The AI key heist

Bots went hunting for AI keys 3,362 times.

Most wanted: Anthropic keys. They checked 117 hiding spots, from /.claude/settings.local.json to /.claude/settings.json.

Tuesday, Oct 27, 2026 (UTC)

Share on X Download the GIF

3,362

AI key hunts

▲ +85% vs the day before

361

hunters

▲ +15% vs the day before

117

hiding spots

▲ +70% vs the day before

0.9%

of all probes

Whose keys they want requests

Anthropic 1,200

OpenAI 801

MCP & agent configs 673

Google Gemini 618

xAI 70

↳ Keep your keys out of your web root.

Every edition: AI key hunts

Oct 7 Oct 27

How I measure

Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.

Where they looked

The paths scanners tried, most-requested first.

Path	Provider	Requests	Scanners
/.claude/settings.local.json	Anthropic	383	45
/.claude/settings.json	Anthropic	383	45
/.env.openai	OpenAI	332	28
/.env.anthropic	Anthropic	332	28
/.cursor/mcp.json	MCP & agent configs	332	28
/img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp	Google Gemini	312	249
/.well-known/mcp	MCP & agent configs	87	6
/.well-known/mcp/server-card.json	MCP & agent configs	86	5
/gemini.config	Google Gemini	51	17
/gemini.env	Google Gemini	51	17
/gemini.json	Google Gemini	51	17
/gemini.yml	Google Gemini	51	17
/openai.yml	OpenAI	51	17
/azure-openai.json	OpenAI	51	17
/azure-openai.yml	OpenAI	51	17
/.claude/agents/	Anthropic	51	17
/.claude/agents/index.md	Anthropic	51	17
/config/azure-openai.json	OpenAI	51	17
/config/gemini.json	Google Gemini	51	17
/config/openai.json	OpenAI	51	17
/.mcp.json	MCP & agent configs	51	17
/vertex-ai.json	Google Gemini	51	17
/my/openaikey	OpenAI	51	17
/openai.config	OpenAI	51	17
/openai.json	OpenAI	51	17