9,300 leaked AWS keys still work, and 768 hand over full control of a company's cloud
Truffle Security tracked exposed Amazon cloud keys for four years. Most were never rotated, and 88% still logged in on the day of testing.
Key points
- Truffle Security found more than 9,300 Amazon Web Services access keys leaked publicly between August 2022 and August 2026 that are still active.
- 768 of those keys give full control of a company's AWS account, including 526 root keys and 242 keys tied to administrator accounts.
- Of the 10,616 keys the researchers could fully re-test, 88% still authenticated as of 10 August.
- Hugging Face, an AI development platform, was the single largest source of leaks, with 8,482 unique keys exposed.
- Only 262 of 2,754 readable accounts had a budget alert set, leaving companies open to runaway bills from crypto-mining abuse.
Security firm Truffle Security has been quietly scraping the public internet for four years, looking for the digital keys that let staff log in to their company's Amazon cloud. It found a lot.
More than 9,300 Amazon Web Services (AWS) keys, exposed at some point between August 2022 and August 2026, are still working. AWS is the cloud platform where a huge share of the world's websites and business data actually live. A working key is the equivalent of a spare office key left under a very public doormat.
Of the leaked keys, 768 give an intruder full control of the company's AWS account: reading data, deleting it, or creating new admin accounts to stay inside.
Who is Truffle Security and how did they find these?
Truffle Security makes a widely used open-source tool called TruffleHog that scans public code for secrets developers have accidentally published. The company mostly sells to enterprises but also runs research projects like this one.
Its researchers, whose findings were first reported by BleepingComputer, pulled 431,875 AWS secrets from public code repositories, old Git history, public datasets and CI logs. After removing duplicates, that left 64,024 unique keys tied to 50,654 AWS accounts.
They could only fully re-test a subset of 10,616 keys. On 10 August, 88% of them still logged in.
What can an attacker actually do with one of these keys?
Quite a lot, and quickly. A key carrying the AdministratorAccess policy, the AWS setting that grants permission to do almost anything inside an account, lets a criminal read customer records, wipe backups, or seize the company's own servers.
| Category | Count |
|---|---|
| Live keys still valid | 9,300+ |
| Keys giving full account control | 768 |
| Root keys (highest privilege) | 526 |
| Admin-level user keys | 242 |
| Accounts with a budget alert set | 262 of 2,754 |
A popular trick is to install cryptocurrency mining software on the victim's servers. The company pays the electricity bill in the form of a huge AWS invoice while the attacker keeps the coins. Fewer than one in ten readable accounts had set a budget alert to catch this kind of abuse. We reported in August how a single exposed access key let criminals drain the records of more than a thousand UK charities before anyone noticed.
Why are keys from years ago still working?
Because almost nobody rotates them. Rotating a key means retiring the old credential and issuing a fresh one, the cloud equivalent of changing the locks.
Among keys with a known creation date, the median age was 1,831 days, roughly five years. The oldest had been sitting in the wild for 17.4 years. Only 13.7% had a newer key issued for the same user, suggesting the rest had never been replaced.
Where are the leaks coming from?
The single largest source was Hugging Face, the popular platform where developers share artificial intelligence models and code. It accounted for 8,482 unique key exposures on its own. Of those, 17.9% were root keys, the master credential for an entire AWS account that AWS's own permission controls can't restrict.
Developers often paste a key into a script, forget it's there, then push the code somewhere public. Automated scanners find it within minutes.
What should companies do now?
Truffle Security says any credential ever pushed to a public location should be treated as already stolen. Delete all root access keys, review every IAM credential by age, rotate or revoke anything old, and switch on budget alerts so a mining attack shows up on the invoice before it reaches the boardroom.
The firm says its testing used read-only metadata only and that it's notified every identifiable owner it could find.
The median key age here is five years. Most of these weren't forgotten in a moment of carelessness last week; they've been sitting in the open since before many of the companies running them had a security team to notice.
