Researcher Buys 6TB Leaked Dataset from Chinese LLM Router, Containing Credentials of Xiaomi, Huawei and Others
Security researcher Chaofan Shou (@shoucccc), who was first to reveal the Claude Code source leak, claims to have bought a 6TB "Fable" dataset from a top Chinese LLM API router for a five-figure sum, sparking widespread community concern over the security of relay services.
Confirmed
- The dataset is 6TB, purchased for a five-figure price from a leading Chinese LLM relay service.
- Beyond chat traces, it contains a large volume of sensitive credentials customers sent through the router: SSH keys, VPN configurations, Alibaba Cloud AccessKeys and GitLab tokens.
- According to the disclosure, the credentials involve 7 government agencies and 19 top tech companies, including Xiaomi and Huawei — enough to take over these organizations' systems.
Unconfirmed
- All details come from the researcher's one-sided disclosure and community reposts; the router's identity, data authenticity and impact scope have not been confirmed by any implicated party or independently verified.
Why it matters
- The incident exposes how LLM API relay/router services may retain and leak the most sensitive enterprise-grade credentials (SSH, VPN, cloud AccessKeys, code-hosting tokens), a risk far beyond ordinary chat log leaks.
- If true, affected government agencies and top tech companies face real risk of system takeover — a supply-chain security warning for any enterprise using LLM APIs via third-party relays.
2026-09-11 ~ 2026-09-12 · 5 related posts
Primary sources
- 6TB leak from a Chinese LLM router exposes credentials to hijack Xiaomi, Huawei and gov entities — teortaxesTex · 2026-09-11
- 6TB of Fable data sold with leaked SSH keys, cloud creds tied to Xiaomi, Huawei, NIO — teortaxesTex · 2026-09-11
- Leaked 'Fable' dataset from API reseller reportedly holds secrets of 7 gov agencies, 19 tech firms — teortaxesTex · 2026-09-11
- Researcher buys 6TB of LLM router data packed with SSH keys and corporate credentials — teortaxesTex · 2026-09-12
1 near-duplicate retellings: PMinervini