Zero Radar
← feed
HighData breachupdated 29 Oct 2026, 12:21 UTC

26,400 working cloud and AI keys left in public Gitee code

Developers accidentally left login keys for cloud and AI services inside publicly visible code on Gitee, a Chinese code-sharing site. Anyone who copied them could have used those accounts, possibly at the owners' expense.

1 source, unconfirmed
SeverityHighData breach
Being exploited?UnclearNo reports either way yet
What to doCheck exposureRevoke and rotate any credential that appeared in a public Gitee repository.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Public code postedDeveloper commits keys to a Gitee repo
  2. 2Repo scannedResearcher scanned 7.25 million public repositories
  3. 3Keys found26,400 hardcoded credentials identified
  4. 4Keys still validCredentials authenticated when tested
  5. 5Anyone can reuse themCopied keys grant access to accounts
  6. ResultStrangers can access cloud and AI accounts

What happened

A researcher scanned 7.25 million public Gitee repositories and found 26,400 hardcoded cloud and AI credentials that still authenticated successfully when tested.

Why it is dangerous: Valid keys let strangers access cloud and AI accounts, which can mean data theft, unexpected charges, or misuse of services under the owner's name.

Are you affected?

You are affected if you have pushed API keys, tokens, or other cloud or AI credentials into public Gitee repositories.

Public Gitee repositories containing hardcoded cloud and AI service credentials (specific providers and versions not stated in the material).

What to do

  1. Search your public Gitee repositories for keys, tokens, and passwords
  2. Revoke and rotate any exposed credential immediately, even if the repository is now private
  3. Remove secrets from code and load them from environment variables or a secrets manager
  4. Check cloud and AI account activity logs for unfamiliar usage

Timeline

  1. 29 Oct 2026, 11:33 UTC
    Publicly disclosed
  2. 29 Oct 2026, 11:33 UTC
    Reported by The Hacker News · The Hacker News
  3. 29 Oct 2026, 12:21 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-c9e7c513
Disclosed
29 Oct 2026, 11:33 UTC
On Zero Radar
29 Oct 2026, 12:21 UTC (48 min after disclosure)
Last change
29 Oct 2026, 12:21 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

26,400 working cloud and AI keys left in public Gitee code · Zero Radar