Researchers Found Thousands of Leaked AWS Access Keys
A security audit uncovered over 9,000 active and valid Amazon Web Services credentials exposed in public repositories.
Updated on Sept. 27, 2026 in Cybersecurity
Live Poll
Do you trust that companies are doing enough to secure their sensitive digital credentials?
As of August 21, 2026, security researchers reported that they identified 9,300 active Amazon Web Services (AWS) access keys residing in public locations. These credentials pose a significant risk, as they grant potential unauthorized access to corporate cloud infrastructure.
Why it matters
The widespread exposure of these secrets allows attackers to easily infiltrate sensitive cloud environments and exploit corporate data. With only 14% of the keys having been rotated, the vast majority remain a high-risk security vulnerability for affected organizations.
The investigation identified 526 AWS root keys and 242 IAM user keys with full administrator privileges. A test of 10,616 keys performed on August 10, 2026, confirmed an 88% authentication success rate for the exposed credentials.
The players
Truffle Security
This cybersecurity firm specializes in identifying and mitigating the risks posed by exposed secrets and credentials in software development environments.
Amazon Web Services
As a primary cloud infrastructure provider, this company offers tools for compute, storage, and database management to organizations globally.
Hugging Face
This collaborative platform hosts machine learning models and datasets, serving as a primary hub for researchers and developers to share technical assets.
The details
Researchers at Truffle Security discovered the credentials by scanning diverse sources, including code repositories, Git history, container images, and CI logs. The Hugging Face platform was identified as the largest source of the leaks, accounting for 8,482 of the discovered keys.
Timeline
Truffle Security began monitoring exposed AWS access keys in 2022.
Researchers confirmed an 88% authentication success rate for key samples on August 10, 2026.
The findings regarding the scope of credential exposure were formally reported on August 21, 2026.
The Tech Race
This discovery follows the documented trend of secret-sprawl vulnerabilities in CI/CD pipelines by demonstrating that automated scanning is essential to prevent mass credential exposure. It highlights the recurring struggle to replace static, long-lived credentials with more secure, temporary authentication tokens in modern cloud architecture.
Developers and system administrators must prioritize immediate credential rotation and implement secret scanning tools within their CI/CD pipelines to prevent unauthorized access. Organizations should also move toward using temporary, short-lived security tokens instead of hard-coded access keys to reduce the risk of future leaks.
The takeaway
Security relies on the proactive management and regular rotation of credentials rather than long-term static passwords. Teams should treat all cloud access keys as sensitive code and ensure they are never committed to public or shared environments.
Further reading
For additional context on protecting cloud infrastructure, visit the Cybersecurity section.
Source note: This article includes information reported by Computer Crime Research Center.
Live Poll
Do you trust that companies are doing enough to secure their sensitive digital credentials?
