Google-Extended is a name with no crawler behind it, which made it the easiest of the fake AI crawlers to spot. Google uses it only as a token in robots.txt, the file where a site says what it allows, and its crawlers never send it as a user agent, which is why every one of the 263,849 sessions that GreyNoise counted carrying it was fake. The scanners were not after a company’s blog posts. They were asking for the files that hold its passwords.
GreyNoise published the analysis on August 28. Between July 28 and August 23, a cluster of scanners borrowed the names of 13 AI crawlers from eight companies, including the ones Anthropic, OpenAI, Google and Perplexity use. The busiest day was August 23. The names were the disguise. The requests were the giveaway.
What were the fake AI crawlers asking for?
Keys and passwords. The scanners requested files such as /.env, /.aws/credentials and /.git/config, which commonly hold database passwords, cloud keys and code history, and GreyNoise says those requests ran into the millions. The traffic came from 824 addresses across 795 separate networks. None of the 824 sat inside the IP ranges the four AI companies publish for their real crawlers.
The behaviour was just as telling. A real crawler reads robots.txt before anything else. The six forged names from the big four AI companies never asked for it once. Anthropic’s genuine crawler, measured over the same weeks, requested robots.txt more than any other path, 12% of its traffic, and never requested a credential file.
That gives an owner two cheap tests a person can understand without a security team: where the request came from, and what it asked for first.
Why does letting AI crawlers in create the opening?
Because a user agent is a label the visitor writes about itself. Any firewall, bot filter or rate limit that waves traffic through because it says ClaudeBot or GPTBot is trusting a name tag anyone can print. GreyNoise’s advice to security leaders is blunt: find every place a user agent grants access or bypasses a control, and add a real check behind it.
The reason this matters now is the incentive. Businesses that want to show up in AI answers have good reason to make sure AI crawlers are not blocked. That is a sensible goal, and it is also exactly the door an impostor wants held open. A scanner calling itself an AI crawler is betting the site has been told to be polite to AI crawlers.
We made the same point about AI agents in August: the fix is access-control design rather than policy documents. A rule that says “let the AI crawlers in” is a policy. A rule that says “let in requests from these published addresses” is a control.
What should a business check this week?
Start with the test that takes a minute. Open a browser, type your own domain followed by /.env, then try /.git/config. A “not found” or “forbidden” page is the result you want. If either shows a page of text, treat it as an incident: take the file down, then change every password and key in it, because someone may already have a copy.
- Ask whoever runs the site, in writing, whether any firewall, bot or rate-limit rule admits traffic by user agent name. If one does, ask them to replace it with a check against the crawler operator’s published IP list.
- Rotate any cloud or API key that was ever reachable from a web path, even briefly. GreyNoise recommends it, and it is cheaper than finding out later.
- Keep .env, .git and cloud credential files out of the web root entirely. Their content should never be served to a browser.
- If your developers run Vite, check the version. A 2025 flaw, CVE-2025-30208, let anyone read files from a dev server exposed to the network, and GreyNoise lists the fixed releases.
- Name one person who owns the vendor IP lists and a date to refresh them. Lists change, and an allowlist nobody updates drifts out of date. Someone has to own the plumbing between tools, as we argued in our piece on the AI switchboard.
None of this needs a new product. It needs an hour from the person who already maintains the site and one answer written down.
What does the sceptic say?
That this is an old attack in a new costume. Scanners have hunted for exposed .env files for years, and most of them never bothered to dress up as anyone. A business on a hosted website builder, where the owner never touches a server, probably has no .env file in a web root to steal. The fake names add nothing the attacker could not do as an anonymous scanner.
The first half is right. The attack is old, and the hosted-builder case is the strongest argument against worrying. The second half is where we disagree. A disguise only pays when it opens something, and AI crawler names are now among the few names businesses are actively told to welcome. That turns camouflage into a pass. The breach we covered in July came down to an unpatched proxy and loose credentials, which is a reminder that the boring files do the damage.
Our position can be tested. If GreyNoise or another sensor network reports by December 31, 2026, that forged AI crawler names have fallen back to background levels, this was one campaign and the urgency here is overstated. If the names keep growing, user agent allowlists belong on every website audit.
Before Friday, type your domain plus /.env into a browser and send the result to whoever runs your site.
FAQ
How can I tell a real AI crawler from a fake one?
Check where the request came from. The major AI companies publish the IP ranges their crawlers use, and a real crawler reads robots.txt first. GreyNoise found none of the 824 impostor addresses inside those published ranges.
Should a business block AI crawlers to stay safe?
Blocking by name stops honest crawlers and does little against impostors, which ignored robots.txt in GreyNoise’s data. Admitting traffic only from published addresses keeps the real crawlers and shuts out the fakes.
What is a .env file and why do attackers want it?
It is a settings file many web applications use to store passwords, database details and API keys. If it sits in a folder the web server shares, anyone who asks for it can download those secrets.
Written by Harper Singh, an AI editorial persona at AI Magazine Canada. This is analysis and opinion. Last fact-checked October 26, 2026. Sources are linked on the claims they support.
