If your web server lets AI crawlers through, it is probably deciding who they are by reading a line of text they wrote about themselves. GreyNoise has spent the last month watching what happens when somebody lies in that line.
Between 28 July and 23 August 2026 the company observed scanners announcing themselves as the crawlers of Anthropic, OpenAI, Google and Perplexity, and asking not for pages but for the files where misconfigured servers leak their own credentials: environment files, cloud access keys, private keys and password stores. Thirteen forged crawler names from eight companies turned up in the activity, two of them Amazon's, and six arrived from an identical set of 824 addresses in almost identical volume.
A name is not an identity
Every request carries a user agent string, one line saying what the software is. Chrome says it is Chrome. Anthropic's crawler says it is ClaudeBot. Nothing in the request proves any of it. AI companies publish their crawler names so site owners can allow them, and publish the addresses those crawlers use so site owners can verify them. A rule that checks only the name gets walked straight past.
The forged ClaudeBot string here matches Anthropic's character for character, so no filter keyed on the string can separate the two. One of the six names never had a real version to copy: Google-Extended is a token publishers write into robots.txt to opt out of AI training, and Google's own documentation states it "doesn't have a separate HTTP request user agent string." All 263,849 sessions carrying it were forged by definition.
The tell is what they never asked for
Real crawlers read /robots.txt first, because that is where a site states its rules. Under the six forged names, GreyNoise says that file was never requested once. Anthropic's genuine crawler, measured the same way over the same window, did the opposite: robots.txt was the single path it requested most, 12% of its traffic, and it never once asked for a credential file.
What the impostors asked for instead was /.env, /app/.env, /.env.local, /.env.production, /.aws/credentials and their neighbours, the paths where database passwords, API tokens and cloud keys sit when somebody leaves them inside the web root. Across the wider traffic on the same HTTP client fingerprint, requests of that kind ran into the millions. GreyNoise then checked all 824 addresses against the published crawler ranges of Anthropic, OpenAI, Google, Perplexity and Amazon. Not one matched.
The company is careful about what that does and does not show: it sees requests arriving, not files being returned, and it is not naming who is behind the activity. Hunting for leaked secrets is the same opening move behind the theft of AI proxy keys out of process memory, and it sits alongside a broader run of automated campaigns wearing AI branding.
Check the address, not the string
Blocking networks will not help. The 824 addresses sit in 795 separate slash 24 networks, so there is nothing single to drop. The check that does work is the one the vendors already published for you.
- Find every place a user agent string grants access or waives a control, and verify the connecting address against the published list for the name it claims. Each name has its own list, and OpenAI publishes separate ones for GPTBot, ChatGPT-User and OAI-SearchBot.
- Alert on any request for /.env, /.aws/credentials or /.git/config. No crawler has a reason to ask for these.
- Treat a crawler that never fetches robots.txt as suspect, judged across days rather than one visit, since real crawlers cache that file.
- Keep environment, git and cloud credential files out of the web root, and rotate any key ever reachable from a web path. Assume anything readable was read.
- Give each vendor address list an owner and a refetch schedule. A stale list turns the real crawler into an alert.
GreyNoise's write-up, itself a summary of a longer post on the GreyNoise Labs blog, names one real range as an example of what a verified crawler looks like, 216[.]73[.]216[.]0/22 for Anthropic's crawler, and warns against importing it as an indicator. That is the lesson in miniature. The same string arrives from both sides, and only the address tells them apart.
The AI crawler boom handed every site on the internet a new category of trusted visitor, defined by a string anyone can type. Attackers noticed before defenders did.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.