Truffle Security said its Hugging Face scan found 221,303 live credentials

Why it matters

Public AI datasets are copied and remixed faster than leaked keys are revoked, turning one exposed credential into a persistent supply-chain risk.

Dylan Ayrey (@InsecureNature), the co-founder and CEO of Truffle Security, said his security scanner found 221,303 live, unique credentials across 6,003 public datasets hosted by Hugging Face. The findings came from a scan covering 7.6 petabytes of data, according to research Truffle published on June 1.

The scale is a long way from how Ayrey started. In 2017, while unemployed and sleeping on co-founder Dustin Decker's couch, he wrote the first version of TruffleHog to hunt for API keys in Git history and submit bug-bounty reports. One of those searches surfaced a credential in a public Netflix repository; Ayrey later did security work for Netflix. He and Decker, who met as students at Rochester Institute of Technology, turned the open-source project into Truffle Security in 2021, according to RIT's account of their founding story.

That original problem has spread from source-code repositories into the raw material used to build AI systems. Public training corpora are assembled from code, websites, technical documents and chat transcripts, then filtered, copied and recombined into derivative datasets. A credential exposed once can survive across many of those copies long after its original file is removed.

What Truffle says it found

Truffle said it cloned every public dataset repository on Hugging Face, including branches and large-file objects, then converted formats such as Parquet, Arrow, JSONL and archives into text that TruffleHog could scan. The reported workload covered 186.9 million unique files across roughly 815,000 repositories.

About 670,000 repositories completed cleanly, according to the post. That leaves roughly 145,000 that did not, based on Truffle's rounded figures. The distinction limits Truffle's claim that it scanned "every public dataset": Truffle attempted platform-wide coverage, while a substantial share of repositories did not complete cleanly.

Truffle said it verified candidate credentials directly with the services that issued them. Its reported findings included 8,557 live Google service-account keys, 8,594 working database logins, 3,343 AWS keys that passed identity checks, 231 Slack tokens and 5,654 Mailgun keys. The scan also found credentials capable of changing software distributed to other users, including 223 GitHub tokens with full repository-write access and 318 Docker Hub tokens that could push images.

Ayrey's team said it limited its checks to authentication and metadata, such as database sizes, storage totals and permissions. Truffle said it did not read database rows, list stored objects, download files or modify systems.

The most consequential number may be the duplication rate. Truffle reported that 44% of the unique live credentials appeared in multiple datasets, with 19,380 showing up in at least 10. One Infura key appeared in 1,131 datasets and 10,162 file locations after being pasted into a chatbot conversation and swept into a public chat-log corpus, according to the research.

That copying pattern changes the response required after a leak. Removing a credential from one repository or dataset leaves other versions untouched. Rotation at the issuing provider is the only reliable way to render every copy useless.

Hugging Face was already scanning uploads

The research does not cast Hugging Face as the source of the exposed credentials. Most originated in public code, websites or conversations that dataset builders later collected. Truffle said that, among traceable Hugging Face write and organization-admin tokens, about 700 had been scraped from material belonging to someone other than the dataset publisher, while 63 were uploaded by their owners into their own namespaces.

Hugging Face's security documentation says the platform runs TruffleHog on each push and emails users when it detects a verified secret. Truffle said Hugging Face CTO Julien Chaumond also contributed native storage-bucket scanning support to TruffleHog.

Those controls depend on users revoking exposed credentials after an alert. The live keys in Truffle's scan show the gap between detection and remediation: a warning does not neutralize a credential, and a secret copied from an upstream source may belong to someone who has no relationship with the dataset publisher receiving the alert.

Ayrey is turning an open-source scanner into an AI security company

The Hugging Face project gives Truffle Security a large-scale demonstration of the verification engine at the center of its commercial product. TruffleHog classifies credentials and attempts to determine whether they still authenticate, allowing security teams to separate active access from strings that merely resemble keys.

Truffle Security raised a $14 million Series A led by Andreessen Horowitz in 2021. On November 6, 2025, Truffle announced a $25 million Series B led by Intel Capital and a16z, with Abstract, Lytical Ventures and several security executives participating. The valuation was not disclosed.

The Series B financed Truffle's expansion from finding exposed credentials toward analyzing what each credential can access. The Hugging Face research follows the same direction. Counting keys creates a headline; verifying permissions, reachable infrastructure and duplication paths gives security teams a remediation order.

The research also serves Truffle's commercial interests. A scan showing credentials scattered through popular AI data makes a direct case for scanning corpora before publication and training. That alignment does not invalidate the findings, though it raises the bar for evidence.

Truffle published the methodology and aggregate results while withholding affected dataset names, file paths and credential material to prevent abuse. That decision protects credential owners, but it also means outside researchers cannot reproduce the headline total from the post alone. The figures remain Truffle's self-reported results rather than an independently replicated measurement.

The underlying failure mode is clear even with that constraint. AI developers have treated public datasets as inert input. Ayrey's scan shows they can also contain working access to cloud accounts, databases, communications systems and software distribution channels. Each remix preserves the credential until its owner rotates it, giving a bug-bounty tool written on a couch a new job policing the AI data supply chain.