AI Bot Impersonation Drives Credential Hunt on US Sites

A threat actor has been masquerading as 32 artificial-intelligence crawlers to scan US websites for exposed secrets, according to research from Cequence Security. The scanner, active from late September to late October 2026, pretended to be bots from OpenAI, Anthropic, Perplexity, Meta and other well-known AI providers.

On a single day in October, the malicious scanner reached 48% of the organizations monitored by Cequence that received AI bot traffic. The affected firms spanned financial services, retail, telecommunications, energy and software. Nearly all requests from the scanner were blocked or failed during the observation period, but the breadth of coverage shows the scale of the attempt.

How the Scanner Operates

The scanner rotates through different bot identities, sometimes claiming to represent OpenAI, Anthropic, Meta and Perplexity within seconds of one another. It requests files that legitimate crawlers have no reason to access, including .env configuration files, cloud credential files and private SSH keys. Cequence identified a list of about 90 paths targeted by the scanner.

The activity also makes blocking individual IP addresses difficult. The scanner used more than 300 cloud IP addresses in one day and nearly 400 in a week. None of the addresses observed in late September reappeared a month later. Each address sends between 50 and 190 requests in about eight seconds before the scanner moves to another address. It also sends random, nonsensical URL paths to identify websites that respond to arbitrary requests.

Why Banks Should Be Concerned

The findings come as banks and other businesses work out how to handle legitimate AI agents acting on customers' behalf. Yet these agents still account for a small share of traffic at financial institutions. Even at the most exposed bank in the study, customer-facing agents represented about one in every 4,000 requests. Most AI-related traffic at banks came from crawlers collecting publicly available pages.

Because organizations often grant permissions based on self-reported agent names, attackers are easily exploiting those unverified labels to bypass standard perimeter security. Cequence recommends that companies avoid trusting a bot's self-reported identity alone. Organizations should verify incoming traffic through cryptographic request signing, verified address ranges, direct integrations, and behavioral analysis.

Parallel Findings from Fastly

Fastly reported on October 13 that it had recorded about 6.3 million requests impersonating AI crawlers and fetchers in 24 hours. The requests came from nearly 10,200 IP addresses and targeted .env files, Git metadata and other sensitive files. Fastly's findings point to the same concern raised by Cequence: attackers are using trusted AI bot identities to search for exposed secrets. The two investigations examined separate traffic samples.

Operational Consequences

The rapid IP rotation and broad path coverage suggest the actor is automating secret discovery at scale, making traditional IP-based blocking ineffective. Organizations that grant access based on self-reported bot names are especially vulnerable. Verification through cryptographic signing or direct integration is a practical countermeasure.

What to Verify Now

  1. Confirm that any AI-bot traffic to your site is authenticated through a signed request or a known, whitelisted IP range.
  2. Scan your public directories for .env files, cloud credential files and private SSH keys.
  3. Review access logs for requests that claim to be from known AI providers but originate from unfamiliar IPs or exhibit rapid IP rotation.
  4. Implement rate-limiting or bot-behavior analysis to detect sudden bursts of requests across many IPs.

The available evidence does not show whether any credentials were actually exfiltrated, but the breadth of the scan indicates a high likelihood that exposed secrets were discovered. Organizations should treat the findings as a warning that AI-bot impersonation is a viable attack vector and that verification mechanisms must evolve beyond name-based trust.

Web3 Wallet Drainer Threat Intelligence & Defense Playbook

Explore more on this topic