Scanner Impersonating 32 AI Bots Probed for Exposed Credentials
Summary
CQ Prime Research says a scanner impersonating 32 AI bots probed organizations for credential and configuration files from late September into late October. Nearly all requests were blocked or failed, and the researchers reported no successful credential theft.
Key points
- CQ Prime Research identified a scanner impersonating 32 AI bots, including identities associated with OpenAI, Anthropic, Perplexity, and Meta.
- The scanner requested configuration files, cloud credential files, and private SSH keys across organizations in several industries.
- It sent bursts of 50–190 requests in about eight seconds, including random paths, and rotated among bot identities.
- On one day in October, 48% of Cequence-protected organizations received the malicious bot traffic.
- Nearly all requests were blocked or failed; the article reports no successful credential theft.
- Researchers recommend verifying agent identities, monitoring for behavior inconsistent with those identities, and avoiding static credentials in exposed files.
Article Details
- Event Type
- Malicious credential-scanning activity impersonating AI bots
- Impact
- CQ Prime Research reported that a scanner impersonated 32 AI bots while probing organizations for exposed passwords, API keys, cloud credentials, and private SSH keys. Nearly all requests were blocked or failed, and the researchers reported no successful credential theft or breach. The activity affected organizations across retail, financial services, telecommunications, energy, and software.
People
Collin Hogue-SpearsSenior director of solutions management at Black Duck; characterized the documented activity as testing rather than a breach.Shane BarneyChief information security officer at Keeper Security; discussed risks from AI-agent impersonation and recommended security measures.Will GlazierDirector of CQ Prime threat research and data science; described the scanner's activity and findings in the report.
Vendors
Black Duck"The requests gave it away," observes Collin Hogue-Spears, senior director of solutions management at security firm Black Duck, which means "what Cequence documented is the test, not a breach."Cequence Securityto various organizations, according to a report published today by CQ Prime Research, part of Cequence Security. The scanner requested files from affected organizations — which spanned retail, financial services,Keeper Securityto the activity of threat actors, observes Shane Barney, chief information security officer at Keeper Security.
Industries
Energyfiles from affected organizations — which spanned retail, financial services, telecommunications, energy, and software — that hold passwords, API keys, and cloud credentials.Financial ServicesCequence Security. The scanner requested files from affected organizations — which spanned retail, financial services, telecommunications, energy, and software — that hold passwords, API keys, and cloud credentials.Retailpart of Cequence Security. The scanner requested files from affected organizations — which spanned retail, financial services, telecommunications, energy, and software — that hold passwords, API keys, and cloudSoftwarefrom affected organizations — which spanned retail, financial services, telecommunications, energy, and software — that hold passwords, API keys, and cloud credentials.TelecommunicationsThe scanner requested files from affected organizations — which spanned retail, financial services, telecommunications, energy, and software — that hold passwords, API keys, and cloud credentials.