A community dataset from NHIMG covering 250 breaches says 114 of them, 46%, began with a leaked, stolen or weak credential. It fits neatly with the OpenAI and Hugging Face story: the exposed credentials came first, the cleverness second.
Tip: hunt for credentials in artifact repositories and CI before buying anything with “agentic” on the box.
Sources: NHIMG
