Researchers Found 9,300 Active AWS Keys in Public Repos
The findings, reported on August 21, 2026, highlight widespread exposure of root and admin-level cloud credentials.
Updated on Sept. 27, 2026 in Cybersecurity
Live Poll
Do you trust that companies are doing enough to secure their sensitive digital credentials?
Security researchers identified 9,300 active Amazon Web Services (AWS) access keys residing in public repositories as of August 21, 2026. The findings represent a fraction of 431,875 total exposed AWS secrets uncovered across 50,654 distinct accounts.
Why it matters
The persistence of these unrotated credentials leaves corporate cloud infrastructure vulnerable to unauthorized access. The data illustrates a critical gap in credential lifecycle management, as only 14% of the identified keys had been rotated.
Of the 9,300 active keys identified, 526 were classified as AWS root keys and 242 provided full administrator access via IAM (Identity and Access Management) users. While 8,482 keys originated from Hugging Face, the median age of the keys reached five years.
The players
Truffle Security
A cybersecurity firm specializing in secret scanning and monitoring for exposed credentials in development environments.
Amazon Web Services
A global cloud computing provider offering infrastructure services where the identified root and IAM keys provide administrative access.
Hugging Face
A platform hosting machine learning models and datasets where 8,482 of the leaked AWS keys were identified.
The details
Researchers performed a systematic scan of public code repositories, Git history, container images, registries, datasets, and CI (Continuous Integration) logs to locate exposed secrets. They confirmed the validity of the keys by performing an authentication check against the AWS API. Only 14% of the keys were found to have undergone rotation, a security practice where credentials are periodically replaced to limit the impact of a potential compromise.
Timeline
2022: Truffle Security began tracking exposed AWS access keys.
August 10, 2026: An authentication test of 10,616 keys showed an 88% success rate.
August 21, 2026: Truffle Security released its findings regarding the exposed keys.
The Tech Race
This development highlights the ongoing security challenge of managing credentials in increasingly automated CI/CD environments. It follows the pattern set by the 2026 Truffle Security report on secret exposure, demonstrating that despite increased awareness, hard-coded secrets remain a primary attack vector.
Security teams should prioritize immediate rotation for any keys discovered in public datasets, logs, or container configurations. Organizations relying on third-party model hosting platforms like Hugging Face should implement automated secret scanning to prevent accidental credential exposure.
The takeaway
The high authentication success rate of these keys confirms that stale credentials pose an immediate risk to cloud environments. Security teams should monitor for future updates regarding the remediation of the 817 keys specifically linked to named corporate entities.
Further reading
For broader context on protecting digital infrastructure, visit our Cybersecurity section.
Source note: This article includes information reported by Computer Crime Research Center.
Live Poll
Do you trust that companies are doing enough to secure their sensitive digital credentials?
