Researcher Chaofan Shou discovered sensitive credentials within a 6 TB dataset obtained from a Chinese LLM router. These routers act as intermediaries, directing user queries to various language models while often logging detailed session data.
The logs contained technical metadata, including SSH keys, VPN configurations, cloud API keys, and GitLab tokens. Such information is frequently transmitted by developers or autonomous AI agents when interacting with models to perform specific tasks.
Shou identified active credentials that could potentially grant unauthorized access to systems belonging to Chinese government agencies and major technology firms. The list of affected companies includes Xiaomi, Huawei, NIO, and MiniMax.
The researcher noted that these leaks pose a significant security risk. Attackers do not need to exploit infrastructure vulnerabilities if they can obtain valid authorization data directly from the logs of an inadequately protected intermediary service.
