An unnamed scanner posing as roughly 32 AI bots, including identities tied to OpenAI, Anthropic, Perplexity and Meta, spent a month probing websites for credentials, configuration files and private SSH keys, Cequence Security reports. For Cyprus banks, EMIs and iGaming operators, AI bot impersonation exposes any perimeter exemption keyed on a header anyone can forge.
Key takeaways
- An unnamed scanner impersonated about 32 AI bots to probe roughly 90 paths for config files, cloud credentials and SSH keys.
- On one October day it reached 48% of Cequence-monitored organizations receiving AI bot traffic, not 48% of all customers.
- More than 300 cloud IPs in a day, none reused a month later, make IP block lists ineffective.
- Nearly all requests failed and no CVE is involved; the risk is any access exemption keyed on a bot name.
Why does AI bot impersonation defeat a name-based access rule?
A bot name is text the client writes itself, so any script can claim to be an OpenAI or Anthropic crawler. Cequence researcher Will Glazier tracked a scanner doing exactly that from late September through late October 2026. The named companies were not involved: this is impersonation, not their activity.
The weakness is how organizations react to those labels. Many grant permissions on self-reported agent names: a WAF exception, a looser rate limit, a skipped challenge. A decision to let answer engines index the site becomes a perimeter bypass. Whether robots.txt allows a named AI crawler is a business choice; it is a voluntary convention and enforces nothing.
What did the fake AI crawler look for, and who saw it?
Secrets, not content. The scanner requested about 90 paths, including environment configuration files, cloud credential files and private SSH keys, none of which a crawler indexing public pages needs. It also sent random, nonsensical URLs to find sites that answer any request.
On one unspecified day in October, it reached 48% of Cequence-monitored organizations that received AI bot traffic, across financial services, retail, telecommunications, energy and software. That is a share of a subset, not of all Cequence customers. Nearly all requests were blocked or failed, and no theft or compromise has been confirmed.
Why does rotating cloud addresses beat a block list?
The scanner used more than 300 cloud IP addresses in one day and nearly 400 in a week, sending 50 to 190 requests from each in about eight seconds before moving on. None of the late-September addresses reappeared a month later.
Identities churned too: it sometimes claimed OpenAI, Anthropic, Meta and Perplexity within seconds of each other, which no genuine crawler does. That inconsistency is a detection signal, and it is why behavioral rules outlast IP blocks.
How should a regulated firm verify legitimate AI traffic?
Keep the business case in proportion. Even at the most exposed bank in Cequence’s study, customer-facing AI agents made up about one in every 4,000 requests; most AI traffic at banks came from crawlers collecting public pages. Cequence advises against trusting self-reported identity alone and lists four checks:
- Cryptographic request signing, where the bot operator supports it.
- Verified address ranges, checked against the claimed bot name.
- Direct integrations for agents acting on behalf of customers.
- Behavioral analysis, such as flagging a “crawler” that requests credential files.
Is this one scanner or a wider pattern?
A wider pattern. On October 13, 2026, Fastly reported about 6.3 million requests impersonating AI crawlers and fetchers in 24 hours, from nearly 10,200 IP addresses, targeting environment files and Git metadata. The two studies used separate traffic samples, so their figures should not be combined.
Git metadata is the sharper risk. An exposed .git directory can leak source code and commit history, including credentials deleted from current files long ago.
What should compliance leads verify this week?
No CVE or patch applies here; the fix lies in configuration and documentation you can show a supervisor.
- Check public sites for exposed configuration, cloud credentials, repository metadata and keys, comparing each response with a random nonexistent URL so a soft 404 is not mistaken for a leak.
- Remove any WAF, rate-limit or login exception keyed only on User-Agent.
- Log each decision to allow, challenge or block claimed AI crawlers, with the verification method, for CySEC or your NIS2 or DORA supervisor.
- If real credentials were ever served, rotate them. Deleting the file does not undo the disclosure.
A practitioner’s note: in web application penetration testing and external network penetration tests, these leaks rarely come from a missing patch. We find a forgotten .env or .git folder behind a CDN rule that auto-approves “good bots.” Testing a spoofed crawler name against the client’s own host settles the question in minutes: if the response changes, the control has failed.
FAQ
Did OpenAI, Anthropic, Perplexity or Meta scan these sites?
No. An unnamed actor forged their bot identities.
Was customer data confirmed stolen?
No. Cequence says nearly all observed requests were blocked or failed, and no compromise has been reported.
Does the 48% figure mean half of all websites were hit?
No. It covers Cequence-monitored organizations that received AI bot traffic on one October day.
Should a firm block every AI crawler?
Not necessarily. Allow the crawlers you want after verifying them, and give unverified bots no special exemptions.
Does blocking IP addresses stop fake AI crawlers?
Not reliably. This scanner rotated through hundreds of cloud addresses, so behavioral detection works better.
If your site grants anything to traffic that merely claims to be an AI crawler, we can test that control and document the result for your supervisor through our CySEC ICT risk penetration testing.