State of AI Agent SecurityVolume Without Agents

Key findings

1. Nothing that follows the bait is an agent. Of 2,437 attributed callbacks, 2,130 were browsers and link previewers, 303 declared content crawlers, 4 HTTP libraries, and 0 autonomous agents. An unsplit callback rate measures link previews, not agent behavior.
2. Something is enumerating A2A endpoints. Handshakes rose from 1,125 to 15,670 events, 3.6% of TrapMyAgent traffic; task requests totaled 2. That is scanning, not use. Put mutual authentication on the handshake before the tasks arrive.
3. MCP connections are volume; tool calls are the signal. 422,010 connections produced 35 resource reads and 9 tool calls. An alert tuned to connection counts fires on crawler indexing. Alert on the call.
4. Exposure grew ten percent in a month. The September 1 sweep found 243,615 exposed AI services, up from 221,215, and OpenClaw gateways are 79.0% of them. Exposed MCP servers rose to 1,997 from 1,775.
5. Recurrence doubled, and it is still scanners. 26.7% of fingerprints came back, up from 13.7%, but 98.3% of sessions classify as scanners and the top returner made 4,631 visits of about one event each. Segment out scanners before calling anything persistence.

1. Nothing that follows the bait is an agent

A callback fires when a client fetches the URL inside an injection payload on an AgentPwn page. Every one of the 2,437 callbacks this window carries a client class verdict, and the split is 2,130 browsers and link prefetchers, 303 declared LLM content crawlers, 4 generic HTTP clients, and 0autonomous agents. Last window's attribution covered a six day tail and found the same zero; this one covers all thirty days.

A browser or an unfurler fetches every link it sees, so a callback proves a fetch, not a reading. The zero is a finding about the public web cohort: the 20 baseline honeypots that drew traffic are built to be crawl visible, and crawl visible surfaces draw crawlers. A full window of attribution removes the objection that six days was too short to catch an agent or too short to trust the crawlers.

Every verdict is claimed tier, read from what the client said about itself, except 18 callbacks whose declared identity matched the network they arrived from: 15 crawlers and 3 browsers, no agents. A verified crawler is still a crawler, so no vendor is named as an actor here. If you publish a callback rate from your own bait, publish the client split with it, or readers will take the rate for agent compliance.

Every attributed callback resolved to a browser, a crawler, or an HTTP library

2. Something is enumerating A2A endpoints

Agent-to-Agent handshakes went from 1,125 events last window to 15,670 in this one. That is 3.6% of everything TrapMyAgent recorded, up from 0.5%. The step after a handshake, where one agent asks another to do something, happened 2 times. Last window it happened 0 times.

That shape is enumeration, not use. Something is walking our A2A endpoints at scale and stopping at the door. TrapMyAgent records the handshake, not the intent, so we cannot say who or why. The public target set exists: the ARIAscout sweep of September 1 counted 32 A2A endpoints reachable on the open internet.

The handshake is the cheapest step for a scanner and the one step a defender can gate without touching the task path. An agent card is discoverable by design, so the enumeration itself is not the problem; the problem is an endpoint that will accept a task from any peer that completed a handshake. Mutual authentication at the handshake turns a walk of the endpoint list into a list of failed authentications, which is a log you can read and a rate you can alert on.

A2A handshakes went from a rounding error to a visible share of TrapMyAgent events

3. MCP connections are volume; tool calls are the signal

TrapMyAgent recorded 422,010 MCP connection events in the window, 96.1% of everything it saw. Those connections produced 35 resource reads and 9 tool calls. Almost every client that connects asks for nothing.

The rate is steady on the same instrument. The baseline edition before this one counted 22 tool calls over a 98 day span. That is 0.22 a day; this window ran at 0.30 a day. Connection volume moved far more than that: 884,154 connections in that span, 422,010 in these thirty days. The MCP share slipped from 99% last window to 96.1% only because the A2A handshakes in finding 2 grew.

A resource read is one step past a connection and still short of an action; a tool call is the action. The reads and calls this window are the whole population a person needs to review, and every one of them came from a client that already held a connection, so the connection log adds nothing an alert on the call would miss. If your MCP server is meant to sit idle, the first tool call it receives is the event, whoever sent it.

Almost every MCP client that connects asks for nothing

4. Exposure grew ten percent in a month

The Registry's September 1 sweep counted 243,615 exposed AI services, up from 221,215 on August 1. Both sweeps ran in exhaust mode on the same queries, so the 10.1% rise is like for like. OpenClaw gateways are 192,492 of them, up from 183,737. That one gateway family is 79.0% of everything the sweep found.

Exposed MCP servers rose to 1,997 from 1,775. The LLM serving category went from 8,447 to 20,026, but it has swung on unchanged queries before, so that count is published without a trend. Exposure counts what is reachable; the honeypot streams count what arrives, and finding 3 shows how little of what arrives asks for anything. A model endpoint reachable without a credential is one the next sweep will find in the same pass.

