Threat
26,400 Valid Cloud and AI Credentials Found Exposed in Public Gitee Repositories
First reported thehackernews.com
Page published
Earliest dated coverage: 29 Oct 2026 · First observed: 29 Oct 2026 · Latest dated coverage: 29 Oct 2026
Coverage timeline
Single-source incident — one report is available.
Why it matters
Exposed AI-service credentials can allow unauthorized API usage and charges, making credential discovery and revocation urgent for organizations publishing code on Gitee.
Researcher Ben Zimmermann found 26,400 still-valid credentials while scanning 7.25 million public Gitee repositories, with most belonging to cloud and AI services. The exposed credentials included 9,473 Alibaba Cloud AccessKey pairs; vendors were notified, but revocation had not been confirmed when the findings were published.