The AI key heist

Bots went hunting for AI keys 1,534 times.

Most wanted: MCP & agent configs keys. They checked 194 hiding spots, from /img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp to /sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31d894f-0037-4cf0-a787-6ac478340f55/waiting-room/FfkpXv9M9QdhnIISzxoQmCplR6BE5EMr8uZXOGNkQB1V8Mb7/heartbeat.

Edition of Saturday, Oct 31, 2026 (UTC) · see the latest · updated every 24 hours

Share on X

1,534

AI key hunts

▼ -31% vs the day before

331

hunters

▲ +0.6% vs the day before

194

hiding spots

▲ +44% vs the day before

0.5%

of all probes

Whose keys they want requests

MCP & agent configs 536

Google Gemini 351

OpenAI 211

xAI 199

Anthropic 179

↳ Keep your keys out of your web root.

Every edition: AI key hunts

Oct 13 Nov 11

How we measure

Requests for paths that point at an AI provider's keys or an AI agent's settings: /.env.openai, /anthropic.json, /.claude/settings.json, /mcp.json, /.cursor/mcp.json and the like. Each path is credited to the first provider whose name it contains. Counted across every site behind the NiceTryBot edge during the UTC day.

Where they looked

The paths scanners tried, most-requested first.

Path	Provider	Requests	Scanners
/img/asset/YXNzZXRzL2dlbWluaV9nZW5lcmF0ZWRfaW1hZ2VfaDA2MWxnaDA2MWxnaDA2MS1jb3B5LndlYnA/gemini_generated_image_h061lgh061lgh061-copy.webp	Google Gemini	167	140
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31d894f-0037-4cf0-a787-6ac478340f55/waiting-room/FfkpXv9M9QdhnIISzxoQmCplR6BE5EMr8uZXOGNkQB1V8Mb7/heartbeat	MCP & agent configs	83	3
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31da70f-8e10-4258-afcc-5a6e8691c017/waiting-room/6XzBaZRjiM2RreJsQTBeZSPzc1FqVJzdbJneBhRUbmCPNQH2/heartbeat	MCP & agent configs	63	1
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31c2098-5f9a-4676-b316-53a43ede6818/waiting-room/otWzAX8ARzXwDGRIIeCqB8f4gBzEGntOXaIlYvLszlNpHGv8/heartbeat	xAI	62	45
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31c2226-4cf7-44d2-a6c7-bb4351f9ec23/waiting-room/xsbzzNFR9xtji13pppKEWbntxAKgQZhDt8VYbC4ZHzTGRoKi/heartbeat	xAI	60	41
/gemini.env	Google Gemini	57	12
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31c1977-55bc-4222-ab21-0ef0c95ff406/waiting-room/fOyVGuCLGni9k2COi13xn4LWIMoWhJDmCpZVk46ejfydzTM8/heartbeat	MCP & agent configs	54	37
/.env.openai	OpenAI	46	2
/.env.gemini	Google Gemini	45	1
/mcp	MCP & agent configs	35	14
/.claude/settings.json	Anthropic	35	20
/.claude/settings.local.json	Anthropic	31	19
/.mcp.json	MCP & agent configs	28	19
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31c2098-5f9a-4676-b316-53a43ede6818/waiting-room/otWzAX8ARzXwDGRIIeCqB8f4gBzEGntOXaIlYvLszlNpHGv8	xAI	28	14
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31c2226-4cf7-44d2-a6c7-bb4351f9ec23/waiting-room/xsbzzNFR9xtji13pppKEWbntxAKgQZhDt8VYbC4ZHzTGRoKi	xAI	25	12
/.cursor/mcp.json	MCP & agent configs	25	11
/.well-known/mcp	MCP & agent configs	24	9
/.vscode/mcp.json	MCP & agent configs	20	11
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31c1977-55bc-4222-ab21-0ef0c95ff406/waiting-room/fOyVGuCLGni9k2COi13xn4LWIMoWhJDmCpZVk46ejfydzTM8	MCP & agent configs	19	10
/sign/a20a2ddd-49fd-4df5-864c-a0c388e62db5/a31ca179-11fd-4304-9626-efd96e4fe7b3/waiting-room/Bsqh5K0qV7KMcP1ibGdAhKyfC8VKDyuFvlnkSSk51ge98Kiu/heartbeat	MCP & agent configs	14	1
/.well-known/mcp/server-card.json	MCP & agent configs	14	5
/.anthropic/config.json	Anthropic	14	4
/.cache/huggingface/token	Hugging Face	13	3
/.claude/agents	Anthropic	13	3
/mcp_config.json	MCP & agent configs	13	8

Past editions

Nov 11 Nov 10 Nov 9 Nov 8 Nov 7 Nov 6 Nov 5 Nov 4 Nov 3 Nov 2 Nov 1 Oct 31 Oct 30 Oct 29 Oct 28 Oct 27 Oct 26 Oct 25 Oct 24 Oct 23 Oct 22 Oct 21 Oct 20 Oct 19 Oct 18 Oct 17 Oct 16 Oct 15 Oct 14 Oct 13 Oct 12 Oct 11 Oct 10 Oct 9 Oct 8 Oct 7

More from the edge

Bot Weather · Nov 11

20% of yesterday's traffic was scanners.

How much of yesterday's web traffic was scanners, as a weather report.

Fraud Desk · Nov 11

32,669 requests got turned away at the door.

Most Wanted · Nov 11

Bots' most wanted file: /download.php

The files bots asked for most yesterday. It's usually your .env.

Cloud Landlords · Nov 11

81% of scanning came from rented servers.

Scanners don't own servers. They rent them. Here are the landlords.

Speedrun · Nov 11

New sites get scanned in 1,245 minutes.

How many minutes a brand-new website gets before the first scanner shows up.

Costume Party · Nov 11

57% of "browsers" were bots in costume.

Bots dressed up as Chrome, caught by their handshake. Plus the honest bots wearing name tags.

Want these bots off your site?

Put your domains behind the NiceTryBot edge. You'll see every request, tag the scanners, and send them to the gym while real people get on with their day.

See how it works