PyTorch Typosquatting Attack Leaks 140,000 AI and Cloud Keys

A targeted supply-chain attack on the PyTorch ecosystem has exposed over 140,000 unique API credentials from 2,500 enterprise and research users. The breach, detailed in a recent security report, involved a typosquatted package on the Python Package Index (PyPI) that successfully infiltrated automated CI/CD pipelines. Attackers walked away with 3.4 terabytes of sensitive data, including access keys for OpenAI, Anthropic, Hugging Face, and AWS infrastructure.

The Exfiltration Mechanism

The attack vector relied on dependency confusion. Security researchers at Snyk and GuardDog identified the malicious payload inside torch-data-utils version 2.4.1, a package deliberately named to mimic legitimate data-loading tools used alongside the official torchdata library. Misconfigured internal package mirrors prioritized the malicious public package over internal utilities.

Upon execution, a post-install script immediately scanned the host environment for .env, .aws/credentials, and .ssh directories. The script compressed the harvested credentials and transmitted them via a hidden gRPC stream to decentralized command-and-control nodes hosted on compromised edge servers.

Metric	Detail
Total Data Exfiltrated	3.4 TB
Unique API Keys Leaked	140,000+
Affected Environments	2,500+ unique IPs
Target Directories	.env, .aws/credentials, .ssh

Targeting Compute Clusters

Unlike the 2022 PyTorch-nightly dependency attack which affected a broad range of developers, this 2026 incident was highly targeted toward users of specific data-loading utilities. Security researchers noted the attack profile points to an effort to hijack compute-rich environments, specifically those provisioning high-end H100 and B200 GPU clusters. The attackers likely possessed prior knowledge of high-value internal workflows at specific AI companies.

Following a string of recent incidents involving malware in PyPI science packages, the OpenSSF labeled the incident the largest credential harvest in the history of the AI software supply chain.

To contain the fallout, Hugging Face issued a mass-revocation of all API tokens found in the leaked dataset on August 12, preempting unauthorized model fine-tuning and weight theft. PyPI administrators had previously removed the package and banned the dev-null-ai-arch uploader account on August 11.

Auditing Internal CI/CD Pipelines

The Cybersecurity and Infrastructure Security Agency (CISA) issued emergency bulletin AA26-224A, advising AI firms to audit their Python environments immediately. The directive focuses on identifying any unauthorized packages prefixed with torch-.

If you rely on automated machine learning pipelines, you need to enforce strict dependency pinning and disable public upstream resolution for internal package namespaces. Review your credential rotation policies, particularly if your continuous integration systems maintain standing access to production cloud environments or you route GitHub Actions to Hugging Face jobs.