A cybersecurity firm has reported finding over 9,300 active Amazon Web Services (AWS) keys that were publicly exposed between August 2022 and August 2026, with hundreds of these keys granting full administrative privileges. Truffle Security stated its scanners identified 64,024 unique AWS key pairs across 431,875 public sources, including git histories, Hugging Face datasets, Docker images, package registries, and CI logs.
From these findings, 10,616 key pairs had complete credentials, and upon re-verification, 88% were found to still authenticate. Among these, 768 corporate AWS keys possessed full administrative rights. Truffle Security confirmed it is notifying all identifiable account owners without publishing any key material.
The firm emphasized the significant risk posed by AWS account takeovers, which could lead to data theft, deletion, or the covert installation of cryptocurrency mining software. A notable finding was that only 9.5% of the exposed keys had a budget alert configured, which would typically flag unusual spending patterns indicative of such malicious activity.
Hugging Face emerged as the largest single source of leaked keys, accounting for 8,482 unique live keys found across 3,394 public datasets. Of these, 18% were associated with root privileges. The median age of the live keys with traceable creation dates was approximately five years, with the oldest key dating back over 17 years.
The report also highlighted a significant lack of key rotation. For keys where user access keys could be enumerated, only 13.7% (398 out of 2,903) had a newer key alongside the leaked one, indicating that 86% of these keys had never been rotated, superseded, or cleaned up. Furthermore, 43% of the discovered exposed secrets appeared multiple times across different repositories, datasets, and images.
Truffle Security advised organizations and individuals to improve key management practices to mitigate security risks. Key recommendations include deleting root access keys, sorting IAM keys by age, and setting budget alarms, even for small amounts like $10, to detect unauthorized activity. The firm also stressed that exposed secrets should be considered permanently compromised and noted that AWS may attach an "AWSCompromisedKeyQuarantine" policy to a user if a key is found to be public.
