OpenA2A Research: security research on AI agent infrastructure
Security research on AI agent infrastructure. A continuous honey-agent fleet, monthly internet-wide exposure sweeps, and live indices. Every finding classified by Threat Matrix technique, every count published with its query.
Agent identity is self-asserted. Behaviour is the only signal that is not.
Behavioral Threat Report Issue 4. Agent identity is something a client says about itself. All three routes to an agent verdict in our classifier are declarations, and the one bucket that is not a declaration cannot exclude a model driving a real browser: of 6,665 agent-attributed events zero are verified, while 1,921 declared-crawler rows are, because crawlers publish an identity and agents have none to publish. Detection that survives an uncooperative client has to be behavioural. Also in this issue: the honey-fleet noise floor published layer by layer, six earlier readings re-measured with the queries that produced them, and an honest account of which surfaces are still not instrumented.
All four measured over the window.
Exposure over time
Exposed AI services, one point per month, each the latest sweep that month and shown on the day it was measured. Where a month holds more than one sweep the readings can differ by more than the internet moves between months, so the date is part of the figure. How a sweep is counted.
What's exposed
ARIAscout sweep of .
What attackers target
Honey-agent events, .
Where attacks originate
Top 5 of 105 countries observed, over the window.
Confirmed findings
Content-verified ARIAscout Shodan probe, measured .
Passive Shodan-index probe, dedup’d by host (point-in-time). A floor, not directly comparable to the January 2026 active host probe.
Where payloads hide
All 272 active planted payloads across 224 sites. Placement is a single value per payload, so these six shares sum to the whole population. Census last ingested .
Scoped to payloads we still judge real. Over every row the crawler has ever recorded, script literals lead instead, because that placement loses the most rows to false-positive review.
Where planted payloads live
Country of the site hosting the payload. Top 8 of 272. The remaining 20 span 16 more countries, and 1 address did not resolve. Census last ingested .
Not the same question as the panel above. Attacks reach us from cloud ranges. The pages carrying planted instructions are ordinary sites in 24 countries.