Researchers find 1,500+ exposed Hugging Face API tokens with write access

Researchers reported on December 4, 2023 that they had found more than 1,500 exposed Hugging Face API tokens, some carrying write access, that exposed large language model repositories belonging to Meta and hundreds of other organizations. The tokens let the researchers gain full read and write access to Meta's Bloom, Meta-Llama and Pythia repositories on the Hugging Face platform.

What happened

Researchers at Lasso Security scanned GitHub and Hugging Face during November 2023 to see whether they could find exposed API tokens usable to reach data sets and models on Hugging Face. They found a total of 1,976 tokens across both platforms, of which 1,681 turned out to be valid and usable, with 1,326 on GitHub and 370 on Hugging Face. As many as 655 of the discovered tokens carried write permissions on Hugging Face, and some granted full access to 77 organizations tied to Meta-Lama, Pythia and Bloom. Several tokens tied to Meta included one with write permissions to Meta Llama and two each with write permissions to Pythia and Bloom.

Impact

The exposed tokens provided varying degrees of access to repositories belonging to a total of 722 other organizations, among them Google, Microsoft and VMware. Such access would have allowed an adversary to silently poison training data in widely used LLMs, steal models and data sets, and carry out other malicious activity heightening security risk for millions of downstream users. Tokens tied to Microsoft and VMware carried read-only privileges but still let the researchers view all of those companies' private data sets and models.

Response

Lasso disclosed its findings to all impacted users and organizations with a recommendation to revoke the exposed tokens and delete them from their repositories, and it notified Hugging Face about the issue. According to Lasso's report, many of the named organizations, including Meta, Google, Microsoft and VMware, took very fast and responsible actions and revoked the tokens and removed the public access token code the same day the report reached them.

Lessons for security leaders

The episode was described as a demonstration of the supply chain risks to organizations using these repositories to integrate LLM capabilities into their applications and operations. Security teams should treat write-scoped tokens on model-hosting platforms as high-value credentials, since an attacker with write privileges could replace the existing models with malicious ones or create an entirely new malicious model in their name.