Researchers at Cequence have documented one operator borrowing names from OpenAI, Anthropic, Meta and Perplexity to hunt secrets on corporate servers. The scanner cycled through about 32 fake agent identities and ran out of an unnamed major cloud provider.
Its victims sat in finance, retail, telecom, energy and software. Cequence watched the campaign from late September to late October 2026 and reports no breach. On a single October day, the operator hit 48% of every Cequence-protected organization logging any AI bot traffic. Almost nothing got through; requests were blocked or simply failed.
Pages were never the goal. The scanner chased where keys and passwords get stashed, running down some 90 paths — .env files, cloud credentials, private SSH keys and server environment data. It fired 50 to 190 in about eight seconds, then moved on. It wore four vendor names at once and burned over 300 cloud addresses in a day, leaving blocklists built on fixed IPs badly exposed.
Will Glazier, who directs threat research at Cequence, argues trust must be earned, not taken from a label. Collin Hogue-Spears, senior director of solution management at Black Duck, reviewed the work and agreed: a visitor types its own name into the user-agent field at zero cost, so that name proves nothing.
Cequence says confirm crawlers through published address ranges, signed requests or direct integrations. Treat requests for credential files as a signal, keep secrets out of directories the web can serve and score automated traffic on behavior.
Keeper Security chief information security officer Shane Barney wants zero-trust rules and least privilege applied to AI agents, API keys and service accounts, with expiring local credentials swapped for centrally managed secrets; any session hunting files it has no business touching should be cut once detection sees it.
