TLDR Tech / InfoSec
Scanning 7.6 Petabytes of HuggingFace Training Data for Secrets
Truffle Security scanned all 7.6 petabytes of public Hugging Face datasets (187 million files) with TruffleHog and found 221,303 live, unique credentials across 6,003 datasets, including 349 GitHub PATs with repo-write/CI/admin:org scope, 318 Docker Hub push tokens, 8,557 live GCP service-account keys, 8,594 working database logins, and 742 OpenAI plus 26 Anthropic keys carrying a conservative $920K/year inference-abuse floor. Leaks compounded through scrape corpora like The Stack and Common Crawl, with 44% of unique secrets appearing in more than one dataset and one AWS key, pasted into a chatbot, mirrored across 1,131 datasets. Hugging Face was notified pre-publication and contributed native storage-bucket scanning to TruffleHog. The company withheld all names, dataset paths, and key material, and recommends scanning corpora before publishing or training and treating any publicly exposed key as burned.
Read the full story