12,000 Live API Keys Found in LLM Training Dataset
Truffle Security discovered approximately 12,000 live API keys and passwords in a Common Crawl dataset used for LLM training, comprising 219 different secret types including AWS keys and Slack webhooks. Researchers warn that LLMs cannot distinguish between valid and invalid credentials during training, potentially reinforcing insecure coding practices among users.
What happened
Truffle Security downloaded a December 2024 archive from Common Crawl, a free open repository of web crawl data maintained over 18 years, and analyzed it for hardcoded credentials used in LLM training.
The analysis found 12,000 live secrets across 219 different secret types in the dataset, including Amazon Web Services root keys, Slack webhooks, and Mailchimp API keys.
According to security researcher Joe Leon, LLMs cannot distinguish between valid and invalid secrets during training, so both contribute equally to providing insecure code examples.
Reported impact
The inclusion of live API keys and passwords in training data poses a severe security risk to users and organizations, as the credentials successfully authenticate with their respective services.
LLMs trained on this data may suggest insecure coding practices to users, potentially reinforcing insecure authentication methods even when using invalid or example secrets.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.