Threat actor impersonates 32 AI bots to hunt for enterprise secrets

The AI identity masquerade

A single threat actor recently engaged in a sophisticated scanning campaign by impersonating approximately 32 different AI bots. The attacker targeted enterprise web servers across various industries, including financial services, retail, telecommunications, energy, and software. By posing as legitimate AI agents, the actor aimed to trick organizations into exposing sensitive internal data.

The scanner specifically claimed to represent high-profile AI companies such as OpenAI, Anthropic, Meta, and Perplexity. These identities were cycled through rapidly, sometimes appearing within seconds of one another. This tactic allows attackers to hide their malicious activity behind the veil of legitimate web crawling and data collection that many companies now permit.

According to Cequence, the research team observed this activity from late September through late October 2026. While the actor was hunting for secrets, Cequence confirmed that they did not report a successful breach during this period. However, the scale of the scanning suggests a persistent and organized effort to find vulnerabilities in enterprise infrastructure.

How the scanner hunts for secrets

The malicious scanner did not spend time browsing public-facing web pages or standard content. Instead, it ignored general information and specifically requested files that commonly store sensitive credentials. These included .env configuration files, cloud credential files, private SSH keys, and various server environment data.

The attacker utilized a list of roughly 90 specific file paths to conduct their search. The scanner would send rapid bursts of 50 to 190 requests in about eight seconds before moving on to a new target. This high-speed approach is designed to probe as many potential entry points as possible in a very short window of time.

A key technical detail involves the user-agent header, which is the part of a web request where a visitor names itself. As Collin Hogue-Spears of Black Duck noted, setting this header costs nothing for an attacker. The scanner tested whether websites would treat a bot's self-declared name as proof of its actual identity rather than verifying the source.

Bypassing traditional defenses

To avoid being blocked by simple security measures, the threat actor used a sophisticated distribution strategy. The scanner was observed using more than 300 different cloud addresses in a single day. This variety makes static IP blocklists, which are common defense tools, much less effective as a standalone method for stopping the attack.

The actor's approach is described as polymorphic, meaning it can change its shape and characteristics to evade detection. Patrick Harr, CEO of DataVisor, explained that AI allows attackers to vary their approach every time, causing legacy defenses to decay faster than teams can update them. This creates a constant arms race between automated scanners and security software.

Despite these tactics, many of the scanner's requests were successfully blocked or failed during the observation period. The activity serves as a warning that while many organizations have basic protections in place, the methods used by attackers are becoming increasingly dynamic and difficult to predict.

Moving toward zero-trust security

Security experts suggest that organizations must stop trusting any identity based solely on a self-reported name. Instead, companies should verify AI crawlers through published address ranges, signed requests, or direct integrations. This ensures that only authorized bots can access the parts of the network they are intended to interact with.

Shane Barney, CSO at Keeper Security, recommends extending zero-trust controls and least-privilege policies to AI agents and service accounts. This means that even if a bot is authorized to exist on a network, it should only have access to the specific files it needs to perform its job. If a bot starts looking for sensitive files it should not need, the system should flag it immediately.

Another critical step is replacing long-lived local credentials with centrally managed secrets. By moving away from static files like .env configurations that can be easily discovered by scanners, businesses can reduce their attack surface. Real-time threat detection is also necessary to terminate machine sessions instantly when suspicious behavior is detected.

What to watch for next

As AI agents become more common in enterprise workflows, the risk of identity spoofing will likely increase. Attackers will continue to look for ways to blend into the noise of legitimate AI traffic to find

The future of bot defense

Organizations will need to invest in detection systems that adapt as quickly as the threats do. Using AI to defend against AI-driven attacks is becoming a necessity for companies that handle sensitive data. The goal is to move from reactive blocking to proactive, behavior-based monitoring.

We should watch for new standards in how AI companies sign their requests to verify their identity. If major players like OpenAI and Anthropic adopt universal standards for bot verification, it will make it much harder for attackers to impersonate them. This could lead to a more secure environment for automated web crawling.

Finally, the shift toward centrally managed secrets will likely accelerate as more companies realize the dangers of local configuration files. Security teams will need to prioritize auditing which automated agents have access to what data. The focus is shifting from 'who is this bot' to 'what is this bot actually doing right now.'