Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
12 findings · run finished 2026-09-12 06:04Z · worst first
OIDC provider client id added6
Medium
‹generated-workload-25› +7234567890123 · us-east-1‹i-00000000000000019›175dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-25 in us-east-1 (account 234567890123): first seen 175 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/AhcbpHrrdB · e/STUVWXYZabcd e/Zabcdefghijk e/ghijkmnopqrs +8
Medium‹generated-workload-95› +7sandbox · us-east-1‹i-0000000000000005f›125dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-95 in us-east-1 (account 345678901234): first seen 125 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/E3vVZkXgLQ · e/GHJKLMNPQRST e/PQRSTUVWXYZa e/WXYZabcdefgh +6
Medium‹generated-workload-15› +4prod-acct · us-east-1‹i-0000000000000000f›105dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-15 in us-east-1 (account 123456789012): first seen 105 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/Cu9RdzrAkZ · e/GHJKLMNPQRST e/PQRSTUVWXYZa e/WXYZabcdefgh +7
Medium‹generated-workload-65› +5sandbox · us-east-1‹i-00000000000000041›95dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-65 in us-east-1 (account 345678901234): first seen 95 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/G2VqgQkQoe · e/STUVWXYZabcd e/Zabcdefghijk e/ghijkmnopqrs +3
Medium‹generated-workload-55› +9234567890123 · us-east-1‹i-00000000000000037›25dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-55 in us-east-1 (account 234567890123): first seen 25 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/4HAboUoZ4W · e/GHJKLMNPQRST e/PQRSTUVWXYZa e/WXYZabcdefgh +2
Medium‹generated-workload-105› +3prod-acct · us-east-1‹i-00000000000000069›15dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-105 in us-east-1 (account 123456789012): first seen 15 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/C23sHYSv3z · e/STUVWXYZabcd e/Zabcdefghijk e/ghijkmnopqrs +7
OIDC provider client id added3
Low
‹generated-workload-75› +8prod-acct · us-east-1‹i-0000000000000004b›165dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-75 in us-east-1 (account 123456789012): first seen 165 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/7SkpPP2J2i · e/cdefghijkmno e/3456789ABCDE e/ABCDEFGHJKLM +4
Low‹generated-workload-115› +6234567890123 · us-east-1‹i-00000000000000073›85dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-115 in us-east-1 (account 234567890123): first seen 85 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/ujyUkbdM7A · e/cdefghijkmno e/3456789ABCDE e/ABCDEFGHJKLM +8
Low‹generated-workload-35› +3sandbox · us-east-1‹i-00000000000000023›65dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-35 in us-east-1 (account 345678901234): first seen 65 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/6cMXScTxyH · e/cdefghijkmno e/3456789ABCDE e/ABCDEFGHJKLM +9
OIDC provider client id added3
Info
‹generated-workload-45› +6prod-acct · us-east-1‹i-0000000000000002d›135dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-45 in us-east-1 (account 123456789012): first seen 135 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/7Xn4EfUed5 · e/6789ABCDEFGH e/DEFGHJKLMNPQ e/LMNPQRSTUVWX +1
Info‹generated-workload-85› +4234567890123 · us-east-1‹i-00000000000000055›55dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-85 in us-east-1 (account 234567890123): first seen 55 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/AZu723CLkZ · e/6789ABCDEFGH e/DEFGHJKLMNPQ e/LMNPQRSTUVWX +5
Info‹generated-workload-5› +8sandbox · us-east-1‹i-00000000000000005›35dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. OIDC provider client id added on generated-workload-5 in us-east-1 (account 345678901234): first seen 35 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-009 · f/FMFFSvbwzc · e/6789ABCDEFGH e/DEFGHJKLMNPQ e/LMNPQRSTUVWX +6