Researchers found thousands of leaked AWS access keys that still work, including hundreds with full administrative access to corporate accounts.
Truffle Security reached that finding after analyzing 431,875 public findings containing 64,024 unique AWS access keys. Of the 10,616 complete key pairs researchers rechecked, 9,308 still authenticated with AWS. Although the live keys are small compared to the initial figures, the risk lies in what a single exposed live key can grant if exploited.
The research does not establish that attackers used the credentials, but it shows why exposure alone is not the end of the story. A leaked key can remain valid as its copies propagate across different pipelines, turning an old developer mistake into a long-lived cloud security risk.
Thousands of exposed AWS keys are still working
The researchers analyzed 431,875 publicly exposed materials from Git repositories, Git history, Docker images, package registries, CI logs, and public datasets.
The analysis identified 64,024 unique AWS access keys. Researchers reverified 10,616 complete key pairs on Aug. 10, 2026, finding that 88% still authenticated with AWS.
The more serious finding was what some of those keys could access.
Of the active credentials, 817 were tied to companies, including 526 root access keys and 242 IAM credentials with AWS’s Administrator Access policy. That means 768 corporate-linked keys had full administrative control of their AWS accounts.
For the 2,903 active keys that allowed researchers to retrieve their creation dates, the median key was about five years old, while the oldest was 17.4 years old.
Why leaked AWS keys can remain valid for years
AWS access keys do not automatically expire simply because they have been exposed publicly. These keys can remain valid until someone explicitly revokes them.
That points to a breakdown in credential lifecycle management. A company may remove a secret from a repository, switch to another key, or retire an application, but none of those actions necessarily revokes the underlying key.
Truffle Security’s finding of active credentials carrying AWS’s AWSCompromisedKeyQuarantine policy is particularly telling. AWS had identified some credentials as compromised, yet the keys still existed and could be authenticated.
There is also a visibility and internal policy problem. Organizations can accumulate old IAM users over time. But, if nobody owns a credential anymore, there may be no one to check whether it is still active or whether it still needs the permissions it was originally granted.
That helps explain how a five-year-old secret can remain technically valid even after the system that created it has changed completely.
The lesson goes beyond AWS
Although the study focused on AWS access keys, its credential-management lesson applies more broadly. The same mistake can occur with anything from API keys and database credentials to tokens used by SaaS platforms.
That risk is becoming harder to contain as more of an organization’s infrastructure moves into the cloud. Hugging Face was the study’s largest single source, with 8,482 unique live AWS keys found across 3,394 public datasets.
The same problem becomes more consequential as AI agents and integrations receive service identities, credentials used by MCP servers and clients, and permissions to access cloud resources, databases, and other services.
Long-lived credentials should be replaced with short-lived credentials or role-based access wherever possible.
Exposed keys should be immediately revoked or rotated rather than simply removed from source code. Organizations should also scan Git history and public artifacts, maintain clear credential policies, and use logging and billing alerts to catch suspicious activity.
The goal should be simple: if a credential leaks today, it should not still be able to open the same door five years from now.
Read more: An AI-driven AWS attack shows how exposed credentials can lead to full administrative access in under 10 minutes, reinforcing why security teams must revoke leaked keys before attackers can escalate their access.