Plenty of organisations now write rules that let AI crawlers in. An attacker only has to read the same rule and use the same name.

On 28 October, CQ Prime Research at Cequence Security published its tracking of a single actor that posed as about 32 different AI bots, including crawlers and assistants from OpenAI, Anthropic, Meta and Perplexity. It ignored web pages. It asked for files that commonly hold secrets: .env configuration files, cloud credential files, private SSH keys and server environment data, from a list of roughly 90 paths. Each address fired a burst of 50 to 190 requests in about eight seconds and moved on, around the clock, from at least late September through late October. On one day in October it reached 48% of the Cequence-protected organisations that saw any AI bot traffic, across financial services, retail, telecommunications, energy and software. Nearly all of its requests were blocked or failed, and Dark Reading’s coverage describes the scanning as unsuccessful. What gave it away was behaviour, not the name: it cycled evenly through every identity, one machine claimed to be four different AI companies within seconds, and every fake Claude identity carried the contact address of Anthropic’s real crawler. As Hackread reports, it also used more than 300 cloud addresses in one day and nearly 400 in a week, and none of the late-September addresses came back a month later.

The lesson is not that AI crawlers are dangerous. It is that we have started granting access based on a string the visitor writes about itself. A user-agent header costs nothing to set. If your WAF, CDN or bot policy allow-lists “GPTBot” or “ClaudeBot” so your content shows up in AI search, you have handed attackers a free costume. The same research found that at several organisations the impersonator made up more than 80% of the traffic labelled as AI bot traffic, so any dashboard built on self-reported identity is overstating real agent use. Cequence frames this against banks deciding which AI agents to let into customer accounts. APAC banks and digital platforms face the same decision, and a policy keyed to a name will be tested by whoever borrows the name first.

What security leaders should do:

• Stop allow-listing AI bots by user-agent alone. Verify them against the operator’s published IP ranges (OpenAI publishes its crawler ranges, for example) or signed requests such as HTTP Message Signatures (RFC 9421).
• Alert on identity-behaviour mismatches: any “AI assistant” requesting .env, credential or key files is not an assistant.
• Remove secrets from anything web-reachable, and check that staging and admin sites aren’t exposed to the internet.
• Don’t rely on IP blocklists for this; the addresses rotated faster than feeds caught up.
• Re-baseline any AI-traffic metrics your board sees once impersonators are filtered out.

A name is a claim. Access should go to whoever can prove it, not whoever can type it.

Disclaimer: This post was researched and written by AI agents working with Philip Sow. Every source is linked so you can check the facts. Views are personal and do not represent any employer.

#AISecurity #AgenticAI #APISecurity #APAC #CyberSecurity

Sources: Cequence CQ Prime Research · Dark Reading · Hackread · OpenAI crawler documentation · IETF RFC 9421