Fake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud Credentials

Gbhackers •Divya • September 1, 2026

Threat actors are impersonating AI web crawlers from organizations such as OpenAI, Anthropic, DeepSeek, Google, Perplexity, and Amazon to scan internet-facing servers for exposed secrets, according to a GreyNoise research report published on August 28, 2026. This activity involves automated scanners that use forged crawler user-agent strings to request sensitive files, including .env configurations, AWS […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Impersonation of AI Crawlers Targets Sensitive Cloud Credentials Threat actors are impersonating web crawlers from organizations like OpenAI, Anthropic, and DeepSeek to scan for exposed secrets on internet-facing servers. This activity, reported by GreyNoise on August 28, 2026, involves automated scanners using forged user-agent strings to request sensitive files, including .env configurations and cloud credentials. The attackers are targeting misconfigured servers that may leak API tokens, passwords, and private keys. GreyNoise identified a broader cluster utilizing 13 AI crawler identities from eight companies. The ongoing campaign poses a significant risk to organizations with improperly secured cloud environments. Current status indicates active scanning and credential theft attempts are in progress. Organizations are urged to review their security configurations to mitigate risks. 2 sources 65

Fake OpenAI, Anthropic and DeepSeek Crawlers Target .env Files and Cloud Credentials

The full story

Extracted Entities

Companies (1)

CWE Weaknesses (1)