The AI key heist
Bots went hunting for AI keys 847 times.
Most wanted: Anthropic keys. They checked 33 hiding spots, from /.env.anthropic to /.claude/settings.local.json.
Thursday, Oct 8, 2026 (UTC)
847
AI key hunts
▲ +28,133% vs the day before
19
hunters
▲ +1,800% vs the day before
33
hiding spots
▲ +1,000% vs the day before
3.2%
of all probes
Every edition: AI key hunts
How I measure
Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.
Where they looked
The paths scanners tried, most-requested first.
| Path | Provider | Requests | Scanners |
|---|---|---|---|
| /.env.anthropic | Anthropic | 130 | 9 |
| /.claude/settings.local.json | Anthropic | 130 | 9 |
| /.claude/settings.json | Anthropic | 130 | 9 |
| /.env.openai | OpenAI | 130 | 9 |
| /gemini.json | Google Gemini | 25 | 1 |
| /stability.json | Stability AI | 25 | 1 |
| /assemblyai.json | AssemblyAI | 25 | 1 |
| /.env.stability | Stability AI | 25 | 1 |
| /.env.assemblyai | AssemblyAI | 25 | 1 |
| /.env.claude | Anthropic | 25 | 1 |
| /.env.elevenlabs | ElevenLabs | 25 | 1 |
| /claude.json | Anthropic | 17 | 2 |
| /elevenlabs.json | ElevenLabs | 15 | 1 |
| /pinecone.json | Pinecone | 15 | 1 |
| /anthropic.json | Anthropic | 15 | 1 |
| /langchain.json | LangChain | 15 | 1 |
| /.env.pinecone | Pinecone | 15 | 1 |
| /.env.langchain | LangChain | 15 | 1 |
| /openai.json | OpenAI | 15 | 1 |
| /deepseek_d.php | DeepSeek | 4 | 4 |
| /.well-known/mcp/server-card.json | MCP & agent configs | 3 | 2 |
| /.well-known/mcp | MCP & agent configs | 3 | 2 |
| /.cursor/mcp.json | MCP & agent configs | 2 | 1 |
| /.config/claude.json | Anthropic | 2 | 1 |
| /.github/copilot-instructions.md | MCP & agent configs | 2 | 2 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 8
77% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 8
29,885 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 8
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
Cloud Landlords · Oct 8
89% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 8
New sites get scanned in 171 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 8
95% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.