After the Hugging Face incidents: check your tokens and the models you downloaded
If you use Hugging Face, two things are worth ten minutes: the tokens you created, and the model files you downloaded. This page says what was reported, what to do, and what to check on your own machine.
What was reported
- Spaces secrets (2024). Hugging Face said it detected unauthorized access to secrets on its Spaces platform, revoked several tokens and told affected users. Its advice was to refresh keys and tokens and to move to fine-grained access tokens. See TechTarget and ITPro.
- Malicious models. Security researchers reported models on public hubs that run code when loaded; JFrog counted roughly one hundred such models in early 2024 (mentioned in the coverage above). The mechanism is simple: some model formats can contain executable code.
Both lead to the same two questions: which of my tokens could be exposed, and what did I load on my machine?
Check 1: your tokens
- Open your Hugging Face account settings and list your access tokens.
- Delete tokens you no longer use. Replace long-lived "write" tokens with fine-grained ones that can only do what the job needs.
- If a token was ever stored as a Space secret, or lives in a file others can read, treat it as exposed and rotate it.
- Look for the token on your own machine: a copy in a project
.env, in shell history, or in a notebook. Dante finds them and shows file and line, never the value.
Check 2: the models you downloaded
A model file is not just numbers when its format can carry code. The older Python pickle format (.pkl, .bin, many .pt files) can run code during loading. The safetensors format stores tensors only and does not execute code when loaded. Practical rule: prefer safetensors, and treat a pickle-based model from an unknown author like a program from an unknown author.
- Where they live: the Hugging Face cache (
~/.cache/huggingface/hub), a~/modelsfolder, and your project folders. - What to look at: who published it, whether it ships Python files, whether it needs
trust_remote_code, and which file formats it contains.
What Dante's Hugging Face pack does
The optional pack Hugging Face Analysis (command models) looks at the models on your machine and at the configuration of your AI agents. For a model it reads the name, size, the head of the model card and config.json; never the weights. For the Python files a model ships it reports the file, the line and the kind of pattern, not the code. For an agent configuration (for example MCP entries) it reports the server, what it can do and what stands out, never a key. Nothing leaves your machine.
user ❯ models looking at: ~/.cache/huggingface/hub · ~/models · project folders reads names, sizes, model cards and config.json. Never the weights.
Without the pack Dante explains what it is and offers to open the shop page. Details and the price are on the install and packs page.
Ten minutes, once
You cannot undo an incident that already happened. You can make sure yours is not the token that was lying around, and that the model you loaded last week is what you think it is.
npx dante-watchnpx dante-watch. Step-by-step for Mac, Windows and Linux.~/.dante and it is gone.Questions people ask
Was my Hugging Face token leaked?
Hugging Face told users whose tokens were revoked after the 2024 Spaces incident. If you did not get such a mail you cannot be sure either way, so the safe step is to delete unused tokens and replace long-lived ones with fine-grained tokens.
Are pickle model files dangerous?
They can be. Loading a pickle can execute code embedded in the file, so a model from an unknown author deserves the same caution as a program from an unknown author. Safetensors does not execute code on load.
How can I check models on my own machine?
Look at who published the model, which file formats it contains and whether it ships Python files or needs trust_remote_code. A scanner can list these across your cache; Dante's Hugging Face pack does this locally and sends nothing.
More
- AI agent security risks: seven ways an agent on your machine gets abusedPrompt injection, over-broad permissions, poisoned MCP tools, secrets in readable files, supply-chain malware that talks to your AI assistant.
- How to find leaked API keys and secrets on your own machineWhere keys hide (code, .env, Git history, shell history, cloud files), how to tell a normal private .env from a real leak, and how to check without ever printing the secret..
- Is my server hacked? How to check your own server for warning signsA practical checklist for a server you own: SSH settings, world-writable files, web shells, outdated PHP, unknown cron jobs and keys - and what a read-only check can and cannot prove..
- Bait files that warn you when someone uses your secretsA fake .env, mcp.json, .npmrc or AWS credential that nobody legitimate would ever use.
- Install Dante in three minutes - and what the packs costStep-by-step install for Mac, Windows and Linux with one command, how to talk to Dante, the free and paid parts, and how updates and knowledge packs work.