GoKawiiltl;dr We scanned every public dataset on Hugging Face, which is where most open AI training data lives. That came to 7.6 petabytes across 187 million files, the largest secret scan of AI training data we know of. We found 221,303 live, unique credentials sitting in 6,003 datasets.
One of the highest-impact secrets we found had access to 393 GB of PII covering what we estimate to be roughly 3.7% of the global population. More on this will come in a dedicated follow-up. The rest of the scan shows how broad the problem is: cloud storage buckets, hosted databases, cloud-admin keys, and tokens that can push code into software a lot of people install.
We shared the findings with Hugging Face before publication; the company partnered closely with us, and CTO Julien Chaumond contributed native storage-bucket scanning support to TruffleHog.
You’ve probably seen the OpenAI and Hugging Face news. This scan began before that broke, but it’s worth pointing out that part of that kill chain involved stolen API keys. There has never been a stronger imperative for us to work with vendors to get their exposed keys revoked (please reach out to us if we’re not already working with you).
Tokens that can push code into things you install
Sometimes when we publish our findings of large quantities of keys, people ask how many of them actually materially matter. Here’s a bunch we found in this scan that have supply chain risk.
The scariest credentials here let you change software that other people run. Inside the training data we found 349 live GitHub personal access tokens: 223 with full repo write, 130 that can rewrite CI workflows, 112 with admin:org , and 110 that can publish packages. On top of that, 318 Docker Hub tokens that can push images. We checked npm and PyPI specifically and found zero live, so we’re not claiming those.
A single repo or admin:org token rewrites every repository its owner can push to, and that change ships to everyone who installs the result. Some of these tokens sit on accounts wired into software that millions of people run. Others belonged to accounts positioned deep in the software supply chain.
GitHub PAT Docker Hugging Face Docker Hub: push images 318 Hugging Face: write 237 GitHub: full repo write 223 GitHub: rewrite CI (workflow) 130 GitHub: admin:org 112 GitHub: publish packages 110 Hugging Face: org-admin 70 Live, verified tokens — hover a bar
Live, verified write-capable credentials found in public training data, counted by what they actually authorize.
... continue reading