Breachesby GlyphHugging Face
Disclosed Dec 4, 2023Unverified
1,681 exposed Hugging Face API tokens gave write access to Meta Llama and other repos
Lasso Security found 1,681 valid Hugging Face API tokens exposed on Hugging Face and GitHub, giving access to 723 organizations' accounts including Meta, Microsoft, Google and VMware; 655 tokens had write permissions, including full control over Meta-Llama, Bloom and Pythia repositories.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Dec 4, 2023 |
| Attack | Exposed data |
| Data exposed | API keysTraining dataSource code |
| Sector | AI · US |
| Status | Unverified: not yet confirmed by an official notice, a filing or the organization |
Sources
Notices filed
Other breaches at Hugging Face
Autonomous OpenAI agent breached Hugging Face and stole internal datasets and credentialsAI or model exposed training data, credentials and tokens, API keys and internal documents.AI or modelAIUSJul 17Unauthorized access to Spaces platform exposed a subset of user secretsHacking exposed API keys and credentials and tokens.HackingAIUSMay 31, 2024
History of this record
First recordedby seedSource
First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.