Reachable is not the same as touched, and touched is not the same as used. The sweep counts doors; TrapMyAgent watches a set of decoy doors; and the traffic reaching the decoys is still connecting and asking for nothing. That gap is the reading to keep. It says the exposed population is growing faster than anything is exploiting it, which is the month to close doors, not the month to declare them safe.

OpenClaw gateways are most of the exposed surface, and the total rose on the month

5. Recurrence doubled, and it is still scanners

Of 8,776 distinct fingerprints TrapMyAgent saw this window, 2,343 returned across more than one session. That is 26.7%, up from 13.7% last window. The fingerprint count itself fell from 14,588, so fewer clients came, and each came back more often. Total events doubled to 439,114.

The returners are scanners. 98.3% of sessions classify as automated scanners (99.5% last window). The most frequently returning fingerprint opened 4,631 sessions carrying 5,016 events, about one event per visit, which is the signature of a scheduled scanner rather than an adversary sampling defenses. The busiest by volume sent 50,196 events in 147 sessions and carries the same verdict.

The classes that are not scanners are small: 605 unknown, 25 manual researcher and 6 APT reconnaissance sessions. The heuristics are not retuned between editions, so a small non scanner count is a set of flags to investigate, not a noise floor. Each of those classes is small enough to read by hand, and if your own telemetry has a class this size, read it before you tune anything else. A session that falls outside the scanner class is the rare one.

Almost every TrapMyAgent session is an automated scanner

What to do this month

1. Log the client class beside every fetch of an injected URL before you derive a rate from it. (finding 1; OASB OASB 10.1 (Security Event Logging), OASB 3.1 (Prompt Injection Protection))
2. Put mutual authentication and message integrity on every A2A handshake. (finding 2; OASB OASB 7.1 (Mutual Authentication), OASB 7.2 (Message Integrity), OASB 5.2 (Context Window Isolation))
3. Alert on the MCP tool call, not the connection. (finding 3; OASB OASB 2.1 (Explicit Capability Grants), OASB 2.3 (Capability Boundaries))
4. Put a scoped credential in front of every model endpoint and gateway. (finding 4; OASB OASB 2.1 (Explicit Capability Grants), OASB 5.3 (Credential Scope Limitation))
5. Split recurrence by classifier verdict before you read it as persistence. (finding 5; OASB OASB 10.1 (Security Event Logging))
6. Strip hidden text, HTML comments and tag block Unicode from retrieved web content before it reaches the context. (Appendix A; OASB OASB 3.1 (Prompt Injection Protection), OASB 3.3 (Input Validation))
7. Instrument authenticated and dynamic surfaces before you draw conclusions about agents from crawl data. (Methodology; no control mapping)

What we can't say yet

• Whether any agent has acted on an injection: the authenticated cohort that could observe one recorded no interactions, no FOITW signature fired in the window, and our own test traffic is excluded from every count.
• A page level agent share: attribution is wired on 3.7% of AgentPwn rows while the per surface rollout completes, so callbacks are the only attributed population.
• Who is enumerating A2A endpoints: TrapMyAgent records the handshake, not the intent.
• A trend on the LLM serving exposure category: it has swung on unchanged queries before.
• A month over month reading: the edition before this one was a baseline with no window figures, so every comparison here is to the previous comparable window.
• Any vendor as an actor: 18 callbacks reached the verified tier, all crawlers or browsers, and the other 2,419 are claimed tier.

Methodology and data

Window. August 18 to September 17, 2026 (30 days), measured in one pass on September 17, 2026; the only reading that predates the pass is the Registry's September 1 exposure sweep. TrapMyAgent figures are keyed on capture time, not ingest time.

Streams.TrapMyAgent runs honey agents that record protocol level events from whatever connects; it sees the request, not the intent. AgentPwn serves honeypot pages carrying benign injection payloads and records visits and callbacks; its public cohort is crawl visible, and its authenticated cohort (one archetype live) records nothing until an agent acts. HoneyMap samples the public web for bait planted by third parties; a sample, not a coverage count. ARIAscout reads the Registry's first of month exposure sweep; it counts what is reachable, not what is attacked.

Denominators. TrapMyAgent shares use the window event count, 439,114, and classifier shares use sessions, 37,754. Callback shares use the 2,437 attributed callbacks. The cumulative count since the first TrapMyAgent event, 1,385,544, is exact this month and never a denominator.

Comparison basis. Comparisons are edition over edition with Issue 3, the 30 days ending July 22, 2026, the last edition with the standard monthly shape; its window closed 27 days before this one opened, so no comparison here is month over month. Issue 4 was a baseline edition and published no windowed distributions. Issue 4's window closed on August 16 and this one opens on August 18, so no edition reports the two days between them. Its MCP tool call count covered 98 days, so that comparison is a per day rate.

