---
id: "CMP-202611-c7pjgr"
kind: "campaign"
aliases: []
title: "Scanner disguised as ChatGPT, Claude and Perplexity bots hunts web servers for exposed .env files, cloud credentials and SSH keys (Cequence)"
severity: "medium"
cvss: null
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "WAF / bot management allowlists for AI crawlers", "fixed": []}, {"name": "Web servers (nginx, Apache) serving .env or config files", "fixed": []}]
ecosystems: []
tags: ["campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-01T14:13:26+00:00"
updated_at: "2026-11-01T14:13:26+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-01T14:13:26+00:00"}]
---

# Scanner disguised as ChatGPT, Claude and Perplexity bots hunts web servers for exposed .env files, cloud credentials and SSH keys (Cequence)

Cequence CQ Prime research (28 Oct 2026) tracks one actor that poses as about 32 AI crawler and assistant identities (OpenAI, Anthropic, Meta, Perplexity and others). It skips web pages and requests about 90 file paths that commonly hold secrets: .env files, cloud credential files, private SSH keys, server environment data. It runs from a major cloud provider (name not given), rotates through 300+ IPs a day, and has been active from at least late September to late October 2026, hitting financial services, retail, telecom, energy and software organisations. On one day it reached 48% of Cequence customers that saw AI bot traffic. It also tests which AI agents a site allowlists, so sites that let AI bots through by user agent are the most exposed. Cequence says almost all of its requests were blocked or failed at its customers. It does not say whether the actor stole anything elsewhere.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :WAF / bot management allowlists for AI crawlers affected ? fixed ?
- :Web servers (nginx, Apache) serving .env or config files affected ? fixed ?

## How to check

In web server, CDN and WAF logs, look for requests with AI bot user agents (GPTBot, ChatGPT-User, ClaudeBot, Claude-User, PerplexityBot, Meta crawlers) that ask for /.env, cloud credential files (e.g. .aws/credentials), SSH private keys (id_rsa) or environment/config files, especially bursts of 50-190 requests in about 8 seconds that start with random nonsense paths, or one IP claiming several AI vendors within seconds. Check for any 200 responses to those paths. The source publishes no IP list (the addresses rotate within days anyway).

## Fix

Make sure .env, credential, key and config files cannot be fetched from any web root, including staging and admin sites. If any of them returned 200, rotate the secrets inside. Do not allowlist or skip WAF and bot rules for AI agents based on user agent. Verify them by the vendor's published IP ranges or signed requests instead. IP blocklists will not keep up.

## Timeline

- 2026-11-01T14:13:26+00:00 analyst

## Documents

- [describes] @campuscodi.risky.biz: At least one threat actor has posed as an AI agent to scan enterprise networks f https://bsky.app/profile/campuscodi.risky.biz/post/3mzawk34rjc2u
- [describes] Attackers Are Using AI Agent Impersonation to Hunt for Credentials (Cequence CQ Prime) https://www.cequence.ai/blog/ai-agent-impersonation

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_