768 Leaked AWS Keys Still Have Full Admin Access — And Nobody Rotated Them

A four-year cybersecurity investigation just uncovered one of the most overlooked cloud security failures in recent memory. Truffle Security, the team behind the open-source scanner TruffleHog, quietly collected 431,875 exposed AWS credentials from GitHub repositories, Docker images, CI/CD pipeline logs, and — surprisingly — Hugging Face datasets.

When researchers re-verified a sample of 10,616 keys using read-only AWS API calls, the results were alarming:

• 88% of leaked AWS access keys are still active
• 768 keys grant full admin or root-level access to corporate cloud accounts
• 526 are root access keys — the most dangerous credential type in AWS
• Only 13.7% of leaked keys were ever rotated after exposure
• Hugging Face, not GitHub, was the single largest leak source
• The median leaked key stayed active for nearly five years before anyone noticed

The core problem isn't that secrets leak — that's inevitable at scale. It's that almost nobody finishes the job afterward. Deleting a secret from a Git branch doesn't erase it from history. Copies spread into Docker layers, forked datasets, and cached mirrors long after the "fix" commit goes in.

This piece breaks down exactly how these keys stayed active for years, why Hugging Face has become an unexpected leak vector for AI/ML teams, the specific AWS CLI commands to audit your own IAM keys today, and a full remediation checklist for security and DevSecOps teams.

If you work in cloud security, DevOps, IAM policy, or incident response, this is worth 10 minutes of your time before your next audit cycle.

Read the full breakdown: https://www.xpert4cyber.com/2026/08/768-leaked-aws-keys-full-admin-access.html