Research methodology

Authorship

ARIA is OpenA2A's autonomous research system. Six specialized agents handle hypothesis generation, exposure sweeps, behavioral threat synthesis, exploit development, patch development, statistical analysis, and disclosure coordination. Reports authored by ARIA carry a system byline. Editorial review is done by a named human, currently Abdel Fane. Bylines on every report disclose both.

Disclosure of authorship is a credibility move, not a limitation. We document how our content is made. Trust signals in 2026 favor organizations that show the work, not organizations that hide automation.

All findings are reviewed by a human editor before publication. The editor can return a draft for revision. The editor cannot rewrite an ARIA finding under a different byline.

Four data streams

OpenA2A operates four telemetry streams. Each measures a distinct slice of AI agent security. The monthly Behavioral Threat Report synthesizes across all four; specialty reports may use only one. Every stream is documented in full at its own sub-page.

Registry trust signals (opt-in)

Where deployed scanners (HMA), guards (ARP), verifiers (AIM), and brokers (Secretless) are opted in, telemetry from those deployments contributes supplementary signal. Examples include scan volume, check failure rates, trust score distribution, and capability decision counts. All Registry telemetry is opt-in. Reports cite Registry signals only when the deploying organization has explicitly authorized inclusion in research data.

Deduplication rule

One number, one home. Each metric lives in exactly one stream. Live values stay on dashboards. Monthly reports quote with a timestamp and link to the dashboard. Reports are time capsules. Live numbers stay on the dashboard.

• Exposed AI services count lives on the Exposure Prevalence Index (ARIAscout).
• Honeypot fleet event totals live on the Attack Prevalence Index (ARIAtrap).
• Sophistication distribution lives on the Sophistication Index (ARIAtrap, distribution-only).
• HoneyFinder surface counts live on the wild-bait dashboard.
• Each Agent Threat Matrix technique resolves to exactly one T-NNNN identifier.

Evidence standards

Every Agent Threat Matrix technique cited in a report carries an evidence tier. We do not publish a technique that does not pass at least one tier. The tier rubric comes from the Agent Threat Matrix evidence audit.

Counts as of the publication of the May 2026 Behavioral Threat Report. The Threat Matrix grows continuously. The live evidence audit lives at the matrix repository.

Per-source limitations

Every stream has a structural limit. We publish each limit alongside the finding it constrains.

• HoneyFinder is a sample, not a coverage count. Numbers are what CommonCrawl, Shodan banner data, and CT-log domain expansion reached during the reporting window. Surfaces that block crawlers are systematically invisible.
• TrapMyAgent geography reflects origin IP geolocation. VPN, proxy, and Cloudflare-fronting infrastructure can obscure the real origin. ASN-level analysis separates origin from terminus when needed.
• AgentPwn attack-success rate measures injection-following. A callback proves an agent followed a payload. It does not measure downstream impact. Reports that extrapolate from injection-following to compromise scope should be read with that caveat.
• Sophistication scoring is distribution-only. The supervised classifier that would ground a mean does not yet exist. We do not publish a sophistication mean, grade, or month-over-month delta. We publish the per-session distribution and label the rubric as in calibration.
• User-agent strings are not identity claims. Attacker UA strings are attacker-controllable. We report aggregate UA categories with explicit limits, never name a vendor or model without evidence beyond the UA string.
• ARIAscout sees what Shodan indexes. Shodan's index is a public snapshot of internet-facing infrastructure with banner-grabbing limitations and indexing lag. Services that block Shodan crawlers, run on non-standard ports without service signatures, or sit behind login walls are systematically invisible.

How to cite OpenA2A research

Every report carries a citation block in BibTeX and APA format. Citation makes the work compound. Make citation easy.

@techreport{opena2a-btr-YYYY-MM,
  author = {{ARIA, OpenA2A autonomous research system} and <editor name> (editor)},
  title  = {State of AI Agent Security: <Month> <Year>},
  institution = {OpenA2A Research},
  year   = {<year>},
  month  = {<month>},
  type   = {Behavioral Threat Report},
  number = {Issue N},
  url    = {<report URL>}
}

ARIA, & <Editor>. (Ed.). (<year>, <month> <day>). State of AI Agent Security: <Month> <Year> (Behavioral Threat Report Issue N). OpenA2A Research. <URL>

DOI assignment is on the roadmap. Until then, the canonical URL of each report is the persistent identifier.

How to challenge a finding

Email research@opena2a.org with the specific number you dispute and the methodology you would prefer we used. Substantive challenges that hold up under review are published as methodology updates in subsequent editions with attribution.

Response target: five business days. Disputes that turn on definitions (what counts as an agent, what counts as a session) typically resolve faster than disputes that turn on sampling. We will not silently change a published number. Errata appear in the methodology page changelog and in the affected report's footer.

ARIAscout: exposure sweeps

ARIAscout is the longest-running stream. It uses 207 Shodan search queries across ten categories to identify internet-facing AI agent infrastructure. As of April 10, 2026, 321,929 services were indexed.

Process

1. Target discovery via Shodan. 207 queries across Python frameworks, Node.js servers, Go/Java/Ruby/Rust frameworks, cloud platforms, API patterns, AI/ML infrastructure, and agent-framework signatures.
2. Banner and response analysis. Shodan's cached banner data and HTTP response headers are analyzed for security-relevant patterns: exposed configuration files, agent instruction files, API key patterns, MCP tool definitions, gateway signatures, and debug mode indicators. Only findings with clear signature matches in the indexed data are counted.
3. Aggregation and reporting. Findings are aggregated by pattern type. Rates are computed against the proportion of indexed hosts showing security-relevant patterns. No individual hosts, IPs, or organizations are identified in published output.

Shodan query categories

207 queries are distributed across these categories.

Patterns analyzed

ARIAscout analyzes Shodan index data for 12 security-relevant patterns.

Reproducibility

All ARIA methodology is documented for transparency. Each stream's reproduction requirements are published on its sub-page. ARIAscout's requirements:

Ethics and legal framework

• *ARIAscout research is based on analysis of Shodan's publicly available index data.
• *ARIAtrap honey agents and AgentPwn honeypot pages run on infrastructure OpenA2A controls.
• *HoneyFinder samples public-web content via CommonCrawl, Shodan, and CT logs. It does not authenticate into any system.
• *No authentication mechanisms on third-party systems are bypassed or tested.
• *No private data is retrieved, stored, or disclosed.
• *Reports use aggregate statistics only. No organizations, IPs, or domains are identified in published output.
• *Security patterns are identified through open source code review and default configuration analysis.
• *Vulnerability findings flow through the ARIAdesk 90-day coordinated disclosure pipeline before publication.