Artificial Intelligence Bots Can Steal Your Login Credentials, but You Can Protect Yourself.
Artificial intelligence is constantly improving at detecting information, including sensitive data like your passwords, financial information, and API secrets, when it’s hidden in obvious places. You may have followed the recent news about OpenAI’s malicious agent attack on Hugging Face servers during testing. But you may not have noticed that OpenAI’s public statement about the breach acknowledged that the company’s AI models had been attacking publicly available credentials online even before this incident. The day after OpenAI’s statement, Anthropic published a report detailing similar incidents involving several Claude models, dating back to April of this year.
Several years ago, Security Magazine reported on a study that identified up to 24 billion username and password combinations circulating on the dark web in 2022. This doesn’t even take into account all the exposed tokens, secrets, and API keys stored in public repositories on GitHub or Hugging Face. All this information is accessible to anyone with an internet connection—but thanks to the computing power of agent-based AI, it can now be discovered and exploited at record speed.
Attackers specializing in such hacks regularly use AI-powered tools to harvest publicly available user credentials. Now—as we just saw with OpenAI—it turns out that even large language models can independently find and use this compromised login data. So, how can you protect your accounts on online platforms? First, you need to check whether your credentials have been compromised. Then, you need to take immediate steps to recover them.
Why OpenAI’s Agent Went Out of Control
According to OpenAI , one of Sol’s GPT-5.6 agents was tested on the ExploitGym platform, which tests large language models by challenging them to write exploit prototypes for known vulnerabilities. ExploitGym is typically a closed ecosystem for prototype testing only, and the AI agents are not allowed to have internet access during testing.
However, this agent discovered a zero-day vulnerability in the Artifactory package registry tool and then exploited it to gain network access. From there, the OpenAI agent gained access to Hugging Face’s corporate systems using publicly available credentials for four different services. He then spent two days inside the company’s internal systems, managed to gain root access to several production servers, and even connected 181 devices controlled by the attacker to Hugging Face’s corporate network.
Regarding how the AI agent managed to bypass the model’s standard security measures, OpenAI noted that due to the nature of ExploitGym’s evaluation, the agent followed instructions that reduced the likelihood of rejecting a successful model evaluation. OpenAI’s statement noted that this issue isn’t limited to Hugging Face: since then, cases have been discovered of the company’s agents finding and using leaked credentials on various platforms. The AI company is now collaborating with Hugging Face to reveal more details about the attack and prevent similar incidents in the future.
Following the OpenAI disclosure, Anthropic issued a public notice announcing the launch of a large-scale review of its own cybersecurity protocols, which had already uncovered similar attacks targeting three different organizations at different times, including Hugging Face. Each attack used a different Claude model: Opus 4.7, Mythos 5, and another undisclosed research model. As with the OpenAI Hugging Face data breach, Anthropic’s attacks also involved venturing AI agents outside of controlled test environments to access the internet while evaluating the models.
However, in this case, Anthropic claims that a configuration error was discovered in each of the test environments that allowed Claude models to access the internet, which was not part of the evaluation protocol. It appears they didn’t even need to search for or identify the vulnerability in the evaluation environment, as the configuration error was already present.
Where do AI models find vulnerable credentials?
While using AI to collect data breaches is a new problem, the data breaches themselves are not. However, agents make it faster and easier to find leaked credentials, as they can process large volumes of information in record time or even perform automated breaches. There are several common paths through which automated AI-powered data collection typically occurs, and all involve some form of human error, which results in sensitive data becoming accessible.
Public data leaks
Immediately after a major data breach or cyberattack, files containing massive amounts of compromised usernames, passwords, emails, and other sensitive data end up on forums and darknet marketplaces. They’re searchable and often publicly accessible, meaning attackers can find them just as easily as a human attacker.
In June 2026, a database containing over 24 billion credentials mapped to active vulnerabilities appeared on an Elasticsearch cluster , making it easier for hackers to select low-hanging fruit. In mid-2025, another major data breach occurred, compromising 16 billion credentials .
The credentials are exposed in the source code.
Developers often mistakenly add API keys, tokens, and passwords to public code repositories, especially when in a hurry or using tools like Vibe Code. If someone were simply browsing GitHub or Hugging Face, they wouldn’t see these credentials publicly available. But if a hacker or AI agent decides to peek beneath the source code, these credentials are easily accessible. In 2023, Lasso Security discovered over 1,500 compromised API keys on Hugging Face, many of which belonged to major tech companies like Meta and Google.
Targeted attacks with instant signal injection
Even if your credentials weren’t exposed beforehand, malware has made it incredibly easy to hack an attacker’s device and harvest any user credentials and authorized accounts within reach. Hackers can manipulate AI agents with access to your local storage to find unsecured passwords and browser session cookies, which can then be remotely transmitted to attackers who can use them to hack your personal accounts. If your AI agent has access to your local device and web browser, you are especially vulnerable. In some cases, a remote hacker can completely take over your system and conduct surveillance undetected, without you even knowing.
How to check your current exposure level
You may not even know if your credentials will end up in a publicly accessible database or open-source file, or if you’re the victim of a malicious code injection attempt, unless you use dedicated tools and strategies to monitor for data breaches. Based on the three risk points discussed earlier, here are a few tools and strategies to help identify and prevent potential breaches:
Check your email and password for known data breaches.
