Mr. Nice Try Notes from the edge

New record The AI key heist

Bots went hunting for AI keys 16,813 times.

Most wanted: Anthropic keys. They checked 81 hiding spots, from /.claude/settings.json to /.env.openai.

Saturday, Oct 17, 2026 (UTC) · see the latest

Share on X Download the GIF
The AI Key Heist: Bots went hunting for AI keys 16,813 times.

16,813

AI key hunts

▲ +121% vs the day before

192

hunters

▲ +26% vs the day before

81

hiding spots

▼ -39% vs the day before

2.5%

of all probes

Whose keys they want requests
Anthropic 12,314
OpenAI 4,116
Hugging Face 148
MCP & agent configs 90
Google Gemini 86
↳ Keep your keys out of your web root.

Every edition: AI key hunts

Oct 7 Oct 17

How I measure

Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.

Where they looked

The paths scanners tried, most-requested first.

Path Provider Requests Scanners
/.claude/settings.json Anthropic 4,028 63
/.env.openai OpenAI 4,028 63
/.env.anthropic Anthropic 4,025 62
/.claude/settings.local.json Anthropic 4,025 62
/.cache/huggingface/token Hugging Face 148 109
/.anthropic/credentials Anthropic 112 3
/.openai/keys.json OpenAI 38 2
/.config/openai/keys.json OpenAI 38 2
/.gemini/keys.json Google Gemini 38 2
/.config/gemini/keys.json Google Gemini 38 2
/.config/anthropic/keys.json Anthropic 29 2
/.config/claude/keys.json Anthropic 29 2
/anthropic.key Anthropic 29 2
/.claude/keys.json Anthropic 29 2
/.well-known/mcp MCP & agent configs 18 4
/.well-known/mcp/server-card.json MCP & agent configs 15 3
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a300a305-9eac-4cfb-8e82-360aa88fad53/waiting-room/oclZXAif6vATsFLKhb55rcKaRXBokUyZ40XzaUM2FpTYgfBh/heartbeat xAI 15 1
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a2fff277-6a24-45cb-9ccb-2d55cdd42609/waiting-room/xa8SkrgXaiPNvBHRNo6L4xrrZ9JczgihPsPuXYAgfrS5GOWq/heartbeat xAI 13 1
/mcp MCP & agent configs 5 3
/storage/photo_uploads/684/vdYhomso7Ar8i1SuLictWL4HtNPc6VpM9mcPmv9S.jpeg MCP & agent configs 4 2
/storage/photo_uploads/646/ObrClcXAiYpz5jtI42SNAlJOFZmIK10mfiHieHVN.jpeg xAI 4 2
/AGENTS.md MCP & agent configs 3 1
/api/mcp MCP & agent configs 3 1
/api/mcp/mcp MCP & agent configs 3 1
/api/mcp/v1 MCP & agent configs 3 1

Past editions

Oct 27 Oct 26 Oct 25 Oct 24 Oct 23 Oct 22 Oct 21 Oct 20 Oct 19 Oct 18 Oct 17 Oct 16 Oct 15 Oct 14 Oct 13 Oct 12 Oct 11 Oct 10 Oct 9 Oct 8 Oct 7

A new one every morning.

Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.

More from yesterday

Bot Weather: 48% of yesterday's traffic was scanners.

Bot Weather · Oct 27

48% of yesterday's traffic was scanners.

How much of yesterday's web traffic was scanners, as a weather report.

 Fraud Desk: 457,316 requests got turned away at the door.

Fraud Desk · Oct 27

457,316 requests got turned away at the door.

Login stuffing, failed logins, and who got turned away at the door.

 Most Wanted: Bots' most wanted file: /.env

Most Wanted · Oct 27

Bots' most wanted file: /.env

The files bots asked for most yesterday. It's usually your .env.

 Cloud Landlords: 88% of scanning came from rented servers.

Cloud Landlords · Oct 27

88% of scanning came from rented servers.

Scanners don't own servers. They rent them. Here are the landlords.

 Speedrun: New sites get scanned in under a minute.

Speedrun · Oct 27

New sites get scanned in under a minute.

How many minutes a brand-new website gets before the first scanner shows up.

 Costume Party: 71% of "browsers" were bots in costume.

Costume Party · Oct 27

71% of "browsers" were bots in costume.

Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.