A single attacker disguised its traffic as about 32 artificial intelligence bots, including OpenAI's ChatGPT and Anthropic's Claude, to search company web servers for exposed passwords and keys, security vendor Cequence said in research reported by CSO Online Thursday. Cequence reported no breach, and nearly all the requests were blocked or failed. The finding is a warning for any organization that lets AI crawlers past its defenses because of the name they give.
What Happened
In a blog post, Cequence said it saw the activity from at least late September through late October. The scanner claimed to be crawlers and assistants from OpenAI, Anthropic, Meta, Perplexity and others, at times switching between several companies within seconds from the same machine.
It skipped web pages and requested about 90 file locations that commonly hold secrets, including configuration files known as .env files, cloud credential files, private Secure Shell (SSH) keys used to log into servers, and server environment data. Each source address sent 50 to 190 requests in about eight seconds. Cequence said the operator used more than 300 cloud addresses in one day, which limits the value of blocking by address.
On one day in October, the scanner reached 48% of the Cequence customers that saw any AI bot traffic, the company said. Targets included financial services, retail, telecommunications, energy and software firms. The figures come from Cequence's own customer data and have not been independently verified.
Why It Matters
Many organizations let AI crawlers in so their content shows up in AI search answers. Websites usually recognize those bots by the user agent, a label a visitor's software attaches to each request. "The user-agent header is where a visitor names itself, and setting it costs nothing," Collin Hogue-Spears of software security firm Black Duck, who reviewed the findings, told CSO Online.
For boards and executives, trust in non-human visitors needs proof. An allow rule keyed to a bot's claimed name opens a door anyone can walk through, and one exposed credential file can hand over cloud accounts or servers.
What to Watch
Cequence and commentators quoted by CSO Online advise verifying AI crawlers through the address ranges AI companies publish, signed requests or direct integrations; flagging any bot that asks for credential files; and keeping secrets out of folders a web server can reach.
The open questions are whether AI providers widen cryptographic verification of their bots and whether other security firms report the same actor.
