Threat actors are impersonating web crawlers from OpenAI, Anthropic, DeepSeek, and other major organizations to scan websites for exposed credentials and sensitive configuration files, targeting misconfigured servers that may leak cloud keys, API tokens, passwords, and private keys.
GreyNoise observed a broader cluster using 13 AI crawler identities from eight companies. The scanners requested files such as .env, /.aws/credentials, private key locations, and password stores. An .env file commonly contains application secrets, including database passwords, cloud access keys, and API tokens.
The campaign relies on a simple but effective deception technique: forging the HTTP User-Agent header. Web crawlers identify themselves through this header, such as Googlebot, ClaudeBot, or GPTBot. However, the header is supplied by the client. It does not prove that a request actually came from the organization named in it.
This poses a risk to organizations that grant access, bypass controls, or suppress security alerts based solely on crawler names. An attacker can copy an official crawler string character-for-character, making user-agent-based detection ineffective.
GreyNoise identified six forged AI crawler names associated with Anthropic, OpenAI, Google, and Perplexity. Between July 28 and August 23, 2026, the names appeared on one HTTP client fingerprint and came from 824 separate IP addresses.
The same fingerprint had used more than 1,500 user-agent strings over the previous 90 days, most of which claimed to be normal web browsers. Nearly all activity involving the six crawler names occurred in August, with the highest daily volume recorded on August 23.
The researchers also found that the activity was distributed across 795 separate /24 network ranges. This distribution makes simple network blocking impractical, as defenders cannot reliably stop the campaign by blocking a single hosting provider or a small set of IP ranges.
GreyNoise said none of the 824 source addresses matched published IP ranges for the legitimate crawlers. The company checked the addresses against published lists from Anthropic, OpenAI, Google, Perplexity, and Amazon, but found no overlap.
A key indicator was the scanners’ request pattern. Legitimate search and AI crawlers normally check /robots.txt, which tells automated clients what content a website allows them to access.
The six forged crawler identities never requested /robots.txt during the observed activity. Instead, they attempted to access exposed secret files and cloud credentials. Requested paths included:/.env, /app/.env, /api/.env, /backend/.env, and/.env.production, /.env.bak, and /.aws/credentials.
GreyNoise compared the suspicious activity with Anthropic’s legitimate ClaudeBot traffic over the same period. The real crawler requested /robots.txt more than any other path, accounting for 12 percent of its traffic, and did not request credential files.
The distinction matters because a legitimate AI crawler is designed to retrieve public web content for indexing, search, or citation-related functions. It has no reason to request environment files, cloud credential stores, or private keys.
Organizations should never use a user-agent string as proof of crawler identity. Any service that allows access or waives controls for a crawler should validate the source IP address against the vendor’s official published crawler ranges.
Security teams should also investigate and alert on requests for sensitive paths such as /.env, /.aws/credentials and /.git/config. These files should never be exposed through a public web server.
Web administrators should ensure that .env and .git directories, cloud credential files, and private keys are outside the web root. If any cloud key was accessible via a public URL, it should be rotated immediately, as exposure should be treated as a potential compromise.
The campaign does not prove that attackers successfully obtained files from any specific victim. However, it highlights how easily threat actors can abuse trust in recognizable AI brands to hide credential-harvesting scans in ordinary web traffic.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
DSPM finds sensitive data you didn’t know you had, classifies it, maps who can reach…
Open-source packages are meant to save developers time. In the GemStuffer campaign, that trust became…
Google has released an important Chrome 153 security update that fixes 42 vulnerabilities across the…
The Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology…
CISA and five international cybersecurity agencies have released detailed guidance describing 17 common techniques hackers…
Apple has released one of its largest coordinated security rollouts, addressing 273 distinct critical vulnerabilities…