768 leaked AWS keys still work

Published August 21, 2026

Researchers found 768 AWS login keys sitting in public code and datasets that still work, and every one of them grants full administrator control over a company's cloud account. Anyone who finds these keys can take over the account, steal data, or run up huge bills.

Report priority
Medium
Involves
Hugging Face

What is known

Developers accidentally publish AWS keys in public GitHub code, Hugging Face AI datasets, Docker container images, package files, and CI/CD logs, and many of those keys are never revoked, so anyone who searches those public archives can find and reuse them.

What to do

Check whether your organization has ever committed AWS access keys to public GitHub repositories, Docker images, Hugging Face datasets, or CI/CD logs, and review AWS IAM Access Analyzer or CloudTrail for any keys AWS has flagged under its AWSCompromisedKeyQuarantine policy.

Treat any key that was ever publicly exposed as permanently compromised: delete AWS root access keys entirely, rotate and revoke any exposed IAM keys immediately, remove admin-level policies from keys that do not need them, and turn on AWS billing alerts to catch unauthorized usage.

Reported details

Truffle Security re-validated 10,616 previously reported AWS key pairs on August 10, 2026, drawn from 64,024 unique keys found across 431,875 public findings collected since August 2022. 88% still authenticated. Of 817 active keys tied to business accounts, 768 (526 root keys, 242 AdministratorAccess IAM keys) had full admin rights, and 130 live root keys belonged to AWS Organizations management accounts.

Hugging Face was the largest single source, with 8,482 live keys across 3,394 public datasets. Median age of an active leaked key was 1,831 days, and only 398 of 2,903 keys had ever been rotated.

References

View Original Source