Attackers spoof ClaudeBot and other AI bots to scan for credentials

Key facts

• Known Agents' Agentic Web Index, which covers 5,000+ websites, posted an active-threat notice describing a widespread campaign that impersonates AI bot identities to scan sites for vulnerabilities, targeting credential and configuration paths used by AI coding tools.
• A visit counts as spoofed when it claims a recognized bot identity but fails that identity's supported authentication check, such as verified IP or Web Bot Auth; the check flags likely impersonation without identifying who actually sent the request.
• In the current Top Spoofed Agent Identities ranking, Googlebot leads at 0.5% of spoofed traffic; ChatGPT-User, OAI-SearchBot, GPTBot, PerplexityBot and ClaudeBot are tied for second at 0.1% each.
• The 'Recent Top Targeted Paths' examples include Claude/Anthropic config files, Codex, Continue and Aider configs, cloud credential and service-account files, and a range of .env files.
• The notice does not name the attacker, give a start date, or identify any affected website; Known Agents does not disclose how many requests hit each targeted path.

Why it matters

Many sites give AI bots and search crawlers a degree of trust that ordinary traffic does not get: they are allow-listed, rate-limited more gently, or excluded from bot-blocking rules. A campaign that impersonates those identities specifically to run vulnerability scans is trying to exploit exactly that trust gap. That the targeted paths line up with AI coding tool configs and cloud credentials suggests the attacker is hunting for exposed secrets left behind by developers using tools like Claude Code, Codex, Continue or Aider, not for generic web vulnerabilities.

Who it affects

Website and API operators who allow-list or otherwise treat traffic claiming to be Googlebot, ClaudeBot, GPTBot, ChatGPT-User, OAI-SearchBot or PerplexityBot as trustworthy by default. It also affects developers and teams who run AI coding tools and cloud services and may have left credential or configuration files reachable at predictable paths, since those are the specific targets the notice lists.

How to use it

Known Agents' own description of its check is the practical takeaway: verify a claimed bot identity against that identity's supported authentication method, such as a verified source IP range or Web Bot Auth, rather than trusting the User-Agent string alone. Separately, treat the listed path patterns, credential and config files for AI coding tools, cloud provider keys, service-account JSON files, and .env variants, as things to confirm are not reachable from the public internet on your own infrastructure.

How solid is it

The claim comes from one vendor's own monitoring of its customer base, not an independent security audit, and Known Agents does not name the attacker, state when the campaign began, say how long it has been running, or name a single affected site. The spoofing percentages and the targeted-path list are presented as live dashboard output rather than a research report, so they can be expected to change as the campaign, if it continues, evolves.

Risks and caveats

By Known Agents' own methodology, agents that have no supported authentication method are excluded from the spoofing measurements entirely, so the true scale of impersonation across all bot identities is not captured here. A failed authentication check indicates likely impersonation of the named identity, not proof of who actually made the request. ClaudeBot itself is not implicated in running the scans: it appears only as one of several impersonated identities, and its 0.1% spoofed-traffic share sits well below Googlebot's 0.5%, the current top entry.

“We are observing a widespread campaign impersonating AI bots to scan websites for vulnerabilities. The attacker appears to be targeting credential and configuration paths used by AI coding tools.”

— Known Agents, "Active Threat: AI Bot Spoofing Campaign" notice