Lasso Security — 1,500+ HuggingFace API tokens exposed in code repositories
Date: 2023-12
Affected: HuggingFace — 1,500+ organisations including Meta, Google, Microsoft
Attack vector: auth-bypass
Category: real-world
Severity: Critical

Lasso Security discovered over 1,500 valid HuggingFace API tokens exposed in public GitHub repositories and CI/CD configurations. 655 tokens had write access to organisations including Meta, Google, Microsoft, and VMware. The tokens could be used to poison training data, modify model weights, inject malicious code into model repositories, or exfiltrate private datasets — affecting the entire AI supply chain dependent on HuggingFace.

Impact: AI supply chain compromise potential; model poisoning risk; training data modification; credential rotation required

Mitigations:
Automated secret scanning in CI/CD pipelines (pre-commit hooks)
Least-privilege API token scoping (read-only by default)
Token rotation policies with automated credential lifecycle management
HuggingFace organisation access audit and cleanup

Architectural layers (MAESTRO):
label: Deployment & Infrastructure
notes: API tokens committed to public code repositories and CI/CD configurations
role: origin
label: Agent Ecosystem
notes: Write-access tokens enable supply chain compromise across the AI ecosystem
role: propagation
label: Data Operations
notes: Training data, model weights, and datasets modifiable via leaked credentials
role: impact