Have I Been Pwned constantly updates its library of known data breaches and thefts. In June 2026 alone, they extracted 56 million email addresses from attacker logs. Furthermore, the database is fully searchable and free.
You can search by email address or password to check if your credentials have been compromised in a recent data breach. If you want to search multiple email addresses within a shared domain you own, you can sign up for a paid subscription for just $4.39 per month. This will also give you access to their API, as well as a real-time monitoring service that continuously monitors your domain for new data breaches as they occur.
Scan your code repositories for hidden secrets.
If you write code, own a website, or maintain any public repositories, there’s a good chance that personal credentials like passwords or tokens could end up in your publicly accessible source code files due to human error or technical issues.
You can use free tools like TruffleHog or Gitleaks to scan your public repositories, cloud storage, wikis, logs, and databases for leaked secrets. They can alert you even if leaked credentials have been removed from your working repository but still exist in the public version history.
If you have a WordPress site with many plugins or themes, you can find similar vulnerabilities using WPScan . GitHub repositories also have access to their own built-in secrets scanning tool , which can check your repositories for compromised API keys in just a few clicks.
Check the access rights and connected applications of your AI agents.
Vulnerability injection attacks don’t rely on publicly available or disclosed credentials, but rather target AI agents with access to your devices and applications. Users of platforms like ChatGPT Work , Claude Cowork, Microsoft Copilot , and others should regularly audit their AI platform to see what files and services it has access to. In general, it’s always best to restrict privileged access unless specifically required by a specific task, so your agent can’t simply rummage through your file systems or grant access to connected online platforms where you have accounts.
Another important step is to review your AI platform’s activity logs to ensure it isn’t performing actions you haven’t authorized, such as accessing folders on its own or sharing data with sources you haven’t approved. If you detect anything suspicious, immediately revoke permissions to prevent further damage and change the credentials of the compromised account.
What to do if you’ve become a victim of AI-powered data collection?
If these checks reveal a vulnerability, you need to take immediate action to prevent further hacking of your accounts. Here’s what to do if you realize you may be a victim of AI-based scams.
Reset your password, then log out of all sessions.
If you suspect your password has been compromised, whether through a public data leak or a random character injection attack targeting your device, the first step is to log in to your account and reset your password. You can use a random password generator to create a hard-to-guess password, ideally a combination of numbers, symbols, and text.
After resetting your password, look for an option that looks something like “Log out of all sessions.” If you don’t see it, check if your account has a “Device Management” option to individually manage sessions on each device you’re signed in to. Make sure you’ve logged out of all devices and sessions to prevent attackers from retaining access if they’ve already compromised your account.
If you suspect a data leak, change your API keys and tokens immediately.
If your compromised data contains API keys, tokens, secrets, or other developer credentials in publicly accessible source code, don’t wait for a cyberattack to reset them. It’s better to assume an attack is likely before it happens, so replace your credentials with new ones immediately.
But don’t stop there. Review every piece of your running code, CI/CD logs, chat exports, and shared documents and files to ensure the same key or token hasn’t been used elsewhere. If so, reset every instance of the compromised credentials to prevent attackers from brute-forcing all your accounts using the compromised secret.
Instead of SMS, use an authenticator app or security key.
Two-factor authentication (2FA) is a fundamental security measure that prevents most account takeover attempts during cyberattacks. Even if a hacker manages to gain access to a compromised password, they won’t be able to access your accounts unless they have access to the one-time code from your authenticator app or your private security key.
For even greater security, avoid using SMS authentication when enabling two-factor authentication. SMS messages are easily intercepted by SIM card swapping, which is less of a problem if only your password is compromised, but would be a much bigger problem if your accounts were involved in a massive data breach at a major company.
Authenticator apps like Google Authenticator, Bitwarden, 2FAS, Authy, and others offer a much higher level of security because they’re tied to your specific device and account. Physical security keys are also an excellent option, completely protecting you from all forms of digital attacks, as logging in requires access to a physical device.
You should not hardcode credentials into the repository.
Even if your GitHub project is only for testing, hard-coding your secrets and tokens in a public repository will make it easier for attackers to harvest your credentials. Instead of embedding API keys directly in script files, use environment variables or dedicated secret managers.
When assigning access rights to AI assistants, the principle of least privilege should be followed.
Artificial intelligence (AI) or browsers like ChatGPT Work, Perplexity Comet, Dia, or Claude Cowork run directly on your desktop and autonomously perform tasks like programming, file management, and web browsing. But if you grant them full access to your entire device, vulnerability injection attacks can easily steal files storing your credentials or active cookie sessions from accounts logged into your browser.
Limit your AI agent’s access rights to a single, controlled file system or folder. For everything else, approve requests for each task separately to prevent automated hint injection attacks.
Decommission old accounts when you no longer use them.
When you stop using online accounts but don’t delete or decommission them, they remain stored in the company’s database along with your old password, payment information, and other personal information. These inactive accounts on online platforms are a favorite target for attackers using artificial intelligence to steal information, as they are easier to exploit due to weakened security measures and outdated authentication.
When you terminate your account, be sure to use the platform’s built-in “close account” or “delete account” feature to permanently remove your information from the database. If these options aren’t available in the platform’s user interface, you may want to contact support to delete your account, even if it seems a bit of a hassle.
Some companies retain your data on file for compliance reasons for a certain period after your account is closed, but this is usually not an indefinite period, and your account will not remain vulnerable to abuse during this time.