Study finds 10,000 leaked AWS keys still active, some with full account control

Security firm Truffle Security published research showing that a significant number of Amazon Web Services (AWS) access keys that have already leaked publicly remain valid and usable months, and in many cases years, after being exposed. The findings were reported by CNews and Bleeping Computer.

What the researchers found

Truffle scanned 431,875 AWS secrets spread across code repositories, Git history, datasets, Docker images, registries, and CI logs. From that volume, it extracted 64,024 unique keys, corresponding to 50,654 AWS accounts after removing duplicates.

But the number that matters is different: only 10,616 keys had the complete credentials needed for revalidation (that is, a paired key and secret). Of those, 88% remained valid as of August 10. In absolute terms, that means more than 9,300 keys compromised between August 2022 and August 2026 are still working, even though the leak is publicly known.

The level of access these keys grant is what turns the problem into a critical risk:

• 526 keys with root access to the AWS account, the highest level, which bypasses even IAM restrictions.
• 42 keys belonging to users with administrative IAM permissions (the power to create, modify, delete, and monitor virtually every service in the account).
• 817 keys linked to specific, identifiable companies.
• 768 keys, according to the researchers, gave full control over the corporate AWS account.

Old keys nobody rotates

The picture of credential hygiene is poor. The median age of nearly three thousand keys in the sample is about 5 years, and the oldest key found was 17.4 years old. Worse: only 13.7% of cases showed any kind of key rotation for the same user over time.

Dmitri Peshkov, an information security specialist at SEQ interviewed by CNews, summed it up: "These numbers demonstrate the real state of AWS cybersecurity more eloquently than any report. It seems nobody cared about the 'health status' of these keys for years, and no one will be able to say precisely how many of them have already been used by criminals." He adds that the problem doesn't lie with Amazon, but with the irresponsible posture of cloud end users.

Where the leak comes from

One detail stands out for its relevance to anyone working with AI: the largest source of leaks in the dataset was the Hugging Face platform, a hub for machine learning models and datasets. On its own, it accounted for 8,482 unique keys, and 17.9% of those were root account keys, the kind that not even IAM can limit.

This makes sense given the ML workflow: notebooks, training scripts, and deploy configs frequently carry hardcoded credentials that end up committed to repositories and public model cards. For Brazilian teams pushing AI projects to production using Hugging Face and AWS together, it's a direct warning.

The concrete risk: cryptomining on your bill

Beyond data theft and the hijacking of access to servers and applications, the most immediate scenario is financial. With a valid key, an attacker can install cryptominers in the account and consume computing capacity nonstop, which automatically translates into losses, since in the cloud you pay for what runs.

And here's an aggravating factor: of the 2,754 readable accounts analyzed, only 262 had any kind of spending-overage alert configured. In other words, most exposed accounts simply wouldn't notice an anomalous spending spike until the bill arrived.

What to do now

Truffle Security's recommendation is to treat any credential that has ever been publicly accessible as compromised, without exception. In practice:

• Remove all root access keys. Root shouldn't have any access key at all; access to the root account is for exceptional cases and should go through MFA.
• Audit IAM credentials for age and usage. The IAM Credential Report lists each key's age and when it was last used.
• Rotate or revoke compromised or old keys immediately.
• Set up spending alerts (AWS Budgets / CloudWatch billing alarms) to catch cryptomining and anomalous usage early.

A practical point for everyday work: run a secrets scan on your Git history before someone else does. Tools like TruffleHog itself (open source, from the same company) or git-secrets scan commits for access key patterns. And it's worth remembering that git rm doesn't solve it: a key that was committed and later removed remains in the history and should be considered leaked regardless.

On Amazon's side, the company told Bleeping Computer that it's aware of the leak and that all affected users have been notified. "We thoroughly investigate every report of key exposure and quickly take the necessary steps, such as applying quarantine, to minimize risks to customers without disrupting the operation of their IT environment," a representative said.

What remains unclear

The study doesn't claim that these specific keys have already been exploited by criminals, and as the specialist quoted above points out, it's practically impossible to know how many are already being actively used. The quarantine mentioned by AWS depends on the company detecting the exposure, which clearly didn't happen for most of the keys in the sample, given that 88% remained valid. In practice, the responsibility for closing these doors remains in the hands of whoever operates the account, under the cloud's shared responsibility model.