Overview
A persistent threat actor has been identified conducting large-scale credential scanning operations by impersonating bots from leading AI companies, including OpenAI, Anthropic, and Meta. By spoofing the user-agent strings associated with legitimate AI crawlers, the attacker camouflages malicious reconnaissance traffic as routine AI platform activity. This tactic exploits the growing permissiveness that web operators extend to AI service traffic, enabling the actor to probe for exposed credentials with reduced friction and detection risk.
Technical Analysis
The attack relies on a straightforward but effective deception: crafting HTTP requests that present user-agent headers mimicking those used by genuine AI web crawlers. Because many organisations explicitly allowlist or deprioritise alerts for traffic appearing to originate from trusted AI providers, this spoofed traffic can traverse perimeter defences and logging filters with minimal scrutiny.
The attacker uses this cover to systematically scan publicly accessible web assets — including configuration files, repositories, login endpoints, and API surfaces — in search of inadvertently exposed credentials such as API keys, tokens, and passwords. The relentless, automated nature of the scanning suggests tooling purpose-built for this impersonation technique, with targets likely selected opportunistically across a broad surface area.
Critically, user-agent strings are trivially forged. Unlike legitimate AI crawlers from OpenAI or Anthropic, which originate from documented and verifiable IP ranges, the attacker’s infrastructure does not resolve to the expected autonomous systems — a key differentiator that most passive defences miss.
Framework Mapping
MITRE ATLAS:
- AML.T0012 (Valid Accounts): The end goal of credential harvesting is to obtain valid credentials for follow-on access.
- AML.T0047 (AI-Enabled Product or Service): The attacker weaponises the perceived identity of legitimate AI services to establish false trust.
- AML.T0098 (AI Agent Tool Credential Harvesting): Scanning for credentials exposed to AI-accessible surfaces aligns directly with this technique.
- AML.T0040 (AI Model Inference API Access): Harvested API keys may grant direct access to AI inference endpoints.
OWASP LLM Top 10:
- LLM06 (Sensitive Information Disclosure): Exposed credentials discovered through this scanning can lead to direct disclosure of sensitive model and organisational data.
Impact Assessment
Any organisation with web-facing infrastructure that inadequately validates inbound crawler traffic is potentially at risk. The primary damage vector is credential exposure: harvested API keys and tokens could grant attackers access to AI model APIs, cloud infrastructure, internal systems, or proprietary data stores. The impersonation of multiple high-profile AI vendors — OpenAI, Anthropic, Meta — broadens the attack surface by exploiting trust relationships across the AI ecosystem simultaneously. The relentless, automated scanning posture suggests this is an ongoing, scaled operation rather than a targeted intrusion.
Mitigation & Recommendations
- Verify crawler identity beyond user-agent: Cross-reference inbound crawler IPs against official published IP ranges and validate via reverse DNS. OpenAI, Google, and others publish authoritative lists.
- Audit for exposed credentials: Conduct regular sweeps of public-facing assets, repositories, and configuration endpoints for inadvertently exposed secrets using tools such as truffleHog or GitGuardian.
- Apply rate limiting universally: Do not exempt crawler-labelled traffic from rate limiting or anomaly detection; apply consistent scrutiny regardless of claimed bot identity.
- Monitor for credential misuse: Instrument API key usage with alerting on anomalous access patterns that may indicate harvested credential abuse.
- Rotate secrets proactively: Any credentials that may have been exposed to public-facing scanning should be rotated immediately.