> status: mostly fine. patch anyway.practical AI security · est. 2026

Calm down. · Builders

Calm down: the "AI bot" hunting for your credentials is a regular scanner in a borrowed name tag

By alkizz ·

On Oct 28, Dark Reading ran "Attacker Relentlessly Scans for Credentials by Impersonating AI Bots," which reads like the AI crawlers have turned on us and started going through the cupboards, and they haven't. What CQ Prime Research, the research arm of Cequence Security, actually describes is one actor running an ordinary credential scanner that sets its User-Agent header to the names of AI bots from OpenAI, Anthropic, Meta, Perplexity and others. The AI part is a label the attacker typed into a request header, and the request behind the label is the same "do you have a .env file lying around?" question that ordinary credential scanners ask.

The details come from the Cequence report, published the same day. The scanner rotates through about 32 AI bot identities, ignores web pages, and asks for files that commonly store secrets, "including .env configuration files, cloud credential files, private SSH keys, and server environment data," from "a list of roughly 90 file paths." Each address sends "a short burst of 50 to 190 requests in about eight seconds and then moves on," and it hit organizations in financial services, retail, telecommunications, energy and software from at least late September through late October. Dark Reading adds that the researchers identified the activity on Oct 21.

Then comes the line the headline skips. Per the report, "nearly all of the actor's requests ended in a block or a failure," and Dark Reading's own first paragraph describes the actor "continuously scanning for sensitive data without success." Collin Hogue-Spears of Black Duck put it neatly to Dark Reading: "what Cequence documented is the test, not a breach." The scanning was relentless, but neither source reports it working. Calm down.

Claimed vs. confirmed

What the doom version says What the sources say
AI bots are scanning for your credentials One actor's scanner claims to be AI bots. The report's own tells are that it "cycled evenly through all 32 identities, something no legitimate bot does," and that "the same machine claimed to be OpenAI, Anthropic, Meta, and Perplexity within seconds." Its fake Claude identities all carried the contact address of Anthropic's crawler, "which points to a copied-and-pasted string"
48% of organizations were hit Dark Reading says 48% of Cequence-protected organizations got the traffic on one day. The report's wording is narrower: "48% of the Cequence-protected organizations that saw any AI bot traffic." Either way, it's a share of one vendor's customers, not of the internet
Credentials were stolen Neither source reports a single credential taken. The report says nearly all requests were blocked or failed, and Dark Reading calls the scanning "without success"
This is a new AI-era attack The targets are .env files, cloud credential files and SSH keys, and the report calls its nonsense-path probing "a common scanning technique." Fastly published a similar finding on Oct 13: in one day, about 6.3 million requests posing as AI bots went looking for private files, mostly from one campaign working from a 96-file wordlist
Banks are being overrun by rogue AI agents At the financial services organizations CQ Prime studied, AI agents acting for customers "made up fewer than 1 in 4,000 requests, even at the most exposed institution"

Some of the report's numbers are more useful than its framing. The actor used "more than 300 cloud addresses in one day and nearly 400 in one week," and none of the late-September addresses came back a month later, so an IP blocklist goes stale fast. And at several organizations, the impersonator made up "more than 80% of the traffic labeled as AI bot traffic," which is a good reason to be suspicious of any "AI bot traffic is exploding" chart that counts User-Agent strings.

The boring lesson

My opinion, offered politely: this is a vendor report that ends by recommending the vendor's product category, specifically "bot management that evaluates traffic by how it behaves, not by the name it gives itself," and it says Cequence Bot Management "is built to catch mismatches like these." That doesn't make the data wrong, and the defensive advice in it is sound. It does mean the scary-sounding parts are written by someone who sells the fix. The same goes for the quote at the end of Dark Reading's piece from Keeper Security's CISO, Shane Barney, who says teams "must move away from long-lived local credentials in favor of centralized, zero-knowledge secrets vaults." Keeper sells a zero-knowledge secrets manager, so in my opinion that's a vault pitch dressed as a threat insight. Getting secrets out of plain files is good advice, and you don't need any particular vendor's vault to do it.

The real lesson is older than any AI crawler. A scanner can only steal a secret you've left where a web server will hand it out, and a User-Agent is a name the client picks for itself. As Hogue-Spears put it in CISO Voice's coverage, the User-Agent header "is where a visitor names itself, and setting it costs nothing."

What to do:

Sources

Related

On the checklist

More briefs

← All briefs