Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
11 findings · run finished 2026-09-12 06:04Z · worst first
Access entry created or widened by a deployer identity11
MediumNot read
‹generated-workload-47› +8sandbox · eu-west-1‹i-0000000000000002f›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-47 in eu-west-1 (account 345678901234): first seen 149 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/G8Rr7JPart · e/89ABCDEFGHJK e/FGHJKLMNPQRS e/NPQRSTUVWXYZ +3
MediumNot read‹generated-workload-97› +9234567890123 · eu-west-1‹i-00000000000000061›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-97 in eu-west-1 (account 234567890123): first seen 139 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/93wYzpmu7V · e/JKLMNPQRSTUV e/RSTUVWXYZabc e/YZabcdefghij +8
MediumNot read‹generated-workload-17› +6sandbox · eu-west-1‹i-00000000000000011›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-17 in eu-west-1 (account 345678901234): first seen 119 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/9486vuk5d1 · e/JKLMNPQRSTUV e/RSTUVWXYZabc e/YZabcdefghij +9
MediumNot read‹generated-workload-87› +6prod-acct · eu-west-1‹i-00000000000000057›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-87 in eu-west-1 (account 123456789012): first seen 69 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/477WMbwwNb · e/89ABCDEFGHJK e/FGHJKLMNPQRS e/NPQRSTUVWXYZ +7
MediumNot read‹generated-workload-7› +3234567890123 · eu-west-1‹i-00000000000000007›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-7 in eu-west-1 (account 234567890123): first seen 49 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/HqrpEhqATW · e/89ABCDEFGHJK e/FGHJKLMNPQRS e/NPQRSTUVWXYZ +8
MediumNot read‹generated-workload-57› +4prod-acct · eu-west-1‹i-00000000000000039›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-57 in eu-west-1 (account 123456789012): first seen 39 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/GNR4TaNDwM · e/JKLMNPQRSTUV e/RSTUVWXYZabc e/YZabcdefghij +4
LowNot read‹generated-workload-67› +7234567890123 · eu-west-1‹i-00000000000000043›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-67 in eu-west-1 (account 234567890123): first seen 109 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/3uJGX4cQuf · e/UVWXYZabcdef e/bcdefghijkmn e/23456789ABCD +5
LowNot read‹generated-workload-107› +5sandbox · eu-west-1‹i-0000000000000006b›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-107 in eu-west-1 (account 345678901234): first seen 29 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/FmBdAo1r9B · e/UVWXYZabcdef e/bcdefghijkmn e/23456789ABCD +9
LowNot read‹generated-workload-27› +9prod-acct · eu-west-1‹i-0000000000000001b›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-27 in eu-west-1 (account 123456789012): first seen 9 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/2fmt3vedCj · e/UVWXYZabcdef e/bcdefghijkmn e/23456789ABCD +1
InfoNot read‹generated-workload-77› +3sandbox · eu-west-1‹i-0000000000000004d›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-77 in eu-west-1 (account 345678901234): first seen 179 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/4xd3CVdDLn · e/efghijkmnopq e/56789ABCDEFG e/CDEFGHJKLMNP +6
InfoNot read‹generated-workload-37› +5234567890123 · eu-west-1‹i-00000000000000025›not readDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Access entry created or widened by a deployer identity on generated-workload-37 in eu-west-1 (account 234567890123): first seen 79 days ago and still present on the run that wrote this board; the weak set grew from 1 to 3 between the two runs, and none of the new members is covered by an allowlist entry.V-012 · f/znw4WBaQFp · e/efghijkmnopq e/56789ABCDEFG e/CDEFGHJKLMNP +2