88% of 64,000 Leaked AWS Keys Were Still Active, Truffle Security Finds
Truffle Security rechecked 64,024 publicly exposed AWS keys and found 88% still active, with many carrying administrator or root access.
Why it matters: The research quantifies how long leaked cloud credentials remain active and shows that AI training datasets can expose live infrastructure secrets at large scale.
Thousands of publicly exposed Amazon Web Services credentials remain usable years after they first leaked, according to new research from Truffle Security.
Researchers rechecked 64,024 unique AWS keys found across public source code, container images and datasets and found that 88% were still active. The median exposed credential had remained active for about five years, while only 14% showed evidence of rotation.
The access behind many of those credentials was extensive. Among keys Truffle Security was able to examine closely, the company says 84% carried full administrator privileges and approximately one in six was an AWS root key.
Artificial-intelligence datasets are also becoming an important source of credential exposure. A TruffleHog scan of 7.6 petabytes of public Hugging Face data discovered 3,343 live AWS credentials. More than 900 could enumerate S3 buckets containing at least 51.7 terabytes of private data.
The research highlights a growing cloud-security problem as AI agents, CI/CD pipelines and automated workloads create and copy credentials across increasingly complex infrastructure.
Finding a leaked secret is no longer the entire security problem. Organizations also need to know what the credential can access and revoke it before somebody else does.