authorized_keys is an OpenSSH file that contains the public keys permitted to authenticate as a particular user account. It is typically stored in that account’s .ssh directory. When a matching private key is presented, the SSH server can allow login, subject to its configuration and other access controls.
Attackers may try to add a key they control to authorized_keys to create persistent remote access. That attempt does not prove access was established: the file must be writable, the SSH service must accept the login, and the attacker must possess the matching private key. Defenders should restrict file permissions, review changes to authorized keys, and investigate unexpected entries alongside authentication and system logs.