The First Scanner to Hit Our AI-Agent Config Canaries Asked for Your CLAUDE.md in the Same Second as Your Settings File
Two weeks ago our edge started blocking requests for the configuration files of AI coding agents. We saw the requests and nothing else, because the firewall in front of our decoys answered first. This morning one finally reached a decoy and got an answer. It asked for eight paths in 79 seconds, and four of them in a single second.
What it asked for
At 16:09:17 UTC on October 30, one address on a Polish hosting range (AS218785) sent four requests inside the same second: /.claude/agents, /.claude/CLAUDE.md, /.claude/settings.json and /.claude/settings.local.json. Four seconds later it asked for /.cursor/mcp.json. Ten seconds after that, /.mcp.json, then /.vscode/mcp.json three seconds later, and a final /mcp.json at 16:10:36. Every request was a plain GET with a desktop Chrome-on-Windows user agent, against one of our own sites.
Four requests in one second is not a person and not a crawler walking a tree. It is a tool firing a list in parallel, then working through the rest of the list more slowly.
Why those eight
Settings files and MCP configuration are the obvious prize. They hold tool allowlists, server commands and, often, API keys. Anyone who has read an agent's documentation knows where they live.
The two that deserve attention are CLAUDE.md and .claude/agents. Neither holds credentials. CLAUDE.md is the project's standing instructions to the agent: conventions, internal system names, the rules the team gave it. The agents directory holds subagent definitions, which are system prompts. An attacker who reads them learns how your agent behaves, what it is told never to do, and what your infrastructure is called. That is reconnaissance for the next step, whether the next step targets the agent or the people who wrote its rules.
We cannot say what the operator did with what it found. Our decoys return inert content: a placeholder host that cannot resolve, no command and no credential. The address made no follow-up request to our decoys.
What this does and does not show
It shows that someone is sweeping for agent configuration beyond the settings files, with CLAUDE.md and the agents directory on the list from the start, and that the sweep arrives in two speeds, a fast parallel burst and a slow tail.
It does not show who is behind it, but it is not a new face. The same /24 (a block of 256 addresses) produced the earlier blocks. Between October 23 and October 30 our edge blocked 273 requests from two addresses in that range: 104 of them inside one minute on the 23rd, 169 spread from the 25th to early this morning. Every one carried the same Chrome-on-Windows user agent string as today's catch.
We do not know why this request reached a decoy on one of our other sites when those did not. One catch from one address is one observation. The range is the thing to watch.
What to do about your own repository
These steps take minutes.
Never serve a dot-directory from a web root. Block /.claude/, /.cursor/, /.vscode/ and /.mcp.json at the web server or edge, the same way you block /.git/.
Check what your deploy actually ships. A build that copies the whole repository to a static host carries the agent files with it.
Treat CLAUDE.md and agent definitions as internal documents. Do not put keys or customer names in them, and assume anything in a repository that ever gets published can be read.
Keep secrets out of MCP configuration files. Reference environment variables or a secret store.
Limits
One address, one afternoon, eight requests. The path list is what was asked for, not what the operator wanted. The timing is read from our own canary timestamps, and we cannot see the operator's side. The idea that the parallel burst is a scanner template is an inference from the one-second spacing, and linking today's request to the earlier blocks rests on the range and the user agent string, which are strong hints and not proof of one operator.
Five percent of this is wrong somewhere. It always is.
If this was useful, or was not, rate it at the bottom of the page.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments