Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
3 findings · run finished 2026-09-12 06:04Z · worst first
Trail KMS key disabled or scheduled for deletion3
LowChanged
‹generated-workload-51› +5prod-acct · us-west-2‹i-00000000000000033›177dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-51 in us-west-2 (account 123456789012): first seen 177 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/DArBrzYvAq · e/CDEFGHJKLMNP e/KLMNPQRSTUVW e/STUVWXYZabcd +7
LowChanged‹generated-workload-91› +3234567890123 · us-west-2‹i-0000000000000005b›97dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-91 in us-west-2 (account 234567890123): first seen 97 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/63pnVoyK9k · e/CDEFGHJKLMNP e/KLMNPQRSTUVW e/STUVWXYZabcd +2
LowChanged‹generated-workload-11› +7sandbox · us-west-2‹i-0000000000000000b›77dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-11 in us-west-2 (account 345678901234): first seen 77 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/BTsLef3kEm · e/CDEFGHJKLMNP e/KLMNPQRSTUVW e/STUVWXYZabcd +3