- **Oct 21–22** — Requests subsequently confirmed as exposed were sent during this period.\n- **Oct 22, 05:41** — Earliest observed misuse of data obtained in the attack.\n- **Nov 4–5** — Another server was tampered with and an unauthorized CVM was created.\n- **Nov 5, 08:15–17:55** — Initial intrusion contained: attacker-created CVMs stopped, vulnerable services disabled, network controls deployed, and attacker infrastructure blocked. No subsequent successful unauthorized access was observed.\n- **Nov 6, 05:02** — KMS root key rotation completed.\n- **Nov 8, 04:12** — Researcher evidence received and traced to the compromised inference deployment.\n- **Nov 8, 04:12–05:35** — Compromised server and associated deployment infrastructure taken offline; model service stopped; gateway notified.\n- **Nov 8, 05:35** — Containment completed. No subsequent unauthorized access has been observed.\n- **Nov 9** — Most recent observed misuse of data obtained in the attack.\n- **Nov 10** — Preliminary report published.\n\n## Impact and recommended actions\n\n### Users of DeepSeek V4 Flash 0731\n\nIn-flight request contents may have been exposed for requests sent to Phala's deployment of this model during the window above. Treat any credentials or other sensitive information in those requests as compromised.\n\nFrom July 1 through November 7, the researcher regularly included unique, per-request canary credentials in requests to Phala and monitored them for subsequent use. Only canary credentials from requests sent on October 21 and 22 were subsequently misused. No misuse was observed for canary credentials sent before or after those dates.\n\nThese tests sampled requests and detected credential misuse. They did not provide visibility into every request or every possible data-access event, so we retain the wider precautionary window for user guidance.\n\nIf your requests fall within that window:\n\n- Rotate all API keys, tokens, passwords, and other secrets included in request contents.\n- Review those accounts for unauthorized activity and contact the relevant provider if you identify any.\n\nPhala served this model only through the affected route. The gateway is notifying affected users and distributing this report.\n\n### CVM owners\n\nThe attacker created unauthorized CVMs on two servers and obtained application credentials. Affected CVMs may have had KMS-derived secrets exposed. We confirmed subsequent misuse of some stolen credentials belonging to one tenant.\n\nWe have contacted the affected tenant directly with system-specific rotation guidance. If you received this notice:\n\n- Rotate the identified KMS-derived secrets and other affected credentials.\n- Review their use and report any unrecognized activity to us.\n\nIf you did not receive a notice, no action is required based on our current findings.\n\n### Other Phala models and products\n\nWe completed an audit of the full platform. Beyond the systems described above, we found no evidence of compromise affecting other models or products. No other customer workloads were interrupted.\n\nWe have included practical credential-rotation and misuse-response guidance in our emails to affected users.\n\n## Containment and remediation\n\n- Stopped attacker-created CVMs and blocked identified attacker infrastructure on November 5.\n- Disabled vulnerable legacy services and deployed additional network controls.\n- Completed KMS root key rotation on November 6.\n- Took the compromised GPU server and associated deployment infrastructure offline.\n- Restored the affected model service with additional protections and monitoring.\n- Detected further attacker attempts after the KMS root key rotation, with no successful unauthorized access observed.\n- Notified the affected tenant and the gateway and shared relevant attack indicators with them.\n- Implemented additional security measures that remain undisclosed while the investigation is active.\n\n## Frequently asked questions\n\n### Are other Phala models or products affected?\n\nWe have found no evidence of additional impact. Phala served this model only through the route described above, and the full-platform audit identified no other compromised systems.\n\n### Why use a wider exposure window when only October 21 and 22 requests were confirmed exposed?\n\nThose dates are established by canary evidence. The tests sampled requests rather than monitoring every request, and we cannot yet bound the attacker's access to those two days. The precautionary window reduces the risk of leaving an affected user unaware.\n\n### How do I know whether my CVM was affected?\n\nWe have contacted the affected tenant directly with system and credential guidance. If you did not receive a notice, no action is required based on our current findings.\n\n### Has the incident been contained?\n\nYes. We have closed the identified attack paths, removed the affected deployments, and observed no unauthorized access since November 8 at 05:35 UTC. Investigation and additional hardening continue. Service has been restored with additional protections and monitoring. Further attacker attempts since containment have not resulted in successful unauthorized access.\n\n## Next steps\n\nThe investigation remains active. We will publish a full RCA with the complete attack timeline, root causes, and corrective actions. We will update this report if our understanding of the scope changes.\n\nWe thank the third-party security researcher who alerted us and the gateway that carried this traffic for their coordination. For questions or potentially relevant suspicious activity, contact [\\[email protected\\]](https://phala.com/cdn-cgi/l/email-protection#026167707642726a636e632c6c6776756d7069).\n\nThe Phala CERT Team", "url": "https://wpnews.pro/news/phala-confidential-ai-compromised", "canonical_source": "https://phala.com/posts/phala-november-preliminary-incident-report", "published_at": "2026-11-11 09:48:10+00:00", "updated_at": "2026-11-11 10:23:13.332519+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "ai-policy"], "entities": ["Phala", "DeepSeek V4 Flash 0731", "OpenRouter"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/phala-confidential-ai-compromised", "markdown": "https://wpnews.pro/news/phala-confidential-ai-compromised.md", "text": "https://wpnews.pro/news/phala-confidential-ai-compromised.txt", "jsonld": "https://wpnews.pro/news/phala-confidential-ai-compromised.jsonld"}}