In a post dated 31 May 2024, Hugging Face said it detected unauthorized access to its Spaces platform, specifically Spaces secrets, and suspected a subset of secrets could have been accessed. It revoked a number of tokens and advised users to refresh keys. Here is what the company reported and how to apply it.
What did Hugging Face say happened?
The disclosure says that earlier that week its team detected unauthorized access to the Spaces platform related to secrets, and that it suspected a subset of secrets could have been accessed without authorization. As a first remediation step it revoked a number of Hugging Face tokens present in those secrets, and users whose tokens were revoked received an email.
It recommended that users refresh any key or token and consider switching to fine-grained access tokens, which it said had become the default. It said it was working with outside forensic specialists and had reported the incident to law enforcement and data protection authorities.
The post does not describe how the intrusion happened, and this article does not speculate. Treat anything beyond the disclosure as unconfirmed.
What did the company change?
According to the post, it removed organization tokens entirely, citing better traceability and audit capability, implemented a key management service for Spaces secrets, expanded its ability to identify leaked tokens and invalidate them proactively, and planned to deprecate classic read and write tokens once fine-grained tokens reach feature parity.
Why does it matter to AI teams?
AI projects tend to accumulate secrets quickly: model hub tokens, cloud keys, vector database credentials and API keys for model providers. A demo app or a hosted space often holds several. When a platform that stores your secrets is breached, every secret in it should be treated as exposed until rotated, whatever the platform says about scope.
A token with write access to a model repository is especially sensitive, since someone holding it could alter a model that others download. That is a supply chain concern as well as a credentials concern. The post does not claim that happened here.
What does a good response look like?
Constructed example: a team hosts three demo apps on a shared platform. Each holds a read token for a private model, a write token for the team's model repository and a key for a third-party model API. When the platform reports a secrets exposure, the team lists every secret in each app, revokes the write token first, replaces it with a fine-grained token scoped to one repository, rotates the other keys, and checks repository history for unexpected commits. Total time: a few hours, because the list already existed.
What is different about secrets in AI projects?
They sprawl. A notebook, a demo app, a training job and a pipeline each get their own copy of a token, often pasted in during a rush. Rotating one is easy. Finding all the copies is the hard part.
A useful habit is to treat the token inventory as a living document tied to each project, updated in the same pull request that adds a new integration. When a platform notice arrives, you open the inventory and work down it, instead of searching chat history and old branches for places a key might live.
What to do
- Keep a list of every secret each hosted app, pipeline and notebook holds.
- Prefer fine-grained tokens scoped to one repository and the minimum permission.
- Use read tokens wherever a write token is not needed.
- Rotate on any platform notice, then investigate.
- Review model and dataset repository history for unexpected changes after an exposure.
- Pin and verify the models your applications download.
- Store secrets in a managed secret store and keep them out of code.
What should you ask any platform that holds your secrets?
Ask how secrets are stored and encrypted, who inside the provider can read them, how you are told about an exposure, and whether you can scope and expire tokens. The disclosure mentions a key management service and expanded leak detection as improvements, which are good questions to put to any provider. Their answers belong in your vendor review, next to uptime and price.
Quick check
Were models tampered with?
The disclosure does not say so. It describes unauthorized access related to secrets and the remediation. Check the company's current statements for updates.
Should every token be rotated after such a notice?
Rotate any token stored in the affected feature, starting with those that have write access.
Sources
Last reviewed: 18 October 2026.
