# One scanner posed as 32 AI bots to hunt for .env files and SSH keys, Cequence says

Source: https://startwithidentity.com/blog/2026-10-28-one-scanner-posed-as-32-ai-bots-to-hunt-for-env-files-and-ssh-keys/
Last updated: 2026-10-28
License: content by Start with Identity. Cite the source URL.

---

Cequence Security's CQ Prime threat research team reported on October 28 that one actor has been impersonating AI bots to hunt for exposed secrets since at least late September. The scanner cycled evenly through about 32 bot identities, including crawlers and assistants claiming to come from OpenAI, Anthropic, Meta and Perplexity, and worked from a list of roughly 90 file paths: `.env` configuration files, cloud credential files, private SSH keys and server environment data. It ignored ordinary web pages. Each address sent 50 to 190 requests in about eight seconds, and the actor used more than 300 cloud addresses in one day. On one day in October it reached 48% of the Cequence-protected organizations that saw any AI bot traffic. Tells included one machine claiming several AI companies within seconds, and fake Claude identities all copying the contact address of Anthropic's crawler.

## Why it matters

A user-agent string is a claim, not an identity. Any site that lets named AI crawlers and assistants past its bot rules is treating that name as a pass, and this actor used it to look for the secrets that open everything else. As AI agents browse and act for users, sites need a way to check who an agent really is before trusting it.

Cequence recommends verifying agents with signed requests, published address ranges or direct integrations, and flagging behavior that does not fit the claimed identity, such as an assistant asking for credential files. The bigger fix is on your side: no secrets in web-reachable files, and [secrets management](https://startwithidentity.com/glossary/secrets-management/) with rotation for anything that leaked. The [Agent Identity Standards Map 2026](https://startwithidentity.com/reports/agent-identity-standards-map-2026/) covers the emerging ways to authenticate agents, and [secrets in repositories and CI](https://startwithidentity.com/techniques/secrets-in-repositories-and-ci/) covers the exposure.

Source: [Cequence Security](https://www.cequence.ai/blog/ai-agent-impersonation)