7.6 Petabytes of Secrets: Massive Scan Reveals 221K Live Credentials in HuggingFace Training Data
Key Takeaways
- ▸221,303 live credentials discovered across 6,003 public HuggingFace datasets in the largest AI training data security scan
- ▸High-risk GitHub tokens with supply-chain impact found, including tokens from major AI labs, banks, and open-source project leaders
- ▸Single exposed credential grants access to 393GB of PII affecting approximately 3.7% of global population
Summary
Security researchers conducted the largest known scan of AI training data, analyzing 7.6 petabytes across 187 million files on HuggingFace—where most open-source AI training datasets reside. The scan uncovered 221,303 live, unique credentials embedded in 6,003 public datasets, including dangerously privileged GitHub tokens, Docker credentials, and cloud infrastructure keys with access to sensitive systems.
The findings revealed critical supply-chain risks: 349 live GitHub personal access tokens (223 with full repo write access, 130 capable of rewriting CI workflows), 318 Docker Hub tokens, and 8,557 live Google service-account keys across 3,811 projects. Most alarming was a single credential with access to 393 GB of personally identifiable information (PII) covering an estimated 3.7% of the global population.
HuggingFace demonstrated responsible disclosure practices by partnering closely with the research team before publication. The company's CTO Julien Chaumond contributed native storage-bucket scanning support to TruffleHog, the security scanning tool used in the research, strengthening defenses against future credential leaks in public datasets.
- HuggingFace proactively partnered on findings and contributed storage-bucket scanning enhancements to TruffleHog security tool
Editorial Opinion
This research exposes a critical vulnerability in the AI development pipeline: training data repositories have become silent supply-chain attack vectors. While HuggingFace's responsive partnership is commendable, the sheer scale of exposed credentials—particularly those with code-deployment capabilities—reveals a systemic problem in how the AI community treats secrets hygiene. The discovery of credentials affecting billions of people's PII should catalyze mandatory secret-scanning standards before datasets reach public repositories.
