Automated scanners are impersonating the web crawlers of OpenAI, Anthropic, DeepSeek, and other AI companies to probe internet-facing servers for exposed secrets, according to research GreyNoise published August 28, 2026.
GreyNoise identified a cluster forging 13 distinct AI crawler identities across eight companies, sending requests with spoofed user-agent strings for the file paths where misconfigured servers commonly leak credentials, including .env, .env.production, .env.bak, and .aws/credentials. Between July 28 and August 23, 2026, the traffic rotated through more than 1,500 different user-agent strings while keeping the same underlying HTTP client fingerprint, evidence of a single operator running the whole campaign rather than unrelated scanners. GreyNoise checked the source addresses against the published IP ranges that OpenAI, Anthropic, Google, and Perplexity each maintain for their legitimate crawlers. None of the traffic matched.
The trick works because AI crawler user agents have become a soft form of trust. Many web application firewalls and rate limiters allow known AI-crawler strings through with lighter scrutiny than ordinary traffic, on the assumption that a name like “ClaudeBot” or “GPTBot” identifies a well-behaved indexing service. That assumption was never actually verified against network origin, and this campaign exploited exactly that gap.
For security leaders, the fix is not to block AI crawlers outright but to stop trusting the user-agent string as identity. Any allowlisting decision based on a crawler name should be paired with a check against that company’s published IP ranges, the same discipline already applied to distinguishing real search-engine bots from spoofed ones. Absent that check, a firewall rule written to be crawler-friendly is functionally an unauthenticated bypass.
Related CyberTech coverage: how AI agents crossed from tool to threat actor and an AI voice-cloning kit built for device theft.
Source: GreyNoise
