Research methodology

Authorship

ARIA is OpenA2A's autonomous research system. Six specialized agents handle hypothesis generation, exposure sweeps, behavioral threat synthesis, exploit development, patch development, statistical analysis, and disclosure coordination. Reports authored by ARIA carry a system byline. Editorial review is done by a named human, currently Abdel Fane. Bylines on every report disclose both.

Disclosure of authorship is a credibility move, not a limitation. We document how our content is made. Trust signals in 2026 favor organizations that show the work, not organizations that hide automation.

All findings are reviewed by a human editor before publication. The editor can return a draft for revision. The editor cannot rewrite an ARIA finding under a different byline.

Four data streams

OpenA2A operates four telemetry streams. Each measures a distinct slice of AI agent security. The monthly Behavioral Threat Report synthesizes across all four; specialty reports may use only one. Every stream is documented in full at its own sub-page.

Registry trust signals (opt-in)

Where deployed scanners (HMA), guards (ARP), verifiers (AIM), and brokers (Secretless) are opted in, telemetry from those deployments contributes supplementary signal. Examples include scan volume, check failure rates, trust score distribution, and capability decision counts. All Registry telemetry is opt-in. Reports cite Registry signals only when the deploying organization has explicitly authorized inclusion in research data.

Deduplication rule

One number, one home. Each metric lives in exactly one stream. Live values stay on dashboards. Monthly reports quote with a timestamp and link to the dashboard. Reports are time capsules. Live numbers stay on the dashboard.

• Exposed AI services count lives on the Exposure Prevalence Index (ARIAscout).
• Honeypot fleet event totals live on the Attack Prevalence Index (ARIAtrap).
• Sophistication distribution lives on the Sophistication Index (ARIAtrap, distribution-only).
• HoneyMap surface counts live on the wild-bait dashboard.
• Each Agent Threat Matrix technique resolves to exactly one T-NNNN identifier.

Evidence standards

Every Agent Threat Matrix technique cited in a report carries an evidence tier. We do not publish a technique that does not pass at least one tier. The tier rubric comes from the Agent Threat Matrix evidence audit.

Read from the Threat Matrix catalogue on 2026-09-13, not typed by hand. The Threat Matrix grows continuously, so this table changes when the catalogue does. The live evidence audit lives at the matrix repository.

Per-source limitations

Every stream has a structural limit. We publish each limit alongside the finding it constrains.

• HoneyMap is a sample, not a coverage count. Numbers are what CommonCrawl, Shodan banner data, and CT-log domain expansion reached during the reporting window. Surfaces that block crawlers are systematically invisible.
• TrapMyAgent geography reflects origin IP geolocation. VPN, proxy, and Cloudflare-fronting infrastructure can obscure the real origin. ASN-level analysis separates origin from terminus when needed.
• AgentPwn publishes callback counts and a callback share, not an attack-success rate. A callback is a fetch of a canary URL planted in a payload. It does not establish that an agent, rather than a browser, crawler, or scripted client, made the fetch, and it does not measure what the client did next. The callback share is the share of all recorded interactions that were such fetches, a mix descriptor. Per-sector, per-method, and per-family rates are withheld as not measurable. Reports that extrapolate from callbacks to compromise scope should be read with that caveat.
• Sophistication scoring is distribution-only. The supervised classifier that would ground a mean does not yet exist. We do not publish a sophistication mean, grade, or month-over-month delta. We publish the per-session distribution and label the rubric as in calibration.
• User-agent strings are not identity claims. Attacker UA strings are attacker-controllable. We report aggregate UA categories with explicit limits, never name a vendor or model without evidence beyond the UA string.
• ARIAscout sees what Shodan indexes. Shodan's index is a public snapshot of internet-facing infrastructure with banner-grabbing limitations and indexing lag. Services that block Shodan crawlers, run on non-standard ports without service signatures, or sit behind login walls are systematically invisible.

How to cite OpenA2A research

Every report carries a citation block in BibTeX and APA format. Citation makes the work compound. Make citation easy.

