Persistent Leaked AWS Keys Expose Critical Gaps in Cloud Secrets Lifecycle and Hygiene

Security researchers at Truffle Security analyzed 431,875 public artifacts across Git history, Hugging Face datasets, Docker images, CI logs, and package registries, discovering 64,024 unique AWS key pairs. Upon re-verifying 10,616 complete credential pairs exposed between August 2022 and August 2026, researchers found that 88%—over 9,300 keys—remain fully active and capable of authenticating. Strikingly, 768 of these exposed credentials belong to corporate AWS environments with full administrative permissions. Hugging Face emerged as the largest single contributor, accounting for 8,482 live keys across 3,394 public datasets, with 18% possessing root privileges. The findings also revealed that only 13.7% of investigated identities had ever undergone rotation, while 90.5% lacked basic cloud budget alerts to detect illicit compute usage. These findings expose a systemic operational breakdown in how engineering teams manage non-human identities. Persistent access keys represent an immediate vector for complete account takeover, unmonitored infrastructure hijacking, and stealthy cryptomining operations. The concentration of leaked credentials within machine learning repositories highlights how rapidly adopted AI workflows frequently bypass established corporate DevSecOps controls. When data scientists and ML engineers publish models or training datasets containing embedded environment credentials, traditional repository scanners often miss the leak entirely, leaving high-privilege keys active indefinitely. This credential exposure pattern mirrors broader enterprise security struggles with non-human identity management and machine identity sprawl. As organizations accelerate AI adoption and automated CI/CD pipelines, programmatic credentials have proliferated exponentially compared to human user accounts. While cloud providers have made significant strides in promoting temporary session tokens via AWS STS and Workload Identity Federation, legacy architectures and developer convenience continue to drive reliance on static, long-lived IAM user keys. The persistence of five- to seventeen-year-old active keys proves that secret leakage cannot be treated as a point-in-time incident, but rather as permanent technical debt requiring continuous discovery. To mitigate this exposure, security and infrastructure teams must enforce immediate operational guardrails. First, organizations should audit existing credentials using IAM administrative tooling to identify and deactivate any access keys exceeding 90 days. Second, platform teams must aggressively enforce short-lived role assumption and OpenID Connect (OIDC) authentication across CI/CD and AI platforms, systematically eliminating long-lived access keys. Finally, engineering leads should configure AWS budget alarms with immediate notification thresholds to catch rogue compute spikes early, while actively monitoring for AWS-applied quarantine policies that signal external credential exposure.