+1500 HUGGINGFACE API TOKENS WERE EXPOSED, LEAVING MILLIONS OF META-LLAMA, BLOOM, AND PYTHIA USERS VULNERABLE

Summary from the TLDR InfoSec newsletter

Lasso Security discovered over 1,500 exposed API tokens that could leave millions of users vulnerable to exploitation by malicious actors. Its team was able to gain access to high-value organization accounts and repositories, including from Meta, Microsoft, Google, and VMware. They also found that HuggingFace had deprecated org_api tokens but had not taken active actions to secure exposed tokens.