Attack in progressA leaked CI key of ‹ci-deploy-bot› is being used to break in: 6 accounts and machines created.Open the case
Findings
3 findings · run finished 2026-09-12 06:04Z · worst first
LowChangedTrail KMS key disabled or scheduled for deletionprod-acct · us-west-2
‹generated-workload-51› +5177dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-51 in us-west-2 (account 123456789012): first seen 177 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/DArBrzYvAq · e/CDEFGHJKLMNP e/KLMNPQRSTUVW e/STUVWXYZabcd +7
LowChangedTrail KMS key disabled or scheduled for deletion234567890123 · us-west-2‹generated-workload-91› +397dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-91 in us-west-2 (account 234567890123): first seen 97 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/63pnVoyK9k · e/CDEFGHJKLMNP e/KLMNPQRSTUVW e/STUVWXYZabcd +2
LowChangedTrail KMS key disabled or scheduled for deletionsandbox · us-west-2‹generated-workload-11› +777dDisabling the key makes the existing log files unreadable now. A deletion that runs its course makes them unreadable permanently, without a single log file being touched. Trail KMS key disabled or scheduled for deletion on generated-workload-11 in us-west-2 (account 345678901234): first seen 77 days ago and still present on the run that wrote this board; the weak set grew from 3 to 5 between the two runs, and none of the new members is covered by an allowlist entry.V-002 · f/BTsLef3kEm · e/CDEFGHJKLMNP e/KLMNPQRSTUVW e/STUVWXYZabcd +3