Hugging Face's training data harbored hundreds of thousands of live credentials, some with direct supply chain access

The risk hiding inside AI training data is not only about what a model learns. It is about what got swept up in the corpus before anyone looked.

Zane Lackey raised the alarm with a figure that deserves attention on its own terms: Hugging Face’s training sets contained approximately a quarter million live credentials. Not expired tokens. Not test keys. Active ones. “Turned out there were about a quarter million live keys in their training sets, many of which had direct supply chain implications. There was a foundational Linux library that one of the keys had direct push access to. It could have pushed malware to most.”

The phrase “could have pushed malware to most” is doing real work there. A credential with write access to a widely distributed Linux library is not a data-leak problem in the ordinary sense. It is a single key sitting upstream of a large fraction of the software that organizations run, build on, and ship. The exposure would not need to be sophisticated to be catastrophic: anyone who found that key in a scraped dataset and recognized what it opened could have introduced a malicious commit to a library that propagates through dependency chains before any downstream consumer notices.

External investigation confirms the scale of the problem. Truffle Security published the results of a scan covering 7.6 petabytes of Hugging Face’s public datasets and found 221,303 live, unique credentials. That figure sits close to Lackey’s quarter-million estimate, and the methodology behind Truffle Security’s number is explicit: they scanned the actual data, not metadata or sample sets. TechCrunch and RuntimeWire each reported on the findings independently. Separately, Lasso Security documented thousands of exposed Hugging Face API tokens, with the same supply chain attack surface in view.

Turned out there were about a quarter million live keys in their training sets, many of which had direct supply chain implications. There was a foundational Linux library that one of the keys had direct push access to. It could have pushed malware to most Zane Lackey

The Hugging Face platform occupies a structural position in AI development that amplifies what would otherwise be a routine secrets-management failure. Models, datasets, and the tooling built around them flow through Hugging Face the way code flows through GitHub. When credentials leak into a GitHub repository, the blast radius is usually bounded: it is one project, one team, one set of services. When credentials leak into training datasets that are themselves downloaded, forked, and mirrored at scale, the exposure multiplies with every copy of the data. A key that exists in a training set may exist in thousands of derivative copies before anyone revokes it.

There is also a detection problem. Secrets management tooling is well developed for code repositories. Scanning petabytes of dataset files, many in formats that do not resemble source code, requires dedicated effort that most dataset consumers are not applying. Truffle Security’s scan was notable partly because it happened at all. The question it raises is what remains unscanned in the broader ecosystem of AI training data that organizations are building on right now.

Lackey’s framing puts the supply chain angle front and center, and that framing holds up. The specific risk he describes, a key with push access to infrastructure that reaches most of the software stack, is not hypothetical. The access existed. Whether anyone malicious found and used it before revocation is a separate question, but the window was open. In supply chain security, the window being open is the event. The absence of a confirmed exploit does not retire the exposure; it only means the outcome was fortunate rather than contained.

The Truffle Security findings and the parallel reporting from Lasso Security make clear that this was not an isolated credential or a one-off scraping accident. It was a systemic condition of the training data as it existed on the platform. The broader AI development community has spent considerable energy debating what models trained on public data have absorbed in terms of copyrighted text or personal information. The question of what active infrastructure credentials are sitting in those same datasets has received less attention, and the answer, documented at scale now, is that the number runs well into the hundreds of thousands.