Loading story…
GreyNoise identified an automated scanning campaign that spoofed user-agent strings associated with AI crawlers from OpenAI, Anthropic, Google, Perplexity, DeepSeek, and Amazon to probe internet-facing systems for exposed credentials and secrets. Between July 28 and August 23, the activity originated from 824 IP addresses across 795 separate /24 networks; the infrastructure shared one HTTP client fingerprint linked to more than 1,500 user-agent strings over the preceding 90 days.
The scanners sought sensitive web-accessible files including /.env, /.aws/credentials, private keys, password stores, and Git configuration files, while the forged identities did not request /robots.txt. None of the observed source addresses matched published crawler IP ranges for the impersonated providers. GreyNoise could not determine whether any requested files were retrieved, whether victims were compromised, or who operated the campaign; organizations should validate crawler traffic against provider-published IP ranges rather than trusting user-agent strings and ensure sensitive files are not exposed through web servers.
Map this exposure pattern across your cloud, code, and identities.
2 events from the most recent confirmed update back to the earliest known activity.
Almost all traffic using the six forged AI-crawler identities occurred in August, with the largest single-day volume observed on August 23. The spoofed traffic did not request /robots.txt, unlike legitimate Anthropic crawler traffic observed during the same period.
Between July 28 and August 23, automated scanners used forged AI-crawler user-agent identities to request exposed environment files, cloud credentials, private keys, password stores, and Git configuration files. GreyNoise observed six forged crawler names from 824 IP addresses across 795 /24 networks; none matched published crawler IP ranges, and the activity was not attributed.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourcegreynoise.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Internet-wide reconnaissance is actively probing exposed AI infrastructure, with analysts observing systematic scans for **Model Context Protocol (MCP)** servers, AI assistant credential files, and unauthenticated model-serving endpoints. Over a two-week period, Apache and ModSecurity logs from a small web host recorded roughly 200 AI-related requests, including valid JSON-RPC 2.0 `initialize` handshakes sent to MCP services from 49 source IP addresses. The activity also searched for configuration and credential artifacts tied to tools such as **Claude** and **Cursor**, alongside checks for OpenAI-compatible `/v1/models` and Ollama `/api/tags` endpoints. The probing went beyond simple path enumeration and showed attackers understand the targeted protocols and deployment patterns, suggesting opportunistic discovery of vulnerable AI environments at scale. The same activity included SSRF-style requests aimed at cloud metadata services and Kubernetes token locations, raising the risk that exposed agent tooling, MCP servers, or URL-fetching features could be abused to steal secrets, obtain cloud credentials, or pivot deeper into internal environments. Defenders were urged to review logs for MCP-related traffic, limit public exposure of AI services, secure assistant configuration files, harden fetch capabilities, and enforce metadata protections such as **AWS IMDSv2** and required GCP metadata headers.
Jul 13, 2026
Security telemetry indicates **coordinated, large-scale probing of exposed LLM endpoints** consistent with pre-exploitation reconnaissance. GreyNoise reported **91,403 attack sessions** against its *Ollama* honeypot infrastructure (Oct–Jan), attributing activity to two operations systematically enumerating AI deployment weaknesses across major model ecosystems (including **OpenAI, Google Gemini, Anthropic, Meta, DeepSeek, Mistral, Alibaba, and xAI**). One operation used two IPs to methodically test API formats and identify live endpoints over an 11‑day period, relying on low-noise prompts (e.g., “hi” and simple factual questions) to reduce detection; GreyNoise noted the IPs’ prior association with exploitation of known vulnerabilities, suggesting reconnaissance feeding a broader exploitation pipeline. In parallel, Check Point described an active **GoBruteforcer (GoBrut) botnet** wave targeting cryptocurrency and blockchain project databases by brute-forcing services such as **FTP, MySQL, PostgreSQL, and phpMyAdmin** on Linux, with campaigns amplified by **reused AI-generated deployment examples** that propagate common usernames and weak defaults, plus exposure from legacy stacks like *XAMPP*. The Register’s coverage of the WEF Global Cybersecurity Outlook 2026 aligns with these observations at a strategic level, reporting that leaders increasingly prioritize **AI security risk assessment** and cite **data leakage** and adversary capability gains as top concerns; however, broader policy and CIO “challenges” commentary does not materially add to the specific reconnaissance/botnet activity described in the threat reporting.
Jun 29, 2026
Threat activity observed in late 2025 and early 2026 shows **high-volume, automated probing** of emerging and legacy internet-facing attack surfaces, including exposed large language model (LLM) endpoints. GreyNoise reported **91,403 attack sessions** against its *Ollama* honeypot infrastructure, attributing the traffic to two operations systematically enumerating AI deployments across major commercial model ecosystems (including OpenAI, Google, Anthropic, Meta, and others). One operation used two IP addresses to methodically test API formats and identify live endpoints across dozens of LLM targets while relying on innocuous prompts (for example, simple greetings and basic trivia questions) to reduce the likelihood of detection; GreyNoise noted the source IPs had prior associations with exploitation of known vulnerabilities, suggesting reconnaissance intended to feed follow-on exploitation. In parallel, Check Point Research detailed an updated, modular **GoBruteforcer** botnet variant that compromises Linux servers by **brute-forcing weak credentials** across common services (including FTP, MySQL, PostgreSQL, and *phpMyAdmin*), then reuses newly compromised hosts to expand scanning and password-guessing at scale. Check Point assessed that **50,000+ internet-facing servers** may be exposed to this activity, citing two drivers: widespread reuse of **AI-generated deployment/configuration examples** that propagate predictable usernames and weak defaults, and continued exposure of legacy stacks (such as *XAMPP*) with insufficient hardening. The newer GoBruteforcer variant reportedly adds more sophisticated capabilities and obfuscation, and the operators appear financially motivated, with activity linked to data theft, selling initial access, and cryptocurrency theft.
Jun 29, 2026