65% of Top AI Firms Found Exposing Verified API Keys and Tokens on GitHub

According to Forbes AI 50 list, researchers examined 50 prominent AI companies and found that 65% had leaked verified secrets on GitHub, exposing critical API keys, authentication tokens and other sensitive credentials. The leaks were not confined to high-profile organisations, with disclosures hidden in deleted repository forks, gists and developer repositories. The affected firms collectively have a valuation of over $400 billion, underscoring the breadth of the issue.

The exposed credentials included WeightsAndBiases tokens, HuggingFace authentication tokens, ElevenLabs API keys and LangChain organisation credentials, with one deleted fork containing a HuggingFace token that provided access to around 1,000 private models. LangChain and ElevenLabs acknowledged and promptly fixed disclosed vulnerabilities. The report notes that nearly half of the leaks failed to reach their targets or received no response, highlighting gaps in disclosure channels.

It recommends three measures: mandatory secret scanning across all public version control systems, establishing proper disclosure channels and response procedures, and collaboration with the security community to support emerging secret formats before they proliferate.