Blog · 2026-11-11 · HoneyLabs

We analyzed 366,845 requests from a scanner that asks web servers for .claude.json and .cursor/mcp.json

For four days in September 2026 a credential scanner on Google Cloud asked every web server it reached for 32 AI coding assistant files, among them Claude Code's OAuth token file and MCP server definitions. Other scanners have asked for the same files every week since.

If one of your web servers serves a home directory or a repository checkout, scanners now ask it for your AI coding assistant's files. That includes /.claude/.credentials.json, where Claude Code keeps its OAuth tokens on a machine without a system keychain, and /.cursor/mcp.json.

Everything in this post is unsolicited traffic that reached HoneyLabs honeypots between 27 August and 9 November 2026. It shows what scanners request, and we have no way to tell whether a real server ever answered them.

Here is part of one sweep, sent by one address to one port early on 4 September (times in UTC):

03:31:28  GET /api/actuator/env
03:31:29  GET /internal/actuator/env
03:31:30  GET /wp-config.php.bak
03:31:30  GET /.zsh_history
03:31:30  GET /.aider.env
03:31:30  GET /.claude/.credentials.json
03:31:30  GET /.claude.json
03:31:30  GET /.cursor/mcp.json
03:31:30  GET /.vscode/mcp.json
03:31:30  GET /.mcp.json

The requests for actuator/env and wp-config.php.bak were familiar. This scanner runs from Google Cloud (AS396982), and it had requested the same 543 paths every day since 27 August, most of them Laravel logs, mail provider keys and database dumps.

The lines from /.zsh_history down were new that morning. We compared each day's list of paths with the day before. Nothing had been added for a week, and then 49 paths showed up within one second. Of those, 32 belong to AI coding tools:

The model vendor's key is only part of what leaks with these files. An MCP config tells the assistant how to start other services, and its env block carries the tokens for them, which in practice means GitHub, a database or Slack. A LiteLLM config usually lists keys for several providers at once. Whoever wrote the list was also guessing, because as far as we know no tool writes /anthropic.json, /openai.json or /ai.json.

The remaining 17 additions are shell history and startup files such as /.zsh_history, /.psql_history and /.bashrc, with a few loose ones like /.secrets.json. We think they belong to the same idea: a line like export ANTHROPIC_API_KEY=... typed once into a terminal stays in the history file.

With the additions the list stood at 592 paths, and the chart sorts them by target. Most of the list is aimed at a deployed application. The AI files and the shell files are the entries that come from a developer's machine. On 6 September the operator added thousands of backup filenames, which took the list past 4,500 paths, some built from the target's own address (/backups/<target-ip>.tar.gz).

We looked at the scanner's first eleven days, to 6 September. It sent 366,845 requests in that time, and it did not keep its addresses for long: of the 2,894 it used, we saw 2,499 on one day only. That looks like short-lived cloud instances, and it means a blocklist of addresses is close to useless here.

The wordlist went to 203 ports, and 443 was only the 28th busiest. The top of the chart is 8190, 8085 and 4567, which are the kind of port where an internal dashboard or a development server ends up exposed.

We call thousands of addresses one scanner mostly because of timing. All 49 new paths were first requested in the same second, and by the end of that day 40 different addresses had sent them.

Every request also carried the same user agent, which claims Chrome 124 on Linux, and the same Akin token. Akin is our fingerprint of how a client orders and formats its HTTP headers. This particular token is weak evidence, because a default curl produces it too.

A second Google Cloud client, crusader-worker/1.0, sends the same token with a much shorter list of .git/config and .env paths, and we wondered whether it was the same operator. The test we used was shared addresses. It used about 3,400 addresses in those eleven days, out of 8,817 Google Cloud addresses that reached us. Two clients picking independently from that pool would overlap on about 1,100. These two share 390, so the addresses give no reason to connect them.

The scanner asked for the AI files on four days, 4 to 7 September. On 8 September it ran one more sweep without them and then disappeared. Other clients have kept asking. Between 8 September and 9 November we counted 8,067 requests for these files, with some in every week. For scale, the week of 4 September alone had 18,707.

Some of those come from clients we can name. crusader-worker/1.0 picked up five of the files in late September, and in October a client calling itself WebSiphon/next-0.1 asked for six of them from Oracle Cloud.

In July, SANS Internet Storm Center wrote up the earliest probes we know, from two weeks of logs on a single small web host that ran none of these tools. The diary's author described it as "scanning ahead of the curve, ready for the moment a developer exposes one."

That diary counted probes from a few dozen addresses. By September the same files were in a general credential wordlist run from thousands.

To check a host of your own, request a few of the paths and look at the status codes:

for p in /.claude.json /.claude/.credentials.json /.cursor/mcp.json /.mcp.json /.aider.env; do
  curl -s -o /dev/null -w "%{http_code} $p\n" "https://your-host$p"
done

A 200 with a body deserves a look, because it means the web root is, or contains, a home directory or a checkout. If one of the files was reachable, rotate every credential in it. For an MCP config that means each token in the env block.

For blocking, match on the paths, since the addresses change daily. In nginx that is one location block:

location ~* ^/(\.claude|\.cursor|\.aider|\.continue|\.codeium|\.windsurf|\.litellm|\.mcp\.json|\.vscode/mcp\.json) {
    return 404;
}