Оригинальный текст на языке EN взят с сайта-источника. Источник ↗

Attackers are impersonating trusted AI bots to scan enterprise websites for exposed passwords, API keys, and cloud credentials.

The company tracked a single actor rotating through approximately 32 bot identities, including ChatGPT, Claude, and Perplexity, to probe organizations across multiple industries.

On one October day, the campaign reached 48% of Cequence-protected organizations that received any AI bot traffic.

The activity highlights a critical weakness in agent access controls: an automated client’s claimed identity does not establish its authenticity or justify access to sensitive resources.

The scanner operated from a major cloud provider and impersonated crawlers and assistants associated with OpenAI, Anthropic, Meta, Perplexity, and other providers.

Rather than browsing ordinary content, it requested roughly 90 paths associated with potentially exposed secrets.

Targets included .env configuration files, cloud credential files, private SSH keys, and server environment information. Each source address generated bursts of approximately 50 to 190 requests in eight seconds before moving on.

Before searching for sensitive files, the scanner requested random, nonexistent paths to identify websites that return responses regardless of whether a resource exists. This preliminary check helped distinguish meaningful discoveries from misleading responses.

Cequence observed the campaign, from at least late September through late October, targeting financial services, retail, telecommunications, energy, and software organizations.

AI Bot Impersonation

Several inconsistencies distinguished the scanner from legitimate AI infrastructure. It rotated evenly through all 32 identities, while the same machine claimed affiliations with competing AI providers within seconds.

Fake AI bot scanner’s addresses (Source : Cequence).

Its fabricated Claude identitiesreused Anthropic’s crawler contact address, including when claiming to represent different Claude agents. That inconsistency suggested copied identification strings rather than independently operated services.

Shared infrastructure and technical fingerprints connected activity across victims to one actor. Cequence reported that nearly all requests were blocked or failed; the findings do not establish widespread credential theft.

The distinction matters because detection must evaluate behavior, not merely labels. Cequence describes its bot management platform as analyzing network-level behavioral intent across application and API traffic rather than depending exclusively on client-side signals.

The actor used more than 300 cloud addresses in one day and nearly 400 during one week. None observed in late September reappeared a month later.

Although external threat feeds flagged many addresses during their use, the scanner frequently moved before those indicators became useful.

Stable request patterns therefore provided stronger continuity than rapidly changing infrastructure.

The impersonator also generated more than 80% of purported AI bot traffic at several organizations, demonstrating how identification-based analytics can inflate estimates of legitimate agent adoption.

The findings coincide with Axios reporting on unvetted agents accessing U.S. bank accounts. Those cases generally involved customer-provided credentials and permission, despite bank restrictions. They should not be conflated with this malicious scanning campaign.

For defenders, claimed AI affiliation should never confer automatic trust. Verify identities through supported signed requests, published network ranges, or direct integrations, then continuously assess requested resources and activity patterns.

Remove secrets from web-accessible locations, review exposed staging and administrative systems, and combine identity verification with behavioral enforcement.

Cequence’s broader application and API security approach similarly emphasizes evaluating interactions by behavior rather than accepting automation labels at face value.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.