Skip to content
26,400 Cloud and AI Credentials Exposed on Gitee

26,400 Cloud and AI Credentials Exposed on Gitee

First seen 29 Oct 2026, 15:47 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 29, 2026 at 16:45 UTC
  • •26,400 valid credentials found exposed on Gitee, including cloud and AI service keys.
  • •Researcher Ben Zimmermann confirmed many credentials were still active when tested.
  • •Developers are advised to revoke any keys previously exposed in public repositories.

Independent researcher Ben Zimmermann discovered 26,400 valid credentials exposed in public Gitee repositories, including access keys for cloud and AI services. The scan, which covered 7.25 million repositories, revealed that many of the credentials were still active when tested. Notably, 9,473 were Alibaba Cloud AccessKey pairs, along with thousands of keys for services like YouTube API and OpenAI. The researcher reported the findings on October 28, 2026, but did not confirm if any credentials had been revoked. Developers who pushed keys to public repositories are advised to treat them as compromised. The credentials include an active organization-admin credential for a major enterprise AI platform, though the platform was not named. The findings highlight the risks associated with credential exposure on platforms like Gitee, which lacks robust secret-scanning partnerships compared to GitHub.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-28
Research findings published
Ben Zimmermann reported finding 26,400 valid credentials in public Gitee repositories, including keys for major cloud services.
Feeds.Feedburner

More articles in this cluster (4)

Following this threat?

Track Alibaba Cloud in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (12)

1 / 3

Common questions

What types of credentials were exposed?
The exposed credentials include access keys for Alibaba Cloud, YouTube API, OpenAI, and others.
How can developers mitigate this issue?
Developers should revoke any keys that have been exposed in public repositories and generate new ones.
What tools were used to find these credentials?
The researcher used TruffleHog and Kingfisher to scan the repositories for exposed credentials.