Cequence says it tracked one scanner cycling through ~32 AI crawler identities while requesting .env files, cloud credentials, and private keys from web servers. The researchers did not report a confirmed breach. For admins: don't treat a bot's User-Agent label as proof of trust. Keep secrets out of web-accessible paths, review logs for sensitive-file probes, and verify automated clients using stronger signals. https://www.cequence.ai/blog/ai-agent-impersonation