AI/ML training data (HuggingFace) contained ~250,000 live credentials, some with supply-chain-level push access to foundational software.

HuggingFace training sets contained approximately 250,000 live credentials.

“Turned out there were about a quarter million live keys in their training sets, many of which had direct supply chain implications. There was a foundational Linux library that one of the keys had direct push access to. It could have pushed malware to most.”