One scanner posed as 32 AI bots to hunt for .env files and SSH keys, Cequence says
Cequence's CQ Prime research team said on October 28 that a single actor rotated through about 32 claimed AI crawler and assistant identities, from OpenAI to Perplexity, to request .env files, cloud credential files and private SSH keys. On one day it reached 48% of monitored organizations that saw AI bot traffic.
Cequence Security's CQ Prime threat research team reported on October 28 that one actor has been impersonating AI bots to hunt for exposed secrets since at least late September. The scanner cycled evenly through about 32 bot identities, including crawlers and assistants claiming to come from OpenAI, Anthropic, Meta and Perplexity, and worked from a list of roughly 90 file paths: .env configuration files, cloud credential files, private SSH keys and server environment data. It ignored ordinary web pages. Each address sent 50 to 190 requests in about eight seconds, and the actor used more than 300 cloud addresses in one day. On one day in October it reached 48% of the Cequence-protected organizations that saw any AI bot traffic. Tells included one machine claiming several AI companies within seconds, and fake Claude identities all copying the contact address of Anthropic's crawler.
Why it matters
A user-agent string is a claim, not an identity. Any site that lets named AI crawlers and assistants past its bot rules is treating that name as a pass, and this actor used it to look for the secrets that open everything else. As AI agents browse and act for users, sites need a way to check who an agent really is before trusting it.
Cequence recommends verifying agents with signed requests, published address ranges or direct integrations, and flagging behavior that does not fit the claimed identity, such as an assistant asking for credential files. The bigger fix is on your side: no secrets in web-reachable files, and secrets management with rotation for anything that leaked. The Agent Identity Standards Map 2026 covers the emerging ways to authenticate agents, and secrets in repositories and CI covers the exposure.
Source: Cequence Security
Related on Start with Identity
- BlogDocker Sandboxes copy flaw let an AI agent reach host files such as cloud keys and SSH keys
A symlink flaw in the Docker Sandboxes copy command, CVE-2026-103916, let an AI coding agent inside the sandbox read or write host files outside its allowlist,
- BlogOne actor signed in as Entra ID apps with stolen secrets and reached 27 organizations, Todyl says
Todyl is tracking an ongoing campaign in which one operator uses stolen client secrets to sign in to Microsoft Entra ID as app registrations, reaching 27 organi
- BlogCISA contractor left AWS GovCloud admin keys in a public GitHub repo for six months
844 MB of agency data in a repo named Private CISA, including a file called importantAWStokens and plaintext internal passwords. Nine automated GitGuardian aler
- CVEtj-actions/changed-files tags repointed to dump CI secrets into logs
An attacker repointed tj-actions/changed-files version tags to a commit that read the GitHub Actions runner's memory and printed its secrets into workflow logs.
- CVETrivy release and GitHub Action tags hijacked to steal CI secrets
With credentials left valid by a non-atomic rotation, an attacker shipped a malicious Trivy v0.69.4 and repointed 76 of 77 trivy-action tags to code that dumped
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,