A staggering number of Amazon Web Services (AWS) access keys have been publicly exposed, giving attackers full control over corporate accounts. Truffle Security, a company that has been tracking this issue for four years, has discovered that more than 9,300 AWS access keys were leaked between August 2022 and August 2026. Alarmingly, these exposed keys are still active and valid, allowing threat actors to access, exfiltrate, or wipe cloud-hosted data, take control of servers and applications, and create rogue admin accounts for persistent access.
The affected companies are likely unaware that their AWS accounts have been compromised. Truffle Security found that 817 of the exposed keys were linked to companies, with 526 being AWS root keys. These root keys grant full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. Furthermore, 242 of the exposed keys are associated with Identity and Access Management (IAM) users who have the AdministratorAccess policy, which gives them unfettered access to the company’s entire AWS infrastructure.
The scope of this issue is staggering. Truffle Security analyzed over 431,875 AWS secrets across various platforms, including code repositories, Git history, datasets, Docker images, registries, and CI logs. They extracted 64,024 unique AWS keys that corresponded to 50,654 AWS accounts after removing duplicates. However, the subset of keys for which Truffle Security had complete credentials that could be used for re-verification was 10,616, and a whopping 88% of them continued to authenticate as of August 10.
The largest single source of leaked AWS keys was Hugging Face, an online platform where developers share AI models, datasets, and applications. A staggering 8,482 unique key exposures were linked to Hugging Face, with 17.9% being root keys that aren’t restricted by IAM permissions. The median age of these exposed keys was 1,831 days (about five years), while the oldest had existed for 17.4 years.
This is a wake-up call for companies using AWS. Truffle Security recommends deleting all root access keys, reviewing IAM credentials by age, rotating or revoking exposed keys, and configuring budget alerts to prevent potential abuse. Additionally, any credential committed to a public source should be treated as compromised. By taking these steps, companies can reduce the risk of their AWS accounts being compromised.
As Truffle Security notes, once attackers have valid credentials, only 37% of their actions are blocked by prevention measures. This highlights the importance of proactive security measures and regular key rotation. Companies must remain vigilant and take immediate action to protect themselves from potential abuse.
Source: Bleeping Computer — 2026-08-21