Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoChighExploited in the wild

Actor impersonated AI bots to scan sites for secrets, Cequence says

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Cequence says one actor impersonated about 32 AI bots from late September through late October to scan for secrets, with no confirmed theft.

Cequence researchers say a single actor impersonated trusted AI bots, including ChatGPT, Claude, and Perplexity, while scanning enterprise websites for passwords, API keys, cloud credentials, SSH keys, and environment files. The scanner rotated evenly through about 32 bot identities and ran from a major cloud provider, using more than 300 addresses in one day and nearly 400 in a week. Targets included financial services, retail, telecommunications, energy, and software firms. On a peak October day the activity reached 48% of protected organizations receiving AI bot traffic; at some organizations it accounted for more than 80% of labeled AI bot requests. Cequence reports credential-seeking scans, not confirmed theft, and says nearly all requests were blocked or failed.

Key facts
  • About 32 bot identities from OpenAI, Anthropic, and Perplexity were rotated evenly.
  • Bursts of 50–190 requests arrived in about eight seconds.
  • Researchers saw roughly 90 targeted file paths, including .env files and SSH keys.
  • More than 300 cloud addresses were used in one day and nearly 400 in a week.
  • Random nonexistent paths were requested to identify responsive websites.
  • Cequence found no evidence of widespread credential theft or later compromise.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

What each outlet adds

beyond the shared facts
  • GBHackersEven rotation of identities and use of random nonexistent paths.
  • Cyber Security NewsNearly 400 addresses in a week and about 90 file paths.
Vendors
OpenAIAnthropicPerplexity AIMetaPerplexity
Organizations
Cequence
AI models
ChatGPTClaudePerplexity

Coverage

oldest first · one row per article · UTC
  1. · 5h ago GBHackersFirst report

    Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys

    The campaign ran from late September to late October, impersonating 32 AI bot identities to scan for exposed secrets across multiple industries.

  2. · 2h ago Cyber Security News

    Scanners impersonate ChatGPT, Claude and Perplexity to hunt credentials

    Cequence says one actor rotated about 32 bot identities and sought secrets; it does not confirm theft.