{"id":"CMP-202611-c7pjgr","kind":"campaign","aliases":[],"related":[],"title":"Scanner disguised as ChatGPT, Claude and Perplexity bots hunts web servers for exposed .env files, cloud credentials and SSH keys (Cequence)","description":null,"summary":"Cequence CQ Prime research (28 Oct 2026) tracks one actor that poses as about 32 AI crawler and assistant identities (OpenAI, Anthropic, Meta, Perplexity and others). It skips web pages and requests about 90 file paths that commonly hold secrets: .env files, cloud credential files, private SSH keys, server environment data. It runs from a major cloud provider (name not given), rotates through 300+ IPs a day, and has been active from at least late September to late October 2026, hitting financial services, retail, telecom, energy and software organisations. On one day it reached 48% of Cequence customers that saw AI bot traffic. It also tests which AI agents a site allowlists, so sites that let AI bots through by user agent are the most exposed. Cequence says almost all of its requests were blocked or failed at its customers. It does not say whether the actor stole anything elsewhere.","severity":"medium","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-01T14:13:26+00:00","products":[{"name":"WAF / bot management allowlists for AI crawlers","fixed":[]},{"name":"Web servers (nginx, Apache) serving .env or config files","fixed":[]}],"ecosystems":[],"tags":["campaign","early-warning"],"not_affected_if":[],"how_to_check":"In web server, CDN and WAF logs, look for requests with AI bot user agents (GPTBot, ChatGPT-User, ClaudeBot, Claude-User, PerplexityBot, Meta crawlers) that ask for /.env, cloud credential files (e.g. .aws/credentials), SSH private keys (id_rsa) or environment/config files, especially bursts of 50-190 requests in about 8 seconds that start with random nonsense paths, or one IP claiming several AI vendors within seconds. Check for any 200 responses to those paths. The source publishes no IP list (the addresses rotate within days anyway).","fix":"Make sure .env, credential, key and config files cannot be fetched from any web root, including staging and admin sites. If any of them returned 200, rotate the secrets inside. Do not allowlist or skip WAF and bot rules for AI agents based on user agent. Verify them by the vendor's published IP ranges or signed requests instead. IP blocklists will not keep up.","status":"open","published_at":null,"first_seen_at":"2026-11-01T14:13:26+00:00","triaged_at":"2026-11-01T14:13:26+00:00","updated_at":"2026-11-01T14:13:26+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':23A '2026':54B,127B '28':52B '300':111B '32':62B '48':142B '90':81B 'activ':118B 'actor':57B,194B 'agent':26A,156B,169B 'ai':25A,33A,63B,148B,155B,164B 'allowlist':159B 'allowlists':31A 'almost':176B 'also':152B 'anthrop':69B 'anyth':196B 'apache':38A 'assist':66B 'block':182B 'bot':8A,29A,149B,165B 'c7pjgr':24A 'campaign':44B 'cequenc':21A,48B,144B,174B 'chatgpt':4A 'claud':5A 'cloud':16A,90B,104B 'cmp':22A 'common':85B 'config':42A 'cq':49B 'crawler':64B 'crawlers':34A 'credenti':17A,91B 'custom':145B,187B 'data':98B 'day':114B,139B 'disguis':2A 'earli':46B 'early-warn':45B 'elsewher':197B 'energi':133B 'env':14A,40A,88B 'environ':97B 'expos':13A,173B 'fail':184B 'file':15A,82B,89B,92B 'files':43A 'financi':129B 'for':32A 'given':108B 'hit':128B 'hold':86B 'hunt':9A 'ident':67B 'impersonation':27A 'ip':112B 'key':20A,95B 'late':122B,125B 'least':121B 'let':163B 'major':103B 'management':30A 'meta':70B 'name':106B 'nginx':37A 'oct':53B 'octob':126B 'one':56B,138B 'openai':68B 'or':41A 'organis':136B 'other':73B 'page':77B 'path':83B 'perplex':7A,71B 'pose':59B 'prime':50B 'privat':93B 'provid':105B 'reach':141B 'request':79B,180B 'research':51B 'retail':131B 'rotat':109B 'run':100B 'saw':147B 'say':175B,191B 'scanner':1A 'secret':87B 'septemb':123B 'server':11A,96B 'servers':36A 'servic':130B 'serving':39A 'site':158B,161B 'skip':75B 'softwar':135B 'ssh':19A,94B 'stole':195B 'telecom':132B 'test':153B 'track':55B 'traffic':150B 'user':168B 'waf':28A 'warn':47B 'web':10A,35A,76B 'whether':192B","nicknames":["AI agent impersonation"],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"first_public_at":"2026-10-28T00:00:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"CMP-202611-c7pjgr","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-01T14:13:26+00:00","fetched_at":"2026-11-01T14:13:26+00:00","note":null}],"documents":[{"id":39010,"url":"https://bsky.app/profile/campuscodi.risky.biz/post/3mzawk34rjc2u","title":"@campuscodi.risky.biz: At least one threat actor has posed as an AI agent to scan enterprise networks f","kind":"post","source":"bluesky","publisher":null,"text":"At least one threat actor has posed as an AI agent to scan enterprise networks for unsecured passwords, API keys, and cloud credentials.\n\nThe attacker has rotated through 32 different AI bots, including ChatGPT, Claude, and Perplexity.\n\nwww.cequence.ai/blog/ai-agen...\nhttps://www.cequence.ai/blog/ai-agent-impersonation\n\nlikes 0 reposts 0","published_at":"2026-11-01T13:37:06+00:00","relation":"describes","confidence":null,"note":null},{"id":39148,"url":"https://www.cequence.ai/blog/ai-agent-impersonation","title":"Attackers Are Using AI Agent Impersonation to Hunt for Credentials (Cequence CQ Prime)","kind":"blog","source":"analyst","publisher":null,"text":"Cequence CQ Prime Threat Research (Will Glazier), 28 Oct 2026. One actor, running from a major cloud provider, rotates evenly through about 32 AI bot identities (OpenAI, Anthropic, Meta, Perplexity crawlers and assistants) while requesting about 90 secret-bearing file paths: .env config files, cloud credential files, private SSH keys, server environment data. Each address sends bursts of 50-190 requests in about 8 seconds, around the clock, and first probes random nonsense paths to find sites that answer every request. Fake Claude identities all carry the contact address of Anthropic's crawler. More than 300 cloud IPs in one day, nearly 400 in a week, rotated; IPs from late September not reused a month later. Targets: financial services, retail, telecom, energy, software. Active from at least late September to late October 2026. On one October day it reached 48% of Cequence-protected organisations that saw AI bot traffic. Attackers also probe which AI agents a business allowlists and then impersonate those. Advice: verify AI agents via signed requests or published IP ranges, not the user agent; alert on AI agents requesting config or credential files; keep secrets out of web-accessible files; IP blocklists go stale within days.","published_at":"2026-10-28T00:00:00+00:00","relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}