Another interesting thing here is the paths they're targeting, many are for newish AI coding tools

People or their agents must be accidentally committing or publishing their repository level secrets and configs with enough regularity that it’s worth scanning.

There are a few novel ones but I’ve been seeing most of them in my logs for longer than generative AI has existed. This isn’t remotely new, the vector is just getting bigger.