InfoSecBulletin Cybersecurity for mankind
A major security issue happened at Elon Musk’s AI company, xAI, when a developer accidentally posted a private API key on GitHub, making it publicly accessible for nearly two months.
Exposed credentials allowed unauthorized access to private large language models (LLMs) fine-tuned for SpaceX, Tesla, and Twitter/X, revealing serious security vulnerabilities at major tech companies.
Hackers Bypass Gmail MFA With App-Specific Password Reuse
Russia detects first SuperCard malware attacks via NFC
Income Property Investments exposes 170,000+ Individuals record
ALERT (CVE: 2023-28771)
Zyxel Firewalls Under Attack via CVE-2023-28771 by 244 IPs
CISA Flags Active Exploits in Apple iOS and TP-Link Routers
10K Records Allegedly from Mac Cloud Provider’s Customers Leaked Online
Canada 2nd largest airlines “WestJet” investigates cyberattack disrupting internal systems
Paraguay 7.4 Million Citizen Records Leaked on Dark Web
High-Severity Flaw in HashiCorp Nomad Allows Privilege Escalation
SoftBank: Over 137,000 personal info leaked
Philippe Caturegli, Chief Hacking Officer at Seralys, discovered the security incident and shared the leak on LinkedIn.
GitGuardian, a company that detects exposed secrets in code repositories, investigated the issue.
Their automated scanning systems monitor GitHub for sensitive credentials and detected a compromised API key on March 2, 2025.
KrebsOnSecurity reports that the API key leaked by an xAI employee stayed active until April 30, despite the employee being notified right away. GitGuardian escalated the issue to xAI’s security team at that time.
According to Eric Fourrier from GitGuardian, the company found that “the key had access to at least 60 distinct data sets” including several unreleased and developmental versions of Grok models.
The leaked API credentials could have been used to query private custom-trained models including “grok-2.5V” (unreleased), “research-grok-2p5v-1018” (development), and “grok-spacex-2024-11-04” (private).
These models seem to be customized for managing internal data from Musk’s corporate network.
“The associated account not only has access to public Grok models but also to what appears to be unreleased, development, and private models,” GitGuardian noted in their communication to xAI.
The leak happened when a .env file was accidentally added to a public GitHub repository.
xAI did not provide public comment on the incident, and the repository containing the key was removed shortly after GitGuardian’s notification to the security team.
Caturegli noted that such “long-lived credential exposure highlights weak key management and insufficient internal monitoring, raising questions about safeguards around developer access and broader operational security”.
