A single scanner has been searching corporate websites for exposed credentials while disguised as roughly 32 AI bots, borrowing the names of crawlers and assistants run by OpenAI, Anthropic, Perplexity, and Meta.
CQ Prime Research, the threat research arm of Cequence Security, detailed the activity in research published Oct. 28.
One day in October saw 48% of Cequence customers experiencing AI bot traffic, in sectors from software and energy to telecommunications, financial services, and retail. Almost every request it made was blocked or failed, and the research does not report stolen credentials or identify any customer as breached.
Cequence based the findings on a sample of the web and API traffic it protected between late September and late October 2026. GreyNoise reported a similar crawler impersonation in August.
Among banks, AI agents working on behalf of customers accounted for roughly one request in 4,000, even at the financial institution with the highest exposure. CQ Prime said impersonators probably inflate any AI traffic figures drawn from what bots say about themselves.
“Recognizing a real OpenAI or Anthropic request settles who sent it, and nothing about which customer authorized the agent or what that customer allowed it to do,” Collin Hogue-Spears, senior director of solution management at application security provider Black Duck, told CISO Voice.
What gave the scanner away
CQ Prime said the scanner spread its traffic evenly across its bot identities, which no genuine bot does, and a single machine claimed to be OpenAI, Meta, Perplexity, and Anthropic within seconds.
Every fake Claude identity also carried the contact details of Anthropic’s real crawler, even when it claimed to be another Claude agent, which Cequence said pointed to copied text.
It asked only for files that no crawler needs; these included private SSH keys, stored cloud credentials, and configuration files. In addition, the crawler never identified itself, which all reputable scanning services would do. It also used upward of 300 different cloud addresses in a single day, and not one address from late September was seen again a month later, CQ Prime said.
“The user-agent header is where a visitor names itself, and setting it costs nothing,” Hogue-Spears said. “If your gateway trusts the name in the header, you will let the attacker choose which of your rules applies.”
Cequence advised confirming an agent’s identity through signed requests, direct integrations, or the operator’s published address ranges, flagging activity at odds with what an agent claims to be, and storing secrets outside web-reachable files.
