Reported by 2 outlets

Timeline

1. original reporting

   Fake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud Credentials

   gbhackers.com · 42d ago · September 1st, 2026

   Threat actors are impersonating AI web crawlers from organizations such as OpenAI, Anthropic, DeepSeek, Google, Perplexity, and Amazon to scan internet-facing servers for exposed secrets, according to a GreyNoise research report published on August 28, 2026. This activity involves automated scanners that use forged crawler user-agent strings to request sensitive files, including .env configurations, AWS […] The post Fake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud Credentials appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

2. update from cyberpress.org

   Fake OpenAI and Anthropic Crawlers Scan Websites for Cloud Keys and Passwords

   cyberpress.org · 42d ago · September 1st, 2026

   Threat actors are impersonating web crawlers associated with OpenAI, Anthropic, DeepSeek, Google, Amazon, and other major brands to probe websites for exposed credentials, cloud keys, and private configuration files. GreyNoise researchers observed the automated scanning activity between late July and late August 2026. The campaign used forged crawler user-agent strings while requesting sensitive paths commonly exposed by web-server misconfigurations , including .env files, cloud credential stores, private keys, and password databases. Fake OpenAI and Anthropic Crawlers Scan Websites The activity exposes a critical weakness in how websites identify automated bots. Every HTTP client can submit a user-agent header claiming to be Chrome, Googlebot, ClaudeBot, or another recognized crawler. The string itself is not proof that the request originates from the organization named in the header. AI companies publish crawler names and, in many cases, the IP address ranges used by their legitimate infrastructure. A website that trusts only a user-agent string can therefore be deceived when an attacker presents an identical header from an unrelated IP address. GreyNoise identified a cluster impersonating 13 AI-crawler identities across eight companies. Sessions per user agent string on one HTTP client fingerprint (Source: GreyNoise) Six of the forged names, associated with Anthropic, OpenAI, Google, and Perplexity, appeared at nearly identical volumes across 824 IP addresses. Those addres