Researchers at Truffle Security scanned public repositories, container images, CI logs and machine-learning datasets for exposed AWS credentials and found 768 corporate keys carrying full administrator rights, most of them abandoned for years rather than freshly leaked.

What happened

Truffle Security’s scan, published on its company blog, surfaced 64,024 unique AWS key pairs across 431,875 public findings in git history, Hugging Face datasets, Docker images, package registries and CI logs since August 2022. Of the 10,616 key pairs with complete credentials the firm re-verified, 88 percent still authenticated. Among those, 768 corporate keys, 526 root account keys and 242 IAM users with AdministratorAccess, granted full control of the account. Hugging Face alone accounted for 8,482 live keys across 3,394 public datasets, nearly 18 percent holding root privileges. The median live leaked key was about five years old, and 86 percent had never been rotated. Truffle Security says it is notifying identifiable owners directly and has published no key material.

Why it matters

A leaked key with admin rights is not a theoretical risk, it is standing access to spin up infrastructure, read every stored object, or exfiltrate data undetected, and the exposure runs for years, not hours. Machine-learning workflows are a specific blind spot: datasets uploaded to Hugging Face for sharing routinely carry embedded credentials nobody scrubbed before the repository went public, and once a dataset is forked, the exposure multiplies beyond the original owner’s control, similar in kind to the third-party data exposure CyberTech has covered elsewhere this month.

The original angle

The five-year median age is the number worth sitting with: this is not a story about a fresh developer mistake, it is a story about rotation practices that do not exist at most organizations. A key that still authenticates five years after exposure says the owner never checked and had no automated control that would have caught it. CyberTech has covered automated tools finding cloud misconfigurations manual review missed; this data makes the case that rotation, not just discovery, needs to be scheduled and enforced rather than triggered only after a breach.

Source: Truffle Security