221,000 Live Secrets Found in 7.6PB of Hugging Face Training Data

Security researchers scanned every public dataset on Hugging Face — 7.6 petabytes across 187 million files — in what's described as the largest secret-scanning effort ever run against AI training data. The scan surfaced 221,303 live, unique credentials spread across 6,003 datasets, ranging from cloud admin keys to database logins and CI/CD tokens.

Notable findings include 349 live GitHub personal access tokens (many with full repo write or admin:org scope), 318 Docker Hub push tokens, 8,557 live GCP service-account keys spanning 3,811 projects, and thousands of working database and messaging credentials. One repo-scoped token traced back to a maintainer linked to a widely used Model Context Protocol registry whose repositories carry over 178,000 combined GitHub stars.

The team also quantified exposure to AI provider accounts: 11,496 live keys for OpenAI, Azure OpenAI, Anthropic, Gemini and others, translating to a conservative floor of roughly $920,000 per year in potential stolen inference capacity based purely on default spend caps. Hugging Face was notified before publication, and its CTO contributed storage-bucket scanning support to the open-source TruffleHog tool used in the research.

The findings highlight a persistent AI supply-chain risk: secrets pasted into code, notebooks, or even chatbot conversations get baked into public training corpora, giving attackers durable, hard-to-revoke access long after the original leak.