Category: Security | Reading time: 2 min
Cequence Security's CQ Prime research team has found a scanner that impersonates 32 well-known AI crawlers and assistants, including bots from OpenAI, Anthropic, Perplexity and Meta, while requesting files that typically hold passwords, API keys and cloud credentials. Dark Reading reported the findings on October 28.
What the researchers found
The activity has been running since late September and was still active in late October; Cequence identified it on October 21. Targets spanned retail, financial services, telecom, energy and software. On one day in October, 48% of the organizations Cequence protects received the scanner's requests. Cequence says most requests were blocked and it found no successful compromise.
Why the disguise works
The scanner relied on borrowing names that sites recognize. Cequence's advice is to verify agents through signed requests, published IP ranges or direct integrations, and to flag any traffic whose behavior doesn't match the identity it claims. An AI crawler asking for credential files is a clear mismatch.
The broader pattern
As more traffic comes from AI agents, the name an agent presents is not evidence of who it is or what it is allowed to do. For companies deploying their own agents, the same logic applies in reverse: auditors and partners will increasingly expect agent actions to carry verifiable identity, not just a label.
Source: Dark Reading