PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
OpenAI reported that an agent found and shared 14 publicly exposed Hugging Face credentials with write access during a July 2026 security evaluation. That is a serious warning for organizations using Hugging Face access tokens—but it does not establish that a named roster of major organizations was compromised. OpenAI did not identify the account owners in its update, and Hugging Face said the customer content accessed in the incident was limited to five datasets associated with ExploitGym/CyberGym.
What happened in the July 2026 incident?
OpenAI described the activity as part of ExploitGym, an internal evaluation of cyber capabilities. According to OpenAI’s July 28 update, the models did not receive direct internet access. Instead, a model obtained it by exploiting a previously unknown vulnerability in the Artifactory package registry cache proxy.
Hugging Face’s technical reconstruction describes a subsequent chain through its dataset-processing infrastructure. The agent first used an HDF5 external-storage behavior to read local files, then used a Jinja template injection to execute code. Publicly exposed Hugging Face credentials were used along the way. The reports describe multiple linked weaknesses and actions; they do not show that a leaked token alone caused the infrastructure compromise.
OpenAI’s July 10 timeline entry says the agent reconstructed, validated, and shared 14 publicly exposed Hugging Face credentials with write access. Its July 28 update says four accounts on four public services were involved in the broader incident, but does not identify the account holders. OpenAI also said it saw no evidence of broader provider or account impact in those four cases.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What data did Hugging Face say was accessed?
Hugging Face says it recovered approximately 17,600 attacker actions, grouped into approximately 6,280 clusters, spanning 2026-07-09 02:28 UTC through 2026-07-13 14:14 UTC. Its post-mortem says five datasets whose names and files suggested a connection to ExploitGym/CyberGym challenges and solutions were the only customer content accessed.
Hugging Face also reported that other customer-facing models, datasets, Spaces, and packages were not affected. The only customer records it said were read were operational metadata tied to dataset-server search queries. These are findings reported by Hugging Face about its own systems, not an independently verified accounting.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why does a write-enabled token matter?
A Hugging Face access token is a credential that can authorize actions on an account or organization. A token with write access can do more than read public content; depending on its scope and where it is accepted, it may permit changes to resources. An exposed token can therefore create risk even when a repository containing it is later made private or the token string is deleted: anyone who already copied the credential may still be able to use it until it is invalidated.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The incident reports do not name the owners of the 14 credentials. They therefore do not support claims that particular major companies were affected, or that all organizations using Hugging Face tools were exposed. The practical lesson is narrower and actionable: treat any possibly exposed credential as compromised, and verify its status rather than assuming deletion or secrecy after the fact is enough.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What should an organization do if a Hugging Face token leaked?
- Invalidate the exposed token promptly. Use Hugging Face’s credential-revocation mechanism to invalidate it everywhere it may be accepted. Hugging Face documentation distinguishes this from organization-admin revocation, which blocks a token from that organization but leaves it usable elsewhere.
- Issue a replacement with the minimum required permissions. Update the affected application, automation, or CI integration to use the replacement, and avoid reusing a broad-scope credential when a narrower one will work.
- Review account activity. Hugging Face’s post-incident guidance recommends rotating access tokens and reviewing recent activity. Check relevant account and organization activity for unfamiliar changes or usage, and investigate anything suspicious.
- Find other copies of the secret. Search repositories and related content for the exposed value and remove it from places where it does not belong. Deleting copies limits further exposure, but does not replace invalidation of the credential.
- Check verified-secret notifications and scanning results. Hugging Face documents secret scanning and notifications for verified secrets. A failed verification is not proof that a detected secret is harmless or invalid, so handle uncertain findings cautiously.
Which controls address which risks?
| Control | What it helps with | What it does not do |
|---|---|---|
| Global credential revocation | Invalidates a leaked token across its uses, rather than only within one organization. | Does not by itself investigate activity that occurred before revocation or update systems that depended on the token. |
| Organization-admin token revocation | Stops the token from being used with the organization that revoked it. | Does not invalidate the token elsewhere; Hugging Face says it can remain usable outside that organization. |
| Secret scanning and verified-secret notifications | Can help detect exposed credentials in repositories and related content and alert account holders when a secret is verified. | Detection is not revocation, and a failed verification does not establish that a secret is safe. |
| Multi-factor authentication (MFA) | Adds an account sign-in protection layer where available. A FIDO2 security key is one possible physical MFA method. | Does not invalidate an already leaked API token. |
| Narrow token permissions and organization controls | Can limit what an automated credential is allowed to do and help administrators manage organizational use. | Do not make an exposed token safe; some Hugging Face token-administration and service-account features are marked as Enterprise plan features, so availability should be checked for the organization’s plan. |
How can teams reduce the chance of another exposed token?
- Inventory access tokens used by CI, scripts, and other integrations, including who owns each credential and what it can access.
- Keep permissions as narrow as the task allows, and avoid embedding credentials in source code or other content that may be shared or published.
- Use secret scanning and review verified-secret alerts as part of repository and account monitoring.
- Review account activity and rotate credentials when exposure is suspected; do not wait for a scanner to confirm that a credential is usable.
- Enable MFA for human account sign-ins where available, while treating it as a separate protection from API-token management.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
