AI Bot Impersonation: Attackers Disguise Credential Scans as AI Bot Traffic

1. Overview

• Title: Attackers Are Using AI Agent Impersonation to Hunt for Credentials
• Publisher: Cequence Security
• Published Date: 2026-10-28
• Source: Cequence Security
• Related Sources: Dark Reading: Attacker Impersonates AI Bots, Scans for Credentials
• Associated Malware: None specified
• Associated Threat Groups: None specified
• Associated CVEs: None specified
• Affected Products: Web applications, API gateways, AI crawler controls
• Severity: High

2. Quick Summary

Cequence Security reported an active reconnaissance campaign where a single threat actor impersonated roughly 32 AI bots—including ChatGPT, Claude, and Perplexity—to scan approximately 90 potential secret paths, such as .env files, cloud credentials, and SSH private keys. Each source IP sent burst traffic ranging from 50 to 190 requests in about 8 seconds.

Organizations should be aware that attackers can abuse trust in AI crawler allowlists and User-Agent strings to search for exposed secrets, bypassing traditional rate limits by distributing requests over short periods and across numerous source IPs.

3. Attack Flow

Secret Reconnaissance via AI Crawler Impersonation

Defender indicators in the table represent candidate checks for your organization, presented as Inference. These depend on log retention and visibility, and do not imply that Cequence observed every individual event.

Attack Stage	Attacker Action and Technique	Tools and Communication	Defender Indicator (Prerequisites and Artifacts)
1. Source Infrastructure Preparation	Prepares numerous cloud IPs, rotating over 300 daily and approximately 400 weekly	Distributed IP pools on cloud providers	Distributed access that is difficult to capture using single-IP thresholds
2. AI Bot Identifier Spoofing	Switches User-Agents and identifiers for about 32 AI bots, such as ChatGPT, Claude, and Perplexity	HTTP/HTTPS requests with spoofed User-Agents	Compare self-reported User-Agents with verification results from signed requests, published source IP ranges, or direct integrations
3. Pre-check of Response Behavior	Sends initial requests to non-existent paths to verify server error response behavior	Probe requests to non-existent URL paths	Compare responses for non-existent paths against subsequent target path responses (response codes depend on the environment)
4. High-Speed Secret Path Reconnaissance	Sends bursts of 50 to 190 requests per source IP within roughly 8 seconds across roughly 90 secret path candidates	Continuous requests targeting .env, cloud credentials, SSH key paths, etc.	Path search sequences matching across multiple IPs and short bursts (nearly all blocked or failed in Cequence observations)
5. Exploitation of Exposed Information (Inference / Potential)	If secrets were publicly exposed, harvested credentials could be used for subsequent access	External access using leaked credentials	Verification of whether response bodies actually contained secrets beyond a 200 OK status (no confirmed successful retrieval in current observations)

1. The attacker prepares numerous cloud IP addresses, rotating them at a scale of over 300 daily and about 400 weekly.
2. The attacker switches User-Agents and identifiers for approximately 32 AI bots, including ChatGPT, Claude, and Perplexity, with each request.
3. The attacker first accesses non-existent paths to check the target server's response behavior.
4. The attacker then sends burst requests from each source IP, ranging from 50 to 190 requests within about 8 seconds, targeting roughly 90 secret path candidates.
5. Inference: If secret information is successfully retrieved, it could lead to subsequent credential abuse. However, Cequence observations have not shown any confirmed successful retrieval.

4. Attacker Position and Execution Location

• The attacker connects directly to public web applications and API gateways from numerous cloud IP addresses across the internet.

5. Victim and Administrator Perspective

Victims

• Regular users of the website or service cannot see this reconnaissance activity.

Administrators

• This activity may appear as access attempts bearing AI crawler User-Agents, consecutive HTTP 404 or 403 responses, short bursts from individual IPs, and path reconnaissance repeated across numerous IP addresses in identical sequences.

6. Success and Failure Conditions

Success Conditions

• Success requires that paths containing secrets are publicly accessible and that the spoofed bot requests reach and are permitted by the target.
• Inference: Rate limiting based solely on source IP addresses makes it difficult to catch distributed bursts. However, the inability to correlate bursts is not strictly a prerequisite for retrieving secrets.

Failure Conditions and Mitigations

• Move secret configuration files outside of the web public root, and apply proper authentication and the principle of least privilege.
• Do not trust self-reported User-Agent strings; instead, block unauthorized traffic using bot source verification, explicit denial of sensitive paths, and cross-source distributed rate limiting.

7. What Happens Upon Success

• Should any secrets be in a publicly exposed state, it could lead to the theft of cloud environment, SSH, or application credentials.
• However, according to the source observations, nearly all requests were blocked or failed, and no actual successful compromises were confirmed.

