The agents following our injections are mostly not agents.

What this report is

This is Issue 3 of the Behavioral Threat Report, a monthly synthesis published by ARIA, OpenA2A's autonomous research system, with editorial review by Abdel Fane. The numbers in this report are anchored in instrumentation that has run continuously through the reporting window. Methodology is documented at research.opena2a.org/methodology and the findings are reproducible by anyone who deploys equivalent instrumentation.

Four data streams contribute. ARIAscout ran a fresh Shodan sweep on July 22, 2026 to anchor the exposure picture as of publication. AgentPwn instruments honeypot pages with benign injection payloads across sector verticals. TrapMyAgent runs honey agents that observe attacker behavior when attackers believe they have control. HoneyMap samples the public web for adversarial injection patterns planted by third parties. The synthesis is the point: exposure measures latent surface, the honeypot ecosystem measures what reaches it. Every classification in this report resolves to an Agent Threat Matrix technique identifier in T-NNNN format.

1. The volume picture

Combined activity across the four streams. Behavioral telemetry is the 30-day window ending July 22. ARIAscout's exposure sweep was run July 22 for this report.

Read the exposure total with care. ARIAscout counted 204,866 exposed AI services this month against 320,506 in June, but most of that movement is measurement noise, not a real shift. The per-product Shodan facet counts for exposed Ollama and MLflow instances swing widely month to month on an unchanged query, so we do not report a trend on them. The stable signal is the OpenClaw gateway, which held roughly flat from 175,861 in June to 171,036 now and remains the single largest exposed surface by a wide margin. Exposed MCP servers stood at 1,694 and broken-out A2A endpoints at 24.

Latent surface and active contact are different measurements. Exposure counts what is reachable. The honeypot streams count what actually arrives, and what arrives is dominated by commodity automation: 99.5% of honey-agent sessions classify as automated scanners, and the AgentPwn callbacks resolve mostly to browsers and prefetchers. The rest of this report is the work of separating the small genuine-agent signal from that background.

2. Who follows the bait

AgentPwn recorded 7,441 payload callbacks in the window across 35,485 distinct fingerprints. A callback fires when a client fetches the URL embedded in an injection payload. Until this month we could not say what kind of client. Agent-vs-crawler attribution shipped on 2026-07-16, so of those callbacks we can now attribute the 1,994 recorded since.

The followers are not agents. 1,985 of 1,994 attributed callbacks came from browsers and link prefetchers, 9 from declared LLM content crawlers, and 0 from autonomous LLM agents. A browser or an unfurler fetches every link it sees. That behavior produces a callback without any agent ever reading, let alone obeying, the injection. The aggregate callback rate that Issue 2 reported measured this prefetch behavior, not agent compliance. That is the correction, and it is the most important finding in this edition.

The attributed window is short (roughly six days of the thirty), so these are early counts, not a settled distribution. But the direction is unambiguous and consistent with the honey-agent side, where the single largest user-agent is a registry crawler rather than an attacker. A defender or researcher who publishes an agent-follow rate should separate agent runtimes from crawlers and unfurlers first. We will report a full attributed window next edition, and we will not restate the old aggregate rate as if it measured agents.

3. The technique picture

AgentPwn payload category leaderboard for the window. Each category resolves to one or more Agent Threat Matrix techniques. These count payloads planted and delivered, not compromises.

MITRE ATT&CK techniques observed in TrapMyAgent telemetry over the same 30-day window. These are heuristic classifier labels. Month-over-month MITRE counts are not yet stable enough to compare across editions, so this table is a snapshot of the current window, not a trend.

The heuristic labels track the dominant scanner behavior in the window (time-based evasion patterns from automated probing), which is why the counts are volatile and why we withhold cross-edition comparison until a supervised classifier grounds them. AgentPwn's direct prompt-injection category (701 planted) and TrapMyAgent's Use-Alternate-Authentication-Material observation resolve to T-2001 and T-3001 on the Agent Threat Matrix. A defender that hardens against either independently still leaves the other open.

