Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
6 findings · run finished 2026-09-12 06:04Z · worst first
Access key minted on another user6
Medium
‹generated-workload-23› +5sandbox · eu-central-1‹i-00000000000000017›161dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-23 in eu-central-1 (account 345678901234): first seen 161 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/95WftKfNAF · e/QRSTUVWXYZab e/XYZabcdefghi e/efghijkmnopq +6
Medium‹generated-workload-73› +6234567890123 · eu-central-1‹i-00000000000000049›151dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-73 in eu-central-1 (account 234567890123): first seen 151 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/CFXkn5tQvF · e/abcdefghijkm e/123456789ABC e/89ABCDEFGHJK +2
Medium‹generated-workload-63› +3prod-acct · eu-central-1‹i-0000000000000003f›81dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-63 in eu-central-1 (account 123456789012): first seen 81 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/AgFoTMag59 · e/QRSTUVWXYZab e/XYZabcdefghi e/efghijkmnopq +1
Medium‹generated-workload-113› +4sandbox · eu-central-1‹i-00000000000000071›71dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-113 in eu-central-1 (account 345678901234): first seen 71 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/F4sHUGvTHN · e/abcdefghijkm e/123456789ABC e/89ABCDEFGHJK +6
Medium‹generated-workload-33› +8prod-acct · eu-central-1‹i-00000000000000021›51dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-33 in eu-central-1 (account 123456789012): first seen 51 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/GfmbB7AHbU · e/abcdefghijkm e/123456789ABC e/89ABCDEFGHJK +7
Medium‹generated-workload-103› +8234567890123 · eu-central-1‹i-00000000000000067›1dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access key minted on another user on generated-workload-103 in eu-central-1 (account 234567890123): first seen 1 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-004 · f/7rNaK68Eqg · e/QRSTUVWXYZab e/XYZabcdefghi e/efghijkmnopq +5