Researchers Uncover Thousands of Leaked AWS Keys

Truffle Security found tens of thousands of publicly exposed AWS key pairs across git history, Hugging Face datasets, Docker images and CI logs; 10,616 key pairs had complete credentials, 88% still authenticated, and 768 corporate keys had full admin/root rights. Many keys were old and never rotated, most accounts lack budget alerts (increasing risk of unnoticed cryptomining or data theft), and the report urges deleting root keys, sorting IAM keys by age, setting budget alarms, treating exposed secrets as compromised, and monitoring for AWSCompromisedKeyQuarantine.