Attacker impersonates 32 AI bots to hunt for credentials

A single threat actor impersonated about 32 AI bots while probing company servers for passwords, API keys and cloud credentials, Cequence said in a threat research post, as CSO Online reported. Cequence observed the attacker posing as bots from OpenAI, Anthropic, Meta, Perplexity and other companies from at least late September through late October 2026.

The scanner requested about 90 file paths associated with configuration files, cloud credentials, private SSH keys and server environment data. Each address sent bursts of 50 to 190 requests in about eight seconds before moving to another target. The activity reached companies in financial services, retail, telecommunications, energy and software.

The attacker used more than 300 cloud addresses in one day and rotated through the bot identities from the same machines. On one day in October, it reached 48% of Cequence protected organizations that received any AI bot traffic. Cequence said nearly all requests were blocked or failed, and it did not report a breach.

Cequence recommends verifying agents through signed requests, published address ranges or direct integrations rather than trusting claimed identities. It also advises companies to keep secrets outside web accessible files and evaluate automated traffic based on behavior.