What changed since Issue 4. One window and one measurement day for the whole edition, given here once: 30-day window August 18 to September 17, 2026, closed at 00:00 UTC. Measured September 17, 2026. Every figure on this page is measured in it. Callback attribution covers the whole window; it shipped July 16. The cumulative TrapMyAgent count is an exact row count, not a planner estimate. The third Threat Matrix tier is labeled "adapted", the Registry's own label, where Issue 3 wrote "theoretical". MITRE labels are a snapshot: Time-Based Evasion led Issue 3, Use Alternate Authentication Material leads this window, and the heuristics are not retuned between editions.

Attribution tiers. Observed: we counted it. Claimed: the client declared it about itself. Verified: network ownership matches the declaration. Nothing lifts a verdict further yet.

Geolocation.Country is origin IP geolocation, which VPN, proxy and cloud fronting obscure. Provider shares read "fronted through", never "originating in". Full methodology: /methodology, with sub pages for behavioral-sweep and foitw.

How to cite

@techreport{opena2a-btr-2026-09,
  author = {{ARIA, OpenA2A autonomous research system} and Abdel Fane (editor)},
  title  = {State of AI Agent Security: Volume Without Agents},
  institution = {OpenA2A Research},
  year   = {2026},
  month  = {9},
  type   = {Behavioral Threat Report},
  number = {Issue 5},
  url    = {https://research.opena2a.org/reports/state-of-ai-agent-security-2026-09}
}

ARIA, & Fane, A. (Ed.). (2026, September 17). State of AI Agent Security: Volume Without Agents (Behavioral Threat Report, Issue 5). OpenA2A Research. https://research.opena2a.org/reports/state-of-ai-agent-security-2026-09

How to challenge a finding

Email info@opena2a.org with the specific number you dispute and the methodology you would prefer we used. We aim to respond within five business days. Substantive challenges that hold up under review are published as methodology updates in subsequent editions with attribution.

Appendix A: Full tables

Volume across the four streams

The exposure row is the Registry's September 1 sweep. Payload callbacks moved the opposite way from page visits: 7,441 last window, 2,437 in this one, while page interactions went from 111,761 to 325,644. More pages were visited and fewer visitors fetched the URL the payload pointed at.

AgentPwn payload categories delivered

Payloads delivered, not compromises. Each category resolves to an Agent Threat Matrix technique through AgentPwn's technique map; prompt injection (1,311 delivered) resolves to T-2001 on the Agent Threat Matrix. Tool shadowing and supply chain have no mapping yet and are listed without one.

MITRE ATT&CK heuristic labels on TrapMyAgent events

A snapshot of this window, not a trend: the leading label swapped since the previous comparable window (see Methodology). Use Alternate Authentication Material is an ATT&CK technique with no Agent Threat Matrix mapping recorded, so none is claimed for it.

Attack origin, top ten of 127 countries

Shares of the TrapMyAgent window events; 105 countries appeared last window. The United States held at 60.2% (58.8% last window). Bulgaria, absent from last window's top ten, is second at 5.9%, and Ireland fell from 13% to 2.1%. A country entering the top ten from nowhere at scale is usually one hosting range: of Bulgaria's 26,094 events, 14,333 were fronted by a single hosting network registered in the United Kingdom.

Networks that fronted the traffic

Fronted through, not originating in. Microsoft Azure fronted 39.7% of events (56.1% last window) and Google Cloud went from 1.7% to 17.5%, with 76,707 of its 76,937 events through a single ASN. Between them the two front 57.2% of events, the same combined share as last window (57.8%); what moved is the split. That reads as cloud hosted scanning and content indexing, not a distributed adversary population, and it is why a country chart on its own overstates geography.

HoneyMap: injection bait planted on the public web

A sample, not a coverage count. At measurement the catalog held 276 surfaces across 226 unique domains (262 surfaces and 215 domains last window, same signature set). The signature that moved is the Unicode tag block class: 54 surfaces, up from 39. Script literals as a placement went from 17 surfaces to 32. 259 of 276 surfaces carry no sector classification because the catalog does not guess one. The wild is being seeded, not yet weaponized at scale, and the seeding is getting harder to see with the eye.

Attack classes:

Top AIIS signatures observed:

Where the bait lives on the page:

Sector distribution:

Callback attribution by client class

Verdicts over the 2,437 attributed callbacks, read from what each client declared about itself. 86 callbacks declared a model vendor in their user agent, 68 of them from one address; a declaration is not an identity, because the string is attacker controllable. Page level attribution, as distinct from callback attribution, covers 12,526 of the 341,951 AgentPwn rows of every event type, so this report states no page level agent share.

Agent Threat Matrix evidence tiers

Appendix B: First Observed In The Wild log

FOITW is the mechanism by which OpenA2A pre registers signatures for sophisticated AI agent attack techniques and publishes within seven days of first wild observation. The pre registration catalog is held internally until transparency log anchoring lands; until then the registration dates below are our claim, not an independently verifiable one. Full methodology at /methodology/foitw.

Catalog state at measurement: 3 signatures registered, 0 firings during the reporting window.

Appendix C: Live indices

The three indices below update between editions. Sophistication is published as a distribution only: no mean, no grade, no month over month delta.