9,300 leaked AWS keys still work, and 768 hand over full control of a company's cloud
Truffle Security tracked exposed Amazon cloud keys for four years. Most were never rotated, and 88% still logged in on the day of testing.
Key points
- Truffle Security found more than 9,300 Amazon Web Services access keys leaked publicly between August 2022 and August 2026 that are still active.
- 768 of those keys give full control of a company's AWS account, including 526 root keys and 242 keys tied to administrator accounts.
- Of the 10,616 keys the researchers could fully re-test, 88% still authenticated as of 10 August.
- Hugging Face, an AI development platform, was the single largest source of leaks, with 8,482 unique keys exposed.
- Only 262 of 2,754 readable accounts had a budget alert set, leaving companies open to runaway bills from crypto-mining abuse.
Security firm Truffle Security has been quietly scraping the public internet for four years, looking for the digital keys that let staff log in to their company's Amazon cloud. It found a lot.
More than 9,300 leaked Amazon Web Services keys, exposed between August 2022 and August 2026, are still working. Amazon Web Services, usually shortened to AWS, is the cloud platform where a huge share of the world's websites, apps and business data actually live. A working key is the equivalent of a spare office key left under a very public doormat.
Of the leaked keys, 768 give an intruder full control of the company's AWS account. That means reading data, deleting it, taking over servers, or spinning up new admin accounts to stay inside.
Who is Truffle Security and how did they find these?
Truffle Security makes a widely used open-source tool called TruffleHog that scans public code for secrets developers have accidentally published. The company mostly sells to enterprises, but it also runs research projects like this one.
Its researchers, whose findings were first reported by BleepingComputer, pulled 431,875 AWS secrets from public code repositories, old Git history, public datasets, Docker container images, and continuous-integration logs. After removing duplicates, that left 64,024 unique keys tied to 50,654 AWS accounts.
They could only fully re-test a subset of 10,616 keys. On 10 August, 88% of them still logged in.
What can an attacker actually do with one of these keys?
Quite a lot, and quickly. A key with the AdministratorAccess role, the AWS setting that grants permission to do almost anything inside an account, lets a criminal read customer data, wipe backups, or hijack the company's own servers.
| Category | Count |
|---|---|
| Live keys still valid | 9,300+ |
| Keys giving full account control | 768 |
| Root keys (highest privilege) | 526 |
| Admin-level user keys | 242 |
| Accounts with a budget alert set | 262 of 2,754 |
A popular trick is to install cryptocurrency mining software on the victim's servers. The company pays the electricity bill, in the form of a huge AWS invoice, while the attacker keeps the coins. Truffle Security found that fewer than one in ten readable accounts had set a budget alert to catch this.
Why are keys from years ago still working?
Because almost nobody rotates them. Rotating a key means retiring the old one and issuing a new one, the cloud equivalent of changing the locks.
Among keys with a known creation date, the median age was 1,831 days, roughly five years. The oldest had been sitting in the wild for 17.4 years. Only 13.7% had been replaced with a newer key for the same user.
Where are the leaks coming from?
The single largest source was Hugging Face, the popular platform where developers share artificial intelligence models and code. It accounted for 8,482 unique key exposures on its own. Nearly 18% of those were root keys, the master credential for an entire AWS account that cannot be limited by normal permission settings.
Developers often paste keys into a script for testing, forget them, and push the code to a public repository. From there, automated scanners, both friendly and hostile, find them within minutes.
What should companies do now?
Truffle Security says any credential ever committed to a public source should be treated as already stolen. Its advice: delete all root access keys, review every account by age, rotate or revoke anything old, and switch on budget alerts so a mining attack shows up on the invoice before it shows up in the boardroom.
The firm says it has notified the owners it could identify.
