Threat actor impersonates AI bots from OpenAI and Anthropic to steal credentials

A threat actor impersonated approximately 32 artificial intelligence bots to scan enterprise web servers for private keys and credentials, CSO Online reported. Security researchers observed the single attacker cycling through fake identities associated with prominent artificial intelligence firms, including OpenAI, Anthropic, and Meta. [1]

The attacker probed organizations across multiple industries by targeting enterprise web servers, according to CSO Online. The malicious activity specifically targeted files used to store passwords, application programming interface keys, and cloud infrastructure credentials while completely ignoring standard web pages. [1]

CSO Online reported that the malicious scanner operated from an unnamed major cloud provider. OpenAI reached a valuation of approximately 852 billion dollars following a funding round in March 2026, and released its GPT-6 series models earlier in the autumn. [1][3]

The incident highlights growing security challenges as attackers exploit organizational trust in legitimate artificial intelligence crawlers and automated agents to bypass monitoring systems and harvest sensitive environment variables. [1]