Kernel, a browser platform for AI agents, reports an intrusion into its servers

Kernel, a company that provides cloud browsers for AI applications and agents, has published a security incident notice dated November 4, 2026. According to the company, it detected the incident on November 2 and it affected 0.28% of its customers, without giving an absolute figure.

According to the company's timeline, on October 24 an unauthorized third party used a compromised Kernel API key, and on October 27 used it to break into an employee's access to its logging provider, from which it downloaded data containing a small number of API keys and third-party secrets from customer deployments.

On November 3, again according to Kernel, the same actor used a compromised credential from its hosting provider to access four GPU servers: three were running customer browser sessions and one held no customer data. The company recorded an attempt to launch a cryptocurrency mining program on them.

Kernel says the attackers are financially motivated and that the attack was part of a broader cryptomining campaign, and writes that it believes they rely on the AI-assisted pentesting platform ARTEX as a command center to automate the campaign. It does not identify the perpetrators.

The company says it revoked the credentials, blocked the IP addresses involved, disconnected the affected servers, rotated credentials and notified the organizations whose data was exposed. It has not explained how the initial key was leaked.