Hackers Impersonate AI Bots to Steal Passwords and API Keys

What Happened

Security researchers have uncovered a troubling trend: malicious actors are routinely faking the identities of leading AI search crawlers, including bots operated by OpenAI (ChatGPT), Anthropic (Claude), and Perplexity AI. By spoofing the User-Agent strings and request headers associated with these trusted services, attackers can inspect business websites without tripping routine alarms.

Their focus centers on high-value targets: misconfigured web directories, exposed environment variables (.env files), database credentials, internal passwords, and proprietary API keys. Because many site managers intentionally loosen firewall restrictions to help generative search engines index their content, attackers are exploiting that very goodwill as an open backdoor.

Key Details of the Spoofing Campaign

Unlike traditional brute-force intrusions that trigger immediate web application firewall (WAF) alerts, this campaign relies on webmasters' eagerness to be indexed by generative AI:

• User-Agent Spoofing: Attackers set automated scrapers to mirror legitimate bot signatures, including GPTBot, PerplexityBot, and ClaudeBot.
• Probing High-Value Directories: Rather than browsing standard pages, these impostors target sensitive paths like /.git/, /.env, /wp-config.php, /config.json, and loose backup files where API tokens or hardcoded database passwords often hide.
• Exploiting Lax Firewall Rules: Web teams frequently exempt AI bots from strict rate limits and security controls so platforms like ChatGPT Search and Perplexity can surface their content. Threat actors lean directly into this loophole.
• Harvesting Cloud & AI API Keys: Uncovering live credentials—such as OpenAI, Anthropic, or AWS keys—lets intruders drain paid compute resources, access confidential internal records, or trigger unauthorized transactions.

What It Means For Your Business

For businesses competing for citations in conversational engines, welcoming genuine web crawlers has become standard operating procedure. Yet treating User-Agent headers as proof of identity introduces severe risk.

Here is what that vulnerability looks like in practice:

• Risk of Account Takeover and Financial Loss: Compromised API keys can rack up thousands of dollars in cloud infrastructure charges within hours, all while exposing protected customer databases behind your application.
• SEO and AI Citation Penalties: A hijacked server serving malicious payloads risks getting blacklisted by Google and promptly purged from the exact AI answer engines you are trying to reach.
• Accidental Firewall Misconfigurations: Panicked site owners often respond by blocking AI traffic entirely—an overcorrection that cuts off their brand from emerging search channels like ChatGPT, Gemini, and Perplexity.

How to Protect Your Site Without Losing AI Search Traffic

Securing your digital perimeter does not require locking out generative search engines. Take these practical safeguards:

• Verify Bot Authenticity via Reverse DNS and IP Verification: Major platforms, including OpenAI, Anthropic, and Google, publish verified IP address ranges and support reverse DNS checks. Instruct your technical team or CDN provider (such as Cloudflare or AWS CloudFront) to confirm origins at the network level instead of trusting User-Agent headers alone.
• Audit Sensitive Web Directories: Confirm that your public root folder never exposes configuration files, git directories, or server diagnostics. Lock down internal endpoints with explicit 403 Forbidden responses.
• Rotate and Scope API Keys: Keep sensitive keys out of client-facing code. Store credentials in dedicated secret managers and apply least-privilege permission models to ensure a single exposed token cannot unravel your wider infrastructure.
• Monitor Web Logs for Anomalous AI Bot Behavior: True AI crawlers request public landing pages, blog posts, and catalog listings. When an alleged bot starts requesting administrative panels, login screens, or .env paths, you are dealing with an intruder.