Threats · 5h ago
CQ Prime Research reported that a scanner impersonating 32 AI bots had probed organizations for credential-bearing files since late September. The activity targeted organizations in retail, financial services, telecommunications, energy, and software.
The scanner rotated evenly among identities associated with real AI bots, including OpenAI, Anthropic, Meta, and Perplexity, and sent bursts of 50 to 190 requests in about eight seconds. That pattern differs from genuine bots and helped identify the impersonation. The report says nearly all requests were blocked or failed and found no successful credential exposure.
For organizations that allow traffic based on recognized bot names, a claimed identity can become a route toward files containing passwords, API keys, or cloud credentials. The report documents probing, not a confirmed compromise; it does not establish whether other organizations’ bot-identity rules would let the scanner through.
2 sources covering this story
Imposter abused trust in OpenAI, Anthropic, and 30 others to hunt for secrets
A threat actor impersonated roughly 32 AI bots to scan enterprise web servers for credentials, cloud secrets, and private SSH keys.
Attacker Impersonates AI Bots to Scan Orgs for Keys, Credentials
The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.
Part of the PlainSec briefing for 2026-10-29