Hackers are using the names of ChatGPT, Claude, Perplexity, and other AI services to disguise automated scanning for passwords, API keys, and cloud credentials. Cequence researchers tied the activity to a single actor impersonating about 32 AI bots, and the campaign affected organizations across several sectors.
What the impersonation campaign tested
The operation was built to see whether businesses would let requests through simply because they appeared to come from a familiar provider. Cequence said the case shows a weakness in how organizations recognize automated visitors, since a claimed identity is not proof of origin.
The scanner ran from a major cloud provider and rotated through identities associated with OpenAI, Anthropic, Meta, Perplexity, and others. It did not behave like a normal crawler. Instead, it asked for configuration files, cloud credential files, private SSH keys, and server environment data, and researchers saw a target list with roughly 90 file paths.
How the scanning activity behaved
Cequence said the actor worked through targets one by one, around the clock, and started by requesting random, meaningless paths to find websites that answered every request. Each scanning address issued between 50 and 190 requests in roughly eight seconds before moving on. The campaign affected financial services, retail, telecommunications, energy, and software organizations from at least late September through late October.
Researchers also found that the impersonation pattern was visible across requests. One machine claimed to be several unrelated AI providers within seconds, while the scanner cycled evenly through all 32 identities. Fake Claude identities also reused Anthropic’s crawler contact address even when claiming to represent a different Claude agent, and shared infrastructure plus technical fingerprints linked the activity across targets.
Why the files were being sought
The requested files matter because they can provide access beyond the website itself. Previous exposed environment file attacks have shown that leaked cloud credentials can support privilege escalation and data theft. Cequence’s findings establish credential-seeking activity, but they do not confirm theft or later compromise in this campaign.
How defenders can respond
Address-based defenses were difficult because the actor used more than 300 cloud addresses in one day and nearly 400 during one week. None of the addresses seen in late September appeared again a month later, and external threat feeds flagged many of them while the scanner had already moved elsewhere. At several organizations, the traffic made up more than 80% of requests labeled as AI bot traffic, which shows how a visitor’s self-description can make malicious scanning look legitimate in security dashboards.
Cequence recommends verifying agents through signed requests, published address ranges, or direct integrations. Teams should also inspect behavior, especially requests for credential files, and keep secrets, staging systems, and administration sites away from public access. Broader AI agent identity controls address ownership and permissions, but a familiar bot name alone should never justify access.
Indicators of compromise
Type | Source-reported indicator | Hunting relevance
Targeted file | .env | Configuration file sought for exposed secrets.
Request burst | 50–190 requests in about eight seconds | Short, concentrated scanning activity.
Identity pattern | About 32 rotating AI bot identities | Correlate inconsistent provider claims.
Targeting pattern | Roughly 90 file paths | Repeated searches for sensitive files.
Keywords: Cequence, AI bot impersonation, credential hunting, financial services, .env
Licensed under CC BY-ND 4.0 International