An unidentified actor is conducting mass vulnerability scans across the web while disguising their traffic as legitimate AI crawlers, including ClaudeBot. The campaign exploits the growing reliance on bot identification systems that separate friendly AI services from malicious scanners.

What You Need to Know

AI crawlers from companies like Anthropic are used to collect training data. Attackers are now mimicking their user-agent strings to bypass rate limits and access restricted areas. Website operators who block suspicious traffic may inadvertently block legitimate AI bots. Security teams face a growing challenge in distinguishing genuine scraping from malicious probing.

How the Spoofing Works

Automated scanners typically identify themselves by a user-agent string. The attacker in this campaign sets the string to match ClaudeBot, a legitimate crawler used by Anthropic. This allows the scans to blend in with normal AI traffic, making detection difficult for basic security tools.

Key tactics observed in the campaign include:

  • User-agent forgery: Attackers copy the exact user-agent string of ClaudeBot to appear in logs as legitimate traffic.
  • Mass targeting: The scans hit thousands of domains in short time frames, probing for vulnerabilities in web applications.
  • Low-and-slow patterns: Requests are spread over time to avoid triggering rate limits, mimicking the behavior of real crawlers.

The result is a flood of traffic that looks harmless to automated filters but carries payloads designed to test for SQL injection, cross-site scripting and other common flaws.

Stakeholder Impact

Website operators now face a dilemma. Blocking ClaudeBot outright could prevent genuine AI companies from indexing their content. Allowing it through, however, opens the door to malicious scans. Small and medium sites that lack dedicated security teams are especially vulnerable because they rely heavily on user-agent lists for traffic management.

AI companies like Anthropic also have a stake in the outcome. If their crawlers become associated with abuse, more sites will block them entirely. That reduces the quality of training data available for models. The spoofing creates a shared problem that requires coordinated solutions.

Why This Matters

This campaign signals an escalation in the arms race between security defenders and attackers. As AI crawlers become essential infrastructure, their reputation is becoming a target. If spoofing attacks succeed, they will erode the trust that makes automated data collection possible. Web security teams will need to adopt behavioral analysis instead of relying solely on user-agent strings. The broader consequence is a less open web, where legitimate services suffer because of the actions of bad actors leveraging their names.

Until the industry develops better verification methods such as cryptographic attestation, the line between friendly and hostile bots will remain dangerously thin.