Quick Takeaways
- A malicious scanner impersonated 32 AI bots to hunt for passwords, API keys, and cloud credentials across multiple industries.
- Nearly half of Cequence-protected organizations saw the traffic in one day; most requests were blocked or failed, and no breach was reported.
- The fake bots gave themselves away by rapidly switching identities and requesting sensitive files legitimate crawlers wouldn’t need.
- Verify agent identities, monitor suspicious behavior, and replace exposed or long-lived credentials with securely managed secrets.
Fake AI Bots Probe Organizations for Credentials
A threat actor used 32 fake AI bot identities to search organizations for exposed passwords, API keys and cloud credentials, according to security researchers. The scanner targeted companies in sectors including finance, retail, energy and telecommunications.
It ran from late September and remained active in late October. On one day, nearly half of the organizations protected by one security provider received its traffic. The scanner sent bursts of 50 to 190 requests, checking about 90 file paths. Nearly all requests failed or were blocked, and researchers found no evidence of a breach.
Identity Checks Become More Important
The scanner claimed to represent services from several major AI companies, sometimes switching identities within seconds. However, its requests for private keys and configuration files exposed its intent. Legitimate crawlers do not need those files, researchers said.
AI agents can help people and businesses complete tasks, but their wider use also gives attackers new identities to imitate. Organizations should verify bots through signed requests or other trusted methods, rather than relying on claimed names. They should also monitor unusual activity and keep long-lived credentials out of exposed files. In financial services, researchers found that customer-facing AI agents made up fewer than one in 4,000 requests, but experts warn that some agents may instead use ordinary customer logins.
Expand Your Tech Knowledge
Dive deeper into the world of Cryptocurrency and its impact on global finance.
Explore past and present digital transformations on the Internet Archive.
CyberRisk-V1
