Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot

This Hacker News item carries the headline "Someone is running mass vulnerability scans, spoofing AI bots like ClaudeBot." The accompanying excerpt is an overview from Agent Analytics covering 5,000+ websites, presenting key ecosystem metrics on bot and AI chat traffic.

The metrics show that bot traffic makes up 35% of all visits, down 2 percentage points from the previous 90 days. The "agentrification" rate — the share of bot traffic that is AI-related — is 28%, up 11 points. AI chat referral volume, the percentage of human visits arriving from AI chat, is only 0.1%, down 9 points. Robots.txt effectiveness stands at 98.5%, meaning most bots follow robots.txt rules.

The excerpt then categorizes traffic by agent type, listing AI agents, AI assistants, AI coding agents, data providers/scrapers, search crawlers, archivers, developer helpers, fetchers, intelligence gatherers, scrapers, search engine crawlers, security scanners, SEO crawlers, and undocumented AI agents. Top visiting agents include bingbot at 8.2%, Googlebot at 7.9%, AhrefsBot at 6.2%, a "Known Agent" classified as developer helper at 5.5%, and ChatGPT-User as an AI assistant.

In the context of the headline, these analytics likely illustrate how apparent AI bot traffic could actually be masked vulnerability scanners mimicking known AI bots. This raises concerns about the reliability of bot classification and the potential for malicious actors to evade detection by impersonating legitimate crawlers.