Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
3 findings · run finished 2026-09-12 06:04Z · worst first
Default policy version changed on an attached policy by a non-deployer3
MediumBack
‹generated-workload-92› +4sandbox · eu-west-1‹i-0000000000000005c›104dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-92 in eu-west-1 (account 345678901234): first seen 104 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/2VG3MsB7GC · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +3
MediumBack‹generated-workload-12› +8prod-acct · eu-west-1 / payments-prod-cluster-0‹i-0000000000000000c›84dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-12 in eu-west-1 (account 123456789012): first seen 84 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/H2nPpcxPT7 · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +4
MediumBack‹generated-workload-52› +6234567890123 · eu-west-1‹i-00000000000000034›4dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-52 in eu-west-1 (account 234567890123): first seen 4 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/2LRiP945Ug · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +8