A four-year research effort by Truffle Security, a company that scans public code for accidentally leaked secrets, has found that thousands of Amazon Web Services access keys spilled into public view between 2022 and 2026 are still valid today, many of them carrying enough privilege to take over an entire cloud account. The findings were first reported by BleepingComputer and later summarized by SC Media and Cybernews, among others.
Truffle Security said it scanned public code repositories, container images posted to Docker Hub, and continuous integration logs going back to August 2022 and turned up 431,875 distinct AWS secrets. After removing duplicates, that left 64,024 unique access keys tied to an estimated 50,654 separate AWS accounts. Of a sample of 10,616 keys the researchers were able to verify directly, about 88 percent, roughly 9,300 keys, were still active as of August 10, 2026, meaning no one had revoked or rotated them after they leaked.
The researchers said they could trace 817 of the exposed keys to specific named companies. Among those, 526 were AWS root keys, the account’s highest level of access with no restrictions on what it can do, and 242 belonged to IAM users with the broad AdministratorAccess policy attached. In total, Truffle Security counted 768 live keys capable of giving whoever holds them complete control of the associated account, including the ability to create, modify or delete cloud resources, read stored data, launch new servers such as those used for cryptocurrency mining, or shut the account down outright.
Hugging Face, the platform widely used for sharing machine learning models, turned out to be the single largest source of exposure in the dataset, accounting for 8,482 of the leaked keys, of which the researchers said about 17.9 percent were root keys. The report did not specify whether Hugging Face itself was breached; the exposures were describing keys that users had inadvertently committed to code or files hosted on the platform.
Age was a recurring theme in the findings. The median exposed key had been active for about 1,831 days, close to five years, and the oldest one the researchers found had remained valid for 17.4 years. Only 13.7 percent of the affected accounts appeared to have rotated their credentials at any point since exposure. Separately, among 2,754 accounts the researchers could inspect for basic monitoring, just 262 had budget alerts configured, a simple setting that can flag unusual spending, such as the kind generated by an attacker running cryptomining jobs on someone else’s account.
It is worth noting that the study measures exposure and continued validity of these keys, not confirmed break-ins. Truffle Security’s report does not claim that all, or even most, of the affected accounts have already been accessed by an outside party, only that the credentials remain technically capable of it.
Amazon told reporters covering the study that it notifies customers when it becomes aware that their keys have been exposed, investigates such reports, and applies quarantine policies to affected credentials when necessary. The company pointed customers toward its published security, identity and compliance guidance.
Security researchers recommend that organizations delete root access keys entirely and rely on IAM roles with limited, task-specific permissions instead, rotate any long-lived credentials on a regular schedule, and treat any key that has ever touched a public repository, even briefly, as compromised and revoke it immediately rather than waiting to confirm misuse. Enabling budget alerts and reviewing account activity logs are also recommended as basic detection measures.
Source: BleepingComputer, “Hundreds of leaked AWS keys give full control over corporate accounts”, based on research from Truffle Security.