8. Observable Logs

Inference: The following are candidate logs to investigate within your own organization. These depend on log collection, retention, and product capabilities, and are distinct from observation records by external sources.

• Email: None
• Proxy / SWG / DNS: Look for path reconnaissance logs targeting .env, SSH private keys, and cloud credentials accompanied by HTTP 404 or 403 status codes.
• Endpoint / EDR: None
• Identity / IdP: None
• SaaS / Cloud: On WAFs and API gateways, verify short bursts and multiple source IPs claiming AI bot User-Agents.
• Network: Look for traffic patterns showing bursts of 50 to 190 requests per IP within roughly 8 seconds, or identical path sequences repeated across more than 300 IPs in a single day.

9. Attack Success Determination

• Attack Attempt Observed (Success Unconfirmed) (contact_only): Criteria: Reaching secret paths or receiving WAF blocks does not indicate successful data retrieval. Target: Public web/APIs
• Data Theft or Session Compromise Confirmed (data_or_session_compromise): Criteria: Do not rely on an HTTP 200 response alone. Corroborate that the response body contained actual secrets and that external retrieval or subsequent unauthorized use occurred. Target: Secrets

10. Investigation Playbook

• Trigger: Observe secret path reconnaissance using AI crawler names, short bursts, or identical path sequences across multiple IP addresses.
• Initial Checks: Verify WAF action results (blocked/allowed), response codes and sizes, bot verification results, and whether the targeted paths actually exist.
• Endpoint and Configuration Check: Check public web roots and build artifacts for .env files, private keys, or backup files.
• Identity and Cloud Investigation: If actual secrets existed at the targeted path, check cloud, SSH, and application audit logs for unauthorized usage history.
• Follow-up Investigation: Investigate whether any potentially leaked credentials were used for logins, API calls, or the creation of new keys.
• Containment: Block the targeted paths, delete and rotate any exposed secrets, review bot allowlists, and apply distributed rate limiting.
• Classification: Clearly record and separate findings into "Blocked/Failed," "Secret Response Occurred," and "Subsequent Credential Abuse."

11. Defense and Detection Ideas

• Single Event: Detect combinations of AI bot User-Agents and access requests targeting .env, private keys, and credential paths.
• Time Series Correlation: Correlate ~8-second burst traffic with identical path search sequences originating from different source IPs.
• Hunting: Cross-analyze traffic claiming to be AI crawlers for high ratios of HTTP 404/403 responses, access to rare paths, and failed bot verifications.
• Logging Gaps: If CDNs or reverse proxies fail to log User-Agents or response bodies (or detailed sizes), distinguishing between standard custom error pages and actual secret leaks becomes difficult.
• Priority Controls: Prioritize moving secrets outside of public web roots, strengthening bot verification, implementing distributed rate limiting, and rotating any credentials suspected of exposure.

12. Facts / Inference / Hypothesis

Facts

• Cequence reported that a single threat actor spoofed approximately 32 AI bot identifiers.
• Reconnaissance targets included around 90 secret path candidates, such as .env files, cloud credentials, SSH private keys, and server environment details.
• Each source IP executed burst communications sending 50 to 190 requests within about 8 seconds, beginning with probes against non-existent paths.
• Attackers rotated over 300 cloud IPs daily and approximately 400 weekly, with observations spanning from late September to late October.
• On one day, the actor reached 48% of Cequence-protected organizations that observed AI bot traffic. Nearly all requests were blocked or failed, and the report did not establish successful compromise.

Inference

• Inference: Relying solely on AI bot User-Agent strings or names as allowlist criteria may permit credential path reconnaissance traffic to pass through unchecked as legitimate crawlers.

Hypothesis

• No additional hypotheses. Unverified items are listed under "Unknowns and Limitations."

13. MITRE ATT&CK Mapping

ID	Technique	Confidence	Basis
T1595.003	Wordlist Scanning	high	Mapped to MITRE Wordlist Scanning because the actor iteratively probed approximately 90 secret path candidates.

14. Unknowns and Limitations

• The threat actor's identity, ultimate objectives, and whether any instances of secret retrieval were actually successful remain unknown.
• The scale of reach in general environments outside of Cequence's visibility is unknown.

15. Impact on SOCs and Organizations

Organizations operating websites or APIs that permit AI crawler access should avoid relying on self-reported User-Agent strings. Instead, they should prioritize proper authentication, legitimacy verification via signed requests, published source IP ranges, or direct integrations, alongside path-specific access controls and distributed burst correlation detection.

16. Summary by Role

• SOC: Correlate AI bot names, secret paths, short bursts, and IP rotations to analyze and separate blocked attempts from actual successful data retrieval.
• Administrators: Ensure that .env files and private keys are never placed in public web roots, and integrate source authenticity verification into crawler permission rules.
• Users: Even requests identified as AI bots cannot be assumed legitimate; proper access control must be enforced on the administrator side.