Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case

Findings

2 findings · run finished 2026-09-12 06:04Z · worst first

Rule V-001 ×Clear filters

Case k/cbfca6f4bf85Attack in progress · A leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.CriticalLeaked key spreading; can reach customer data1 finding

Grouped only by links code confirmed: a case, a credential's lineage or a risk theme. A critical or high finding outside a case is always its own row.

CriticalNewRoot account used234567890123 · us-east-1‹generated-workload-40› +8100d

Disabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Root account used on generated-workload-40 in us-east-1 (account 234567890123): first seen 100 days ago and still present on the run that wrote this board; the weak set grew from 0 to 2 between the two runs, and none of the new members is covered by an allowlist entry.V-001 · f/ArnVq4KxdQ · e/123456789ABC e/89ABCDEFGHJK e/FGHJKLMNPQRS +5