2024-06 · 2024-Q2
Hugging Face Spaces Breach
Should this run hold this key at all?
- Fixable
- Vendor patch
- Vendor response
- Patched
- In the wild
- Yes
- Actor
- Attacker
Target
Hugging Face Spaces platform
Impact
Unauthorized access to authentication secrets, API tokens, and keys used by developers
Root cause
Unauthorized access to platform secrets storage
Sources
Catalog
Cite this: AgentProv incident record: Hugging Face Spaces Breach (2024-06). https://agentprov.com/incidents/2024-06-hugging-face-spaces-breach
Related
- Also L1 · 2026-10-21LiteLLM 1.107.0 on PyPI and Docker Ships a Credential Stealer That Runs at Every Python StartupL1Credential
- Also L1 · 2026-10-17OpenCode Console Breach Exposes Users' Stored OpenAI, Anthropic, and Google API KeysL1Credential
- Also L1 · 2026-10-13IBM MCP Context Forge Shipped a Known JWT Secret, Letting Anyone Mint Platform Admin Tokens (CVE-2026-53709)L1Credential