“Intriguingly, among these accounts, 655 users’ tokens were found to have write permissions, 77 of them to various organizations, granting us full control over the repositories of several prominent companies.”
Lasso searched GitHub and Hugging Face for token strings and found 1,681 valid ones, reaching 723 organization accounts including Meta, Microsoft, Google and VMware. They created a repository inside meta-llama to prove write access, and got write access to 14 datasets downloaded hundreds of thousands of times a month. Hugging Face had deprecated org tokens, but a small library tweak still let them download private Microsoft models. GitHub revokes leaked tokens automatically. Hugging Face hosts more than 500,000 models and does not.