Truffle Security cloned and scanned every public dataset on Hugging Face — 7.6 petabytes, 186.9 million unique files, roughly 815,000 dataset repositories, of which about 670,000 finished cleanly — flattening Parquet, Arrow, JSONL, archives and binaries into scannable text and running TruffleHog with live verification enabled. The result is 221,303 unique, verified-live credentials sitting inside 6,003 public training corpora. The previous largest web-scale scan the team had run topped out near 400 terabytes, so this is roughly a nineteen-fold jump in surface area.
The breakdown matters more than the headline. Cloud infrastructure accounted for 13,100 live keys: 8,557 Google Cloud service-account keys across 3,811 projects, including 1,926 Firebase admin keys, one with an explicit Owner role and one Kubernetes cluster-admin; 3,343 AWS keys that passed STS identity checks, 907 of which could list buckets, with 8,676 buckets visible through metadata and a confirmed 51.7 terabytes sitting in buckets that had public access blocked. Hosted databases contributed 8,594 live logins totalling 3.5 terabytes by size metadata — the median MongoDB cluster was a trivial 2.8 megabytes, but 89 MongoDB clusters and five Postgres databases exceeded a gigabyte, the largest MongoDB instance holding 617.7 gigabytes. Email and messaging contributed 14,500 keys, and AI provider accounts another 10,700, including 742 live OpenAI keys and 26 live Anthropic keys. Using published entry-tier spend caps alone, the authors put a floor of roughly $920,000 a year on that exposure, and they are explicit that this is a floor derived from caps, not a measurement of actual balances or unauthorized use.
The supply-chain findings are the sharper edge. Among 349 live GitHub personal access tokens, 223 carried full repository write, 130 could rewrite CI workflows, 112 held admin:org, and 110 could publish packages; 318 Docker Hub tokens carried push rights. One live repository-scoped token belonged to the founder of a widely used Model Context Protocol registry whose connected organization repositories carry more than 178,000 GitHub stars combined. npm and PyPI were checked specifically and returned zero live tokens.
The amplification analysis is what makes this structural rather than anecdotal. Forty-four percent of unique live secrets appear in more than one dataset, and 19,380 appear in ten or more. The Stack and its forks alone carry 51,571 distinct live keys; the Dolma family carries 28,110; and of keys reaching ten or more datasets, 99.3 percent pass through one of these scrape corpora. Two near-identical stack-edu re-uploads share all 19,977 of their keys. Chat logs turn out to be a genuinely new leak path: one Infura key pasted into a ChatGPT conversation was captured by WildChat and copied into 1,131 public datasets across 10,162 file locations, and a live AWS key for a Brazilian lending fintech reached training data through boto3 code pasted into a chatbot, captured by LMSYS-Chat-1M and mirrored roughly eighteen times.
Impact measurement was deliberately metadata-only — database size statistics, Redis memory counters, CloudWatch bucket-size metrics — with no rows read and no objects listed. Coverage is incomplete, closed corpora are invisible by construction, and disclosure at this scale is unsolved: emailing 221,303 owners is not realistic, so names, dataset names, file paths and key material are all being withheld while notification runs through provider partner channels. Hugging Face's CTO contributed native storage-bucket scanning support to TruffleHog for an upcoming release.