What happens when the agent is long gone, but its access key lives on?
The article examines a critical security gap: cloud agents and services created for temporary projects often leave behind active access keys that are never decommissioned. Unlike employee offboarding, abandoned infrastructure lacks automated lifecycle management, allowing credentials to persist as security liabilities. OWASP's 2025 Top 10 for non-human identities now flags improper offboarding as a primary risk, and the article illustrates how rapidly attackers can exploit such exposed access before annual audits catch them.
Key points
- AWS IAM access keys don't expire automatically and can remain active indefinitely
- Forgotten credentials from closed projects create unmanaged security risks
- OWASP ranks improper non-human identity offboarding as a top threat
- Attackers can move faster than annual security audits
Summary and key points written by AI from the headline and a short excerpt, so they can be incomplete or wrong. The New Stack did the reporting; read the original for the full story.
Read the full story at The New Stack
