> For the complete documentation index, see [llms.txt](https://docs.agenticflow.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.agenticflow.ai/policies/security-incident-2026-11.md). # Security Incident — November 2026 Security incident of November 2–3, 2026 — what it means for you, what to do now, what happened, and what we are changing. {% hint style="warning" %} **Last updated: 2026-11-06 (UTC).** Our emails about this incident come only from ****. We will never ask for your password or your keys. {% endhint %} On November 2–3 someone broke into part of AgenticFlow. We contained it on November 3. **Public access to AgenticFlow resumed on November 5.** We made security improvements and tested the system before reopening public access. Monitoring continues. [Office Hour #59: Connection Recovery & Workflow Compatibility](/changelog/office-hour-59-connection-recovery-and-workflow-compatibility.md) explains how to replace connections, update affected workflows, and test before resuming automatic runs. If you saved API keys or other tokens from other services in AgenticFlow before the incident was contained, treat those credentials as exposed: revoke them at the issuing service unless it has confirmed they are disabled, then add replacements in AgenticFlow. If you already revoked the old credentials and created replacements, use those replacements; you do not need to rotate them again solely because the service reopened. Your password and your card details are not stored in our systems. We are sorry. What we know so far is on this page, and we keep it updated until the incident is closed. ## Provider response update — November 6 We contacted providers with the affected credential records so they could disable access and review usage. Their responses provide some reassurance within the scope of their checks: * **Firecrawl:** on November 3, Firecrawl reported that its review of matched keys found no activity that looked unauthorised since November 2, 10:26 UTC. On November 4, it confirmed that those keys were already inactive. * **Pipedream:** on November 5, Pipedream confirmed it had disabled affected credentials on the list we supplied. It reported no unauthorised activity detected before disablement. Pipedream has also begun notifying affected users directly. * **Perplexity:** on November 4, Perplexity advised that account changes require the account owner's request. Users should revoke affected keys and contact Perplexity from their account email if they need help. Credential replacement is a protective step following unauthorised access; it does not mean every affected credential was misused. These findings apply to the providers and checks described above. They do not resolve whether other credentials or stored data were accessed or misused. ## What to do now 1. **Revoke affected keys or tokens at the service that issued them, unless that provider has confirmed they are disabled.** Add replacement credentials in AgenticFlow, then select the new connections in affected workflows and agents. Review secret-variable warnings too. Test with a small sample before resuming automatic runs. 2. **Check your usage at those services since November 2** for anything you did not do. OpenAI has a form for this: openai.com/form/appeal ("Report unauthorized activity involving my account"). For other services, contact their support. 3. **Watch for phishing.** Check the sender of any email about this incident. We never ask for passwords or keys. Where to replace keys: | Service | Where | | ----------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------- | | OpenAI and OpenAI-compatible endpoints | platform.openai.com → API keys (or your endpoint's key page) | | Google (Gemini / AI Studio) | aistudio.google.com → API keys, or Google Cloud Console → Credentials | | Anthropic | console.anthropic.com → API keys | | DeepSeek, Groq, Perplexity, OpenRouter, Tavily, Replicate, ElevenLabs, others | The service's API-keys page | | Telegram bot | In Telegram, open @BotFather → `/revoke` → choose the bot | | MCP servers on Pipedream | mcp.pipedream.com/accounts → sign in → disconnect each connected account | | MCP servers (Composio, Zapier, Make, custom) | Disconnect the connected accounts in that platform's dashboard; rotate the token at the server that issued it | | Google / Zoho / other accounts linked through an MCP platform | Account security → third-party access → remove the app | Old AgenticFlow API keys no longer work. Create replacements in **API Keys** and update applications that used the old keys. Existing sessions were ended; sign in again if prompted. **Not sure what you saved?** Sign in and review connection and secret-variable warnings in the app. Personalised connection lists were sent to affected workspace owners and admins on November 3. Not receiving an email does not establish that your credentials were unaffected. If you are not sure, email **** from your account email so we can check our records. **If your workspace holds other people's personal data** (for example in datasets or uploads), contact **** so we can support your own assessment and any notification duties you have. ## What was affected We cannot confirm, entry by entry, what was copied. The attacker had read access to the data and held the key that protects saved connections. Treat all of the following as exposed. * **Keys and tokens you saved in a workspace**: LLM provider keys (OpenAI, Anthropic, Google, DeepSeek, Groq and others, including OpenAI-compatible endpoints), Telegram bot tokens, MCP server settings (these often contain access tokens), and keys for other tools. * **Account data**: your email address and workspace role; content stored in AgenticFlow (conversations, agent threads, datasets, uploaded files); agent and workflow configurations; your AgenticFlow API keys. **Not affected** * **Your password.** Passwords are managed by our login provider and are not stored in our systems. No reset is needed. * **Card and bank details.** We do not store them; our payment provider does. ## What happened Two separate things were happening. **A swarm of automated agents.** From November 2, about 290,000 automated agents were created on about 1,900 throwaway accounts and used to run AI-model requests at our expense. That volume set off our alarms at 01:50 UTC on November 3. **A break-in.