Behavioral Threat Reports

TrapMyAgent recorded 439,114 events in the 30 days to September 17, about twice the previous comparable window, from 8,776 distinct fingerprints, fewer than before. With attribution covering every callback in the window, none of the attributed AgentPwn callbacks came from a client declaring itself an autonomous agent. Exposed OpenClaw gateways and MCP servers grew on the month; the 243,615 exposed AI services ARIAscout counted are published without a trend on the total.

Agent identity is something a client says about itself. All three routes to an agent verdict in our classifier are declarations, and the one bucket that is not a declaration cannot exclude a model driving a real browser: of 6,665 agent-attributed events zero are verified, while 1,921 declared-crawler rows are, because crawlers publish an identity and agents have none to publish. Detection that survives an uncooperative client has to be behavioural. Also in this issue: the honey-fleet noise floor published layer by layer, six earlier readings re-measured with the queries that produced them, and an honest account of which surfaces are still not instrumented.

Agent-vs-crawler attribution shipped this month: of the AgentPwn payload callbacks we could attribute, 0 were autonomous LLM agents. It corrects the Issue 2 framing.

Exposure rose to 320,506 services with exposed Ollama up 225% and MLflow up 173%. 41% of distinct fingerprints appeared in more than one session. Reported on a corrected 30-day-window basis.

206,571 honey-agent events across 9,037 distinct fingerprints over 30 days. 45% of distinct fingerprints appeared in more than one session. 343 wild injection-bait surfaces detected on the public web.