2024 Spaces breach — auth tokens and API keys stolen
Data compromised
Authentication tokens, API keys, Spaces secrets
Technical writeup
Hugging Face detected unauthorized access to its Spaces platform in late May 2024. Hackers stole authentication tokens from Spaces; a subset of Spaces secrets (API keys, tokens) were accessed without authorization. Company revoked affected tokens and implemented KMS for Spaces secrets.
Root cause
Unauthorized access to Spaces platform