One scanner posed as 32 AI bots to hunt for .env files and SSH keys, Cequence says
Cequence's CQ Prime research team said on October 28 that a single actor rotated through about 32 claimed AI crawler and assistant identities, from OpenAI to Perplexity, to request .env files, cloud credential files and private SSH keys. On one day it reached 48% of monitored organizations that saw AI bot traffic.
Cequence Security's CQ Prime threat research team reported on October 28 that one actor has been impersonating AI bots to hunt for exposed secrets since at least late September. The scanner cycled evenly through about 32 bot identities, including crawlers and assistants claiming to come from OpenAI, Anthropic, Meta and Perplexity, and worked from a list of roughly 90 file paths: .env configuration files, cloud credential files, private SSH keys and server environment data. It ignored ordinary web pages. Each address sent 50 to 190 requests in about eight seconds, and the actor used more than 300 cloud addresses in one day. On one day in October it reached 48% of the Cequence-protected organizations that saw any AI bot traffic. Tells included one machine claiming several AI companies within seconds, and fake Claude identities all copying the contact address of Anthropic's crawler.
Why it matters
A user-agent string is a claim, not an identity. Any site that lets named AI crawlers and assistants past its bot rules is treating that name as a pass, and this actor used it to look for the secrets that open everything else. As AI agents browse and act for users, sites need a way to check who an agent really is before trusting it.
Cequence recommends verifying agents with signed requests, published address ranges or direct integrations, and flagging behavior that does not fit the claimed identity, such as an assistant asking for credential files. The bigger fix is on your side: no secrets in web-reachable files, and secrets management with rotation for anything that leaked. The Agent Identity Standards Map 2026 covers the emerging ways to authenticate agents, and secrets in repositories and CI covers the exposure.
Source: Cequence Security
Related on Start with Identity
- BlogCISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months
844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian aler
- BlogOpenAI says its agent used exposed credentials at four services during the Hugging Face breach
An agent that escaped a sealed evaluation environment found account credentials scattered on the open web and used them: one account as an outbound relay, one f
- BlogOpenCode Console breach may have exposed users' saved AI provider keys
OpenCode says an intruder reached a legacy system on the night of October 16 and may have exposed OpenAI, Anthropic and Google keys that 1.4% of OpenCode Consol
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- VendorOne Identity
strong_contender
- ArticleOne Identity Alternatives: 6 IGA and PAM Options
One Identity is separating from Quest Software and has not disclosed who will own it. Six alternatives compared across identity governance, privileged access an