Threat Actor Impersonates ~32 AI Bots (ChatGPT, Claude, Perplexity, Meta) to Hunt for .env Secrets and API Keys

Key facts for AI bot impersonation scanner

Detection coverage for AI bot impersonation scanner

As of 2026-11-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5047 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5047 Secret-File Probing (.env, .aws/credentials, .git/config, SSH keys) Behind Forged AI-Bot Identity

Detects a single client requesting multiple credential-bearing paths (/.env and variants, /.aws/credentials, /.git/config, private SSH keys, Vite /@fs/ .env reads) within 10 minutes, or any secret-path request that carries a self-declared AI crawler User-Agent (GPTBot, ClaudeBot, PerplexityBot, meta-externalagent and others). Matches the Cequence CQ Prime ~90-path credential hunt in TL-2026-5047 where an unattributed actor disguised a scanner as ~32 AI bot identities. Behaviour-first: it fires on the path pattern itself, so it still works when the User-Agent is novel and when source IPs rotate daily.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1595.002, T1595.003, T1592.004, T1552.001, T1552.004
• Data sources: web_access_logs, index=web sourcetype=access_combined, W3CIISLog, sigma:webserver
• Severity: medium
• Confidence: high

Splunk SPL

index=web sourcetype=access_combined earliest=-24h
```TL-2026-5047: secret-file hunting (.env, .aws/credentials, .git/config, SSH keys), often behind a forged AI-crawler User-Agent```
| eval path=lower(coalesce(uri_path, uri))
| where match(path, "(^|/)[.]env([._-][a-z0-9_.-]+)?$|/[.]aws/credentials$|/[.]git/config$|/[.]ssh/id_(rsa|ed25519|ecdsa|dsa)$|/id_(rsa|ed25519)$|^/@fs/.*[.]env") AND NOT match(path, "[.]env[._-](example|sample|dist|template)$")
| eval ai_claim=if(match(lower(useragent), "gptbot|chatgpt-user|oai-searchbot|claudebot|claude-user|claude-searchbot|anthropic-ai|perplexitybot|perplexity-user|meta-externalagent|meta-externalfetcher|facebookbot|google-extended|ccbot|bytespider|amazonbot"), 1, 0)
| bin _time span=10m
| stats count AS requests dc(path) AS distinct_secret_paths values(path) AS secret_paths sum(ai_claim) AS ai_claim_requests values(status) AS statuses values(useragent) AS user_agents by _time clientip
| where distinct_secret_paths>=3 OR (ai_claim_requests>0 AND requests>=2)
| sort - distinct_secret_paths

Microsoft KQL

let SecretPath = @'(?i)(^|/)[.]env([._-][a-z0-9_.-]+)?$|/[.]aws/credentials$|/[.]git/config$|/[.]ssh/id_(rsa|ed25519|ecdsa|dsa)$|/id_(rsa|ed25519)$|^/@fs/.*[.]env';
let SecretExclude = @'(?i)[.]env[._-](example|sample|dist|template)$';
let AiUa = @'(?i)gptbot|chatgpt-user|oai-searchbot|claudebot|claude-user|claude-searchbot|anthropic-ai|perplexitybot|perplexity-user|meta-externalagent|meta-externalfetcher|facebookbot|google-extended|ccbot|bytespider|amazonbot';
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem matches regex SecretPath
| where csUriStem !matches regex SecretExclude
| extend AiClaim = iff(csUserAgent matches regex AiUa, 1, 0)
| summarize Requests = count(), DistinctSecretPaths = dcount(csUriStem), SecretPaths = make_set(csUriStem, 25), AiClaimRequests = sum(AiClaim), Statuses = make_set(scStatus), UserAgents = make_set(csUserAgent, 5) by cIP, bin(TimeGenerated, 10m)
| where DistinctSecretPaths >= 3 or (AiClaimRequests > 0 and Requests >= 2)
| project TimeGenerated, cIP, Requests, DistinctSecretPaths, SecretPaths, AiClaimRequests, Statuses, UserAgents
| order by DistinctSecretPaths desc

Sigma

title: Credential File Probing by Self-Declared AI Crawler (TL-2026-5047)
id: 3b8e2f64-5a1c-4d7e-9c0a-6f1d2e8b7a41
status: experimental
description: Detects web requests for .env files, cloud credential files, Git metadata or private SSH keys sent with a User-Agent claiming to be an AI crawler (OpenAI, Anthropic, Perplexity, Meta and others). Genuine AI crawlers do not request these paths. Observed in the Cequence CQ Prime campaign reported 2026-10-28 (TL-2026-5047).
