Loading today’s stories
Security1 distinct publisher3 min readUpdated
Leaked AWS keys keep working: 526 root, 242 admin, and a rotation rate of 13.7 percent
Truffle Security retested 10,616 publicly leaked AWS credentials and 88 percent still authenticated. The median key was about five years old and had no successor.
The Watch · Security desk
What happened
- More than 9,300 AWS access keys publicly exposed between August 2022 and August 2026 are still active and valid.
- Truffle Security has tracked the exposure for the past four years and says 817 of the exposed keys were linked to companies, 526 of them being AWS root keys.
- 242 of the keys are associated with IAM users holding the AdministratorAccess policy, which has full permissions to create, modify, delete and view virtually all AWS services and resources in an account.
- The researchers state that each of the 768 live keys in the two sets gives full control of a company's AWS account.
- Truffle Security found 431,875 AWS secrets across code repositories, Git history, datasets, Docker images, registries and CI logs.
Compiled by The WatchSomething wrong?How this is made
Why it matters
The load-bearing number here is 10,616, not 9,300. That is the count of keys for which Truffle Security held the full credential pair and could actually attempt authentication [7]. The wider haul, 64,024 unique keys mapping to 50,654 accounts [6], is untested for validity, because an access key ID without its secret cannot be tried. So the roughly 9,342 keys that answered on August 10 [8][1] represent about one key in six from the corpus [2], and the honest reading is a floor, not a measurement of how much of the exposure is live.
What keeps a key answering for that long shows up in the age data. Of the 2,903 keys with creation dates, about 4.5 percent of the unique set, the median was 1,831 days old and the oldest had existed for 17.4 years [12][7]. Only 398 of those users had a newer key issued alongside the old one [13]. Rotation is not merely slow at this scale; for this population it mostly does not happen. The practical expiry date of a leaked key is the deletion of the IAM user that owns it.
The privilege breakdown deserves reading with a pencil. Truffle counts 817 company-linked keys with 526 root keys among them [2], plus 242 IAM users carrying AdministratorAccess [3]. 526 and 242 add to the 768 keys the researchers describe as full control of a company's AWS account [4][6]. That sum treats the root and administrator sets as disjoint while the 817 figure uses a different denominator, and the write-up does not reconcile them. Either way, the count of keys with nothing between the holder and the account runs into the high hundreds.
Then the detection question. Of 2,754 accounts whose metadata could be read, 262 had a budget alert configured [9], which is 9.5 percent [3]. Cryptomining on stolen credentials is a billing event before it is a security event [16], and roughly nine accounts in ten here have no tripwire on the bill.
The Hugging Face concentration is the supply-chain part. 8,482 unique key exposures came from that platform [10], 13.2 percent of every unique key in the study [4], and Truffle puts the root share of that set at 17.9 percent [11], on the order of 1,518 root keys from a single source [5]. Datasets and model artifacts are not code review targets in most shops, and they are being published with working cloud credentials inside them.
Truffle says its testing stopped at read-only metadata and that it notified every owner it could identify [15]. Its own advice is to delete root access keys outright and treat anything committed to a public source as compromised [14]. The 88 percent figure is what the last five years of not doing that looks like when someone finally tests it.
Loading claim ledger
Loading source directory links
Loading share composer
Loading topic controls
Loading related stories