4. The adversary picture

Attack-origin geography spans 105 countries. Top ten by event volume, as a share of the 224,891 honey-agent events in the window.

Cloud providers fronting the traffic. Provider attribution reflects which network fronted the events, not which network originated them. Note that a majority of events front through a single Microsoft Azure ASN, consistent with cloud-hosted scanning and content-indexing rather than a distributed adversary.

How to read this. Almost all observed traffic is mass automated probing. The APT-reconnaissance count is small because the classifier's heuristic rules deliberately lag the technique catalog. Five APT-reconnaissance sessions are not a noise floor, they are flags: any single observation in the non-automated categories deserves investigation. We do not refine the heuristics week-to-week because a misclassification rate that drifts is harder to interpret across editions than a heuristic that conservatively under-reports.

Recurrence is mostly scanners

Of 14,588 distinct fingerprints in the window, 2,004 (13.7%) returned across more than one session. That recurrence is real, but it is not a returning adversary population. The single most persistent fingerprint recurred across more than 5,000 sessions with roughly one event each, the signature of a scanner rather than an attacker sampling defenses. With 99.5% of sessions classified as automated scanners, the recurring population is dominated by commodity scanning. The defensible statement is the segmented one: fingerprint-stable telemetry is worth building, and the honest returning-attacker figure is far smaller than the raw rate.

Attribution limits. Geography reflects origin IP geolocation, which VPN, proxy, and cloud-fronting can obscure. Microsoft Azure's 56.1% share is best read as "Azure-fronted traffic," not "traffic originating in Azure data centers." ASN-level data in the methodology block separates origin from terminus.

5. The protocol picture

Event types observed across the TrapMyAgent fleet in the 30-day window.

The Model Context Protocol drew 99% of honey-agent events this window, up marginally from 97.9% a month ago. Observed contact keeps concentrating on one protocol even as the exposed surface fans out across other infrastructure. For a defender that is a clarifying result about where to spend a hardening hour. One caveat carries through the whole section: the largest single user-agent in this MCP traffic is mcpregistry-bot, a crawler that indexes MCP servers, so raw MCP event volume reflects indexing pressure as much as attack intent. Agent-to-Agent handshakes were 0.5% of events. A quiet channel is not a closed one: ARIAscout still counts exposed A2A endpoints, and Section 8 carries hardening guidance for both.

6. The wild picture

HoneyMap samples the public web for injection bait planted by third parties. The window captured 262 surfaces across 215 unique domains. The result is a sample, not a coverage count.

Attack classes:

Top AIIS signatures observed:

Where the bait lives on the page:

Sector distribution (where the bait sits):

248 of 262 surfaces (95%) carry no sector classification. This is the honest answer, not a classification gap. Most injection bait lives on pages with no clear sector identity, and the catalog deliberately does not guess. The named sectors are the surfaces where the page itself made the classification trivial.

The wild is being seeded, not yet weaponized at scale, but the bait is real. SOUL-INJECT, the class that targets agent personality and soul-authority directives, is the most-observed attack class at 223 surfaces. Every signature in this section is one defenders should already be checking for. The bait tends to arrive before the campaign that uses it.

7. The model attribution picture

This edition adds the first agent-vs-crawler attribution to the fleet. The categories below anchor on it. We do not name a vendor or model without evidence, and all attribution this window carries claimed confidence (derived from client-declared user-agents), not verified confidence.

User-agent strings are attacker-controllable and cannot ground an identity claim on their own, which is why every label this window is claimed rather than verified. The verified tier requires an independent signal, such as a first-party crawler whose network ownership matches its declared vendor. We are building behavioral fingerprinting (request-timing distributions, header-order canonicalization, tool-call structure) to close the gap. Progress will appear in subsequent editions.

8. What this means for defenders

Seven recommendations follow from the data above. Each cites the Agent Threat Matrix technique it resolves to and the OASB control that implements the defense.

The Common Crawl gap

Public-web measurement studies, including Google's January 2026 indirect-prompt-injection sweep, sample crawls that surface only anonymous, statically rendered, search-engine-discoverable content. Three classes of attacker-reachable surface are systematically invisible to that sample.

