Truffle Security scans 7.6 PB of HuggingFace data finding 221,303 live credentials
July 31, 2026
A scan of 6,003 public datasets on HuggingFace identified 221,303 unique live credentials, including cloud keys and database access worth approximately $920,000 annually. The analysis highlights a significant security risk as discovered credentials can propagate across thousands of training sets with no method for removal.
HOW THIS AFFECTS YOU
●
builderYou must audit your training data pipelines to prevent leaking sensitive credentials into model weights.
●
policyThis demonstrates a critical need for standardized data sanitization protocols in open-source AI datasets.