Thieves pilfer environment variables from Trigger AI workflow tool. So, who's ready to clear the dust out of that server closet and move things back on-prem? If you're a customer of cloud-hosted AI workflow platform Trigger.dev, take heed, because your environment variables may have been exposed in a security incident disclosed on Sunday. Trigger offered little explanation in its Sunday security incident report, noting that its investigation had identified "exposure across a subset of organizations" and that an attacker had gained unauthorized access to environment variables belonging to those organizations. Whatever exploit was used to gain access has been blocked, the company added, and affected customers have been notified of steps they need to take to prevent further security problems. CyberSwissGuards likely don't have to tell The Reg readers how important environment variables are in SaaS and cloud services like Trigger. If compromised environment variables contain sensitive credentials, an attacker could basically end up with the keys to the kingdom, potentially gaining access to connected services and digital infrastructure. For those unfamiliar with Trigger.dev, it's a platform for building AI agents and workflows in TypeScript, but here's the kicker: Trigger advertises itself as a durable execution platform that handles pesky things like retries, scaling, and keeping long-running tasks going through crashes and redeployments, while providing tools to monitor what those tasks are doing. Trigger, the company's site notes, can be used to "build durable AI agents that survive refreshes, redeploys, and crashes," and is ideal for "long-running tasks with retries, queues, AI observability and elastic scaling." In short, companies running their AI on Trigger probably want it to keep running, which makes stolen environment variables all the more dangerous. Elastic scaling, automated retries, and, as Trigger notes, the ability to run lots of concurrent operations without timeouts could compound the consequences of compromised API keys, depending on what those credentials allow an attacker to access. An attacker with stolen credentials could potentially interfere with a customer's connected services or workflows. Additionally, Trigger recently added webhooks to its offering, supporting services like Stripe, Supabase, and Slack, potentially expanding the range of integrations that could be affected if their credentials were exposed. This could be pretty bad for anyone affected. Trigger has some fairly high-profile customers, with companies like fashion brand Emporio Armani, Pentagon-supporting AI acquisitions platform GovSignals, SaaS calendar platform Cal.com, and others all listed on the company's site. Trigger has not publicly identified which organizations were affected by the intrusion. CyberSwissGuards reached out to Trigger, which declined to provide any additional information on the incident. A company spokesperson instead told CyberSwissGuards to wait for a full incident report to learn more. Luckily for Trigger customers and those concerned about SaaS security now that AI is regularly coming up with new vulnerabilities in commonly used platforms, Trigger is open source and can be self-hosted, which might be a better alternative in this day and age than relying on a hosted service. (R)

Your AI agents won't run in production. This $16M Series A changes that. Trigger.dev secures $16M to fix the broken plumbing of the AI agent economy. Trigger.dev has raised a $16 million Series A round led by Standard Capital to solve a problem that is quickly becoming the bottleneck of the AI boom: actually running agents in production without them crashing. The round values the company at $120 million pre-money. It includes participation from Y Combinator, Pioneer Fund, Liquid2, and a cohort of angel investors specializing in developer infrastructure. While the hype cycle focuses on what AI agents can do, Trigger.dev is focused on the unglamorous reality of how they fail. The startup's open-core platform is now used by more than 30,000 developers to manage background jobs and complex workflows, handling hundreds of millions of executions monthly. "Everyone is rushing to build AI agents," said CEO and co-founder Matt Aitken. "Almost no one is ready to run them in production." From JSON headaches to backend orchestration. Aitken's path to infrastructure wasn't linear. After studying architecture and working in game design, he teamed up with co-founder Eric Allam to build JSON Hero, a tool designed to make complex data readable. While the tool found an audience, the founders noticed a deeper issue plaguing their users. Engineers were struggling to manage the invisible logic that powers applications. Fetching data, calling APIs, and syncing systems required a patchwork of queues and retry logic that often broke. When a server restarted, jobs died silently. A single failed API call could