Attackers are already disguising themselves as AI agents to steal credentials. Cequence has tracked a single actor running AI agent impersonation at scale: it posed as about 32 different AI bots, including ChatGPT, Claude, and Perplexity, while searching for passwords, API keys, and cloud credentials. On one day in October, the actor reached 48% of the Cequence-protected organizations that saw any AI bot traffic.
Banks are now deciding which AI agents to let into customer accounts, following reports that unvetted agents are already accessing U.S. bank accounts. Attackers can test every one of those allow and deny decisions, and Cequence is seeing them probe which agents a business trusts, then impersonate the agents they expect to get through. For anyone responsible for application and API security, a bot’s self-reported identity no longer proves anything.
What AI Agent Impersonation Looks Like in the Wild
The malicious scanner runs from a major cloud provider and rotates through about 32 AI bot identities, spanning crawlers and assistants from OpenAI, Anthropic, Meta, Perplexity, and others. It ignores web pages and requests files that commonly store secrets, including .env configuration files, cloud credential files, private SSH keys, and server environment data, working from a list of roughly 90 file paths.
Each address sends a short burst of 50 to 190 requests in about eight seconds and then moves on. The scanner works through targets one at a time, around the clock, and first sends random nonsense paths to find websites that answer every request, a common scanning technique. It hit organizations in financial services, retail, telecommunications, energy, and software, and stayed active from at least late September through late October.
How Cequence Spotted the Fake AI Bots
Real AI bots behave predictably, and the fake AI bots in this campaign broke almost every pattern.
- The scanner cycled evenly through all 32 identities, something no legitimate bot does.
- The same machine claimed to be OpenAI, Anthropic, Meta, and Perplexity within seconds.
- Its fake Claude identities all carried the contact address of Anthropic’s crawler, even when posing as a different Claude agent, which points to a copied-and-pasted string.
- It never identified itself or offered a contact address. Legitimate internet scanning services publish who they are and where they scan from.
Shared addresses and technical fingerprints across targets tie the activity to one actor. Cequence Bot Management is built to catch mismatches like these, and nearly all of the actor’s requests ended in a block or a failure.
Why IP Blocklists Can’t Stop AI Agent Impersonation
The actor used more than 300 cloud addresses in one day and nearly 400 in one week, and none of the addresses from late September reappeared a month later. Third-party threat feeds flagged many of these addresses during the same days the actor used them against Cequence customers, but by then the scanner had usually moved on to new ones.
The actor’s behavior remained consistent: the same disguises, probe paths, and request patterns repeat at every target, which is why Cequence’s behavior-based bot management catches this activity when a static list of addresses or per-request checks can’t.
Fake AI Bots Inflate AI Bot Traffic Numbers
At several organizations in the study, the impersonator accounted for more than 80% of the traffic labeled as AI bot traffic. Any AI bot metric that relies on self-reported identity likely counts impostors as real agents.
At the financial services organizations CQ Prime Research studied, AI agents acting on behalf of customers made up fewer than 1 in 4,000 requests, even at the most exposed institution. The agents banks worry about most log in with a customer’s own credentials through an ordinary browser and don’t announce themselves. Self-reported AI bot traffic only shows the agents that want to be seen.
Agentic AI Security Starts With Verifying Identity
Defending against AI agent impersonation means verifying every claimed identity before trusting it.
- Verify AI agents through signed requests, published address ranges, or direct integrations instead of accepting the identity a bot claims.
- Watch for behavior that doesn’t match the claimed identity, such as an AI assistant requesting configuration or credential files.
- Keep secrets out of web-accessible files, and confirm that staging and admin sites aren’t exposed to the internet.
- Use bot management that evaluates traffic by how it behaves, not by the name it gives itself.
- Expect IP blocklists to go stale within days against this kind of activity.
As more businesses give AI agents access to their applications, agentic AI security depends on knowing which agents are real and what they’re allowed to do. That’s the focus of agentic AI governance.
Cequence will continue tracking AI agent impersonation and the broader shift in AI bot traffic across the organizations Cequence protects.
