The AI key heist
Bots went hunting for AI keys 7,605 times.
Most wanted: Anthropic keys. They checked 132 hiding spots, from /.claude/settings.json to /.claude/settings.local.json.
Friday, Oct 16, 2026 (UTC) · see the latest
7,605
AI key hunts
▲ +861% vs the day before
152
hunters
▲ +153% vs the day before
132
hiding spots
▲ +81% vs the day before
0.9%
of all probes
Every edition: AI key hunts
How I measure
Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.
Where they looked
The paths scanners tried, most-requested first.
| Path | Provider | Requests | Scanners |
|---|---|---|---|
| /.claude/settings.json | Anthropic | 1,637 | 59 |
| /.claude/settings.local.json | Anthropic | 1,637 | 59 |
| /.env.openai | OpenAI | 1,636 | 58 |
| /.env.anthropic | Anthropic | 1,636 | 58 |
| /.cache/huggingface/token | Hugging Face | 129 | 70 |
| /.well-known/mcp | MCP & agent configs | 32 | 3 |
| /.well-known/mcp/server-card.json | MCP & agent configs | 32 | 3 |
| /.config/openai/keys.json | OpenAI | 31 | 3 |
| /.config/gemini/keys.json | Google Gemini | 31 | 3 |
| /.openai/keys.json | OpenAI | 31 | 3 |
| /.gemini/keys.json | Google Gemini | 31 | 3 |
| /openai.json | OpenAI | 29 | 2 |
| /gemini.env | Google Gemini | 29 | 2 |
| /config/openai.json | OpenAI | 29 | 2 |
| /openai.yml | OpenAI | 28 | 1 |
| /gemini.json | Google Gemini | 28 | 1 |
| /gemini.yml | Google Gemini | 28 | 1 |
| /config/azure-openai.json | OpenAI | 28 | 1 |
| /config/gemini.json | Google Gemini | 28 | 1 |
| /azure-openai.config | OpenAI | 28 | 1 |
| /azure-openai.json | OpenAI | 28 | 1 |
| /azure-openai.yml | OpenAI | 28 | 1 |
| /vertex-ai.json | Google Gemini | 28 | 1 |
| /my/openaikey | OpenAI | 28 | 1 |
| /openai.config | OpenAI | 28 | 1 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 27
48% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 27
457,316 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 27
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
Cloud Landlords · Oct 27
88% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 27
New sites get scanned in under a minute.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 27
71% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.