2023 Hugging Face — 1,600+ API tokens exposed, 723 orgs

2023 1.7K records affected

Data compromised

API tokens; repository access

Technical writeup

Lasso Security found 1,600+ Hugging Face API tokens in public repos. 723 organizations affected; 655 had write permissions. Meta, Microsoft, Google, VMware tokens exposed. Risk: model poisoning, 10K+ private models, 1M+ users. Tokens in public code.

Root cause

Exposed credentials in public repositories

References

https://www.theregister.com/2023/12/04/exposed_hugging_face_api_tokens/
https://www.lasso.security/blog/1500-huggingface-api-tokens-were-exposed-leaving-millions-of-meta-llama-bloom-and-pythia-users-for-supply-chain-attacks