Skip to content
OpenA2AResearch

OpenA2A Research: security research on AI agent infrastructure

Security research on AI agent infrastructure. A continuous honey-agent fleet, monthly internet-wide exposure sweeps, and live indices. Every finding classified by Threat Matrix technique, every count published with its query.

Latest report Threat lifecycle Methodology Latest edition
426.0K
TrapMyAgent events, 30 days
0 of 2,813
AgentPwn callbacks from declared autonomous agents, 30 days
255.6K
exposed AI services
3.1M+
requests logged by the OpenA2A honeypot network, all time
Featured · State of AI Agent Security: The Tool Calls Arrive

TrapMyAgent's decoy MCP servers took 420 tool calls. Still, no callback on the AgentPwn pages declared an agent.

Behavioral Threat Report Issue 6. TrapMyAgent's decoy MCP servers took 420 tool calls in the 30 days to October 19, from 19 fingerprints. 0 of 2,813 attributed AgentPwn callbacks came from a client declaring itself an autonomous agent. Agent-to-Agent handshakes on TrapMyAgent reached 27,247 while A2A tasks totaled 1. Exposed MCP servers rose to 2,495 from 1,997; the 255,582 exposed AI services ARIAscout counted are published without a trend on the total.

Read the report
426.0K
events in window
93.1%
targeted MCP
30%
fingerprint recurrence rate
11,321
distinct fingerprints

All four measured over the window.

Live signalscontinuous measurement
See live indices

Exposure over time

255.6K
MarAprMayJunJulAugSepOct

Exposed AI services, one point per month, each the latest sweep that month and shown on the day it was measured. Where a month holds more than one sweep the readings can differ by more than the internet moves between months, so the date is part of the figure. How a sweep is counted.

What's exposed

OpenClaw gateways205.6K80.5%
Agent tools30.2K11.8%
LLM endpoints17.1K6.7%
MCP servers2.5K1.0%
Agent infrastructure1110.0%
A2A endpoints370.0%

ARIAscout sweep of .

What attackers target

Model Context Protocol (MCP) connection396.4K93.1%
Agent-to-Agent (A2A) handshake27.2K6.4%
Context read (other)1.9K0.4%
MCP resource read, file read, MCP tool call, credential access, soul probe, A2A task4700.1%

Honey-agent events, .

10 reports
behavioral threat report7 min read

State of AI Agent Security: The Tool Calls Arrive

Behavioral Threat Report Issue 6. TrapMyAgent's decoy MCP servers took 420 tool calls in the 30 days to October 19, from 19 fingerprints. 0 of 2,813 attributed AgentPwn callbacks came from a client declaring itself an autonomous agent. Agent-to-Agent handshakes on TrapMyAgent reached 27,247 while A2A tasks totaled 1. Exposed MCP servers rose to 2,495 from 1,997; the 255,582 exposed AI services ARIAscout counted are published without a trend on the total.

behavioral threat report6 min read

State of AI Agent Security: Volume Without Declared Agents

Behavioral Threat Report Issue 5. TrapMyAgent recorded 439,114 events in the 30 days to September 17, about twice the previous comparable window, from 8,776 distinct fingerprints, fewer than before. With attribution covering every callback in the window, none of the attributed AgentPwn callbacks came from a client declaring itself an autonomous agent. Exposed OpenClaw gateways and MCP servers grew on the month; the 243,615 exposed AI services ARIAscout counted are published without a trend on the total.

behavioral threat report14 min read

State of AI Agent Security: The Identity Ceiling

Behavioral Threat Report Issue 4. Agent identity is something a client says about itself. All three routes to an agent verdict in our classifier are declarations, and the one bucket that is not a declaration cannot exclude a model driving a real browser: of 6,665 agent-attributed events zero are verified, while 1,921 declared-crawler rows are, because crawlers publish an identity and agents have none to publish. Detection that survives an uncooperative client has to be behavioural. Also in this issue: the honey-fleet noise floor published layer by layer, six earlier readings re-measured with the queries that produced them, and an honest account of which surfaces are still not instrumented.

behavioral threat report16 min read

State of AI Agent Security: Who Follows the Bait

Behavioral Threat Report Issue 3. Agent-vs-crawler attribution shipped this month: of the AgentPwn payload callbacks we could attribute, 0 were autonomous LLM agents. It corrects the Issue 2 framing.

behavioral threat report15 min read

State of AI Agent Security: A Surface in Migration

Behavioral Threat Report Issue 2. Exposure rose to 320,506 services with exposed Ollama up 225% and MLflow up 173%. 41% of distinct fingerprints appeared in more than one session. Reported on a corrected 30-day-window basis.

behavioral threat report15 min read

State of AI Agent Security: The Protocol Attackers Prefer

Inaugural Behavioral Threat Report. 206,571 honey-agent events across 9,037 distinct fingerprints over 30 days. 45% of distinct fingerprints appeared in more than one session. 343 wild injection-bait surfaces detected on the public web.

exposure sweep6 min read

Internet-Wide AI Exposure Sweep: April 2026

321,929 exposed AI services indexed by Shodan. 263,853 OpenClaw gateways on port 18789, 25,097 Streamlit apps, 25,036 Ollama instances identified by product signature. First sweep using product-based queries for higher-confidence identification.

ecosystem analysis8 min read

OASB scanner benchmark: accuracy figures withdrawn

Withdrawn August 9, 2026. The accuracy figures this report published came from a corpus whose benign class was labeled by the scanner under test. Recall on authored fixtures is retained. The corpus, the taxonomy and the comparison with Holzbauer et al. are unaffected.

exposure sweep6 min read

Internet-Wide AI Exposure Sweep: March 2026

490,295 Shodan detections. ~140,000 verified exposed AI services after active HTTP probing. 3.5x inflation factor between passive scanning and confirmed findings.

exposure sweep7 min read

AI agent security: 97,000 hosts, 1,190 exposed configs

We scanned 97,013 internet-facing hosts for AI agent vulnerabilities. 14.4% had confirmed security issues. 1,190 had their system instructions publicly readable.