Threat actors are posing as AI crawlers to hunt for exposed credentials

Attackers are disguising automated scanning as traffic from AI crawlers operated by OpenAI, Anthropic, Google, Perplexity and other companies while searching websites for exposed credentials and configuration files, according to GreyNoise.

(Source: GreyNoise)

“Every program that visits a website announces itself in one line of the request. Chrome says it is Chrome. Googlebot says it is Googlebot. Anthropic’s crawler says it is ClaudeBot. Nothing in the request itself proves any of it is true,” researchers explained.

“AI companies publish crawler names so site owners can allow their crawlers, and address lists so they can verify them. The user agent is a client-supplied header, so a control that checks the name but not the address can be bypassed by forging it,” they added.

Between July 28 and August 23, 2026, six crawler names belonging to four AI companies arrived on a single HTTP client fingerprint. That fingerprint had carried more than 1,500 different user agent strings over the previous 90 days, most identifying as ordinary browsers.

The six names came from the same 824 IP addresses, arriving in matched volume. None of that traffic requested /robots.txt, the file a site uses to state its rules for crawlers.

GreyNoise measured Anthropic’s crawler over the same period and found that /robots.txt was its most requested path, accounting for 12 percent of its traffic. It did not request credential files.

The researchers also found forged versions of two Amazon crawler names, in greater volume than the six matched names, sent under user agent strings Amazon does not document.

GreyNoise checked all 824 addresses against the published IP ranges for Anthropic, OpenAI, Google, Perplexity and Amazon. None matched. During the same period, thousands of sessions carrying the ClaudeBot name arrived from addresses in Anthropic’s published range.

“Almost every session here carries the same Web Crawler label that real crawler traffic carries. It’s also not possible to do network-based blocking, because the 824 addresses are spread across 795 separate /24 networks,” researchers noted.

The scanners requested .env files, cloud access keys, private keys and password stores. Among the targeted paths were /.env, /.env.production, /.env.bak and /.aws/credentials.

GreyNoise said it can’t confirm whether any request returned a file or whether any organization was affected, and it isn’t naming who is behind the activity.

GreyNoise published all 824 addresses and the credential paths targeted by the scanners, along with the vendor address lists it used for comparison, allowing site owners to run the same checks against their logs.