AI agents are always getting better at finding things, which includes sensitive information like your passwords, financial information, and API secrets if they are left exposed in obvious places. You may have been following the recent news coverage on OpenAI’s rogue agent attacking the Hugging Face servers during an evaluation. But you may not have noticed that tucked in OpenAI’s public disclosure on the hack is an admission that its AI models have been targeting publicly exposed online credentials even before this incident. The day after OpenAI’s disclosure, Anthropic came forward with a report of similar incidents with multiple Claude models dating as far back as April of this year.
A few years ago,Security Magazine reportedon a study that found up to 24 billion username and password combinations circulating on the dark web in 2022. This doesn’t even begin to account for all the exposed tokens, secrets, and API keys sitting in public repositories across GitHub or Hugging Face. All of this information is accessible to anyone with an internet connection—but thanks to the processing power of agentic AI, they can now be discovered and executed at record speed.
Info stealers who specialize in this kind of breaching regularly use AI-powered tools to scrape publicly exposed user credentials. Now—as we have just seen with OpenAI—apparently large language models can even find and use these exposed logins of their own volition. So how does one protect their user accounts on online platforms? First, you have to see if your credentials have been exposed. Then you have to take immediate steps to remediate them.
Why the OpenAI agent went rogue
According toOpenAI, one of its GPT-5.6 Sol agents was being evaluated on a platform called ExploitGym, which benchmarks large language models by asking them to write proof-of-concept security exploits for known vulnerabilities. Normally, ExploitGym is designed to be a closed ecosystem for proof-of-concept testing only, and AI agents shouldn’t have access to the internet while being evaluated.
But this agent found a zero-day vulnerability in a package registry tool called Artifactory, then used it to gain access to the web. From there, the OpenAI agent gained access to Hugging Face’s company systems using publicly exposed credentials across four separate services. It went on to spend two days inside the company’s internal systems, managed to secure root access to several production servers, and even enrolled 181 attacker-controlled devices into Hugging Face’s corporate network.
As for how the AI agent was able to get past the model’s usual safeguards, OpenAI noted that due to the nature of the ExploitGym evaluation, the agent was operating on instructions that reduced cyber refusals to successfully evaluate the model. OpenAI’s disclosure notes that this issue isn’t limited to Hugging Face: It’s since found instances where its agents found and used leaked credentials across different platforms. Now the AI company is collaborating with Hugging Face to uncover more details about the attack and prevent further instances like this one.
Following the OpenAI reveal,Anthropic issued a public noticeannouncing it had begun a large-scale review of its own cybersecurity transcripts, which had already revealed similar attacks aimed at three separate organizations on different occasions, including Hugging Face. The attacks involved a different Claude model each time: Opus 4.7, Mythos 5, and another undisclosed research model. Like the OpenAI Hugging Face breach, Anthropic’s attacks also involved AI agents escaping controlled test environments to gain internet access during model evaluations.
But in this case, Anthropic claims that the test environments each had a configuration error that left the Claude models with internet access, which was not part of the evaluation protocol. It seems they didn’t even need to uncover or target an exploit in the evaluation environment because the misconfiguration was already there.
Where do AI models find exposed credentials?
While using AI to scrape for exposed data is a new problem, the data leaks themselves are not. However, agents make it faster and easier to find leaked credentials because they can go through a large amount of information at record time or even execute hacks on autopilot. There are a few common routes that AI-automated scraping usually happens through, all of it to do with one or another form of human mistake leading sensitive data to become accessible in the first place.
Public data breach dumps
Right after a major data breach or cyber attack, dump files containing huge numbers of compromised usernames, passwords, emails, and other sensitive data end up on dark web forums and marketplaces. They are searchable and often openly accessible, which means agents can find them just as easily as a human attacker can.
In June 2026, a database with over 24 billion credentials just surfaced on anElasticsearch cluster, cross-referenced with live vulnerabilities to make it easier for hackers to pick low-hanging targets. There was another major data breach that led to 16 billion leaked credentials in mid-2025.
Exposed credentials in source code
Developers often commit API keys, tokens, and passwords to public coding repositories by mistake, especially when they’re in a rush or using vibe coding tools for assistance. If a human being were to scroll GitHub or Hugging Face, they wouldn’t see these credentials out in the open. But if any hacker or AI agent decides to peek underneath for the source code, those credentials are easily reachable. In 2023,Lasso Securityuncovered more than 1,500 exposed API keys on Hugging Face, many of which belonged to major tech companies like Meta and Google.
Targeted prompt injection attacks
Even if your credentials aren’t exposed in advance,prompt injectionhas made it incredibly easy to break into someone’s device and scrape for any user credentials and logged-in accounts within reach. Hackers can manipulate AI agents with access to your local storage to search for unprotected passwords and browser session cookies, which can then be fed remotely to attackers who can use them to breach your private accounts. If your AI agent has access to your local device and web browser, you’re especially vulnerable. In some cases, a remote hacker may fully take over your system and quietly run surveillance without you even realizing.
How to check your current exposure
You may not even know if your credentials end up on a public database or open source code file, or if you’re the subject of a prompt injection attempt right now, unless you use specific tools and strategies to monitor your data leakage. Based on the three exposure points we discussed earlier, here are some tools and strategies that work for identifying and plugging potential leaks:
Search your email and password against known data breaches
Have I Been Pwnedmaintains a continuously updated library of known info steals and data breaches. They pulled 56 million email addresses from stealer logs in a single batch in June 2026 alone. It’s also entirely searchable and free to use.
