The Scale of the Exposure
More than 9,300 Amazon Web Services access keys publicly exposed between August 2022 and August 2026 are still active and valid, part of Truffle Security's four-year tracking project. That means thousands of corporate accounts remain within reach of anyone who finds a leaked credential in a public code repository, Git history, or dataset.
Truffle Security reports 431,875 AWS secrets across code repositories, Git history, datasets, Docker images, registries, and CI logs, from which the team extracted 64,024 unique AWS keys corresponding to 50,654 AWS accounts after removing duplicates.
Of those, 10,616 keys were selected for re-verification, and 88% of them continued to authenticate as of August 10 — a finding that underscores how rarely exposed credentials are rotated or revoked.
Hugging Face: the Largest Single Source
Hugging Face, the popular online platform where developers share AI models, datasets, and applications, was the largest single source of leaked AWS keys, accounting for 8,482 unique key exposures. Of those Hugging Face exposures, 17.9% were root keys — the highest-privileged identity, unrestricted by IAM permissions. This single platform alone represents nearly 91% of the 9,300+ active leaked keys, making it the critical choke point in the exposure chain.
Privileged Keys and IAM Roles
Truffle Security reports that 817 of the exposed keys were linked to companies, and 526 of those are AWS root keys — the most privileged identity possible, unrestricted by IAM policies. An additional 242 keys belong to IAM users assigned the AdministratorAccess role, which grants full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. The researchers note that each of the 768 live keys in the tracked sets offers "full control of a company's AWS account."
Key Age and Rotation Patterns
For the 2,903 keys with available creation dates, the median age was 1,831 days — roughly five years. The oldest key in the dataset had existed for 17.4 years. Only 398 entries, or 13.7%, had a newer access key associated with the same user, suggesting most of these credentials were never rotated after being committed to a public source. This long median age means many exposed keys have been valid for half a decade or more, amplifying the risk window for any attacker who finds them.
Authentication Persistence
Researchers found that 88% of verified 10,616 re-authenticated keys still work as of August 10. Once attackers have valid credentials, only 37% of their actions are blocked, according to the Blue Report 2026, which measured defenses across 338 million simulations in customer production environments. Overall prevention scores can hide this sharp decline: the drop from initial-entry blocking to post-access blocking is dramatic and underscores the danger of credential reuse.
Defensive Gaps
Truffle Security says that only 262 of 2,754 readable accounts had a budget alert set up. Without budget alerts, organizations may not notice unusual spending driven by cryptominers or other resource-abuse activities that threat actors deploy once they have valid credentials. The combination of rarely rotated keys, a single platform hosting the majority of exposures, and a high re-authentication rate creates a persistent threat landscape that many organizations are not equipped to detect or respond to.
Recommendations
The researchers recommend several immediate steps to reduce risk:
- Delete all root access keys whenever possible
- Review IAM credentials by age and rotate or revoke exposed keys
- Configure budget alerts to catch unexpected resource usage
- Treat any credential committed to a public source as compromised
AWS's spokesperson told BleepingComputer that the company notifies affected customers whenever it becomes aware of exposed keys and quickly investigates reports. The statement reflects AWS's shared responsibility model, which encourages customers to follow security, identity, and compliance best practices. In the event a customer suspects they may have exposed their credentials, they can start by following the steps listed in this post. As always, customers can contact AWS Support with any questions or concerns about the security of their account.
Why This Matters
More than nine thousand active AWS keys mean that a significant chunk of corporate cloud infrastructure remains vulnerable to credential-based attacks. The combination of rarely rotated keys, a single platform hosting the majority of exposures, and a high re-authentication rate creates a persistent threat landscape. Until organizations treat exposed credentials as compromised and rotate them proactively, the risk of data exfiltration, server takeover, and cryptomining abuse will continue to scale with the size of the exposed footprint.
Gray Moretti is a tech writer and infosec news reporter with over a decade of experience covering open-source, Linux, malware, data breach incidents, and hacks for various online publications. His work has appeared in outlets that track security vulnerabilities, exploits, and breaches in enterprise SaaS platforms.
