Feb 28, 2025Single source
Alleged Inclusion of 12,000 Live API Keys in LLM Training Data Reportedly Poses Security Risks
Rogue: Caused harmAI loose in the worldData exfiltrationDERIVED
Approved by person, Oct 11, 2026. How entries are approved
A dataset used to train large language models allegedly contained 12,000 live API keys and authentication credentials. Some of these were reportedly still active and allowed unauthorized access. Truffle Security found these secrets in a December 2024 Common Crawl archive, which spans 250 billion web pages. The affected credentials could have been exploited for unauthorized data access, service disruptions, financial fraud, and a variety of other malicious uses.
What this means for youIf you or your company ever posted code or settings containing API keys online, those keys may have been copied into AI training data, so rotate any key that was public. At work, teams should keep credentials out of public code and web pages. Governments may need rules on what web data AI developers can collect.
Sources
- AI Incident Databasehttps://incidentdatabase.ai/cite/956
Data from the AI Incident Database (incidentdatabase.ai), licensed CC BY-SA 4.0 (https://creativecommons.org/licenses/by-sa/4.0/). McGregor, S. (2021) Preventing Repeated Real World AI Failures by Cataloging Incidents: The AI Incident Database. IAAI-21.
Source data license: CC BY-SA 4.0 (database). Report contents keep their own rights; reports.text, submissions, images and videos are excluded from the data license.
rogue:R4
Covered by snapshot 45
da93f03b406f409940d0a6ef47b526607f82ebf457d98f69299b88aceede576a
This entry is record number 2037. It has not been edited since it was approved; the hash above would not match if it had. How to verify