Return to Threats

26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories

thehackernews.com 2026-10-29 data leakage Critical
Run AI Security Assessment Talk to AI CISO

Executive Summary

Valid cloud and AI credentials were exposed in public Gitee code repositories, creating potential unauthorized access to associated services. Organizations operating AI applications, cloud infrastructure, or developer repositories should prioritize credential rotation and repository secret scanning.

What Happened

26,400 credentials that developers left in public code on Gitee, a Chinese code-hosting service, still worked when a researcher tested them. Anyone who copied one from that code could have used it. Independent researcher Ben Zimmermann found them by scanning 7.25 million public Gitee repositories and reported the results on October 28. Most were keys for cloud and AI services, led by

Affected Products

  • Gitee
  • cloud services
  • AI services

Vulnerability / Attack Technique

Exposed credential abuse

Technical Mechanism

Developers left credentials in publicly accessible source code repositories on Gitee. The researcher tested the credentials and found that 26,400 remained valid, so a person who copied one could potentially use it to access the associated cloud or AI service.

AI Security Category

LLM02:2025 Sensitive Information Disclosure

Relevant Frameworks

LLM02:2025 Sensitive Information DisclosureMITRE ATLAS: Credential AccessMITRE ATLAS: Initial Access

RealGround Analysis

For teams running AI agents or LLM applications, exposed service credentials can provide unauthorized access to AI APIs and supporting cloud resources. This may affect agent workflows, application data, usage limits, and operating costs, even though the article does not describe a confirmed compromise of a specific AI application.

Recommended Controls

  • Rotate and revoke exposed cloud and AI credentials immediately.
  • Enable automated secret scanning and push protection across public and private repositories.
  • Use short-lived, least-privilege credentials instead of long-lived service keys.
  • Enforce centralized secrets management with audit logging and usage monitoring.
  • Review AI-agent and cloud-service permissions for unnecessary access and unusual activity.

Related RealGround Service

AI Security Readiness Assessment · or start with the free AI Agent Security Scanner.

Sources

thehackernews.com: https://thehackernews.com/2026/10/26400-valid-cloud-and-ai-credentials.html

Summary and analysis written by RealGround from the source above; last updated 2026-10-30.

Talk to AI CISO