Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
2 findings · run finished 2026-09-12 06:04Z · worst first
AMI shared publicly2
Critical
‹generated-workload-24› +6prod-acct · ap-southeast-1 / payments-prod-cluster-0‹i-00000000000000018›168dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-24 in ap-southeast-1 (account 123456789012): first seen 168 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/CriCJcMezw · e/RSTUVWXYZabc e/YZabcdefghij e/fghijkmnopqr +7
Critical‹generated-workload-64› +4234567890123 · ap-southeast-1‹i-00000000000000040›88dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. AMI shared publicly on generated-workload-64 in ap-southeast-1 (account 234567890123): first seen 88 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-008 · f/A1JSYkfbQM · e/RSTUVWXYZabc e/YZabcdefghij e/fghijkmnopqr +2