Fake bots are posing as ChatGPT, Claude and Perplexity to hunt for passwords

What happened

Scanners hunting for leaked credentials are sending their requests under the user-agent names of AI assistants and crawlers. GreyNoise traced six forged AI crawler names, belonging to four companies, to 824 addresses between 28 July and 23 August 2026, requesting .env files, cloud access keys, private keys and password stores, and every one of the 824 sits outside the address ranges those companies publish. DataDome's AI traffic report of 16 March 2026 counted 7.9 million spoofed ChatGPT-User requests, second only to Meta-externalagent at 16.4 million.

A user-agent string is text the client writes itself, so the name proves nothing. All four companies in GreyNoise's report publish the address ranges their crawlers use, and checking the connecting address against that list separates a real fetcher from a copy. GreyNoise published its findings on 28 August 2026 and notes the 824 addresses spread across 795 separate /24 networks, which leaves no single network to block.