--- title: Hundreds of leaked AWS keys give full control over... description: Truffle Security found over 9,300 publicly exposed AWS access keys, spanning August 2022 to August 2026, that remain active and valid. Of those, 817 belong to... canonical: https://daily.dev/posts/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts-rtjxuag2x twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Hundreds of leaked AWS keys give full control over corporate accounts | daily.dev og:description: Truffle Security found over 9,300 publicly exposed AWS access keys, spanning August 2022 to August 2026, that remain active and valid. Of those, 817 belong to... og:url: https://daily.dev/posts/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts-rtjxuag2x og:image: https://api.daily.dev/og/posts/RtjxUag2x.png og:image:alt: Hundreds of leaked AWS keys give full control over corporate accounts og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Hundreds of leaked AWS keys give full control over corporate accounts **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 1 upvotes · 0 comments ## Summary Truffle Security found over 9,300 publicly exposed AWS access keys, spanning August 2022 to August 2026, that remain active and valid. Of those, 817 belong to companies, with 526 being root keys and 242 tied to AdministratorAccess IAM users, giving attackers full account control. The keys were scraped from code repos, Docker images, CI logs, and datasets, with Hugging Face being the single largest source at 8,482 unique exposures. Most keys were never rotated, median age around five years, and only a small fraction of accounts had budget alerts configured to catch abuse like cryptomining. Researchers recommend deleting root keys, rotating exposed credentials, and treating any publicly committed credential as compromised. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many exposed AWS keys are still active and giving attackers full account control? More than 9,300 publicly exposed AWS access keys, leaked between August 2022 and August 2026, remain active. Of these, 817 belong to companies, including 526 root keys and 242 tied to IAM users with AdministratorAccess policies, meaning each grants full control over a company's AWS account, letting attackers exfiltrate data, hijack servers, or create persistent rogue admin accounts. _Track cloud credential exposure trends and remediation guidance for AWS environments on daily.dev._ ### Which platform is the largest source of leaked AWS keys? Hugging Face, the platform where developers share AI models and datasets, was the single largest source of leaked AWS keys, accounting for 8,482 unique key exposures, with 17.9% of those being root credentials that bypass IAM permission restrictions entirely. _Developers sharing AI models on Hugging Face can follow security research like this on daily.dev._ ### How old were the exposed AWS keys and were they ever rotated? For the 2,903 keys with available creation dates, the median age was 1,831 days, roughly five years, and the oldest had existed for 17.4 years. Only 13.7% had a newer key associated with the same user, indicating most exposed credentials were never rotated after initial creation. _Teams auditing stale AWS credentials can keep up with cloud security findings on daily.dev._ ## Similar posts on daily.dev - [Security boffins harvest bumper crop of API keys from web](https://daily.dev/posts/security-boffins-harvest-bumper-crop-of-api-keys-from-web-56ku6ambh) · The Register · 0 upvotes · 0 comments - [Over 543,000 valid credentials exposed in public GitHub repositories](https://daily.dev/posts/over-543-000-valid-credentials-exposed-in-public-github-repositories-fblhmhuem) · BleepingComputer · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#secrets-management](https://daily.dev/tags/secrets-management) [View this post on daily.dev](https://daily.dev/posts/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts-rtjxuag2x) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Hundreds of leaked AWS keys give full control over corporate accounts","url":"https://daily.dev/posts/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts-rtjxuag2x","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts-rtjxuag2x"},"datePublished":"2026-08-21T16:32:29.052Z","dateModified":"2026-09-13T18:45:16.096Z","description":"Truffle Security found over 9,300 publicly exposed AWS access keys, spanning August 2022 to August 2026, that remain active and valid. Of those, 817 belong to...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecef09f038745aa1681302feb60e1427?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ecef09f038745aa1681302feb60e1427?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts-rtjxuag2x","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,secrets-management","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Hundreds of leaked AWS keys give full control over corporate accounts"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/hundreds-of-leaked-aws-keys-give-full-control-over-corporate-accounts-rtjxuag2x#faq","mainEntity":[{"@type":"Question","name":"How many exposed AWS keys are still active and giving attackers full account control?","acceptedAnswer":{"@type":"Answer","text":"More than 9,300 publicly exposed AWS access keys, leaked between August 2022 and August 2026, remain active. Of these, 817 belong to companies, including 526 root keys and 242 tied to IAM users with AdministratorAccess policies, meaning each grants full control over a company's AWS account, letting attackers exfiltrate data, hijack servers, or create persistent rogue admin accounts. Track cloud credential exposure trends and remediation guidance for AWS environments on daily.dev."}},{"@type":"Question","name":"Which platform is the largest source of leaked AWS keys?","acceptedAnswer":{"@type":"Answer","text":"Hugging Face, the platform where developers share AI models and datasets, was the single largest source of leaked AWS keys, accounting for 8,482 unique key exposures, with 17.9% of those being root credentials that bypass IAM permission restrictions entirely. Developers sharing AI models on Hugging Face can follow security research like this on daily.dev."}},{"@type":"Question","name":"How old were the exposed AWS keys and were they ever rotated?","acceptedAnswer":{"@type":"Answer","text":"For the 2,903 keys with available creation dates, the median age was 1,831 days, roughly five years, and the oldest had existed for 17.4 years. Only 13.7% had a newer key associated with the same user, indicating most exposed credentials were never rotated after initial creation. Teams auditing stale AWS credentials can keep up with cloud security findings on daily.dev."}}]} ```