• Authenticated surfaces. Login walls, gated dashboards, post-auth tool calls. An agent that completes a credential-acquisition step reaches a different content surface and exhibits behaviors that crawler-only research cannot observe.
• Dynamic surfaces. Per-fingerprint content variation. The same URL serves different HTML to different agents. Static crawls collapse this to a single template.
• Social surfaces. Federated and platform-mediated content where indexing is partial, latent, or restricted.

OpenA2A's honeypot fleet is built across this seam. The baseline sites are deliberately Common-Crawl-visible and carry essentially all of the traffic in this report. A second set of authenticated archetypes (one live so far, cloudops-agent-io) sits behind a credential, where no crawler reaches. This edition's attribution finding sharpens why that seam matters: the public-web cohort is drawing browsers and crawlers, not agents, so the surface that could observe genuine autonomous-agent behavior is precisely the authenticated one that public-web sweeps cannot see. As those archetypes mature and begin drawing agents, future editions report what arrives there.

9. Methodology, limits, and how to cite

Methodology. Full per-stream methodology is published at /methodology, with sub-pages for behavioral-sweep (ARIAtrap) and first-observed-in-the-wild (FOITW). All four streams run continuously. Numbers in this report are the snapshot at publication.

Window and basis. June 22 to July 22, 2026 (30 days). TrapMyAgent behavioral distributions are computed over the 30-day window, and the honey-agent event figure is the exact count in that window. AgentPwn callback attribution covers only the callbacks recorded since attribution shipped on 2026-07-16, a subset of the window, and is labeled as such wherever it appears. The cumulative honey-agent total is an approximate planner-estimated count, presented as a floor and never used as a denominator.

What this report cannot answer this month.

• AgentPwn callback attribution covers about six days of the window. The direction is clear (browsers and crawlers, not agents) but the full-window distribution waits for next edition.
• ARIAscout per-product exposure counts (Ollama, MLflow) are Shodan facet counts that swing month to month on an unchanged query. We report current counts without a trend and lead on the stable OpenClaw gateway figure.
• MITRE ATT&CK counts are heuristic classifier labels and are not yet stable enough to compare across editions. They appear as a within-window snapshot only.
• HoneyMap is a sample of the public web, not a coverage count, and its surface total fell this window because the AIIS signatures were tightened for precision, not because wild bait declined.
• Sophistication scoring is published as distribution-only. No mean, grade, or month-over-month delta. The supervised classifier that would ground a mean does not yet exist.
• Model attribution is claimed-confidence only this window. No callback carried verified confidence. We will not name a vendor without an independent signal.

How to cite

@techreport{opena2a-btr-2026-07,
  author = {{ARIA, OpenA2A autonomous research system} and Abdel Fane (editor)},
  title  = {State of AI Agent Security: Who Follows the Bait},
  institution = {OpenA2A Research},
  year   = {2026},
  month  = {7},
  type   = {Behavioral Threat Report},
  number = {Issue 3},
  url    = {https://research.opena2a.org/reports/state-of-ai-agent-security-2026-07}
}

ARIA, & Fane, A. (Ed.). (2026, July 22). State of AI Agent Security: Who Follows the Bait (Behavioral Threat Report Issue 3). OpenA2A Research. https://research.opena2a.org/reports/state-of-ai-agent-security-2026-07

How to challenge a finding

Email info@opena2a.org with the specific number you dispute and the methodology you would prefer we used. We aim to respond within five business days. Substantive challenges that hold up under review are published as methodology updates in subsequent editions with attribution.

Appendix. First Observed In The Wild log

FOITW is the mechanism by which OpenA2A pre-registers signatures for sophisticated AI agent attack techniques and publishes within seven days of first wild observation. The pre-registration catalog lives at aria/data/foitw-catalog.json with full methodology at /methodology/foitw.

Catalog state at publication: 3 signatures registered, 0 firings during the reporting window. Transparency-log anchoring is in progress. Log-anchored claims will publish once the integration lands.