references:
  - https://www.cequence.ai/blog/ai-agent-impersonation
  - https://www.greynoise.io/blog/threat-actors-posing-as-ai-crawlers
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-02
tags:
  - attack.reconnaissance
  - attack.t1595.002
  - attack.t1595.003
  - attack.credential-access
  - attack.t1552.001
  - attack.t1552.004
  - attack.t1592.004
logsource:
  category: webserver
detection:
  selection_path:
    c-uri|re: '(?i)(^|/)[.]env([._-][a-z0-9_.-]+)?([?].*)?$|/[.]aws/credentials([?].*)?$|/[.]git/config([?].*)?$|/[.]ssh/id_(rsa|ed25519|ecdsa|dsa)([?].*)?$|/id_(rsa|ed25519)([?].*)?$|^/@fs/.*[.]env'
  selection_ua:
    cs-user-agent|contains:
      - 'GPTBot'
      - 'ChatGPT-User'
      - 'OAI-SearchBot'
      - 'ClaudeBot'
      - 'Claude-User'
      - 'Claude-SearchBot'
      - 'anthropic-ai'
      - 'PerplexityBot'
      - 'Perplexity-User'
      - 'meta-externalagent'
      - 'meta-externalfetcher'
      - 'FacebookBot'
      - 'Google-Extended'
      - 'CCBot'
      - 'Bytespider'
      - 'Amazonbot'
  filter_template:
    c-uri|re: '(?i)[.]env[._-](example|sample|dist|template)([?].*)?$'
  condition: selection_path and selection_ua and not filter_template
falsepositives:
  - Security scanners or red-team tooling that deliberately sets an AI-crawler User-Agent
  - Internal vulnerability assessment of web roots
level: high

Known false positives:

• Authorized vulnerability scanners and pentest tools requesting dotfile paths
• Developers or monitoring probes checking that /.env returns 403/404
• Requests for template files such as .env.example (excluded by default, extend the exclusion list for your stack)

Tuning notes: Change index/sourcetype to match your web tier (nginx:plus:access, iis, WAF logs). Allowlist scanner source ranges by clientip. Raise distinct_secret_paths if noisy, lower it to 2 for high-value apps. Source IPs rotate 300+ per day, so do not add attacker IPs to a static blocklist; alert on the path and identity behaviour instead.

• 🔒 TL-2026-5047 Sentinel: Secret-File Probing Behind Forged AI-Bot Identity · unlock with TL Creds
• 🔒 TL-2026-5047 Sentinel: Successful Retrieval of Secret Files · unlock with TL Creds
• 🔒 TL-2026-5047 Sentinel: Single Source Claiming Multiple AI Vendor Identities or Bursting Without robots.txt · unlock with TL Creds
• 🔒 TL-2026-5047 Sigma: Credential File Probing by Self-Declared AI Crawler · unlock with TL Creds
• 🔒 TL-2026-5047 Sigma: Successful Response for Secret File Request · unlock with TL Creds
• 🔒 TL-2026-5047 Sigma: Single Source Rotating Through Multiple AI Crawler Identities · unlock with TL Creds
• 🔒 TL-2026-5047 Successful Retrieval of Secret Files (.env, .aws/credentials, .git/config, SSH Keys) · unlock with TL Creds
• 🔒 TL-2026-5047 Single Source Claiming Multiple AI Vendor Identities or Bursting Without robots.txt · unlock with TL Creds

Indicators of compromise for AI bot impersonation scanner

As of 2026-11-02, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-5047.

