Hugging Face detected unauthorized access to Spaces secrets and revoked tokens

Hugging Face said it detected unauthorized access to its Spaces platform tied to Spaces secrets, and suspected that a subset of those secrets could have been read without authorization. It revoked HF tokens found in the affected secrets, emailed affected users and urged everyone to rotate keys and switch to fine-grained tokens. It reported the incident to law enforcement and data protection authorities.

Sources

• Primary: https://huggingface.co/blog/space-secrets-disclosure
• Upstream: Editorial
• Entered by the cybermap.lol editors, with sources on the entry