The AI Crawler Brand as Cover
A single HTTP client generated 42,000+ user-agent strings impersonating Claude, GPTBot, and Grok to slip past allow-lists, then used the access to probe AWS instance metadata endpoints via SSRF. The shift from fixed to generated user-agents on August 25 made exact-match blocking useless.
Read more →