7.6 PB of Hugging Face Data Leaked 221K Live Credentials, Including Repo‑Write Tokens
Truffle Security scanned every public Hugging Face dataset—7.6 petabytes across 187 million files—and uncovered 221,303 unique live credentials in 6,003 datasets. Among them were 349 GitHub personal access tokens with repo‑write scope and thousands of AWS and Hugging Face API keys, giving attackers the ability to inject malicious code into widely‑used AI models.