Attackers held undetected access to leaked production OpenAI keys stored in Hugging Face Spaces for a full week before any revocation or security action occurred. This delay proves that your external LLM providers will not proactively flag or block stolen active credentials, leaving your systems vulnerable to silent data exfiltration and massive API billing spikes. If you deploy agents or models utilizing Hugging Face Spaces, you must immediately rotate your production secrets and enforce hard, low-threshold usage limits on your LLM accounts.