# Fake ClaudeBots Are Scanning for Your AI Credentials > Source: > Published: 2026-08-12 21:08:47+00:00 [Security](https://sourcefeed.dev/c/security)Article # Fake ClaudeBots Are Scanning for Your AI Credentials A spoofing campaign probing for Claude settings and .env files shows user-agent strings were never identity. [Emeka Okafor](https://sourcefeed.dev/u/emeka_okafor) Somebody is running vulnerability scans across thousands of websites while dressed up as [ClaudeBot](https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-website-owners-block-the-crawler), GPTBot, and friends. Bot-analytics service Known Agents flagged the campaign after seeing a statistically significant surge in spoofed AI-crawler traffic over the past week — requests that present a legitimate crawler's user-agent string but fail IP-ownership and cryptographic checks. Sysadmins in the ensuing Hacker News thread confirmed the same patterns in their own logs. The spoofing itself is the least interesting part. Faking Googlebot to slip past WAF rules is a trick older than most JavaScript frameworks. What's actually new here is the shopping list. ## The attack dictionary has been updated for the agent era These scans aren't hammering `/wp-login.php` . According to Known Agents' telemetry, the probed paths include `/.claude/settings.json` , `/.config/anthropic/credentials/default.json` , `.env` files in various directories, `/.aws/credentials` , and Docker and Terraform config files. Read that list again. Alongside the perennial classics — `.env` scanning has been background radiation for a decade — attackers are now specifically hunting for the credential and settings files that AI coding tools drop on developer machines. That's a rational update to the playbook: an Anthropic or OpenAI API key is immediately monetizable (resold for token laundering or burned on free inference), and the agentic-coding boom has minted millions of fresh credential files sitting in home directories. Some fraction of those directories inevitably end up as the document root of a misconfigured server, an over-eager rsync, or a container image that shipped more than it should have. This is the same evolutionary step we watched when `.git/config` and `wp-config.php.bak` entered the scan dictionaries years ago. Scanners probe for whatever the current generation of developers accidentally exposes. In 2026, that's Claude settings files. Whether or not this particular campaign harvests much, the paths will stay in mass-scanning dictionaries forever — they're cheap to check and the loot is liquid. ## Why an AI crawler is the perfect disguise right now The user-agent header has always been a courtesy, not a credential. What changed is the incentive structure around AI crawlers specifically. Site owners now make deliberate policy decisions about them: block ClaudeBot to protect content, or allow it because you want to show up in AI search results. A lot of robots.txt files, WAF rules, and CDN configs now contain explicit allow rules keyed on AI bot names — and every string-based allow rule is a free pass for anyone who can type a `User-Agent` header, which is everyone. There's also a social-engineering angle: AI crawlers are *expected* to be noisy and to hit odd URLs. An operator who sees "ClaudeBot" requesting weird paths is more likely to sigh about AI companies than to open an incident. The measured volumes are small but not negligible. Known Agents puts spoofed traffic at roughly 0.1% of requests presenting ClaudeBot or GPTBot user-agents, and about 0.5% for Googlebot. [HUMAN Security](https://www.humansecurity.com/learn/blog/crawlers-list-known-bots-guide/)'s independent analysis of 16 AI crawler user-agents found 5.7% of requests spoofed — a much higher figure, which tells you these numbers depend heavily on whose network you measure from. Both can't be the universal truth; treat them as bounds, not gospel. And a single-digit percentage of AI-crawler-scale traffic is still an enormous absolute number of requests, aimed with intent. ## Verification is a solved problem; adoption isn't The irony is that AI crawlers are now among the *most* verifiable bots on the internet. Anthropic publishes a machine-readable IP list at [claude.com/crawling/bots.json](https://claude.com/crawling/bots.json). OpenAI publishes ranges for its crawlers in its [bot documentation](https://platform.openai.com/docs/bots). Google has supported [forward-confirmed reverse DNS verification](https://developers.google.com/search/docs/crawling-indexing/verifying-googlebot) for Googlebot for years. And the newer [Web Bot Auth](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/web-bot-auth/) effort — a pair of IETF drafts championed by Cloudflare — has bots sign requests with Ed25519 keys and advertise a key directory via a `Signature-Agent` header, making impersonation cryptographically detectable rather than merely suspicious. That's exactly how this campaign was caught: the requests claimed to be ClaudeBot but came from IPs Anthropic doesn't own and carried no valid signatures. The tooling works. The problem is that most sites still make bot decisions on the string alone. Practically, here's the short version of doing it right: **Never allow or trust based on user-agent alone.** If you have a WAF rule that says "AI bots: allow," key it to verified identity — published IP ranges, FCrDNS, or Web Bot Auth signatures — not the header. Cloudflare and Fastly's verified-bot programs do this for you if you're on their edge.**Grep your logs for the new tripwires.** Something like`grep -E '\.claude/|anthropic/credentials|\.aws/credentials|\.env' access.log` will tell you in seconds whether you're being probed and, more importantly, whether anything answered with a 200.**Make the loot impossible, not just hidden.** Dotfiles and credential files should never be servable — deny`/.` paths at the server level, keep secrets out of build contexts and document roots, and rotate any key that ever lived under one. ## The string is dead; long live the signature My read: this campaign is a footnote as an attack and a milestone as a forcing function. The web has run for thirty years on the polite fiction that user-agents mean something, and the AI-crawler wars — sites desperate to sort welcome bots from unwelcome ones, at exactly the moment impersonation got profitable — are what finally kills it. Cryptographic bot identity was a nice-to-have in 2024; campaigns like this one make it table stakes. If your bot policy, your analytics, or your "block AI scrapers" plugin still reasons from the `User-Agent` header, you're enforcing rules against honest actors only — and the honest actors were never the problem. ## Sources & further reading - [Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot](https://knownagents.com/insights)— knownagents.com - [HN discussion: Mass vulnerability scans spoofing AI bots](https://news.ycombinator.com/item?id=49272569)— news.ycombinator.com - [Does Anthropic crawl data from the web?](https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-website-owners-block-the-crawler)— support.claude.com - [Web Bot Auth](https://developers.cloudflare.com/bots/concepts/bot/verified-bots/web-bot-auth/)— developers.cloudflare.com - [The Ultimate List of Crawlers and Known Bots](https://www.humansecurity.com/learn/blog/crawlers-list-known-bots-guide/)— humansecurity.com [Emeka Okafor](https://sourcefeed.dev/u/emeka_okafor)· Security Editor Emeka has spent over a decade tracking threat actors, vulnerability disclosures, and the evolving landscape of application security, bringing a sharp continent-spanning perspective to his reporting. He's known for translating dense CVE advisories into clear, actionable context that developers and security teams alike actually read. ## Discussion 0 No comments yet Be the first to weigh in.