Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
1 finding · run finished 2026-09-12 06:04Z · worst first
CriticalBackDefault policy version changed on an attached policy by a non-deployersandbox · eu-west-1
‹generated-workload-32› +744dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-32 in eu-west-1 (account 345678901234): first seen 44 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/GP1E5CpqsD · e/Zabcdefghijk e/ghijkmnopqrs e/789ABCDEFGHJ +6