1,600+ Exposed Hugging Face Tokens Put Top Models at Risk
On this page
A leaked write token to a model hub isn't just a credential — it's a key to poison what millions download.
| When | December 2023 |
|---|---|
| Target | Hugging Face accounts of 700+ organisations |
| Researcher | Lasso Security |
| Technique | Leaked/hardcoded credentials in public code |
| Impact | Write access to Llama 2, Bloom, Pythia and more |
- 1Developers hardcode Hugging Face tokens in public GitHub / HF code
- 2Researchers scan and recover 1,681 valid tokens — 655 with write access
- 3Those tokens could modify foundational models and datasets used by millions
What happened
In December 2023, Lasso Security scanned GitHub and Hugging Face and recovered 1,681 valid, hardcoded Hugging Face API tokens that opened the accounts of 723 organisations. 655 had write permissions, giving effective control to modify foundational models and datasets for projects including Meta's Llama 2, BigScience's Bloom, and EleutherAI's Pythia; read access reached 10,000+ private models and 2,500+ datasets.
How it happened
Tokens were committed into public code and left there. Anyone (including the researchers) could harvest them and, with the write-capable ones, alter the actual models and training data that downstream users pull.
Root cause
Secret sprawl in the model supply chain: high-privilege credentials embedded in code, with no scanning or rotation — so one leak becomes an ecosystem-wide poisoning risk.
What a control would have caught
Secret scanning on every repo and push (and short-lived, least-privilege tokens) catches hardcoded credentials before an attacker does.
How to prevent it
- Never hardcode tokens; use secret managers and scan for leaks.
- Least privilege + short TTLs; a read task should not hold a write token.
- Rotate and revoke fast — the vendors here revoked within a day.
Feel it yourselfThe replay lab hunts for a leaked provider key/secret an app left in its config.
FAQ
Why is a leaked token a supply-chain risk?
Write-capable tokens let an attacker modify the actual models and training data that millions of downstream users pull — turning one leaked secret into a poisoning vector across the ecosystem.
What access did the researchers find?
1,681 valid tokens giving access to 723 organisations' accounts; 655 had write permissions, and read access reached 10,000+ private models and 2,500+ datasets.
Was it exploited?
No evidence the write access was abused before revocation — many organisations revoked tokens the same day, and Hugging Face stopped its already-deprecated org_api tokens from reading private repos.