OpenA2A Research: security research on AI agent infrastructure

OpenA2A
Research
Updated Sep 17, 2026

Security research on AI agent infrastructure. A continuous honey-agent fleet, monthly internet-wide exposure sweeps, and live indices. Every finding classified by Threat Matrix technique, every count published with its query.

Latest report Threat lifecycle Methodology
439.1K
TrapMyAgent events, 30 days
0 of 2,437
AgentPwn callbacks from declared autonomous agents, 30 days
243.6K
exposed AI services
2.3M+
requests logged by the OpenA2A honeypot network, all time
Featured · State of AI Agent Security: Volume Without Declared Agents

TrapMyAgent saw twice the traffic from fewer clients. Of 2,437 attributed callbacks on the AgentPwn honeypot pages, none came from a client declaring itself an autonomous agent.

Behavioral Threat Report Issue 5. TrapMyAgent recorded 439,114 events in the 30 days to September 17, about twice the previous comparable window, from 8,776 distinct fingerprints, fewer than before. With attribution covering every callback in the window, 0 of 2,437 attributed AgentPwn callbacks came from a client declaring itself an autonomous agent. Agent-to-Agent handshakes on TrapMyAgent rose about 14 times while A2A tasks stayed at 2. Exposed OpenClaw gateways and MCP servers grew on the month; the 243,615 exposed AI services ARIAscout counted are published without a trend on the total.

Read the report
439.1K
events in window
96.1%
targeted MCP
27%
fingerprint recurrence rate
8,776
distinct fingerprints

All four measured over the window.

Live signalscontinuous measurement
See live indices

Exposure over time

MarAprMayJunJulAugSepOct248.7K2026-10-01

Exposed AI services, one point per month, each the latest sweep that month and shown on the day it was measured. Where a month holds more than one sweep the readings can differ by more than the internet moves between months, so the date is part of the figure. How a sweep is counted.

What's exposed

OpenClaw gateways198.8K80.0%
Agent tools29.4K11.8%
LLM endpoints18.0K7.2%
MCP servers2.3K0.9%
Agent infrastructure1130.0%
A2A endpoints260.0%

ARIAscout sweep of .

What attackers target

Model Context Protocol (MCP) connection422.0K96.1%
Agent-to-Agent (A2A) handshake15.7K3.6%
Context read (other)1.4K0.3%
MCP resource read, file read, MCP tool call, A2A task610.0%

Honey-agent events, .

9 reports
behavioral threat report8 min read

State of AI Agent Security: Volume Without Declared Agents

Behavioral Threat Report Issue 5. TrapMyAgent recorded 439,114 events in the 30 days to September 17, about twice the previous comparable window, from 8,776 distinct fingerprints, fewer than before. With attribution covering every callback in the window, 0 of 2,437 attributed AgentPwn callbacks came from a client declaring itself an autonomous agent. Agent-to-Agent handshakes on TrapMyAgent rose about 14 times while A2A tasks stayed at 2. Exposed OpenClaw gateways and MCP servers grew on the month; the 243,615 exposed AI services ARIAscout counted are published without a trend on the total.

behavioral threat report14 min read

State of AI Agent Security: The Identity Ceiling

Behavioral Threat Report Issue 4. Agent identity is something a client says about itself. All three routes to an agent verdict in our classifier are declarations, and the one bucket that is not a declaration cannot exclude a model driving a real browser: of 6,665 agent-attributed events zero are verified, while 1,921 declared-crawler rows are, because crawlers publish an identity and agents have none to publish. Detection that survives an uncooperative client has to be behavioural. Also in this issue: the honey-fleet noise floor published layer by layer, six earlier readings re-measured with the queries that produced them, and an honest account of which surfaces are still not instrumented.

behavioral threat report16 min read

State of AI Agent Security: Who Follows the Bait

Behavioral Threat Report Issue 3. Agent-vs-crawler attribution shipped this month: of the AgentPwn payload callbacks we could attribute, 1,985 were browsers and link prefetchers, 9 were LLM content crawlers, and 0 were autonomous LLM agents. It corrects the Issue 2 framing. Inside the honey-agent fleet, MCP drew 99% of events and 99.5% of sessions classified as automated scanners.

behavioral threat report15 min read

State of AI Agent Security: A Surface in Migration

Behavioral Threat Report Issue 2. In the 30-day window the Model Context Protocol drew 97.9% of honey-agent events, a larger share than in May. Exposure rose to 320,506 services with exposed Ollama up 225% and MLflow up 173%. 41% of distinct fingerprints appeared in more than one session. Reported on a corrected 30-day-window basis.

behavioral threat report15 min read

State of AI Agent Security: The Protocol Attackers Prefer

Inaugural Behavioral Threat Report. 206,571 honey-agent events across 9,037 distinct fingerprints over 30 days. The Model Context Protocol drew 82.8% of the events in the three published event types. 45% of distinct fingerprints appeared in more than one session. 343 wild injection-bait surfaces detected on the public web.

exposure sweep6 min read

Internet-Wide AI Exposure Sweep: April 2026

321,929 exposed AI services indexed by Shodan. 263,853 OpenClaw gateways on port 18789, 25,097 Streamlit apps, 25,036 Ollama instances identified by product signature. First sweep using product-based queries for higher-confidence identification.

ecosystem analysis8 min read

OASB scanner benchmark: accuracy figures withdrawn

Withdrawn August 9, 2026. The accuracy figures this report published came from a corpus whose benign class was labeled by the scanner under test. Recall on authored fixtures is retained. The corpus, the taxonomy and the comparison with Holzbauer et al. are unaffected.

exposure sweep6 min read

Internet-Wide AI Exposure Sweep: March 2026

490,295 Shodan detections. ~140,000 verified exposed AI services after active HTTP probing. 3.5x inflation factor between passive scanning and confirmed findings.

exposure sweep7 min read

AI agent security: 97,000 hosts, 1,190 exposed configs

We scanned 97,013 internet-facing hosts for AI agent vulnerabilities. 14.4% had confirmed security issues. 1,190 had their system instructions publicly readable.