97,000 AI Agents Exposed

How We Collected This Data

We used 207 Shodan queries across 10 categories to identify internet-facing hosts with AI agent infrastructure signatures. Shodan is a publicly available search engine that indexes internet-connected devices and their response banners.

Shodan's cached banner data and HTTP response headers were analyzed for security-relevant patterns: exposed configuration files, agent instruction files, API key patterns in headers, MCP tool definitions, gateway endpoints, and debug mode indicators.

All findings are based on analysis of publicly indexed data. Our full methodology is documented at methodology.

What We Found

Across 11,100 scanned hosts, we confirmed 8,449 individual security findings.

1,190 Agent Configuration Files Indexed

CLAUDE.md files contain system instructions for AI agents, including behavioral rules, tool access policies, and configuration details. Shodan's index identified 1,190 hosts where these files appeared in HTTP response data or directory listings.

The security risk of publicly accessible agent configuration files:

• Tool access surface — reveals what capabilities the agent has
• Decision logic — may expose authorization rules and guardrail implementations
• Infrastructure details — may reference internal service names and endpoints
• Credential exposure — configuration files sometimes contain hardcoded secrets

645 MCP Tool Definitions Exposed

The Model Context Protocol (MCP) is how AI agents connect to external tools. MCP servers expose a /tools endpoint that lists every available tool with its parameters.

Shodan's cached data showed 645 hosts with MCP tool definitions visible in HTTP response headers or body content. 58 of those showed no authentication indicators in their response headers, suggesting default configurations without access controls.

289 Agent Gateways Indexed

AI agent frameworks like OpenClaw use gateway servers (typically on port 18789) to manage agent sessions, tool execution, and channel integrations. Shodan indexed 289 hosts with gateway signatures on this port. 22 of those also had WebSocket control plane signatures on port 18790.

Review of OpenClaw's open-source gateway code reveals that the default configuration does not require authentication. The config.getAPI method, by design, returns the full configuration object, which may include integration tokens. This is a documented default behavior in the project's source code.

What We're Doing About It

Reporting vulnerabilities without contributing fixes is incomplete work. We are doing both.

Contributing Upstream: OpenClaw Skill Code Safety Scanner

We submitted PR #9806 — a skill/plugin code safety scanner that detects dangerous patterns before they execute:

HackMyAgent: Scan Your Own Infrastructure

Use HackMyAgent to audit your own AI agent infrastructure for the patterns described in this report:

Recommendations

If you are running AI agents in production:

1. Audit your network exposure. Run hackmyagent scan your-domain.com to check what's reachable from the internet.
2. Protect CLAUDE.md and config files. Configure your web server to deny access to /.claude/, /CLAUDE.md, /mcp.json, /.env.
3. Authenticate MCP endpoints. Every MCP server should require authentication. An exposed /tools endpoint is an invitation to invoke your agent's capabilities.
4. Scan plugins before installing. Use static analysis to detect dangerous patterns in plugin code before execution.
5. Don't use dangerous config flags in production. Flags like dangerouslyDisableDeviceAuth exist for local development only.
6. Rotate exposed credentials immediately. If your config files were publicly accessible, assume any credentials in them are compromised.