Threat actors are posing as AI crawlers to hunt for exposed credentials
GreyNoise observed scanners spoofing AI crawler user agents from 824 IPs to harvest .env files and cloud credentials; no confirmed theft.
GreyNoise researchers found attackers disguising automated scanning as AI crawler traffic, using six crawler names from four AI companies including Anthropic's ClaudeBot, OpenAI, Google, and Perplexity. Between July 28 and August 23, 2026, the six names arrived from 824 IP addresses spread across 795 /24 networks that matched no published vendor ranges, shared one HTTP client fingerprint that had used more than 1,500 user agent strings, and never requested /robots.txt. The scanners targeted /.env, /.env.production, /.env.bak, and /.aws/credentials, hunting secrets, cloud access keys, private keys, and password stores, while forged Amazon crawler names appeared at greater volume under undocumented user agents. GreyNoise could not confirm whether any file was returned or any organization affected, and published all 824 addresses and targeted paths for defenders.
- Six AI crawler names from four companies shared one HTTP fingerprint carrying 1,500+ user agents over 90 days.
- None of the 824 source IPs matched published Anthropic, OpenAI, Google, Perplexity, or Amazon ranges.
- Scanners requested /.env, /.env.production, /.env.bak, and /.aws/credentials instead of /robots.txt.
- Forged Amazon crawler names appeared at greater volume under undocumented user agent strings.
- IP blocking is impractical because sources span 795 separate /24 networks.
- ATT&CK
- T1595.002 Vulnerability ScanningT1036.005 Match Legitimate Name or LocationT1552.001 Credentials In Files
- Products
- ClaudeBot
From the original article
2 min read at helpnetsecurity.com
Attackers are disguising automated scanning as traffic from AI crawlers operated by OpenAI, Anthropic, Google, Perplexity and other companies while searching websites for exposed credentials and configuration files, according to GreyNoise. “Every program that visits a website announces itself in one line of the request. Chrome says it is Chrome.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.