Skip to content
NewA calmer, faster ZeroHour
StoryThreat actormedium

Scanner impersonating AI bots probes enterprises for secrets

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

A scanner still active in late October impersonated about 32 AI bots and probed enterprises for credentials; nearly all requests failed.

CQ Prime Research at Cequence Security says an unnamed scanner impersonated about 32 AI crawlers and assistants, including ones tied to OpenAI, Anthropic, Perplexity, and Meta. It requested roughly 90 paths associated with passwords, API keys, cloud credentials, and SSH keys from organizations in retail, finance, telecommunications, energy, and software. Researchers identified the traffic on October 21; activity began in late September, continued through late October 2026 from a major cloud provider, and processed targets one at a time. Dark Reading says 48% of Cequence-protected organizations received the traffic on one day; CSO Online says that share was among organizations that saw AI bot traffic. Cequence reported no breach and said nearly all requests were blocked or failed.

Key facts
  • Activity ran from late September through late October 2026.
  • Bursts sent 50 to 190 requests in about eight seconds.
  • More than 300 cloud addresses were used in a single day.
  • The same machine claimed several AI brands within seconds.
  • Targets included .env files, cloud credentials, and private SSH keys.
  • Nonsense paths were tried first to find sites answering every request.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 21, 2026Researchers identified the AI-bot impersonation traffic. · Dark Reading

What each outlet adds

beyond the shared facts
  • Dark ReadingOctober 21 identification, nonsense-path probe, and one-at-a-time targeting.
  • CSO OnlineAbout 90 secret paths, 300 addresses, cloud origin, and no reported breach.
Organizations
CequenceOpenAIAnthropicMetaPerplexityCQ Prime ResearchCequence Security

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Dark ReadingFirst report

    Attacker impersonates 32 AI bots while scanning for credentials

    CQ Prime says the scanner has run since late September, reached many Cequence customers in one day, and almost all requests failed.

  2. · 1d ago CSO Online

    Attacker spoofed OpenAI and other AI bots to scan for secrets

    One actor reached 48% of Cequence-protected organizations that saw AI bot traffic on one October day; nearly all requests failed.