The user agent said ClaudeBot. It wanted my private keys.

What I measured

Thirty days, from 27 July to 25 August 2026. Every request whose user agent named a known crawler was written to a row: the date, the crawler, the path, and the status code it received. No sampling, no third-party analytics — the site keeps its own log, in its own database.

The total was 3,054 requests across fourteen named crawlers. Of those, 2,333 got a page. 697 — twenty-three percent — asked for a path that does not exist.

That number alone is not interesting. Crawlers guess at sitemaps, retry old URLs, and follow links that rot. What is interesting is who produced it.

The split

I sorted the failed requests by what they were reaching for. One group stood out immediately: requests for .env files, secrets.json, service-account.json, private keys, and configuration backups. There were 415 of them.

Here is how they distribute.

Written out, with the share of each crawler's total traffic that went looking for credentials:

• Googlebot — 723 requests, 0 for secrets.
• Bingbot — 460 requests, 0.
• Applebot — 92 requests, 0.
• YandexBot — 87 requests, 0.
• ClaudeBot — 811 requests, 122 for secrets.
• Amazonbot — 239 requests, 115. Nearly half.
• ChatGPT-User — 212 requests, 78.
• OAI-SearchBot — 192 requests, 38.
• GPTBot — 130 requests, 29.
• PerplexityBot — 51 requests, 33. Two thirds.

Grouped: the four established search engines made 1,417 requests and asked for a secret zero times. The AI crawler user agents made 1,635 requests and asked 415 times — one request in four.

What they asked for

The paths are not ambiguous. This is the top of the list, and none of these have ever existed on this domain:

• /.env, /staging/.env, /src/.env, /sendgrid.env
• /secrets.json, /secrets.yml, /settings.json
• /service_account.json, /serviceAccountKey.json
• /ssl/server.key, /ssl/localhost.key, /server.key
• /v1/graphql, /telescope/requests, /runtime-config.js

That is a vulnerability scanner's word list. It is the same list whether it arrives at a personal site or a bank. Nothing about it belongs to language model training or to answering a question someone typed into a chat window.

A user agent is a string the client chooses. It is a claim about identity, and nothing in the protocol makes it true.

Why this is evidence and not a coincidence

The four search engines are the control group, and I did not design them into the experiment — they were simply already there.

If scanning traffic were spread evenly across spoofed identities, Googlebot's name would be the most valuable one to wear: it is the most likely to be allowed through a firewall. Instead Googlebot's share of credential requests is zero, across 723 requests, over thirty days.

The reason is that Google's identity is checkable and has been for years. Every serious host verifies Googlebot by reverse DNS or against published address ranges, so wearing the costume gets you nothing. The AI crawler names are newer, verification is less widely implemented, and they are on the allow-list of every site chasing citations in AI answers.

The costume works because we all agreed to hold the door open for it.

What I am not claiming

My log recorded the user agent. It did not record the source address, and it did not verify anything at the time — which means I cannot prove, from this data alone, that these requests came from someone other than the named operator.

What I can say is what the requests were for. Anthropic, OpenAI and Perplexity crawl to read pages. None of them has a reason to ask a twenty-six page site for /ssl/server.key, and the clean zero from four search engines over the same thirty days is hard to explain any other way.

Treat this as one small site's measurement, not a study. That is exactly why it is worth writing down: nobody with real traffic can see this pattern, because on a large site it is buried under legitimate noise.

What to do about it

Three things, in order of how much they are worth.

• Stop reading crawler counts as interest. If your dashboard says an AI crawler visited two hundred times, some fraction of that was a scanner. Mine was a quarter. Any conclusion you draw about your visibility in AI answers is built on that number — the same mistake as reading a survey answer as demand: a number that was easy to collect standing in for one that was not.
• Verify by address, not by name. OpenAI publishes its ranges as machine-readable files — I checked while writing this, and they list 21 prefixes for GPTBot, 35 for OAI-SearchBot and 204 for ChatGPT-User. Google and Bing have published theirs for years. A user agent you have not verified is a guess.
• Know what the logging itself costs. Recording every request is what makes a finding like this possible, and it is also work the site does whether or not anybody is reading — most of the rows my database reads in a day are bookkeeping of exactly this kind.
• Log the status code, not just the hit. The whole finding here is in the 404s. A log that records only successful requests would have shown none of it — which is the same reason a build log records what surprised you rather than what shipped.

Six weeks after writing this I gave the same site tools an agent can call directly, which raises the same question from the other side: not who is claiming to be a crawler, but what a caller I cannot identify should be allowed to do.

And the flat one: do not put secrets where a word list can reach them. That was never news. What is news is who is running the word list, and what name it is using while it does.