Attackers Impersonate AI Bots to Scan for Exposed Credentials
A threat actor is masquerading as numerous AI bots from major companies to scan for exposed credentials, exploiting the trust associated with AI development to bypass security measures.
A sophisticated threat actor has been actively scanning for exposed credentials by impersonating over 30 different AI bots, including those from prominent companies like OpenAI, Anthropic, and Meta. This tactic aims to deceive security teams into overlooking malicious activity by disguising it as legitimate AI-related traffic. The scanner has been operational since late September and was still active as of late October, according to research from CQ Prime Research. The campaign highlights a growing challenge for organizations: discerning between trusted AI agents and malicious ones attempting to infiltrate networks.
The scanner employs a technique of sending rapid bursts of requests, typically 50 to 190 in about 8 seconds, before moving to the next target. It systematically probes organizations across various sectors, including retail, financial services, telecommunications, energy, and software, seeking sensitive data such as passwords, API keys, and cloud credentials. While the researchers noted that most of these requests were blocked or failed, the persistence and evolving nature of the attack underscore the need for enhanced AI agent security.
CQ Prime Research identified the traffic as malicious due to several tell-tale behaviors that undermined the scanner's attempt to blend in. Unlike legitimate AI bots, the attacker rotated through approximately 32 bot identities uniformly. In one instance, a single machine claimed to be an agent from OpenAI, Anthropic, and Meta within seconds. Furthermore, the attacker reused the contact address of Anthropic's crawler for all its fake Claude identities, indicating a copied, rather than unique, signature for each impersonated agent.
The scanner's requests for configuration files, cloud credential files, and private SSH keys from a list of about 90 paths, while never identifying itself or providing a contact address, further exposed its malicious intent. Legitimate internet-scanning services typically identify themselves and do not require such sensitive files. These requests were the primary giveaway, suggesting that while the documented activity represents a test, it points to a broader trend of attackers probing for exploitable trust in AI agents.
The implications are particularly concerning for financial institutions, where the potential for rogue AI agents to log into customer accounts undetected could lead to significant economic fallout. While current findings suggest AI agents acting for customers represent a small fraction of requests at financial services firms, experts warn that threat actors are already moving to the next phase: simply logging in disguised as trusted AI agents rather than attempting to break in.
To defend against this growing threat, security leaders are advised to treat AI agents, API keys, and service accounts with the same rigor as human administrators, eliminating implicit trust across all access paths. Organizations should not solely rely on a bot's claimed identity but should verify agents through methods like signed requests, published address ranges, or direct integrations.
Monitoring for anomalous behavior that deviates from a claimed identity, such as an AI assistant requesting configuration or credential files, is crucial. Additionally, eliminating obvious security gaps by stopping the practice of leaving static credentials in vulnerable files is essential. The recommendation is to move away from long-lived local credentials in favor of centralized, zero-knowledge secrets vaults to mitigate the risk of scraping bots easily finding sensitive information.
This evolving threat landscape, where attackers weaponize the trust inherent in AI development, necessitates a proactive and adaptive security posture. As AI integration deepens across industries, the ability to accurately identify and manage AI agents will become paramount in preventing sophisticated credential theft and potential breaches.