Attackers Spoof ChatGPT and Claude Bots to Hunt Exposed Credentials
TechNadu · x · 2026-11-06
William Glazier of Cequence Security details an emerging attack: cybercriminals impersonate legitimate AI crawlers like ChatGPT and Claude to scan for exposed .env files, API keys, and cloud credentials.
- One scanner rotated through 32 bot identities and hundreds of cloud IPs to evade detection
- Traditional controls fail: User-Agent headers are trivially spoofed, IP rotation defeats rate limits, and standard WAFs treat paths like /.env as benign
- Recommended mitigations: combine IP verification and cryptographic signatures with behavior-based tracking of identity-switching patterns, plus web-root hygiene, honeytokens, and securing forgotten secondary domains
More from Safety
- Reddit criticizes AI-danger debate: "AI can't create hardware" dodges Yampolskiy's point — MustBeSomethingThere · 2026-11-06
- AI regulation went from voluntary principles to binding law in under a decade: a global atlas — CurieuxExplorer · 2026-11-06
- Hidden website messages can hijack AI agents: Palo Alto Networks catalogs 22 tricks — Shufti-Global · 2026-11-06
- 155 live leaked API keys found via public search, worth $500-900 — dbasch · 2026-11-06
- moyix releases slides from Offensive Con Tokyo talk: Fuzzing vs. AI — moyix · 2026-11-06
- Anthropic RSP and OpenAI Preparedness replaced by commitmentless docs, experts warn — lxrjl · 2026-11-06