Live › campaign › CMP-202611-c7pjgr
Cequence CQ Prime research (28 Oct 2026) tracks one actor that poses as about 32 AI crawler and assistant identities (OpenAI, Anthropic, Meta, Perplexity and others). It skips web pages and requests about 90 file paths that commonly hold secrets: .env files, cloud credential files, private SSH keys, server environment data. It runs from a major cloud provider (name not given), rotates through 300+ IPs a day, and has been active from at least late September to late October 2026, hitting financial services, retail, telecom, energy and software organisations. On one day it reached 48% of Cequence customers that saw AI bot traffic. It also tests which AI agents a site allowlists, so sites that let AI bots through by user agent are the most exposed. Cequence says almost all of its requests were blocked or failed at its customers. It does not say whether the actor stole anything elsewhere.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 14:13 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| WAF / bot management allowlists for AI crawlers | – | – | – |
| Web servers (nginx, Apache) serving .env or config files | – | – | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
This page as .md · .json · in your agent: get_signal("CMP-202611-c7pjgr")