– Thousands of API tokens were left exposed on an open-source repository for AI projects, posing a security risk.
– Lasso Security researchers discovered the exposed tokens and found that they could have been used for supply chain attacks.
– The researchers were able to collect API tokens and determine their validity, ownership, email, and permissions.
– At least 1,500 API tokens were found, granting access to over 700 business accounts.
– Hackers could exploit these tokens to manipulate training data, steal AI models, and potentially compromise email filters and network traffic.
– The breach has significant consequences as the researchers were able to gain full access to organizations with millions of model downloads.
– The affected companies have since restricted access to the exposed tokens.
Thousands of valid API tokens were left exposed on an open-source repository for AI projects, potentially granting hackers easy access to major business accounts, researchers have revealed.
A report from Lasso Security claims the access could have been used for supply chain attacks, having run several substring searches on the Hugging Face platform and manually collecting the API tokens that were returned.
Then, by using the whoami Hugging Face API, the researchers were able to learn if the tokens were valid, who they belonged to, what the owner’s email was, and what permissions they had.
In total, the researchers found at least 1,500 API tokens that gave them access to more than 700 business accounts. Most tokens (655) had write permissions, allowing the attackers to modify the files they found in the repositories. Those 655 tokens belonged to 77 organizations, including hotshots Meta.
So, how could hackers exploit these API tokens? The researchers said attackers could use them to swipe or poison training data, or even steal AI models. In its writeup, The Register claims Google’s Gmail anti-spam filters work on “reliably trained” artificial intelligence models, and should the training data be compromised, that could potentially result in spam or malicious emails making it into people’s inboxes.
The publication also claims data poisoning of this sort could lead to the sabotage of network traffic. “If network traffic isn’t correctly identified as email, web browsing, etc, then it could lead to misallocated resources and potential network performance issues. “
During their analysis, the researcher stole more than 10,000 private models, they concluded.
“The ramifications of this breach are far-reaching, as we successfully attained full access, both read and write permissions to Meta Llama 2, BigScience Workshop, and EleutherAI, all of these organizations own models with millions of downloads – an outcome that leaves the organization susceptible to potential exploitation by malicious actors,” says Bar Lanyado, security researcher at Lasso Security.
”The gravity of the situation cannot be overstated.”
The three companies in question have all barred access to these tokens in the meantime.
More from TechRadar Pro
AI Eclipse TLDR:
Thousands of valid API tokens were found exposed on an open-source repository for AI projects, potentially giving hackers easy access to major business accounts. Researchers from Lasso Security discovered the vulnerability and warned that the access could have been used for supply chain attacks. By running substring searches on the Hugging Face platform and manually collecting the API tokens that were returned, the researchers were able to identify at least 1,500 tokens that granted access to more than 700 business accounts. Most of these tokens had write permissions, enabling the attackers to modify the files in the repositories. The researchers explained that hackers could exploit these API tokens to steal or poison training data, as well as steal AI models. The compromised data could potentially lead to spam or malicious emails in users’ inboxes and sabotage network traffic. The researchers concluded that they were able to steal over 10,000 private models during their analysis. The companies affected by this breach, including Meta Llama 2, BigScience Workshop, and EleutherAI, have since barred access to these tokens.