Fake bots are posing as ChatGPT, Claude and Perplexity to hunt for passwords and API keys

Automated scanners have started wearing the names of the best-known AI assistants on the web. They announce themselves as ChatGPT-User, Claude-User or Perplexity-User, the labels those assistants use when they read a page for someone, then ask for the files a careless web server leaves lying about: /.env, /service-account.json, /.git/config, /key.pem.

Security companies have been measuring it. GreyNoise traced six forged AI crawler names to 824 addresses hunting for credentials between 28 July and 23 August 2026, and DataDome counted 7.9 million requests faking ChatGPT-User in the first months of 2026. YFarmX’s own logs show the same pattern: on one sampled day, 25 September, about one in nine of the requests reaching the site under AI crawler names came from two scanning machines in Taiwan.

What are ChatGPT-User, Claude-User and Perplexity-User?

ChatGPT-User, Claude-User and Perplexity-User are the names AI assistants give when a person asks a question and the assistant goes to read a web page live to answer it. OpenAI’s crawler documentation says that “when users ask ChatGPT or a CustomGPT a question, it may visit a web page with a ChatGPT-User agent”. Anthropic’s help page says the same of Claude-User, and Mistral documents MistralAI-User for its Vibe assistant. They sit apart from the training crawlers, GPTBot and ClaudeBot, which collect pages in bulk.

Each company publishes the internet addresses its assistant fetches from, so a site can check a visitor’s claim. OpenAI and Perplexity also say their assistants may pass over robots.txt, the file where a site states which bots may read what, while Anthropic says all its bots follow it.

OpenAI’s reason is that “because these actions are initiated by a user, robots.txt rules may not apply”. Perplexity’s documentation puts it as “since a user requested the fetch, this fetcher generally ignores robots.txt rules”.

Why would a scanner pretend to be an AI assistant?

A scanner wears an assistant’s name because some sites wave that name through. Sites that want to be quoted in ChatGPT, Claude and Perplexity answers let these fetchers past rules that stop other automated traffic, and the name is the easiest thing to check. GreyNoise, a company that runs sensors across the internet to watch scanning, set out the weakness on 28 August 2026: “The user agent is a client-supplied header, so a control that checks the name but not the address can be bypassed by forging it.”

How widespread is it?

Three security companies have measured AI crawler impersonation, each from a different vantage point: GreyNoise runs sensors across the internet, while DataDome and HUMAN Security sell bot detection to websites. The biggest AI labs’ names turn up in all three.

GreyNoise found every one of its 824 addresses outside the ranges the four companies publish. Its fakes arrived in almost identical volume per name, the mark of a script cycling through a list.

One of those names gives itself away on sight. GreyNoise counted 263,849 sessions carrying Google-Extended as a user agent, and Google’s crawler documentation says Google-Extended “doesn’t have a separate HTTP request user agent string”. It is a word publishers write in robots.txt to opt out of AI training, so every request wearing it is somebody else.

HUMAN Security put the ChatGPT-User finding in one line: “OpenAI’s ChatGPT-User crawler stands out as the most heavily spoofed, with a striking spoof ratio of 1:5”.

How do you tell a fake from the real thing?

A fake fails on the address it comes from, and often on the name itself. In the fakes that reached YFarmX in September 2026, the ChatGPT-User string was a character-for-character copy of the one OpenAI documents, and the other three each carried a mistake a careful reader can spot.

The real Claude-User ending comes from the verified Claude-User requests in yfarmx.com’s own logs, because Anthropic’s help page names the bot without printing its string. The other three real endings are the companies’ own documentation.

The address check is the one a scanner cannot fake by typing. YFarmX checked every address that sent these names to the site more than a handful of times over the 30 days to 26 September against OpenAI’s, Anthropic’s, Perplexity’s and Mistral’s published lists, downloaded that day. Every one fell outside every list, and Google Cloud’s published ranges place the addresses behind about 98 per cent of those requests inside Google Cloud. Real assistants use Google Cloud too, since Anthropic’s own list includes Google Cloud addresses, so the exact address is what settles it.

