Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
12 findings · run finished 2026-09-12 06:04Z · worst first
CriticalBackDefault policy version changed on an attached policy by a non-deployersandbox · eu-west-1
‹generated-workload-32› +744dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-32 in eu-west-1 (account 345678901234): first seen 44 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/GP1E5CpqsD · e/Zabcdefghijk e/ghijkmnopqrs e/789ABCDEFGHJ +6
HighBackDefault policy version changed on an attached policy by a non-deployerprod-acct · eu-west-1 / payments-prod-cluster-2‹generated-workload-102› +7174dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-102 in eu-west-1 (account 123456789012): first seen 174 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/TXXFKFQSDR · e/PQRSTUVWXYZa e/WXYZabcdefgh e/defghijkmnop +4
HighBackDefault policy version changed on an attached policy by a non-deployer234567890123 · eu-west-1‹generated-workload-22› +4154dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-22 in eu-west-1 (account 234567890123): first seen 154 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/DVL5oUvKVV · e/PQRSTUVWXYZa e/WXYZabcdefgh e/defghijkmnop +5
HighBackDefault policy version changed on an attached policy by a non-deployerprod-acct · eu-west-1 / payments-prod-cluster-0‹generated-workload-72› +5144dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-72 in eu-west-1 (account 123456789012): first seen 144 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/7X3QLtQoNy · e/Zabcdefghijk e/ghijkmnopqrs e/789ABCDEFGHJ +1
HighBackDefault policy version changed on an attached policy by a non-deployerprod-acct · eu-west-1 / payments-prod-cluster-2‹generated-workload-42› +3114dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-42 in eu-west-1 (account 123456789012): first seen 114 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/G4XRD56Ufj · e/3456789ABCDE e/ABCDEFGHJKLM e/HJKLMNPQRSTU +7
HighBackDefault policy version changed on an attached policy by a non-deployersandbox · eu-west-1‹generated-workload-62› +974dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-62 in eu-west-1 (account 345678901234): first seen 74 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/DgDRrFHxud · e/PQRSTUVWXYZa e/WXYZabcdefgh e/defghijkmnop +9
HighBackDefault policy version changed on an attached policy by a non-deployer234567890123 · eu-west-1‹generated-workload-112› +364dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-112 in eu-west-1 (account 234567890123): first seen 64 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/5s1aU9pWLu · e/Zabcdefghijk e/ghijkmnopqrs e/789ABCDEFGHJ +5
HighBackDefault policy version changed on an attached policy by a non-deployer234567890123 · eu-west-1‹generated-workload-82› +834dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-82 in eu-west-1 (account 234567890123): first seen 34 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/6tvoDDpoWT · e/3456789ABCDE e/ABCDEFGHJKLM e/HJKLMNPQRSTU +2
HighBackDefault policy version changed on an attached policy by a non-deployersandbox · eu-west-1‹generated-workload-2› +514dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-2 in eu-west-1 (account 345678901234): first seen 14 days ago and still present on the run that wrote this board; the weak set grew from 2 to 4 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/5Ynpo3N41f · e/3456789ABCDE e/ABCDEFGHJKLM e/HJKLMNPQRSTU +3
MediumBackDefault policy version changed on an attached policy by a non-deployersandbox · eu-west-1‹generated-workload-92› +4104dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-92 in eu-west-1 (account 345678901234): first seen 104 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/2VG3MsB7GC · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +3
MediumBackDefault policy version changed on an attached policy by a non-deployerprod-acct · eu-west-1 / payments-prod-cluster-0‹generated-workload-12› +884dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-12 in eu-west-1 (account 123456789012): first seen 84 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/H2nPpcxPT7 · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +4
MediumBackDefault policy version changed on an attached policy by a non-deployer234567890123 · eu-west-1‹generated-workload-52› +64dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Default policy version changed on an attached policy by a non-deployer on generated-workload-52 in eu-west-1 (account 234567890123): first seen 4 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-003 · f/2LRiP945Ug · e/DEFGHJKLMNPQ e/LMNPQRSTUVWX e/TUVWXYZabcde +8