You can search by either email address or password to see if your credentials are compromised from a recent data leak. If you’d like to search multiple email addresses across a shared domain that you own, you can get a paid subscription for as little as $4.39 per month. This also gives you access to their API, along with a live monitoring service that constantly checks your domain against new breaches as they happen.
Scan your code repositories for exposed secrets
If you write code, own a website, or maintain any public repositories, there’s a good chance that private credentials like passwords or tokens may end up in your public-facing source code files due to human error or technical issues.
You can run free tools likeTruffleHogorGitleaksagainst your public repositories, cloud storage systems, wikis, logs, and databases to scan for exposed secrets. They can alert you even if an exposed credential was removed from your live repository but still exists in a publicly accessible version history.
If you own a WordPress site with lots of plugins or themes, you can find similar vulnerabilities usingWPScan. GitHub repositories also have access to their own built-insecret scanning tool,which can scan your repos for compromised API keys in a few clicks.
Review your AI agents for permissions and connected apps
Prompt injection attacks don’t rely on publicly available or exposed credentials but instead target the AI agents that have access to your devices and applications. For users who rely on platforms likeChatGPT Work, Claude Cowork,Microsoft Copilot, etc., you should regularly review your AI platform to see what files and services it has access to. Generally speaking, it’s always better to restrict privileged access unless the specific job demands it, so your agent can’t just poke around in your file systems or hand over access to connected online platforms that you have accounts with.
Another thing you should do is review your AI platform’s activity logs to make sure it’s not doing anything that you haven’t authorized, like accessing folders on its own or exchanging data with sources you haven’t approved. If you see anything suspicious, revoke permissions immediately to avoid further damage and change your compromised account credentials.
What to do if you’ve been exposed to AI scraping
If running these checks triggered a detection, you need to take immediate action to prevent your accounts from being compromised any further. Here’s what to do if you realize you might be exposed to AI scraping.
Reset the password, then sign out of all sessions
If you suspect a password has been compromised, either through public data leaks or prompt injection attacks targeting your device, the first course of action is to log into your account and reset that password. You can use a random password generator to create one that’s hard to guess, ideally with a mix of numbers and symbols along with text.
Once the password has been reset, look for an option that says something along the lines of “log out of all sessions.” If not, see if your account has a “manage devices” option for individually managing any signed-in device sessions. Make sure that you’re logged out of every device and session, so that attackers don’t retain access in case they have already breached your account.
Rotate your API keys and tokens the moment a leak is suspected
If your compromised data includes any API keys, tokens, secrets, or other developer credentials in publicly accessible source code, don’t wait until a cyber attack occurs to reset them. It’s best to assume that an attack is likely if it’s not already taken place, so replace your credentials with new ones at once.
But don’t stop there. Search every bit of your live code, CI/CD logs, chat exports, and shared documents and files to see if the same key or token has been reused elsewhere. If it has, reset each instance of the leaked credential so that attackers can’t run a brute-force attack against all your accounts using the compromised secret.
Use an authenticator app or security key instead of SMS
Two-factor authentication (2FA)is a fundamental security stopgap that prevents most account takeover attempts during cyber attacks. Even if a hacker manages to secure a compromised password, they can’t actually get into your accounts unless they also have access to the one-time code from your authenticator app or your private security key.
For even better security, avoid using SMS authentication when enabling 2FA. SMS messages can be easily intercepted through SIM-swapping, which is less of an issue if it’s just your password that’s been compromised but a much bigger problem if your accounts end up in a massive data dump after a breach at a major company.
Authenticator apps like Google Authenticator, Bitwarden, 2FAS, Authy, etc. offer much better security because they’re locked to your specific device and account. Physical security keys are also a great option that insulates you from all forms of digital attacks altogether since logging in requires access to a piece of physical hardware.
Don’t hardcode your credentials into a repository
Even if that GitHub project is just for testing, hardcoding your secrets and tokens into a public repository will make it simple for agents to scrape your login credentials for attackers. Instead of pasting your API keys directly into script files, use environment variables or dedicated secret managers.
When assigning permissions to AI assistants, follow least privilege principles
AI agents orbrowserslike ChatGPT Work, Perplexity Comet, Dia, or Claude Cowork live directly on your desktop and execute tasks like coding, file management, and web browsing autonomously. But if you give them blanket access to your whole device, prompt injection attacks can easily steal files that store your credentials or active cookie sessions from logged-in accounts in your browser.
Relegate your AI agent’s access permissions to a single controlled file system or folder. For everything else, approve requests on a per-task basis to avoid automatic prompt injection attacks from executing.
Decommission old accounts when you stop using them
When you stop using online accounts but don’t actively delete or decommission them, they continue to sit in a company database along with your old password, payment details, and other personal information. These dormant accounts on online platforms are a favorite target for AI-augmented info stealers, who find them easier to exploit due to reduced security measures and outdated authentication.
When you stop using an account, make sure to use the platform’s built-in "close account" or "delete account" option to permanently remove your information from their database. If these options aren’t available in the platform’s UI itself, it might be worth shooting an email to their customer support team to get the account decommissioned, even if that feels like a bit of extra hassle.
Some companies will still keep your data on file for compliance reasons for a set period after decommissioning the account, but that’s usually not an indefinite amount of time, and your account won’t be sitting open to exploitation in the meantime.