How AI bot impersonation scanner works

Cequence Security's threat research arm (CQ Prime Research, reported by Will Glazier, Director of Threat Research) documented a single actor that disguised a credential-hunting scanner as AI crawlers and assistants. The scanner cycled evenly through approximately 32 self-reported AI bot identities, including identities claiming to be from OpenAI (ChatGPT), Anthropic (Claude), Perplexity and Meta. A single machine was observed claiming to be agents from OpenAI, Anthropic, Meta and Perplexity within seconds of one another, and a copied-and-pasted Anthropic crawler contact address was reused across different fake Claude identities. Genuine bots do not distribute traffic evenly across unrelated vendor identities, which is the primary behavioral tell.

Operationally, the actor worked around the clock against one organization at a time, sending bursts of 50 to 190 requests in about 8 seconds before moving to the next target. It first requested random, nonsensical paths to find catch-all web servers that answer any URL (so that later 200 responses can be distinguished or false positives filtered), then requested a list of roughly 90 specific paths. Reported targets were .env configuration files, cloud credential files, private SSH keys, server environment data and Git metadata. Secondary reporting states that nearly all requests were blocked or failed and no breach was reported by the source.

Infrastructure: traffic came from a major cloud provider (not named in the source). The actor used 300+ cloud addresses in a single day and nearly 400 over a week; no address seen in late September reappeared a month later, and third-party threat feeds flagged many addresses only after the actor had moved on, so static IP blocklists decay within days. On one October day the actor reached 48% of Cequence-protected organizations that saw any AI bot traffic, and at several organizations it generated more than 80% of requests labeled as AI bot traffic. Affected sectors were financial services, retail, telecommunications, energy and software. The primary Cequence report is dated 2026-10-28. No specific IP, domain or hash values were published, so no BeaconBeagle lookup was possible; no CVE is associated.

Related but separately reported (not attributed to this actor by the sources): GreyNoise documented forged AI-crawler traffic (ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot, Google-Extended) from 824 IPs between 2026-07-28 and 2026-08-23 requesting /.env variants, /.aws/credentials and /.git/config, with zero /robots.txt requests; Fastly's single-day analysis of 2026-09-23 found 6.3 million requests claiming AI bot identity from nearly 10,200 IPs (the ~10,200 figure belongs to Fastly, not Cequence), ~94% of it from about 1,600 addresses on one cloud provider. These corroborate the technique and path set but are kept as context, not as the same campaign.

Defensive takeaway: self-reported User-Agent strings are not identity. Verify AI crawlers by published IP ranges, signed requests or direct integrations, apply behavior-based bot management (credential-file requests, multi-vendor identities from one source, no robots.txt fetch, burst rates), and ensure secrets, staging systems and admin sites are never publicly reachable.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036 Masquerading

Initial Access

T1190 Exploit Public-Facing Application

Credential Access

T1552.001 Credentials In Files; T1552.004 Private Keys

Resource Development

T1583.003 Virtual Private Server

Reconnaissance

T1595.002 Vulnerability Scanning; T1595.003 Wordlist Scanning

Remediation for AI bot impersonation scanner

Immediate actions

• Block or challenge requests that claim an AI bot identity but request credential files (.env, .aws/credentials, .git/config, SSH keys)
• Verify claimed AI crawlers against vendor-published IP ranges or signed requests instead of trusting the User-Agent
• Search web and WAF logs since late September 2026 for requests to .env and other secret paths and confirm none returned HTTP 200
