Attacker posed as 32 AI bots to hunt for enterprise secrets

Cequence observed a single threat actor impersonating bots from OpenAI, Anthropic, Meta and Perplexity between late September and late October 2026 while probing enterprise web servers. The scanner cycled through roughly 90 paths to .env files, SSH keys and cloud credentials, firing bursts of 50–190 requests in about eight seconds.

• Attacker cycled through about 32 fake AI bot identities
• Scanner targeted roughly 90 secret-bearing file paths
• More than 300 cloud addresses used in a single day
• Nearly all requests were blocked or failed