Attacker Relentlessly Scans for Credentials by Impersonating AI Bots

The threat actor lurked behind bots posing as agents from OpenAI, Anthropic, Meta, and others to find exposed data.

A threat actor lurked behind more than 30 different AI bots to find and steal exposed credentials, continuously scanning for sensitive data without success. The findings highlight a growing problem for organizations: distinguishing between which AI agents belong in their networks and which may be malicious.

A scanner impersonating 32 bots — including crawlers and assistants from OpenAI, Anthropic, Perplexity, Meta, and others — hunted for exposed credentials to various organizations, according to a report published today from CQ Prime Research, a part of Cequence Security. The scanner requested files from affected organizations — which spanned retail, financial services, telecommunications, energy, and software — that hold passwords, API keys, and cloud credentials.

The scanner has been running since late September and as of late October was still active, according to the researchers. They identified the activity on Oct. 21, discovering that on a single day this month, 48% of Cequence-protected organizations received the malicious AI bot traffic.

The findings highlight a growing challenge for security teams at a pivotal time, as businesses must figure out which AI agents to trust and permit access to their services.

“Attackers can test every one of those allow and deny decisions, and Cequence is seeing them probe which agents a business trusts, then impersonate the agents they expect to get through,” Will Glazier, director of CQ Prime threat research and data science, wrote in the report.

Malicious Scanner Gives Itself Away

The scanner operates by firing off a burst of 50 to 190 requests in about 8 seconds and then moving on, working through targets one at a time, around the clock. Fortunately for the organizations affected, nearly all of the requests were blocked or failed, according to the report.

“It sends random nonsense paths first to find websites that answer every request, a common scanning technique,” Glazier wrote.

CQ Prime Research identified the traffic as malicious through some telling behaviors that undermined the scanner’s attempt to blend in with other traffic. The scanner rotates through about 32 bot identities evenly, which real bots do not do, according to the report; one machine claimed to be an agent from OpenAI, Anthropic, Meta, and Perplexity, all within seconds.

The attacker also used the contact address of Anthropic’s crawler for all of its fake Claude identities, even when posing as different Claude agents, which shows the text was copied and not unique to each agent, according to CQ Prime Research.

The scanner also makes requests for configuration files, cloud credential files, and private SSH keys, from a list of about 90 paths, while never identifying itself or providing a contact address. Legitimate Internet-scanning services would never need these files and always identify themselves.

“The requests gave it away,” observes Collin Hogue-Spears, senior director of solutions management at security firm Black Duck, which means “what Cequence documented is the test, not a breach.”

Financial Accounts at Risk

However, what happens when AI agents scanning a network get through? This is what organizations are facing, particularly banks and financial instituations, with growing concern among experts that rogue agents are already logging into customer accounts at these organizaitons without them knowing. The result of such activity could cause global economic fallout.

For now, CQ Prime Research found that at financial services firms, AI agents acting for customers represented fewer than 1 in 4,000 requests. “The agents banks worry about most log in with a customer’s own credentials through an ordinary browser and don’t announce themselves,” Glazier wrote in the report.

At this point, financial institutions should be starting to take action to identify which AI agents are legit and which aren’t. But acting now already could mean they’re playing catch-up to the activity of threat actors, observes Shane Barney, chief information security officer at Keeper Security.

“Banks are currently scrambling to figure out which AI bots belong on their networks, but cybercriminals have already moved on to the next phase,” he says. “They are no longer trying to break into these systems. Instead, they are simply logging in disguised as trusted AI agents.”

Defending Against AI Agent Impersonation

To mitigate the growing threat from AI bots and agents, security leaders must treat AI agents, API keys, and service accounts with the same operational rigor as human administrators, Barney suggests. “That requires eliminating implicit trust across every access path,” he says.

Indeed, organizations should not trust a bot’s claimed identity on its own, according to CQ Prime Research, and they should verify agents through signed requests, published address ranges, or direct integrations.

They also should monitor for behavior that does not match the claimed identity, “such as an AI assistant requesting configuration or credential files,” Glazier wrote.

Organizations also should stop leaving static credentials in vulnerable files where scraping bots can easily find them to eliminate obvious security gaps. Instead, Barney says, “Security teams must move away from long-lived local credentials in favor of centralized, zero-knowledge secrets vaults.”