• Rotate any secret that was ever served from a publicly reachable .env, key or credential file

Workarounds

• Return 404/403 for dotfile paths (/.env*, /.git/*, /.aws/*) at the web server or CDN edge
• Disable catch-all routing that answers arbitrary URLs with HTTP 200

Longer-term hardening

• Deploy behavior-based bot management rather than relying on static IP blocklists, which decay within days
• Keep secrets, staging systems and admin sites off the public internet and out of web roots
• Replace long-lived credentials with centrally managed secrets and short-lived tokens
• Apply zero-trust controls to AI agents and service accounts

Affected and fixed versions

• Various — Internet-facing web servers and applications exposing .env, cloud credential, SSH key or Git metadata files

Timeline of AI bot impersonation scanner

• 2026-07-28 Related, separately reported forged AI-crawler credential scanning begins in GreyNoise's observation window (824 IPs, through 2026-08-23); not attributed to the Cequence actor
• 2026-09-23 Fastly measures 6.3 million requests falsely claiming AI bot identities from nearly 10,200 IPs on this single day, mostly .env probing (related, not attributed to the Cequence actor)
• 2026-09-25 Approximate date (source says 'late September'): Cequence begins observing the single actor impersonating ~32 AI bot identities and probing ~90 credential paths
• 2026-10-15 Approximate date (source says 'mid-October'): peak activity per the Cequence report; on one unspecified October day the actor reached 48% of Cequence-protected organizations with AI bot traffic and used 300+ cloud addresses
• 2026-10-28 Hackread publishes coverage of the Cequence report, adding that .git metadata was among targets, nearly all requests were blocked or failed, and Fastly saw a comparable 6.3M-request single-day spike
• 2026-10-28 Cequence CQ Prime Research publishes its report: activity observed through late October, no late-September IP reappeared a month later, and on one unspecified October day the actor reached 48% of Cequence-protected organizations that saw any AI bot traffic (300+ cloud addresses used that day)
• 2026-10-29 CSO Online reports the campaign: 32 identities (locked-ioc-14, locked-ioc-13, locked-ioc-16, locked-ioc-6 and 28 others), ~90 paths, no confirmed breach, and recommends zero-trust controls for AI agents and service accounts
• 2026-10-31 Approximate date (source says 'late October'): Cequence's observation window ends; no IP address from late September reappeared a month later, indicating complete address turnover
• 2026-11-02 Cyber Security News and other outlets report the campaign; Cequence recommends verifying AI agents via signed requests, published ranges or direct integrations

Sources cited for AI bot impersonation scanner

• Cequence: AI Agent Impersonation (CQ Prime Research) cequence.ai · Research · 2026-10-28
• GreyNoise: Threat actors posing as AI crawlers (related, separate campaign) greynoise.io · Research
• Fastly: AI Bot Cosplay (related, separate analysis of 2026-09-23) fastly.com · Vendor report
• Hackers Impersonate ChatGPT, Claude, and Perplexity AI Bots to Hunt for Passwords and API Keys cybersecuritynews.com · News · 2026-11-02
• CSO Online: Imposter abused trust in OpenAI, Anthropic and 30 others to hunt for secrets csoonline.com · News
• Hackread: Hackers Impersonate 32 AI Bots to Hunt for Exposed Credentials hackread.com · News
• Let's Data Science: Cequence Reports Scanner Posing as 32 AI Bots Hunting Credentials letsdatascience.com · News

More in threat intel

• OWASP Warns AI Agents Are Lowering the Skill Barrier for Cyberattacks (LLM Exploit Generation Guide 2.0)
• Talos IR Trends Q3 2026: IT help desk vishing and rising ransomware activity; Salt Typhoon exploiting CVE-2023-20198
• Hunting Malware C2 Infrastructure with FOFA Queries (AsyncRAT, Cobalt Strike, Amadey, Quasar RAT, Laplas Clipper, Sliver, Mythic, Supershell)
• Kaspersky ICS CERT: Threat Landscape for Industrial Automation Systems, Q1 2026
• AI-Enabled Cyberattack Campaigns Against Japan: Three Cases Beyond ARTEX (CyberStrikeAI, LLM-Assisted Intrusions, AI-Written Tooling)