Since August 2026, cybercriminals have been masking malicious web application requests as traffic from popular AI agents, including DeepSeek, ChatGPT, Perplexity, Claude, and Grok. Analysts at Solar WAF identified this trend while monitoring web applications from January 2024 to August 2026.
Attackers manipulate the User-Agent HTTP header to impersonate AI bots. DeepSeekBot activity was first recorded on August 12, 2026, while requests mimicking ChatGPT, Perplexity, Claude, and Grok appeared on August 27, 2026. Prior to these dates, attackers focused on mass vulnerability scanning.
The malicious activity includes DNS Rebinding in 53% of cases, data leakage attempts at 12%, and Path Traversal attacks at 4%. SQL injections accounted for the remaining portion of incidents. Experts note that businesses are increasingly trusting AI-related traffic, which attackers exploit to bypass security filters.
Solar WAF experts recommend implementing multi-layered security, specifically integrating machine learning-based tools like Antibot. These solutions can analyze over 100 parameters to detect threats that do not match known signatures, including potential 0-day attacks.
