- A scan of 7.6 petabytes of public AI training data on Hugging Face found 221,303 live, unique credentials in 6,003 datasets.
- The highest-impact secret exposed 393 GB of PII, covering an estimated 3.7% of the global population.
- Supply chain risks include 349 live GitHub personal access tokens (223 with full repo write, 130 with CI workflow write, 112 with admin:org, 110 with package publishing) and 318 Docker Hub tokens that can push images.
- Live cloud credentials include 8,557 GCP service-account keys, 3,343 AWS keys passing STS identity checks, and 8,594 live database logins.