Truffle Security re-tested 10,616 leaked AWS key pairs and 88% still authenticate; 768 of them give full control of a company account, and none of the measured leak surfaces is the current working tree

Truffle Security re-verified 10,616 leaked AWS key pairs on 2026-08-10, a subset with complete credentials drawn from a scanned population of 64,024 unique verified AWS key pairs across 431,875 public findings surfaced between August 2022 and August 2026, and reports that 88% still authenticate (Truffle Security, 2026-08-19). Of the broader population, 10,625 keys (16.6%) were root keys across 9,945 distinct accounts. Within the enumerable subset described below, only 25 keys (0.9%) were created in the last thirty days, and Truffle's reading of that is blunt: almost none of the population leaked recently, and the count has been building for years.

The privilege picture is what makes it operational. Crossing ownership against privilege, Truffle states: "The two sets do not overlap, so 768 live keys give full control of a company AWS account", 526 root keys plus 242 IAM users carrying AdministratorAccess, derived from a wider set of 817 business-linked keys, with the remaining 49 scoped below administrator. Separately, 130 of the live root keys sit on organization-management accounts, which control every member account in the organisation beneath them. Age and hygiene compound it: "The median live leaked key is five years old and has never been rotated", 1,831 days, measured across the 2,903 keys that permitted access-key enumeration, of which only 13.7% had any newer key alongside the leaked one, with the oldest live key 17.4 years old. On the accounts where budget data was readable, "90.5% of leaked-key accounts have none," and where a budget did exist the median configured limit was $8, the free-tier guardrail rather than a control. Truffle also found that 929 of 7,590 active IAM users (12%) already carry AWS's own compromised-key quarantine policy, meaning AWS itself detected the exposure and restricted them, and that 112 of those carry the pre-2023 version of that policy, AWS flagged them at least three years ago and they still authenticate. Spend on the readable set was mostly negligible at a $0.03 median, but with a real tail: 50 accounts spent over $1,000 in the preceding month, nine over $10,000, and the readable set $420,631 in July alone.

The finding a defender should act on is the source distribution, not the counts. Truffle names five measured surfaces (Git history, public dataset repositories, container images, package registries and CI logs) and ranks only one of them: the largest single source is a public machine-learning dataset platform, with 8,482 unique live keys across 3,394 public datasets, whose keys skew most privileged of any source it tracks at 17.9% root. It publishes no ordering among the other four, so none should be inferred. None of those is the current working tree, which means the reassurance a team takes from a clean secret scan of HEAD is answering a different question from the one that matters: a credential deleted in a later commit is still in the object history, a credential removed in a later image build is still in the published layer, and a credential echoed by a build step is still in the job log long after the pipeline changed.