PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Exposure Report: 65% of Leading AI Companies Found with Verified Secret Leaks

wiz.io | research | #ai-security | #secrets | #github | #wiz-research | #ai-companies | #exposure | #leak-detection
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz scanned the Forbes AI 50 and found 65% of leading private AI companies had verified secret leaks on GitHub — API keys and tokens buried in deleted forks and gists that standard scanners miss.
Published
Collected

Related coverage

incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
blog · wiz.io
Dismantling a Critical Supply Chain Risk in VSCode Extension Marketplaces
Wiz Research uncovered 550+ valid secrets across 500+ VSCode and Open VSX extensions — over a hundred enabled malicious updates — and worked with Microsoft on marketplace guardrails.
blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
incident · wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
blog · wiz.io
Leaking Secrets in the Age of AI
A month-long Wiz scan found AI-related credentials dominating valid secrets leaked to public repos — .ipynb notebooks, mcp.json, .env and agent configs — with valid keys tied to 30+ companies.
tool · github.com
Apple Private Cloud Compute (PCC) Security Source Code and Research Tools
Provides unprecedented source-level visibility into Apple's cloud AI infrastructure, allowing security researchers to verify cryptographic privacy guarantees and audit components eligible for Apple's PCC Security Bounty.
Back