Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
12 findings · run finished 2026-09-12 06:04Z · worst first
AMI shared publicly2
Critical
‹generated-workload-24› +6prod-acct · ap-southeast-1 / payments-prod-cluster-0‹i-00000000000000018›168dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-24 in ap-southeast-1 (account 123456789012): first seen 168 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/CriCJcMezw · e/RSTUVWXYZabc e/YZabcdefghij e/fghijkmnopqr +7
Critical‹generated-workload-64› +4234567890123 · ap-southeast-1‹i-00000000000000040›88dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-64 in ap-southeast-1 (account 234567890123): first seen 88 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/A1JSYkfbQM · e/RSTUVWXYZabc e/YZabcdefghij e/fghijkmnopqr +2
AMI shared publicly7
High
‹generated-workload-74› +7sandbox · ap-southeast-1‹i-0000000000000004a›158dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-74 in ap-southeast-1 (account 345678901234): first seen 158 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/8RRpyPRrX6 · e/bcdefghijkmn e/23456789ABCD e/9ABCDEFGHJKL +3
High‹generated-workload-94› +6234567890123 · ap-southeast-1‹i-0000000000000005e›118dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-94 in ap-southeast-1 (account 234567890123): first seen 118 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/74TBtiwU7L · e/FGHJKLMNPQRS e/NPQRSTUVWXYZ e/VWXYZabcdefg +5
High‹generated-workload-14› +3sandbox · ap-southeast-1‹i-0000000000000000e›98dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-14 in ap-southeast-1 (account 345678901234): first seen 98 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/AdjFkGnGsg · e/FGHJKLMNPQRS e/NPQRSTUVWXYZ e/VWXYZabcdefg +6
High‹generated-workload-114› +5prod-acct · ap-southeast-1 / payments-prod-cluster-2‹i-00000000000000072›78dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-114 in ap-southeast-1 (account 123456789012): first seen 78 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/4dD9civYEE · e/bcdefghijkmn e/23456789ABCD e/9ABCDEFGHJKL +7
High‹generated-workload-34› +9234567890123 · ap-southeast-1‹i-00000000000000022›58dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-34 in ap-southeast-1 (account 234567890123): first seen 58 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/j7XD1icvyt · e/bcdefghijkmn e/23456789ABCD e/9ABCDEFGHJKL +8
High‹generated-workload-54› +8prod-acct · ap-southeast-1 / payments-prod-cluster-2‹i-00000000000000036›18dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-54 in ap-southeast-1 (account 123456789012): first seen 18 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/AJoVqy3nYf · e/FGHJKLMNPQRS e/NPQRSTUVWXYZ e/VWXYZabcdefg +1
High‹generated-workload-104› +9sandbox · ap-southeast-1‹i-00000000000000068›8dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-104 in ap-southeast-1 (account 345678901234): first seen 8 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/VnjcjwnMBR · e/RSTUVWXYZabc e/YZabcdefghij e/fghijkmnopqr +6
AMI shared publicly3
Medium
‹generated-workload-44› +5sandbox · ap-southeast-1‹i-0000000000000002c›128dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-44 in ap-southeast-1 (account 345678901234): first seen 128 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/5aaW9ER6hH · e/56789ABCDEFG e/CDEFGHJKLMNP e/KLMNPQRSTUVW +9
Medium‹generated-workload-84› +3prod-acct · ap-southeast-1 / payments-prod-cluster-0‹i-00000000000000054›48dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-84 in ap-southeast-1 (account 123456789012): first seen 48 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/5mr1sAbQ9K · e/56789ABCDEFG e/CDEFGHJKLMNP e/KLMNPQRSTUVW +4
Medium‹generated-workload-4› +7234567890123 · ap-southeast-1‹i-00000000000000004›28dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-4 in ap-southeast-1 (account 234567890123): first seen 28 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/3BBJZUDogz · e/56789ABCDEFG e/CDEFGHJKLMNP e/KLMNPQRSTUVW +5