Attackers are impersonating bots from leading AI firms like OpenAI, Anthropic, and DeepSeek to target misconfigured web servers. Their goal: access exposed credentials, API keys, private keys, and other secrets by mimicking legitimate crawler traffic.
How the Scam Operates
Security firm GreyNoise has uncovered a campaign using forged HTTP user-agent headers to pretend to be AI crawlers. The attackers request files such as “.env”, “/.aws/credentials”, private key locations, and directories holding password stores—paths that often reveal sensitive application secrets like database passwords or cloud access tokens. The user-agent header, which is client-supplied, can be easily faked; pretending to be “ClaudeBot”, “GPTBot”, or names tied to Anthropic and OpenAI is part of the ruse.
Patterns & Scope of Activity
Between July 28 and August 23, 2026, hackers used six different crawler names linked to entities including Anthropic, OpenAI, Google, and Perplexity. Traffic came from 824 distinct IP addresses. A single HTTP client fingerprint used over 1,500 user-agent strings in 90 days—mostly posing as common browsers.
Legitimate bots typically begin by checking /robots.txt to see what a website allows them to index. These impersonators skipped that step entirely, immediately trying to fetch sensitive files. In contrast, the real ClaudeBot accessed /robots.txt more often than any other path—and never asked for credential files.
IP addresses used by the imposters did not match the known ranges published by OpenAI, Anthropic, Google, Perplexity, or Amazon. The requests spanned 795 different /24 network ranges, making blanket blocking of IPs ineffective.
What Organizations Should Do
Relying solely on user-agent strings to identify trusted bots is risky. Organizations granting access or suppressing alerts based only on user-agent names are especially vulnerable. Officials recommend validating source IPs against published crawler ranges.
Monitoring web traffic for requests to sensitive paths like /.env, /.git/config, /.aws/credentials is critical. These files should never be publicly accessible. Web admins are urged to keep configuration files, cloud keys, and private keys outside the web root, and immediately rotate any cloud key that may have been exposed.
While there’s no evidence yet that hackers succeeded in exfiltrating data, this campaign underscores how brand trust in AI‐owned names can hide credential harvesting under the guise of normal web traffic.
Why this matters: as AI becomes integral to internet infrastructure, attackers are exploiting the reputational trust of big names. Without stronger verification measures, businesses and developers won’t just risk credential leakage—they’ll also risk data breaches that could damage trust and lead to regulatory trouble. Watch for updates to crawler‐identification practices, cloud key storage policies, and whether AI companies tighten how their crawler IP ranges are published.
