Thousands of AWS Keys Are Wide Open, and Yes, You Are Probably Already Hacked

For the past four years, Truffle Security has been watching a digital car crash in slow motion. They discovered over 9,300 active access keys to Amazon Web Services that were left exposed in public repositories, Git histories, and even Docker images. The real kicker is that 817 of these keys are tied to corporate accounts, and hundreds grant full administrative power.

These aren't just minor leaks; 526 of them are root keys, the "keys to the kingdom" that bypass all Identity and Access Management restrictions. With these credentials, anyone can delete your infrastructure, scrape your data, or turn your cloud environment into a personal crypto-mining farm. Despite years of warnings, most companies involved didn't even have basic budget alerts set up to notice their cloud bill spiking into the stratosphere.

The biggest culprit? Hugging Face, which served as a massive unintentional billboard for these credentials. Some of these keys are ancient—one has been floating around for over 17 years. It seems that while companies are busy obsessing over fancy AI models, they completely forgot to lock the front door of their server room.

This is the natural conclusion of the "move fast and break things" mantra, except the only thing being broken is the security of every client relying on these platforms. If the industry can't figure out how to keep a single text file out of a public Git commit, maybe it's time to stop trusting them with the keys to our digital lives.

Source: Truffle Security