Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
2 findings · run finished 2026-09-12 06:04Z · worst first
Administrator-equivalent AWS-managed policy on a service principal2
Critical
‹generated-workload-16› +5234567890123 · us-west-2‹i-00000000000000010›112dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-16 in us-west-2 (account 234567890123): first seen 112 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/5zDhYAh8zQ · e/HJKLMNPQRSTU e/QRSTUVWXYZab e/XYZabcdefghi +8
Critical‹generated-workload-56› +3sandbox · us-west-2‹i-00000000000000038›32dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Administrator-equivalent AWS-managed policy on a service principal on generated-workload-56 in us-west-2 (account 345678901234): first seen 32 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-010 · f/DSTWvQYDBY · e/HJKLMNPQRSTU e/QRSTUVWXYZab e/XYZabcdefghi +3