Press play to start listening
A threat actor is impersonating roughly 32 artificial intelligence (AI) bots to scan websites for exposed credentials and sensitive configuration files, according to research from cybersecurity firm Cequence Security.
Cequence Security researcher Will Glazier tracked the scanner from late September through late October 2026 as it posed as crawlers and assistants associated with OpenAI, Anthropic, Perplexity, Meta and other companies.
On a single day in October, it reached 48% of the organizations monitored by Cequence that received AI bot traffic. The affected organizations spanned financial services, retail, telecommunications, energy and software. Nearly all requests from the scanner were blocked or failed during the observation period.
How the Scanner Operates
The scanner rotates through different bot identities, sometimes claiming to represent OpenAI, Anthropic, Meta and Perplexity within seconds of one another. It requests files that legitimate crawlers have no reason to access, including .env configuration files, cloud credential files and private SSH keys. The research identified a list of about 90 paths targeted by the scanner.
The activity also makes blocking individual IP addresses difficult. The scanner used more than 300 cloud IP addresses in one day and nearly 400 in a week. None of the addresses observed in late September reappeared a month later.
Each address sends between 50 and 190 requests in about eight seconds before the scanner moves to another address. It also sends random, nonsensical URL paths to identify websites that respond to arbitrary requests.
Why Banks Should Be Concerned
The findings come as banks and other businesses work out how to handle legitimate AI agents acting on customers’ behalf. Yet these agents still account for a small share of traffic at financial institutions. Even at the most exposed bank in the study, customer-facing agents represented about one in every 4,000 requests. Most AI-related traffic at banks came from crawlers collecting publicly available pages.
Because organizations often grant permissions based on self-reported agent names, attackers are easily exploiting those unverified labels to bypass standard perimeter security.
Cequence Security recommends that companies avoid trusting a bot’s self-reported identity alone. Organizations should verify incoming traffic through cryptographic request signing, verified address ranges, direct integrations, and behavioral analysis.
The findings follow similar research from Fastly, which reported on October 13 that it had recorded about 6.3 million requests impersonating AI crawlers and fetchers in 24 hours. The requests came from nearly 10,200 IP addresses and targeted .env files, Git metadata and other sensitive files.
Fastly’s findings point to the same concern raised by Cequence: attackers are using trusted AI bot identities to search for exposed secrets. The two investigations examined separate traffic samples.
The findings raise questions about how organizations verify automated traffic and manage access for AI agents. Patrick Harr, CEO of DataVisor, warned that attackers can change their techniques faster than traditional defences can adapt.
“Fraud is now polymorphic: AI lets attackers vary their approach every time, so legacy, static fraud defenses decay faster than teams can update them,” Harr told Hackread.com. “Institutions that make real-time decisioning the foundation, with detection that adapts as quickly as the threats do, can use AI to defend as effectively as attackers do. The same technology that creates the exposure can help close it.”
