Fake AI Chatbots Steal Credentials, Target OpenAI, Anthropic Users

Key Takeaways

• Threat actors are mimicking legitimate AI web crawlers from companies like OpenAI, Anthropic, and Google.
• These fake crawlers are actively scanning websites for exposed sensitive files, including cloud keys, API tokens, and passwords.
• The attackers exploit the HTTP User-Agent header, which is easily forged, to bypass security measures.
• Defenders should validate crawler source IP addresses against official vendor lists and monitor for requests to sensitive paths.

Cybersecurity researchers have uncovered a widespread campaign where malicious actors are posing as official web crawlers from prominent artificial intelligence organizations, including OpenAI, Anthropic, and DeepSeek. The objective of this sophisticated deception is to systematically scan websites for misconfigured servers that might inadvertently expose critical credentials and sensitive configuration files.

Analysis by GreyNoise said a broad cluster of these malicious scanners adopted 13 different AI crawler identities originating from eight distinct companies. These scanners specifically targeted files such as .env, /.aws/credentials, and various private key and password store locations. An .env file, for instance, frequently contains vital application secrets, including database credentials, cloud access keys, and API tokens.

The campaign leverages a straightforward yet highly effective method of deception: fabricating the HTTP User-Agent header. While legitimate web crawlers identify themselves via this header (e.g., Googlebot, ClaudeBot, GPTBot), the client dictates its content. This means the header alone cannot definitively verify that a request genuinely originates from the organization it claims to represent.

This vulnerability creates a significant risk for organizations that permit access, circumvent controls, or suppress security alerts based solely on the name provided in a crawler’s user-agent string. An attacker can precisely replicate an official crawler string, rendering user-agent-based detection mechanisms ineffective.

Hackers Impersonate OpenAI, Anthropic & DeepSeek

GreyNoise specifically identified six forged AI crawler names associated with Anthropic, OpenAI, Google, and Perplexity. Between July 28 and August 23, 2026, these specific names were observed originating from a single HTTP client fingerprint, but across 824 distinct IP addresses.

The same client fingerprint had previously employed over 1,500 different user-agent strings in the 90 days prior to this observation, with the majority masquerading as standard web browsers. Almost all activity involving the six identified fake crawler names occurred within August 2026, peaking on August 23.

Researchers also noted that this malicious activity was distributed across 795 separate /24 network ranges. This wide distribution renders simple network-based blocking strategies impractical, as defenders cannot effectively mitigate the campaign by merely blocking a few IP ranges or a single hosting provider.

GreyNoise confirmed that none of the 824 source IP addresses matched the officially published IP ranges for legitimate crawlers from Anthropic, OpenAI, Google, Perplexity, or Amazon, indicating a clear disassociation from genuine AI services.

A crucial distinguishing factor was the request pattern exhibited by these malicious scanners. Legitimate search and AI crawlers typically initiate contact by requesting /robots.txt, a file that dictates which parts of a website automated clients are permitted to access.

In stark contrast, the six forged crawler identities never requested /robots.txt during the observed period. Instead, their activity focused exclusively on attempting to access exposed secret files and cloud credentials. Requested paths included /.env, /app/.env, /api/.env, /backend/.env, /.env.production, /.env.bak, and /.aws/credentials.

GreyNoise conducted a comparison between this suspicious activity and Anthropic’s legitimate ClaudeBot traffic during the same timeframe. The genuine ClaudeBot consistently requested /robots.txt more than any other path, accounting for 12 percent of its total traffic, and notably made no requests for credential files. This distinction is critical, as a legitimate AI crawler is designed to retrieve public web content for indexing or citation, not to seek out private environment files, cloud credentials, or private keys.

This campaign, while not definitively proving successful data exfiltration from specific victims, serves as a stark reminder of how easily threat actors can exploit trust in recognizable AI brands to mask credential-harvesting scans within what appears to be routine web traffic.

What You Should Do

• Validate Crawler Identity: Never rely solely on the user-agent string for crawler identification. Always verify the source IP address against the vendor’s officially published crawler ranges.
• Monitor Sensitive Paths: Implement robust monitoring and alerting for any requests targeting sensitive paths such as /.env, /.aws/credentials, and /.git/config. These files should never be publicly exposed.
• Secure Configuration Files: Ensure that .env files, .git directories, cloud credential files, and private keys are stored outside the public web root.
• Rotate Compromised Keys: If any cloud key or credential was accessible via a public URL, treat it as potentially compromised and rotate it immediately.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.