Threat research and intelligence channels are warning of attackers posing as AI agents in credential theft attacks. Cequence has published research following a single threat actor, a scanner rotating through about 32 AI bot identities. This machine has been observed claiming to be OpenAI, Anthropic, Meta, and Perplexity, all in the span of seconds. While posing as legitimate agentic AI tools, it sends requests for sensitive data, including .env files, cloud credentials, and private keys.
One Day to Hit Half the Targets
The speed capability of this campaign is extreme: in just one day in October, 48% of Cequence customers that saw any AI traffic were reached by this actor. Active at least since late September, it has targeted organizations across industries, including retail, financial services, telecom, energy, and software.
The actor cannot be blocked by IP address blocklists, as it uses numerous cloud addresses to carry out its activity. Cequence observed this same actor using more than 300 cloud addresses in a single day, and nearly 400 in one week. Nearly all of the requests analyzed by Cequence were blocked or failed.
Signs Giving Away the Disguise
The technique used by this actor to attempt to impersonate legitimate AI agents is fairly surface-level; there are several giveaways in its behavior that it is not what it claims to be. While the real agents that the actor is imitating show consistency and predictability, this bot displays an even rotation across several identities within a short span of time.
All of the fake Claude agent identities used by this actor carried the same copied contact address from Anthropic’s crawler. Requests were sent in bursts of 50 to 190 in eight seconds, using a list of around 90 different credential paths.
Action Inside the Bank
Axios has reported unauthorized agentic AI activity operating within customer accounts at major U.S. banks, based on information from people in the know. These agents can carry out a wide range of actions, introducing significant risk. “When a customer hands an agent their username and password, the bank sees a legitimate user, and often a legitimate session,” according to Patrick Harr, Chief Executive Officer at DataVisor, a Mountain View, Calif.-based AI-powered fraud and Anti-Money Laundering (AML) Platform. “If that agent has authority to move funds or make purchases, it can do damage whether it was compromised, manipulated, or simply made a mistake. It also gives fraudsters a new angle.”
In response to this activity, major banks including Morgan Stanley, Bank of America, JPMorgan, and Wells Fargo are attempting to contain agent access as rapidly as possible. Some of these institutions have observed known unauthorized access already, while others are acting out of caution. The way these agents have been seen operating presents critical security risks to banks and their customers, with the potential to lead to extensive damage.
Enforcing “Read Only” as a Stopgap
The step that many of these banks are taking to protect against the threat of these agents is to authorize agentic AI for read-only access. This allows the agent to view customers’ financial information, but not to take any action on their accounts; humans still have to approve any movement of money. This is effective against some of the risks associated with this agentic activity, but not all.
Account data, which AI agents can still see with read-only permissions, can still be useful for attackers to leverage as reconnaissance or in social engineering attacks. Customers who wish to use an AI agent to help manage their finances in some way may choose to favor the banks that accept their agents and allow them to grant access to their accounts.
False Security in the Tool’s Name
The main tactic used by the actor seen by Cequence to disguise itself as legitimate AI agents is a simple user-agent header that costs nothing to fake. This enables a fake actor to send requests under the name of a widely trusted tool without much effort or investment.
Even when the operator is verified as a legitimate AI agent, the intelligence from Axios demonstrates that this says nothing about whether the customer authorized the activity the agent is taking on their account. At the most exposed bank, real customer requests from legitimate agents make up only about 1 in 4,000 requests.
Implementing the Necessary Checks
Going beyond the surface disguise to properly protect against fraudulent and unauthorized agentic AI activity requires robust and layered defenses. Cequence stresses the importance of verifying the identity of any AI agents that attempt to take action. This means requiring additional authentication like signed requests, published address ranges, or direct integrations, rather than trusting the claimed identity of the bot. Any API integrations should be registered on the API gateway and implemented with scoped, revocable tokens in order to mitigate the risks of outsized and lingering access.
It is also crucial to enforce policy on agentic actions during runtime, rather than only at the moment of login. Authentication at login does not guarantee the actor is who they say they are, especially when agentic AI enters the equation. “Banks will need ways to recognize an agent as its own identity, tie it to the human who authorized it, and scope what it can do, for how long and up to what amount,” says Chris Hughes, Vice President of Security Strategy at Noma Security, a New York City-based unified AI security and governance platform. “Customers also need clear visibility into what they are granting, in plain terms, so consent means something.”
Target List Built from Approved Operators
The list of targets for impersonation by the actor tracked by Cequence is the list of legitimate AI agents deployed and trusted by users and organizations. The agentic AI market has served as this attacker’s catalog of costumes. Agentic AI should have its own identity and be tied to the human identity that delegated it. The window for mitigating these risks is narrowing as agentic traffic continues to grow both in terms of legitimate use and malicious abuse.
