Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
3 findings · run finished 2026-09-12 06:04Z · worst first
Access key minted on another user3
Low
‹generated-workload-43› +4234567890123 · eu-central-1‹i-0000000000000002b›121dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-43 in eu-central-1 (account 234567890123): first seen 121 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/9arjj6K8xM · e/456789ABCDEF e/BCDEFGHJKLMN e/JKLMNPQRSTUV +8
Low‹generated-workload-83› +9sandbox · eu-central-1‹i-00000000000000053›41dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-83 in eu-central-1 (account 345678901234): first seen 41 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/B1xDU9W4A4 · e/456789ABCDEF e/BCDEFGHJKLMN e/JKLMNPQRSTUV +3
Low‹generated-workload-3› +6prod-acct · eu-central-1‹i-00000000000000003›21dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-3 in eu-central-1 (account 123456789012): first seen 21 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/E7Xtx9Cehz · e/456789ABCDEF e/BCDEFGHJKLMN e/JKLMNPQRSTUV +4