Security researchers at Truffle Security say more than 9,300 Amazon Web Services (AWS) access keys exposed publicly between August 2022 and August 2026 remain active today. The firm has tracked this exposure for four years, scanning code repositories, Git history, datasets, Docker images, registries, and CI logs.
Of the exposed keys, 817 were linked directly to companies, and 526 of those were AWS root keys, the highest-privileged identity type that bypasses IAM permission restrictions entirely. Another 242 keys belonged to IAM users with the AdministratorAccess policy, which grants full rights to create, modify, delete, and view virtually any resource in an AWS account. Combined, the 768 live keys across both sets give attackers full control of the affected companies’ AWS environments.
Truffle Security’s broader dataset totaled 431,875 AWS secrets found in public sources, from which it extracted 64,024 unique keys tied to 50,654 distinct AWS accounts after deduplication. Within a smaller subset of 10,616 keys that could be fully re-verified, 88% still authenticated successfully as of August 10.
Old keys, no rotation, no alerts
The exposed credentials skew old. Among 2,903 keys with known creation dates, the median age was about five years (1,831 days), and the oldest had been active for 17.4 years. Only 13.7% had ever been rotated to a newer key under the same user.
Budget monitoring was similarly neglected: of 2,754 readable accounts, only 262 had a budget alert configured, leaving most organizations without an early warning system if attackers spin up cryptomining infrastructure or rack up abusive charges.
Hugging Face, the AI model and dataset sharing platform, was the single largest source of leaked keys, accounting for 8,482 unique exposures, with 17.9% of those being root keys.
Impact and response
With full account control, attackers could exfiltrate or destroy cloud-hosted data, hijack servers and applications, plant persistent rogue admin accounts, or deploy cryptominers at the victim’s expense.
Truffle Security says its testing was limited to read-only metadata checks and that it has notified all identifiable credential owners. AWS confirmed it investigates all reports of exposed keys and applies quarantine policies to limit risk, and it urged customers to follow shared-responsibility security practices and report exposed credentials to its security team.
Truffle Security recommends deleting all root access keys, auditing IAM credentials by age, rotating or revoking any exposed keys immediately, and enabling budget alerts. Any credential ever committed to a public repository should be treated as compromised, regardless of how long ago it was posted.