The AI key heist

Bots went hunting for AI keys 3,139 times.

Most wanted: Anthropic keys. They checked 108 hiding spots, from /.claude/settings.json to /.claude/settings.local.json.

Saturday, Oct 24, 2026 (UTC) · see the latest

Share on X Download the GIF

3,139

AI key hunts

▲ +41% vs the day before

306

hunters

▼ -22% vs the day before

108

hiding spots

▲ +42% vs the day before

0.5%

of all probes

Whose keys they want requests

Anthropic 1,250

OpenAI 715

MCP & agent configs 569

Google Gemini 430

Hugging Face 61

↳ Keep your keys out of your web root.

Every edition: AI key hunts

Oct 7 Oct 24

How I measure

Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.

Where they looked

The paths scanners tried, most-requested first.

Path	Provider	Requests	Scanners
/.claude/settings.json	Anthropic	391	57
/.claude/settings.local.json	Anthropic	390	56
/.env.openai	OpenAI	366	35
/.env.anthropic	Anthropic	366	35
/.cursor/mcp.json	MCP & agent configs	357	36
/img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp	Google Gemini	217	165
/.cache/huggingface/token	Hugging Face	49	45
/config/openai.json	OpenAI	45	22
/config/azure-openai.json	OpenAI	44	22
/.mcp.json	MCP & agent configs	37	23
/config/gemini.json	Google Gemini	34	21
/.claude/agents/	Anthropic	34	21
/openai.json	OpenAI	34	21
/.claude/agents/index.md	Anthropic	34	21
/gemini.env	Google Gemini	34	21
/gemini.config	Google Gemini	34	21
/gemini.json	Google Gemini	34	21
/vertex-ai.json	Google Gemini	34	21
/azure-openai.config	OpenAI	34	21
/azure-openai.json	OpenAI	34	21
/my/openaikey	OpenAI	34	21
/mcp	MCP & agent configs	34	15
/openai.yml	OpenAI	34	21
/azure-openai.yml	OpenAI	34	21
/openai.config	OpenAI	34	21