Hundreds of leaked AWS keys give full control over corporate accounts

Executive summary: Truffle Security found more than 9,300 active AWS access keys publicly exposed across code repositories, Docker images, registries, CI logs and other sources between August 2022 and August 2026, including thousands linked to corporate accounts; many keys possess AdministratorAccess or root privileges (including 526 root keys and a significant subset with full account control), a large number remain valid and unrotated, and the largest single source of leaks was Hugging Face. The exposure enables full account takeover risks — data exfiltration, service disruption, creation of rogue admin accounts, and cryptomining — and the report recommends deleting root keys, rotating or revoking exposed credentials, reviewing IAM by age, and configuring budget alerts.