Threat Actors Impersonate AI Crawlers to Steal Credentials
Attackers are spoofing user-agent strings of legitimate AI crawlers from companies like OpenAI and Google to scan websites for exposed credentials and configuration files.
Cybercriminals are increasingly employing a sophisticated tactic to mask their reconnaissance activities by impersonating legitimate AI crawlers from major technology firms. Threat actors are spoofing the User-Agent strings of bots operated by companies such as OpenAI, Anthropic, Google, and Perplexity to scan websites for sensitive information, including exposed credentials and configuration files.
This technique exploits the inherent trust placed in well-known AI entities. The User-Agent string, a header in web requests that identifies the client making the request, can be easily forged. This makes it challenging for website owners and security systems to distinguish between legitimate AI traffic and malicious scanning operations. As researchers from GreyNoise noted, "Every program that visits a website announces itself in one line of the request... Nothing in the request itself proves any of it is true."
AI companies typically publish their crawler names and associated IP address ranges to allow website administrators to verify their traffic and grant access. However, attackers leverage the fact that a control checking only the name and not the originating address can be bypassed by simply forging the User-Agent string. This allows them to appear as legitimate AI bots while conducting unauthorized scans.
GreyNoise observed a significant increase in such activity between July 28 and August 23, 2026. During this period, a single HTTP client fingerprint exhibited traffic from six different crawler names belonging to four AI companies. This same fingerprint had previously sent over 1,500 unique User-Agent strings in the preceding 90 days, predominantly identifying as standard web browsers.
Further analysis revealed that the traffic from these spoofed AI crawlers did not request /robots.txt, a file that legitimate crawlers use to understand a website's crawling policies. In contrast, GreyNoise measured legitimate traffic from Anthropic's ClaudeBot, finding that /robots.txt was its most frequently requested path, and it did not request credential-related files. The malicious scanners, however, specifically targeted paths like /.env, /.env.production, /.env.bak, and /.aws/credentials, indicating a clear intent to exfiltrate sensitive data.
Compounding the issue, the 824 IP addresses associated with this malicious activity were spread across 795 separate /24 networks, making network-based blocking impractical. Moreover, GreyNoise found forged versions of Amazon crawler names in even greater volume, using undocumented User-Agent strings. Crucially, none of the observed IP addresses matched the published ranges for the legitimate AI companies, confirming the malicious nature of the scans.
While GreyNoise has published the list of malicious IP addresses and targeted credential paths, they could not confirm whether any actual files were successfully retrieved or if any organizations were compromised. The identity of the threat actors behind this campaign remains unknown. This incident underscores the growing sophistication of attackers who are exploiting the trust and infrastructure of emerging AI technologies for malicious purposes.