Attackers are impersonating AI agents from companies including OpenAI, Anthropic, and Meta in a bid to trick organizations into exposing sensitive credentials, according to researchers who observed a single threat actor cycling through dozens of fake bot identities while probing enterprise web servers for secrets.
A single threat actor was seen posing as approximately 32 AI bots, while probing organizations across multiple industries. Sought files included those used to store passwords, API keys, and cloud credentials.
A malicious scanner used by the attacker ran from an unnamed major cloud provider. “It ignores web pages and requests files that commonly store secrets, including .env configuration files, cloud credential files, private SSH keys, and server environment data, working from a list of roughly 90 file paths,” Cequence’s director of threat research, Will Glazier, said in a blog post.
Collin Hogue-Spears, senior director of solution management at Black Duck, who reviewed Cequence’s findings, points out that the scanner tested whether websites treated an AI bot’s self-declared name as proof of its identity. “The user-agent header is where a visitor names itself, and setting it costs nothing,” he said.
Glazier said defending against such impersonation requires verifying every claimed identity before trusting it.
While Cequence confirmed observing extensive scanning activity attributed to a single threat actor, it did not report a breach. “On one day in October, the actor reached 48% of the Cequence-protected organizations that saw any AI bot traffic,” the company said. According to Glazier, the scanner cycled through roughly 32 AI bot identities and targeted organizations in financial services, retail, telecommunications, energy, and software. The activity was observed from at least late September through late October 2026.
Instead of crawling publicly accessible pages, the scanner requested sensitive paths associated with configuration and credential files. Working through a list of approximately 90 file paths, it sent bursts of 50 to 190 requests in about eight seconds before moving on, Cequence said.
The same bot machine was observed claiming to represent OpenAI, Anthropic, Meta, and Perplexity within seconds. It also used more than 300 cloud addresses in a single day, making static IP blocklists less effective as a standalone defense.
“Fraud is now polymorphic: AI lets attackers vary their approach every time, so legacy, static fraud defenses decay faster than teams can update them,” warned Patrick Harr, chief executive officer at DataVisor. However, institutions that make real-time decisioning the foundation, with detection that adapts as quickly as the threats do, can use AI to defend as effectively as attackers do, he noted.
Nearly all the scanner’s requests were blocked or failed, Cequence noted.
Cequence recommends verifying AI crawlers through published address ranges, signed requests, or direct integrations rather than relying on self reported identities. Security teams should also flag bots that request credential files, keep secrets out of web-accessible directories, and assess automated traffic based on its behavior.
Shane Barney, chief information security officer at Keeper Security, said organizations must extend zero-trust controls and least-privilege policies to AI agents, API keys, and service accounts. He also urged businesses to replace long-lived local credentials with centrally managed secrets.
“When an identity starts looking for sensitive files it shouldn’t need, real-time threat detection must flag and terminate that machine session instantly,” Barney added.