One attacker used the names of 32 AI bots to look for secrets
On one day in October, the attacker got to 48% of the organizations with AI bot traffic, but almost all requests did not work.
Researchers at Cequence saw one attacker use the names of about 32 AI bots, such as bots of OpenAI, Anthropic, Meta and Perplexity. The work went on from late September to late October 2026. The attacker tried to get files that keep passwords, API keys and cloud credentials. Cequence gave no report of a breach.
How it works
The scanner operated from a cloud provider that the firm does not name. It used a list of about 90 file paths and sent bursts of 50 to 190 requests in about eight seconds.
The scanner gave a bot name in the user agent header, the field in which a visitor gives its name. It costs no money to set that field, tells Collin Hogue-Spears of Black Duck.
The numbers
The targets were in finance, retail, telecom, energy and software. The attacker used more than 300 cloud addresses in one day, and fixed lists of blocked addresses are then less useful.
What is not known
Cequence does not name the cloud provider or the attacker. It tells teams to check AI crawlers with published address ranges or signed requests. It also tells them to mark bots that request credential files.
Insight: An AI bot’s name is a claim, not proof
The scanner tested if sites accept the name of an AI bot as proof. Other researchers found ransomware affiliates who use AI agents to break in. They also found an attack agent that can do 100,000 steps with no human approval. This reads as attackers who use the trust that AI brands earned: a bot name is a key that anyone can copy. More checks by evidence, not by name, are possible.
Sources
Posted
