The AI key heist
Bots went hunting for AI keys 1,892 times.
Most wanted: Anthropic keys. They checked 62 hiding spots, from /.claude/settings.local.json to /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp.
Thursday, Oct 22, 2026 (UTC) · see the latest
1,892
AI key hunts
▼ -4.7% vs the day before
424
hunters
▼ -5.8% vs the day before
62
hiding spots
▼ -46% vs the day before
0.2%
of all probes
Every edition: AI key hunts
How I measure
Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.
Where they looked
The paths scanners tried, most-requested first.
| Path | Provider | Requests | Scanners |
|---|---|---|---|
| /.claude/settings.local.json | Anthropic | 450 | 62 |
| /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp | Google Gemini | 319 | 251 |
| /.cache/huggingface/token | Hugging Face | 98 | 68 |
| /.claude/settings.json | Anthropic | 39 | 22 |
| /.claude/agents/ | Anthropic | 35 | 20 |
| /.claude/agents/index.md | Anthropic | 35 | 20 |
| /config/gemini.json | Google Gemini | 35 | 20 |
| /azure-openai.config | OpenAI | 35 | 20 |
| /azure-openai.json | OpenAI | 35 | 20 |
| /azure-openai.yml | OpenAI | 35 | 20 |
| /config/azure-openai.json | OpenAI | 35 | 20 |
| /config/openai.json | OpenAI | 35 | 20 |
| /gemini.config | Google Gemini | 35 | 20 |
| /gemini.env | Google Gemini | 35 | 20 |
| /gemini.json | Google Gemini | 35 | 20 |
| /gemini.yml | Google Gemini | 35 | 20 |
| /.mcp.json | MCP & agent configs | 35 | 20 |
| /my/openaikey | OpenAI | 35 | 20 |
| /openai.config | OpenAI | 35 | 20 |
| /openai.json | OpenAI | 35 | 20 |
| /openai.yml | OpenAI | 35 | 20 |
| /vertex-ai.json | Google Gemini | 35 | 20 |
| /openai-proxy/config.yaml | OpenAI | 34 | 3 |
| /openai-proxy/config.yml | OpenAI | 32 | 3 |
| /openai-proxy.yml | OpenAI | 29 | 3 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 27
48% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 27
457,316 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 27
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
Cloud Landlords · Oct 27
88% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 27
New sites get scanned in under a minute.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 27
71% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.