** The investigation that followed found something more serious. An attacker, on separate throwaway accounts, had abused two flaws in the layer that runs customer-built workflows and escaped the sandbox meant to contain that code. From there they could read the service's configuration, including the key that protects saved connections, and the data the service holds. An escape of this kind is hard to see from the inside. The swarm made it visible. This is our initial account. We preserved the evidence, the investigation continues, and findings may change as it does. Some technical details remain confidential during the investigation. Service availability does not mean the investigation is closed. A post-mortem follows when the investigation is complete. ## What we did All times UTC. | When | What | | ------------------ | --------------------------------------------------------------------------------------------------------------------- | | Nov 2, 10:26 | Earliest attacker activity found so far (identified during the investigation). | | Nov 3, 01:50 | Alarms on abnormal AI-model usage; investigation starts. | | Nov 3, 02:33 | Abused model-access credential revoked; abusive traffic at zero by 04:00. | | Nov 3, 03:30 | Model gateway removed from public access. | | Nov 3, 08:40 | Workflow engine shut down. | | Nov 3, 09:38 | Containment: service credentials replaced, affected cloud accounts disabled, public entry points locked. | | Nov 3, 11:07–13:59 | First customer notice. Affected keys reported to OpenAI, Google, Anthropic, Pipedream, Telegram, Composio and others. | | Nov 3, 19:40 | Notice emailed to all registered users; personalised lists sent to affected workspace owners and admins. | Since containment, we have replaced service credentials, disabled the affected cloud accounts, and deployed security improvements. We tested the system before restoring public access on November 5 and continue to monitor it. Review the recovery steps above before resuming your workflows. Removing or replacing a connection in AgenticFlow does not revoke its old credential at the provider; revoke it there unless the provider has already confirmed it is disabled. ## Other recent incidents We believe we are one of a series of platform companies targeted for the AI-provider keys they hold on behalf of their users. Recent incidents at other companies, each described in the company's own public post: * **Hugging Face, July 2026.** A malicious dataset ran code inside the dataset-processing layer, escalated to the host and harvested cloud and cluster credentials. The actor was an autonomous agent system working through a swarm of short-lived sandboxes. [Their post](https://huggingface.co/blog/security-incident-july-2026). * **Railway, October 2026.** Internal systems holding customer environment variables were accessed, and variables may have been decrypted. Railway describes it as one of a series of attacks on platform companies aimed at reaching AI inference providers. [Their post](https://blog.railway.com/p/security-disclosure-wednesday-october-21st). * **OpenCode, October 2026.** Provider API keys linked to its hosted console were exposed and used to run paid AI inference at scale. [Their statement](https://x.com/opencode/status/2111519637049319818). * **Fireworks AI, October 2026.** Compromised internal credentials were used to read environment variables of customer evaluation jobs. [Their bulletin](https://fireworks.ai/security/bulletins/october-2026-security-incident). We list these for context, not comparison. Each incident is its own, and ours is our responsibility. ## What we are changing * **Hardening beyond the two flaws.** We made security improvements and tested the system before reopening. Work continues on the layer that runs customer-built workflows, the handling of saved credentials, and the detection of automated abuse. We continue to monitor the service. * **Third-party integrations.** Saved provider credentials will get additional protections, and the most-used third-party capabilities will be brought into the core of AgenticFlow so that fewer keys need to be saved on our side. * **Transparency.** This page stays public until the incident is closed, followed by a post-mortem that describes the changes. ## Updates * **2026-11-06** — Public access resumed on November 5 after security improvements and testing. Monitoring continues; the investigation remains open. Clarification to the November 3 update: not receiving a personalised email does not establish that credentials were unaffected. Updated the recovery instructions and linked [Office Hour #59](/changelog/office-hour-59-connection-recovery-and-workflow-compatibility.md) for connection replacement, workflow compatibility, and testing guidance. * **2026-11-04** — Initial findings and response update. Page rewritten in plain language; added the mitigation steps of November 3 (02:33 and 03:30 UTC) and what happened in context. * **2026-11-03, 19:40 UTC** — Notice emailed to all registered users. Owners and admins of workspaces with saved keys received a personalised list of the connections to replace. If you did not get one, we did not find a saved connection in a workspace you own or administer; check spam first, then ask **** from your account email. * **2026-11-03** — Page published. Notices sent to owners of saved keys and tokens; reports with the affected keys sent to providers. Service paused. **Correction to our November 3 email:** we said a forced password reset and new AgenticFlow API keys would follow. Passwords are not stored in our systems, so no reset is needed; existing API keys will be revoked and you create new ones yourself (see "What to do now"). ## Contact * Questions about this incident, your data, or your connections: **** * Feature requests, for example a third-party capability you use today that you want built into the platform: **** * EU/EEA residents have the right to lodge a complaint with their national data-protection authority; UK residents with the Information Commissioner's Office. We are sorry this happened. We will keep this page updated until the incident is closed. AgenticFlow Security · Pixel ML, Inc.