derail a complex workflow, and debugging became a forensic exercise that took days. The existing solutions were either too simple for engineers or too complex for rapid development. "Modern web frameworks made frontends joyful," Aitken said. "But the backend job layer was still hacked together on weekends and held together with hope." Trigger.dev pivoted to build the missing piece: a code-first orchestration engine. It provides the reliability of a massive distributed system but allows developers to write standard code without wrestling with proprietary configuration files. Betting on the agent economy. Standard Capital led the round after tracking Trigger.dev's post-YC trajectory, where execution volume jumped 10x. The firm's thesis is that the market is shifting from static chatbots to autonomous agents that perform multi-step tasks across the web. The founders estimate the total addressable market for this infrastructure at $12 billion by 2027. They argue that as LLMs begin making decisions mid-workflow - deciding to process a refund or file a compliance report - the underlying infrastructure needs to be far more resilient than what exists today. Current tools like Zapier handle simple automations well, and AWS Step Functions handle scale, but neither offers the developer experience or the granular observability required for AI agents that might hallucinate or loop unexpectedly. "We see Trigger.dev as the AWS moment for the agent layer," a partner at Standard Capital noted. "Everyone is experimenting with agents. Very few teams can keep them reliable under real-world load." The technical moat. Trigger.dev functions as a distributed orchestration engine with "deterministic replay." This means every step of a workflow - state, inputs, and outputs - is recorded. If a process fails, it can be inspected and replayed from the exact point of failure. This is critical for AI agents, which face three primary failure modes: * Brittle integrations: A 50-step chain collapses if one API times out. * Runaway costs: Loops that get stuck can rack up massive OpenAI bills before anyone notices. * fragmented context: Trying to stitch together LangChain, cron jobs, and queues usually results in data loss. Trigger.dev attempts to solve this with built-in retries, exponential backoff, and deep observability that flags anomalies like runaway loops immediately. "The boring parts of running agents - retries, queues, observability - are exactly what we obsess over," Aitken said. "Developers should not be debugging Stripe refunds at 3 a.m. because an agent silently failed." Traction and revenue. The company creates a moat through an open-core model. The framework is open source (MIT licensed), but the cloud platform - which offers the proprietary metrics and high-scale orchestration - is where the revenue sits. Revenue has grown 11x year-over-year. Currently, about 1,200 customers run production workloads on the platform. These aren't just hobbyist projects; 85 enterprise accounts exceed a million executions per month. Use cases span from a Fortune 500 retailer automating supply chains to a top 5 U.S. bank running fraud detection agents. Interestingly, the average execution time on the platform is 8.2 minutes, indicating deep, complex processing rather than simple webhooks. The competitive landscape. Trigger.dev is fighting a multi-front war. It competes with Temporal on orchestration, LangChain on agent frameworks, and cloud giants like AWS on serverless functions. Against Temporal, Trigger.dev leverages a TypeScript-first approach that feels more native to web developers than Temporal's configuration-heavy setup. Against AWS Step Functions, they compete on price and debuggability, offering "execution diffing" to spot exactly where two agent runs diverged. "Most custom agent systems lose context the moment something goes wrong," Aitken said. "We designed Trigger.dev so context is a first-class citizen, not an afterthought." Looking ahead. The new capital is earmarked for three main goals: achieving SOC 2 compliance to unlock healthcare and finance sectors, expanding their integration library to over 300 APIs, and building "self-healing" workflows where LLMs can attempt to correct failed steps automatically. The team acknowledges the risks. If the "AI winter" arrives and agent adoption slows, the market could contract. However, Trigger.dev remains hedged: roughly 60% of their current revenue comes from traditional, non-AI background jobs like database syncs. Ultimately, Aitken believes reliability is the product. "Runway is not our moat," Aitken said. "Our moat is how many of the world's agents quietly depend on us to do their job."

Article at a glance:Cyberpunk Edgerunners Season 2 is officially happening, and Trigger is back to animate it.The sequel was announced at Anime Expo 2025 with a teaser visual and staff reveals.No release date yet, but expect a brand-new story, possibly with new characters.