Truffle Security found roughly 250,000 live API keys embedded in training datasets on Hugging Face. One of those keys had push access to a foundational Linux library — meaning malware could have been delivered to most machines on the planet. The discovery wasn't theoretical.