Incident Resolved!

Incident Report: Unauthorized Data Access & Security Exploit

28 December 2025 • INCIDENT-2025-001 • CRITICAL
Security Advisory A vulnerability in our compilation pipeline led to unauthorized access to a subset of user data. The exploit has been patched, and all affected systems are secured.

To our community and partners,

We are writing to inform you about a significant security incident that occurred on the YGAI platform. Earlier today, our security monitoring systems detected unauthorized activity targeting our code generation infrastructure.

We take full responsibility for this failure. Security is the foundation of trust, and today, we fell short of the high standards we set for ourselves. For that, we are deeply and sincerely sorry.

What Happened

During a routine system audit following a series of compilation errors, our engineering team identified anomalous traffic patterns targeting our plugin generation API. Upon immediate investigation, we confirmed that a malicious actor had leveraged a sophisticated injection exploit within our JSON parsing logic to bypass security sanitation layers.

This exploit allowed the attacker to temporarily gain unauthorized read access to a specific segment of our database.

Impact Assessment

Our forensic investigation has determined that the following information was compromised:

  • User Account Data: Portion of [~5-7%] Email addresses and usernames of registered users.
  • Stored Artifacts and Keys: A subset of plugin code generated on the platform and severals servers private key were leaked.
  • Data Stored on Our Servers: Portions of preliminary safety sub-consultancy work and 3D designs stored on our servers for our enterprise partners.

Crucially: No passwords, payment information, or financial records were accessed. All passwords are salted and hashed using industry-standard encryption protocols and remain secure.

Response & Remediation

The moment the exploit was verified, our Incident Response Team executed the following protocols:

Immediate Patching The vulnerability in the API handler was identified and patched within 25 minutes of discovery.
System Lockdown We temporarily suspended the compilation service to perform a full forensic audit of our infrastructure.
Credential Reset While passwords were not compromised, we have forced a session logout for all users as a precautionary measure and our AI Monitoring system thankfully automatically reseted the server's private keys.
Enhanced Monitoring We have deployed stricter input sanitation rules and real-time threat detection monitors to prevent recurrence.

This is the first security breach in YGAI's 5-year history. We pride ourselves on building secure, reliable tools for developers, and falling short of that standard is unacceptable to us.

Moving Forward

We have already reached out directly to the affected enterprise partners to assist with their internal security assessments. For our user community, we are rolling out an apology campaign that includes crediting free generations to all affected accounts.

We are committed to learning from this incident. In the coming weeks, we will be engaging a third-party security firm to conduct a comprehensive penetration test of our entire platform.

"We failed to protect your data, and there are no excuses for that. We will work tirelessly to regain your trust."
Regards.
Sorry, once again.