Attackers Masquerade as OpenAI, Anthropic and Meta Crawlers While Probing for Credentials

Key points

• Unattributed actor is spoofing crawler identities tied to three major AI vendors
• Traffic volume is high and continuous rather than a single burst
• Objective appears to be discovery of leaked credentials and open data stores
• No software vulnerability is involved, so patching alone will not stop it
• Log review and user-agent validation are the practical defenses

A still-unattributed group is generating a steady stream of automated requests while presenting itself as the crawlers operated by OpenAI, Anthropic and Meta. The disguise matters: many site owners have deliberately opened their doors to AI indexing agents, and an operator who borrows that identity inherits the same welcome. Behind the borrowed label, the traffic is not indexing anything — it is hunting.

The activity is best described as persistent reconnaissance. Rather than a single noisy spike, the requests arrive continuously, sweeping for credentials left in configuration files, environment dumps, exposed repositories and other places secrets tend to accumulate. The same probing also surfaces data that was never meant to be publicly reachable. Because the requests look like ordinary crawler visits, they blend into the background noise most organizations already tolerate.

Anyone hosting public-facing services is in scope, which for a school district means web portals, staff-facing applications, vendor-hosted platforms and any cloud storage that has been shared too broadly. The absence of a CVE is the important detail here: nothing is being exploited in the classic sense. The actor is simply looking for doors that were left unlocked, which means patch cycles and vulnerability scanners will not register the problem.

The practical response is visibility. Audit who is actually arriving under these user-agent strings, since legitimate AI crawlers publish their address ranges and can be verified against them. Treat any request claiming to be an AI bot from an unlisted source as suspect. Watch for patterns that no real indexer would produce: requests for .env files, backup archives, credential stores or administrative paths.

What to watch next: whether the spoofed identities rotate to other well-known crawlers, whether request volume escalates, and whether any of the probing is followed by authenticated access. A confirmed hit on a live secret would move this from background noise to an active incident.

What to do now

1. Verify AI crawler traffic against the published IP ranges from OpenAI, Anthropic and Meta; block or challenge requests using those user-agent strings from unlisted addresses.
2. Search web and proxy logs for requests to sensitive paths such as .env, config, backup and admin URLs, and alert on them going forward.
3. Rotate any credential that may have been reachable from a public-facing directory, and confirm secrets are not stored in web-served locations.
4. Audit cloud storage and file shares for public or over-broad permissions, and remove anonymous access where it is not required.
5. Add rate limiting and bot mitigation at the edge for unauthenticated clients, regardless of the user-agent they claim.
6. Brief web and platform owners that spoofed crawler traffic is circulating so they do not whitelist these identities by name alone.

Original source

Dark Reading