Hackers Impersonate 32 AI Bots to Hunt for Exposed Credentials
A threat actor is pretending to be about 32 artificial intelligence (AI) bots to scan websites for exposed passwords, keys, and sensitive settings files, according to research by cybersecurity company Cequence Security.
Cequence Security researcher Will Glazier tracked the scanner from late September to late October 2026. During this time, it pretended to be web crawlers and assistants linked to OpenAI, Anthropic, Perplexity, Meta, and other companies.
On one day in October, the scanner reached 48% of the organizations monitored by Cequence that received AI bot traffic. These organizations worked in financial services, retail, telecommunications, energy, and software. During the time researchers watched it, nearly all of the scanner's requests were blocked or failed.
How the Scanner Operates
The scanner keeps changing the name of the bot it claims to be. Within seconds, it might claim to represent OpenAI, Anthropic, Meta, or Perplexity. It asks for files that real web crawlers have no reason to access, including .env settings files, cloud account credential files, and private SSH keys. The researchers found about 90 different paths that the scanner tried to access.
The scanner also makes it hard to block individual IP addresses. It used more than 300 cloud IP addresses in one day and nearly 400 in one week. None of the addresses seen in late September appeared again a month later.
Each address sends between 50 and 190 requests in about eight seconds before the scanner switches to another address. It also sends requests to random, meaningless web addresses to find websites that respond to any request, even one that does not make sense.
Why Banks Should Be Concerned
The findings come as banks and other businesses are working out how to manage real AI agents that act for customers. However, these agents still make up only a small part of the traffic at financial institutions. Even at the bank in the study that had the most exposure, customer-facing agents made up about one in every 4,000 requests. Most AI-related traffic at banks came from crawlers collecting pages that anyone can view.
Organizations often give permissions based on the name a bot claims to have. Attackers are taking advantage of these unverified names to get around standard security protections at the edge of a network.
Cequence Security advises companies not to trust a bot just because it claims to have a certain identity. Organizations should check incoming traffic using cryptographic signatures on requests, verified IP address ranges, direct connections with trusted services, and analysis of how the traffic behaves.
These findings came after similar research by Fastly. On October 13, Fastly reported that it had recorded about 6.3 million requests pretending to come from AI crawlers and tools that fetch web content in 24 hours. The requests came from nearly 10,200 IP addresses and targeted .env files, Git metadata, and other sensitive files.
Fastly's findings point to the same concern raised by Cequence: attackers are using the names of trusted AI bots to look for exposed secrets. The two investigations studied separate sets of traffic.
The findings raise questions about how organizations check automated traffic and control what AI agents can access. Patrick Harr, CEO of DataVisor, warned that attackers can change their methods faster than traditional security systems can keep up.
“Fraud keeps changing its shape. AI lets attackers change their approach every time, so older fraud defenses that rely on fixed rules become less effective faster than teams can update them,” Harr told Hackread.com. “Institutions that build their systems around making decisions in real time, using detection that adapts as quickly as threats do, can use AI to defend themselves as effectively as attackers use it. The same technology that creates the risk can also help reduce it.”