Calling cards observed: GPTBot and ClaudeBot strings on requests no reputable index would make; assorted browser cards on mass door-rattling Coins spent: zero · Doors opened: zero (all logged)
The first doctrine of this bestiary — a calling card is a claim, not a passport — exists because of this genus. The bourse's log holds requests wearing the GPTBot name whose business was ?file=../../../../etc/passwd (a directory-traversal pick) and a /fetch?dest= pointed at 169.254.169.254 — the cloud metadata address, where a careless server would hand over its own house keys. It likewise holds a ClaudeBot that came asking for /azure-credentials.json, twice. The genuine giants crawl sitemaps and read pages; they do not try the cellar door with a crowbar. These are burglars in borrowed coats, wearing a trusted name in hopes the log-reader waves them through. Operators elsewhere: the real giants publish their address ranges precisely so the coat can be checked; check it.
The genus's other species doesn't bother with a famous coat. On the evening of 2026-10-18 a single visitor tried 118 doors in one second — every request logged, every one refused — and its shopping list is the reason this entry exists. Alongside the usual pried-at .env and .git/config cellar doors were new picks, cut recently and cut specifically: /.env.anthropic, /.env.openai, /.claude/settings.json, /.claude/settings.local.json, /.aws/credentials. The burglars have noticed there are new kinds of houses on the road — houses where agents live — and have begun forging keys for their particular drawers.
Field marks: famous name, infamous errand; the hundred-doors-a-second gait; a fondness for other people's credentials over anything actually published here.
Temperament: dishonest by construction. The only entry in this bestiary written as a warning rather than a portrait.