There has been a recent and interesting uptick in a specific type of unusual spoofing attack. Attackers are impersonating AI agents, in order to go looking for AI credentials. It’s quite a niche angle, so why does it matter?
Part of keeping informed in the noisy AI space involves taking note when a key indicator changes, in this case tracking of a specific type of online activity. This week, our research took us to Known Agents, an AI agent and bot traffic analytics platform, who flagged an active spoofing campaign. Known Agents maintain a public Agentic Web Index which presents real-time metrics and patterns, with numbers coming from their analysis of traffic across more than 5,000 of their customers’ websites.
One of those metrics shows the percentage of impersonated website traffic for various AI agents over time (see their real-time dashboard here). A visit counts as ‘spoofed’ when it claims to be a recognised agent, but fails that agent’s own authentication check. What they’ve been seeing is a surge in impersonation starting on 3 August – ChatGPT-User impersonation increased tenfold over the course of just a week (from roughly 0.1 percent of normal traffic up to 1.4 percent by 10 August), while others such as PerplexityBot, OpenAI-Searchbot, or ClaudeBot also recorded a notable increase in spoofed traffic.
The spoofed agents are scanning websites for vulnerabilities, specifically targeting credentials and configuration paths that are typically used by AI coding tools. This includes a variety of local settings, as well as configuration or environment files belonging to Claude Code, Codex and Aider, which typically hold API keys and connection strings, cloud service account keys for providers like AWS, GCP and Firebase, and Terraform state files. These items can reveal the shape of an entire piece of infrastructure, and might for example have been left behind by developers.
To be clear about scale, this is not a Mythos-level event, and there’s no evidence yet of autonomous discovery or novel exploit generation involved, so what’s happening here sits well below the AI Vulnerability Storm level we described back in April. But the underlying logic is exactly what we discussed in our July webinar – attackers only need to get it right once, and they can now automate nearly all of it at AI speed, while defenders have to get it right everywhere, every time, at that same speed.
This spoofing campaign is a small, concrete example of what that looks like in practice. It’s just reconnaissance, probing for exposed configuration, hunting for the credentials that turn a scan into a breach, the same things attackers have always been doing, but running at a speed and scale that wasn’t available to them 18 months ago.
The practical takeaway for SaaS teams is unglamorous but important and always relevant. Check whether your environment files, service account keys, and tool configuration are definitely excluded from anything internet-facing, not just “gitignored” locally. Ensure that you rotate anything that might have been exposed. And treat “we haven’t seen anything yet” as a low bar, because the whole point of this kind of campaign is that you often don’t see it until someone else finds it first.
If you’re interested in how AI is progressively reshaping the security space, the recording from our July webinar is available on request.
