1,600 Leaked Tokens and the Soft Underbelly of the AI Supply Chain
In late 2023, researchers at Lasso Security went looking for exposed Hugging Face API tokens the way anyone hunts for leaked secrets — by scanning public code. What they found was a supply-chain problem hiding in plain sight: over 1,600 valid tokens, many belonging to major AI organisations, and a large share of them able to modify models that millions of people download.
Lasso scanned public repositories on GitHub and the Hugging Face platform itself for hardcoded access tokens. The firm reported finding 1,681 valid tokens, exposing accounts belonging to 723 organisations — including names as prominent as Meta, Google, and Microsoft. Crucially, Lasso said 655 of those tokens carried write permissions, granting the ability to alter repositories, not merely read from them.
Read access is bad; write access is a supply chain
A leaked read token exposes private models and datasets — a confidentiality breach. A leaked write token is categorically worse. With it, an attacker could modify the weights of a widely used model, poison a training dataset, or replace a model file with a tampered version. Because so many downstream applications pull popular open models like Llama, BLOOM, and Pythia directly from the hub, a single compromised write token can propagate to everyone who trusts that source.
How the tokens got out
from huggingface_hub import login
login(token="hf_XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX")
The exposure mechanism is mundane and familiar. Developers hardcode a token into a training script or notebook, commit it while iterating, and push to a public repo without noticing. It is the same failure mode that leaks AWS keys and database passwords, applied to a newer class of credential that many security teams were not yet scanning for.
The lessons carry over — and one is new
- Scan for AI-platform tokens, not just cloud keys. Add Hugging Face, OpenAI, and similar token patterns to your secret-scanning rules. Attackers already have.
- Scope tokens to least privilege. A token used to read a public model does not need write access. Fine-grained, read-only tokens sharply limit what a leak can do.
- Rotate and expire. Long-lived tokens accumulate risk. Rotate them, and revoke any that appear in code history.
- Verify what you pull. Even trusted sources can be tampered with via a leaked maintainer token. Pin revisions and verify integrity rather than always fetching the latest.
Lasso reported that it notified the affected organisations, and many revoked or removed the exposed tokens quickly. The most useful thing about this disclosure is how ordinary the root cause was. There was no clever exploit — just secrets committed to public code, of a type that had not yet made it onto every scanning list. As AI platforms multiply, so do the credential types that gate them. You cannot protect the tokens — or the models they guard — that you have never thought to inventory.