The AI key heist
Bots went hunting for AI keys 3 times.
Most wanted: MCP & agent configs keys. They checked 3 hiding spots, from /AGENTS.md to /CLAUDE.md.
Wednesday, Oct 7, 2026 (UTC) · see the latest
3
AI key hunts
1
hunters
3
hiding spots
0.9%
of all probes
How I measure
Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the edge during the UTC day.
Where they looked
The paths scanners tried, most-requested first.
| Path | Provider | Requests | Scanners |
|---|---|---|---|
| /AGENTS.md | MCP & agent configs | 1 | 1 |
| /CLAUDE.md | Anthropic | 1 | 1 |
| /.github/copilot-instructions.md | MCP & agent configs | 1 | 1 |
Past editions
A new one every morning.
Follow @MrNiceTry on X for each day's numbers, and the odd story about what the bots get up to.
More from yesterday
Bot Weather · Oct 8
77% of yesterday's traffic was scanners.
How much of yesterday's web traffic was scanners, as a weather report.
Fraud Desk · Oct 8
29,885 requests got turned away at the door.
Login stuffing, failed logins, and who got turned away at the door.
Most Wanted · Oct 8
Bots' most wanted file: /.env
The files bots asked for most yesterday. It's usually your .env.
Cloud Landlords · Oct 8
89% of scanning came from rented servers.
Scanners don't own servers. They rent them. Here are the landlords.
Speedrun · Oct 8
New sites get scanned in 171 minutes.
How many minutes a brand-new website gets before the first scanner shows up.
Costume Party · Oct 8
95% of "browsers" were bots in costume.
Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.