GreyNoise: Attackers forge AI crawler names

Threat actors are forging the user agent names of AI company crawlers to disguise automated scans for exposed credentials and configuration files on websites. GreyNoise researchers observed this activity between July 28 and August 23, 2026, originating from 824 IP addresses that do not belong to the legitimate AI companies.

"Every program that visits a website announces itself in one line of the request," the researchers explained. "Nothing in the request itself proves any of it is true."

How the Impersonation Works

AI companies publish the names of their official web crawlers so website owners can allow them to access their sites. They also publish lists of their official IP address ranges for verification. The user agent string, however, is a client-supplied header. This means a security control that checks only the crawler name, and not the originating IP address, can be bypassed by an attacker simply forging that name in the request.

GreyNoise found that six crawler names belonging to four different AI companies were all arriving from a single, consistent HTTP client fingerprint. This same fingerprint had used over 1,500 different user agent strings in the prior 90 days, with most pretending to be ordinary web browsers. The traffic from the 824 suspect IP addresses showed another telltale sign: none of it requested the /robots.txt file, which legitimate crawlers use to check a site's access rules.

Scanning for Exposed Secrets

The scanners were specifically hunting for sensitive files that developers sometimes mistakenly leave exposed on public web servers. The targeted paths included configuration files, cloud access keys, private cryptographic keys, and password stores.

GreyNoise contrasted this behavior with that of a legitimate crawler. When measuring Anthropic's ClaudeBot traffic during the same period, researchers found that /robots.txt was its most-requested path, accounting for 12 percent of its traffic. The legitimate crawler did not request any credential files.

Evading Detection and Blocking

The impersonation campaign is designed to evade common detection methods. Network-based blocking is also highly challenging. The 824 source IP addresses are spread across 795 separate /24 networks, making simple IP range denylists impractical. GreyNoise verified that none of the addresses matched the published IP ranges for Anthropic, OpenAI, Google, Perplexity, or Amazon. During the observation window, thousands of legitimate sessions carrying the ClaudeBot name did arrive from addresses within Anthropic's published range.

The researchers also discovered forged versions of two Amazon crawler names. These were sent in even greater volume than the six matched AI crawler names and used user agent strings that Amazon does not document as its own.

GreyNoise stated it cannot confirm whether any of the scanning requests successfully retrieved a file or whether any organization was compromised. The security firm is not naming who it believes is behind the activity. To assist defenders, GreyNoise has published the full list of 824 IP addresses, the credential paths targeted by the scanners, and the vendor address lists it used for comparison, enabling site owners to check their own server logs against the stats of this campaign. For more technical details, you can review the fixtures of observed traffic patterns.