The AI key heist
Bots went hunting for AI keys 1,821 times.
Most wanted: Google Gemini keys. They checked 69 hiding spots, from /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp to /.mcp.json.
Monday, Oct 26, 2026 (UTC) · see the latest
1,821
AI key hunts
▲ +20% vs the day before
313
hunters
▲ +48% vs the day before
69
hiding spots
▲ +21% vs the day before
0.5%
of all probes
Every edition: AI key hunts
How I measure
Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.
Where they looked
The paths scanners tried, most-requested first.
| Path | Provider | Requests | Scanners |
|---|---|---|---|
| /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp | Google Gemini | 316 | 257 |
| /.mcp.json | MCP & agent configs | 67 | 25 |
| /.claude/settings.local.json | Anthropic | 66 | 24 |
| /azure-openai.config | OpenAI | 66 | 24 |
| /azure-openai.json | OpenAI | 66 | 24 |
| /azure-openai.yml | OpenAI | 66 | 24 |
| /.claude/agents/ | Anthropic | 66 | 24 |
| /.claude/agents/index.md | Anthropic | 66 | 24 |
| /.claude/settings.json | Anthropic | 66 | 24 |
| /config/azure-openai.json | OpenAI | 66 | 24 |
| /config/gemini.json | Google Gemini | 66 | 24 |
| /config/openai.json | OpenAI | 66 | 24 |
| /gemini.config | Google Gemini | 66 | 24 |
| /gemini.env | Google Gemini | 66 | 24 |
| /gemini.json | Google Gemini | 66 | 24 |
| /gemini.yml | Google Gemini | 66 | 24 |
| /my/openaikey | OpenAI | 66 | 24 |
| /openai.config | OpenAI | 66 | 24 |
| /openai.json | OpenAI | 66 | 24 |
| /openai.yml | OpenAI | 66 | 24 |
| /vertex-ai.json | Google Gemini | 66 | 24 |
| /sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a312a3b6-0315-412d-b773-6801008fd370/waiting-room/X9drkkcRRsSzZpIudRdSsvr4ICyAaVBQxaITyY6tGeZtVXSj/heartbeat | xAI | 28 | 1 |
| /.well-known/mcp/server-card.json | MCP & agent configs | 22 | 5 |
| /sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a312aaa6-6528-48fe-abdb-049221d6c826/waiting-room/OXMTjd9TtbWGnWY8GcmCPs7q5a54MPwXsRkxECJ41EA0f4Yc/heartbeat | MCP & agent configs | 22 | 1 |
| /.well-known/mcp | MCP & agent configs | 22 | 5 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 27
48% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 27
457,316 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 27
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
Cloud Landlords · Oct 27
88% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 27
New sites get scanned in under a minute.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 27
71% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.