Cloudflare’s verified bots programme runs the same test automatically. A bot qualifies when “it declares who it is deterministically, through a cryptographic Web Bot Auth signature, a published IP list with a stable user-agent, or reverse DNS”. It labels the genuine ChatGPT-User and Claude-User fetches AI Assistant, and a copy sent from anywhere else arrives unverified.

Some unverified requests are genuine. In YFarmX’s logs, a few unverified Claude-User requests carried a Claude Code version tag, came from ordinary home and office connections and fetched articles, the pattern of a developer’s own copy of Anthropic’s coding tool reading a page.

Perplexity-User needs the address list for a different reason. Cloudflare de-listed Perplexity as a verified bot on 4 August 2025, after accusing it of crawling with undeclared, browser-like user agents; Perplexity replied that Cloudflare had confused its traffic with a third-party browser service. Since then every Perplexity-User request arrives unverified, the real ones included. On 10 September Perplexity-User requests from an address inside Perplexity’s published list fetched a YFarmX article, and Cloudflare marked those unverified as well.

What it looks like on one website

YFarmX’s own Cloudflare logs show the pattern up close. Between 22 and 25 September 2026, four Google Cloud machines, two in Google’s us-west1 region in The Dalles, Oregon, and two in asia-east1 in Changhua County, Taiwan, according to Google Cloud’s region list, probed the site in eight bursts, each one fitting inside a single clock hour.

They wore more than 30 identities between them. About four requests in five carried the name of an AI crawler or assistant, and most of the rest posed as an Android phone running Chrome. Besides the four assistant names, they claimed to be crawlers from xAI, ByteDance, DuckDuckGo, Moonshot’s Kimi, OpenAI, Cohere, DeepSeek, Apple, Huawei, Brave, Tencent, Anthropic, Perplexity, Meta, You.com, 01.AI, Baidu, Alibaba’s Qwen, Zhipu, Amazon, Common Crawl and Google, Google-Extended included. Like the fakes GreyNoise measured, they skipped robots.txt, the file a real crawler reads first.

On one sampled day, 25 September, about 6,000 requests reached YFarmX under the names of AI crawlers and assistants, and roughly one in nine came from the two Taiwan machines. Over the 30 days to 26 September, about a third of all requests reaching the site under the four assistant names were fakes, arriving in bursts on half of those days, and about 98 per cent of the fakes came from Google Cloud addresses. Every request for a secret file failed.

What are the fake bots looking for?

The fake bots are looking for credentials: the passwords, keys and tokens that let someone into a company’s cloud account, database or AI subscription. GreyNoise lists environment files, cloud access keys, private encryption keys and password stores. The fakes that reached YFarmX asked for paths in a handful of families, and each one targets a mistake with a documented history.

The AI rows are the newer part of the list. Langflow’s bug was fixed in version 1.3.0, and the US vulnerability database describes it in one line: “A remote and unauthenticated attacker can send crafted HTTP requests to execute arbitrary code.” CISA added it to its catalogue of vulnerabilities exploited in the wild on 5 May 2025. Flowise’s CustomMCP bug, fixed in 3.0.6, is rated 10 out of 10. A scanner dressed as an AI assistant, hunting for the servers AI developers run, is going after the people most likely to have left one exposed.

Check where a request comes from

The lesson for anyone running a website is to let a published address list or a verified-bot check decide who counts as an AI assistant. Cloudflare’s verified flag does that work for ChatGPT-User and Claude-User; for Perplexity-User, since the August 2025 de-listing, the company’s own list is the check. The same goes for GPTBot, ClaudeBot, Googlebot and every other name a site might wave through.

The longer fix is a signature. Cloudflare already accepts Web Bot Auth, an IETF draft whose goal is “to allow automated HTTP clients to cryptographically sign outbound requests, allowing HTTP servers to verify their identity with confidence”. A signed request carries proof a scanner cannot copy out of a documentation page. Until the assistants sign, the address is the proof, and the name on a request is only a claim.