More than 9,300 Amazon Web Services (AWS) access keys publicly exposed between August 2022 and August 2026 remain active and valid, according to Truffle Security’s four‑year analysis.
The scale: thousands of secrets, tens of thousands of keys
Truffle Security reported finding 431,875 AWS secrets scattered across code repositories, Git history, datasets, Docker images, registries, and CI logs. After deduplication the company extracted 64,024 unique AWS keys that corresponded to 50,654 AWS accounts. For a smaller subset where complete credentials were available for re‑verification, Truffle counted 10,616 keys — and 88% of those continued to authenticate as of August 10, 2026.
Privilege and impact: root keys and AdministratorAccess
Of the exposed keys, 817 were linked to companies and 526 of those were AWS root keys, the highest‑privileged identity. Truffle Security found 242 keys associated with Identity and Access Management (IAM) users holding the AdministratorAccess policy, a role that allows full permissions to create, modify, delete, and view virtually all AWS services and resources within an account. The researchers said each of the 768 live keys in the two sets granted “full control of a company's AWS account.”
Truffle Security warned of concrete consequences: an attacker with those credentials could access, exfiltrate, or wipe cloud‑hosted data; take control of servers and applications; create rogue admin accounts for persistent access; or deploy cryptominers that generate substantial charges for the company.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHugging Face emerged as the largest single source
Hugging Face — the online platform where developers share AI models, datasets, and applications — accounted for 8,482 unique key exposures in Truffle’s findings. Of those, 17.9% were root keys, meaning they were not restricted by IAM permissions.
Operational weaknesses: age, rotation, and budget alerts
For the 2,903 keys with available creation dates, Truffle found a median age of 1,831 days (about five years); the oldest key had existed for 17.4 years. Only 398 (13.7%) of those entries had a newer access key associated with the same user, suggesting most had never been rotated. On costs and detection, Truffle noted that only 262 of 2,754 readable accounts had a budget alert set up — a shortfall that could allow unnoticed financial damage if credentials were used to run large cloud workloads or cryptominers.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Truffle’s data shows long‑lived keys and low rotation rates. Teams will need to treat any credential committed to a public source as compromised, review IAM credentials by age, rotate or revoke exposed keys, and delete root access keys where possible.
- Procurement leaders and affected enterprises: The presence of root and AdministratorAccess keys across company accounts elevates supplier and third‑party risk reviews, and highlights the need to require budget alerts and tighter credential hygiene from cloud vendors and contractors.
- End users and the general public: While the report focuses on account‑level access, Truffle’s list of potential attacker actions — access to data, service takeover, or deployment of resource‑intensive workloads — underscores why companies should secure the cloud environments that underpin many public services and consumer applications.
Recommendations, testing limits, and the prevention challenge
Truffle Security recommended several defensive steps: delete all root access keys; review IAM credentials by age; rotate or revoke exposed keys; configure budget alerts; and treat any credential committed to a public source as compromised. The company said its testing was limited to read‑only metadata and that it notified all identifiable owners of the exposed credentials.
Truffle also highlighted a broader defensive gap cited in the Blue Report 2026: “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.” The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments, a reminder that detection and response remain critical once valid credentials are in play.
Truffle Security’s findings show a persistent, practical risk: long‑lived and highly privileged AWS keys continue to live in public places. The data supply chain — from code repositories to container images — is a fertile vector for exposure, and the presence of active root and AdministratorAccess keys raises clear, actionable risk for any company that relies on AWS for critical infrastructure.
