Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
12 findings · run finished 2026-09-12 06:04Z · worst first
Root account used2
CriticalNew
‹generated-workload-40› +8234567890123 · us-east-1‹i-00000000000000028›100dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-40 in us-east-1 (account 234567890123): first seen 100 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/ArnVq4KxdQ · e/123456789ABC e/89ABCDEFGHJK e/FGHJKLMNPQRS +5
CriticalNew‹generated-workload-0› +3prod-acct · us-east-1 / payments-prod-cluster-0‹i-00000000000000000›0dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-0 in us-east-1 (account 123456789012): first seen 0 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/A4kqZHhQXj · e/123456789ABC e/89ABCDEFGHJK e/FGHJKLMNPQRS +1
Root account used7
HighNew
‹generated-workload-50› +4sandbox · us-east-1‹i-00000000000000032›170dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-50 in us-east-1 (account 345678901234): first seen 170 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/FPMdGUXNkM · e/BCDEFGHJKLMN e/JKLMNPQRSTUV e/RSTUVWXYZabc +6
HighNew‹generated-workload-70› +3234567890123 · us-east-1‹i-00000000000000046›130dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-70 in us-east-1 (account 234567890123): first seen 130 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/DBnxaMaLQP · e/XYZabcdefghi e/efghijkmnopq e/56789ABCDEFG +8
HighNew‹generated-workload-90› +9prod-acct · us-east-1 / payments-prod-cluster-2‹i-0000000000000005a›90dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-90 in us-east-1 (account 123456789012): first seen 90 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/DfdL2AHeme · e/BCDEFGHJKLMN e/JKLMNPQRSTUV e/RSTUVWXYZabc +1
HighNew‹generated-workload-10› +6234567890123 · us-east-1‹i-0000000000000000a›70dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-10 in us-east-1 (account 234567890123): first seen 70 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/9BQ7kMQMV8 · e/BCDEFGHJKLMN e/JKLMNPQRSTUV e/RSTUVWXYZabc +2
HighNew‹generated-workload-110› +8sandbox · us-east-1‹i-0000000000000006e›50dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-110 in us-east-1 (account 345678901234): first seen 50 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/AoVegcFput · e/XYZabcdefghi e/efghijkmnopq e/56789ABCDEFG +3
HighNew‹generated-workload-30› +5prod-acct · us-east-1 / payments-prod-cluster-2‹i-0000000000000001e›30dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-30 in us-east-1 (account 123456789012): first seen 30 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/5uhB1vwvc2 · e/XYZabcdefghi e/efghijkmnopq e/56789ABCDEFG +4
HighNew‹generated-workload-80› +6sandbox · us-east-1‹i-00000000000000050›20dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-80 in us-east-1 (account 345678901234): first seen 20 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/8MB3yj9q2u · e/123456789ABC e/89ABCDEFGHJK e/FGHJKLMNPQRS +9
Root account used3
MediumNew
‹generated-workload-100› +5234567890123 · us-east-1‹i-00000000000000064›160dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-100 in us-east-1 (account 234567890123): first seen 160 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/9zRn53YkWH · e/MNPQRSTUVWXY e/UVWXYZabcdef e/bcdefghijkmn +2
MediumNew‹generated-workload-20› +9sandbox · us-east-1‹i-00000000000000014›140dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-20 in us-east-1 (account 345678901234): first seen 140 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/BvuA23pvFc · e/MNPQRSTUVWXY e/UVWXYZabcdef e/bcdefghijkmn +3
MediumNew‹generated-workload-60› +7prod-acct · us-east-1 / payments-prod-cluster-0‹i-0000000000000003c›60dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-60 in us-east-1 (account 123456789012): first seen 60 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/EZaYZ4FN6u · e/MNPQRSTUVWXY e/UVWXYZabcdef e/bcdefghijkmn +7