Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets ◆ Truffle Security Co.
Pangram verdict · v3.3
We believe that this text is a mix of AI and human-written content.
AI likelihood · overall
MixedArticle text · 532 words · 5 segments analyzed
tl;dr We scanned every public dataset on Hugging Face, which is where most open AI training data lives. That came to 7.6 petabytes across 187 million files, the largest secret scan of AI training data we know of. We found 221,303 live, unique credentials sitting in 6,003 datasets.One of the highest-impact secrets we found had access to 393 GB of PII covering what we estimate to be roughly 3.7% of the global population. More on this will come in a dedicated follow-up.
The rest of the scan shows how broad the problem is: cloud storage buckets, hosted databases, cloud-admin keys, and tokens that can push code into software a lot of people install.We shared the findings with Hugging Face before publication; the company partnered closely with us, and CTO Julien Chaumond contributed native storage-bucket scanning support to TruffleHog.You’ve probably seen the OpenAI and Hugging Face news.
This scan began before that broke, but it’s worth pointing out that part of that kill chain involved stolen API keys. There has never been a stronger imperative for us to work with vendors to get their exposed keys revoked (please reach out to us if we’re not already working with you).Tokens that can push code into things you installSometimes when we publish our findings of large quantities of keys, people ask how many of them actually materially matter. Here’s a bunch we found in this scan that have supply chain risk.The scariest credentials here let you change software that other people run. Inside the training data we found 349 live GitHub personal access tokens: 223 with full repo write, 130 that can rewrite CI workflows, 112 with admin:org, and 110 that can publish packages. On top of that, 318 Docker Hub tokens that can push images.
We checked npm and PyPI specifically and found zero live, so we’re not claiming those.A single repo or admin:org token rewrites every repository its owner can push to, and that change ships to everyone who installs the result. Some of these tokens sit on accounts wired into software that millions of people run.
Others belonged to accounts positioned deep in the software supply chain.GitHub PATDockerHugging FaceDocker Hub: push images318Hugging Face: write237GitHub: full repo write223GitHub: rewrite CI (workflow)130GitHub: admin:org112GitHub: publish packages110Hugging Face: org-admin70Live, verified tokens — hover a barLive, verified write-capable credentials found in public training data, counted by what they actually authorize.One live repo-scoped token belonged to the founder of a widely used Model Context Protocol registry whose account was connected to the official MCP organization. That organization’s repositories hold servers and SDKs used by major AI coding tools and have more than 178,000 GitHub stars between them. Other examples included a highly privileged token held by an engineer at a large technology company, a developer at a bank, and a researcher at an AI lab. We are withholding the names of the people and organizations involved, and have responsibly disclosed our findings.Following Julien’s contribution to scan storage buckets, we’ve already scanned and found a vast quantity of new keys we’ll do a follow-up post about.Keys with real blast radiusThe scan also turned up live keys that open real infrastructure: cloud accounts, hosted databases, storage buckets, and messaging platforms.