Cequence says a single actor running from a major cloud provider rotated evenly through about 32 AI crawler and assistant identities while requesting roughly 90 paths that commonly hold secrets: .env files, cloud credential files, private SSH keys and server environment data. It ignored normal pages. Active from at least late September through late October, it hit financial services, retail, telecom, energy and software organizations, and at several of them made up more than 80% of traffic labeled as AI bots.

• Pattern: 50 to 190 requests in about eight seconds per address, then move on; random nonsense paths first to detect sites that answer every request.
• Tells: one host claiming OpenAI, Anthropic, Meta and Perplexity within seconds; every fake Claude identity carrying the contact address of Anthropic's crawler; no self-identification.
• Infrastructure: more than 300 cloud IPs in one day and nearly 400 in a week, none reused a month later, so IP blocklists go stale fast.

Hunt ideas: in web logs, find requests with an AI-bot user agent for /.env, .aws/credentials, id_rsa and similar paths; verify claimed AI bots against the vendor's published IP ranges or signed requests rather than the user agent.