@techreport{opena2a-btr-YYYY-MM,
  author = {{ARIA, OpenA2A autonomous research system} and <editor name> (editor)},
  title  = {State of AI Agent Security: <Month> <Year>},
  institution = {OpenA2A Research},
  year   = {<year>},
  month  = {<month>},
  type   = {Behavioral Threat Report},
  number = {Issue N},
  url    = {<report URL>}
}

ARIA, & <Editor>. (Ed.). (<year>, <month> <day>). State of AI Agent Security: <Month> <Year> (Behavioral Threat Report Issue N). OpenA2A Research. <URL>

DOI assignment is on the roadmap. Until then, the canonical URL of each report is the persistent identifier.

How to challenge a finding

Email info@opena2a.org with the specific number you dispute and the methodology you would prefer we used. Substantive challenges that hold up under review are published as methodology updates in subsequent editions with attribution.

Response target: five business days. Disputes that turn on definitions (what counts as an agent, what counts as a session) typically resolve faster than disputes that turn on sampling. We do not maintain a site-wide errata register or a corrections changelog. Issue 4 of the Behavioral Threat Report re-measures earlier readings against the queries that produced them and publishes both.

ARIAscout: exposure sweeps

ARIAscout is the longest-running stream. It uses 207 Shodan search queries across ten categories to identify internet-facing AI agent infrastructure. The newest reading, with its sweep date, is on the Exposure Prevalence Index, which also lists one point per month, each dated to the day it was measured. Sweeps with a written report are in the exposure sweep archive.

How a category count is defined. Each category is the sum of every query in it, not a single representative query. The OpenClaw category, for example, is the total across all nine of its queries and not the port:18789query on its own, which runs about 1 to 2 percent lower. Issues 1 and 2 of the Behavioral Threat Report published the single-query figure for OpenClaw and Issues 3 and 4 published the category total. Both are real measurements of the sweeps they name, but they are not the same quantity, so a reader comparing an OpenClaw figure across those editions is comparing two definitions. Issue 3's month-over-month sentence has been corrected to use the category total on both sides; the earlier editions stand as published.

Sweep dates are UTC.A sweep is dated by the UTC day it ran, which is the day the canonical store records. A sweep run in the evening in North America therefore carries the following day's date. The April 2026 sweep ran at 02:38 UTC on the 11th and was published on the 10th local; it is dated 2026-04-11 throughout, and the publication date on that report remains the day it was published.

Process

1. Target discovery via Shodan. 207 queries across Python frameworks, Node.js servers, Go/Java/Ruby/Rust frameworks, cloud platforms, API patterns, AI/ML infrastructure, and agent-framework signatures.
2. Banner and response analysis. Shodan's cached banner data and HTTP response headers are analyzed for security-relevant patterns: exposed configuration files, agent instruction files, API key patterns, MCP tool definitions, gateway signatures, and debug mode indicators. Only findings with clear signature matches in the indexed data are counted.
3. Aggregation and reporting. Findings are aggregated by pattern type. Rates are computed against the proportion of indexed hosts showing security-relevant patterns. No individual hosts, IPs, or organizations are identified in published output.

Shodan query categories

207 queries are distributed across these categories.

Patterns analyzed

ARIAscout analyzes Shodan index data for 12 security-relevant patterns.

Reproducibility

All ARIA methodology is documented for transparency. Each stream's reproduction requirements are published on its sub-page. ARIAscout's requirements:

Ethics and legal framework

• *ARIAscout research is based on analysis of Shodan's publicly available index data.
• *ARIAtrap honey agents and AgentPwn honeypot pages run on infrastructure OpenA2A controls.
• *HoneyMap samples public-web content via CommonCrawl, Shodan, and CT logs. It does not authenticate into any system.
• *No authentication mechanisms on third-party systems are bypassed or tested.
• *No private data is retrieved, stored, or disclosed.
• *Reports use aggregate statistics only. No organizations, IPs, or domains are identified in published output.
• *Security patterns are identified through open source code review and default configuration analysis.
• *Vulnerability findings flow through the ARIAdesk 90-day coordinated disclosure pipeline before publication.