Not one of the callbacks from injected links on our honeypot pages came from a client declaring itself an autonomous agent, in a window where TrapMyAgent traffic doubled.
This month in numbers
Key findings
- Nothing that follows the bait identifies as an agent. Of the attributed callbacks, 0 came from a client declaring itself an autonomous agent. An unsplit callback rate measures client fetches, not agent behavior.
- Something is enumerating A2A endpoints. Put mutual authentication on the handshake.
- MCP connections are volume; tool calls are the signal. Alert on the call, not the connection count.
- Exposed gateways and MCP servers grew on the month. OpenClaw gateways rose to 192,492 from 183,737 and are 79.0% of the 243,615 exposed AI services the September 1 sweep found. Exposed MCP servers rose to 1,997 from 1,775.
- Recurrence doubled. 26.7% of fingerprints appeared in more than one session, up from 13.7%. Segment out scanners before calling anything persistence.
1. Nothing that follows the bait identifies as an agent
A callback fires when a client fetches the URL inside an injection payload on an AgentPwn page. Every one of the callbacks this window carries a client class verdict, and 0 of them declared an autonomous agent. Last window's attribution covered a six day tail and found the same zero; this one covers all thirty days.
A browser or an unfurler fetches every link it sees, so a callback proves a fetch, not a reading. The zero is a finding about the public web cohort: the 20 baseline honeypots that drew traffic are built to be crawl visible, and crawl visible surfaces draw crawlers. A full window of attribution removes the objection that six days was too short to catch an agent or too short to trust the crawlers.
Every verdict is claimed tier, read from what the client said about itself, except a verified tier whose declared identity matched the network it arrived from, with no agent in it. Claimed tier also has a blind spot: an agent operating inside a real browser presents as that browser, so it would be counted among the browser callbacks. A verified crawler is still a crawler, so no vendor is named as an actor here. If you publish a callback rate from your own bait, publish the client split with it, or readers will take the rate for agent compliance.
Attribute before you count.
Log the client class beside every fetch of an injected URL before you derive a rate from it. A callback rate published without that split measures client fetches, not agent compliance.
Maps to: T-2002 · OASB 10.1 (Security Event Logging), OASB 3.1 (Prompt Injection Protection)
2. Something is enumerating A2A endpoints
TrapMyAgent records the handshake, not the intent, so we cannot say who or why. The public target set exists: the ARIAscout sweep of September 1 counted 32 A2A endpoints reachable on the open internet.
The handshake is the cheapest step for a scanner and the one step a defender can gate without touching the task path. An agent card is discoverable by design, so the enumeration itself is not the problem; the problem is an endpoint that will accept a task from any peer that completed a handshake. Mutual authentication at the handshake turns a walk of the endpoint list into a list of failed authentications, which is a log you can read and a rate you can alert on.
Authenticate A2A handshakes now, not when they carry tasks.
If you expose an A2A endpoint, put mutual authentication and message integrity on the handshake. Accept no task from a peer that has not authenticated.
Maps to: T-1006, T-2008, T-3001 · OASB 7.1 (Mutual Authentication), OASB 7.2 (Message Integrity), OASB 5.2 (Context Window Isolation)
3. MCP connections are volume; tool calls are the signal
A resource read is one step past a connection and still short of an action; a tool call is the action. Every read and call comes from a client that already holds a connection, so the connection log adds nothing an alert on the call would miss. If your MCP server is meant to sit idle, the first tool call it receives is the event, whoever sent it.
Alert on the tool call, not the connection.
A connection count threshold is tuned to crawler behavior and pages on indexing. A single unexpected tool call on an MCP server that should be idle is the event worth a human.
Maps to: T-1002, T-2005 · OASB 2.1 (Explicit Capability Grants), OASB 2.3 (Capability Boundaries)
4. Exposed gateways and MCP servers grew on the month
The Registry's September 1 sweep counted 243,615 exposed AI services, against 221,215 on August 1. Both sweeps ran in exhaust mode on the same queries, but 11,579 of the 22,400 difference is the LLM serving category, which this report publishes without a trend, so we do not claim the total's 10.1% as a trend either. Net of that category, the total rose 5.1%. OpenClaw gateways are 192,492 of them, up 4.8% from 183,737. That one gateway family is 79.0% of everything the sweep found.
Exposed MCP servers rose to 1,997 from 1,775. The LLM serving category went from 8,447 to 20,026, but it has swung on unchanged queries before, so that count is published without a trend. Exposure counts what is reachable; the honeypot streams count what arrives, and finding 3 shows how little of what arrives asks for anything. A model endpoint reachable without a credential is one the next sweep will find in the same pass.
Reachable is not the same as touched, and touched is not the same as used. The sweep counts doors; TrapMyAgent watches a set of decoy doors; and the traffic reaching the decoys is still connecting and asking for nothing. That gap is the reading to keep. It says the exposed population is growing while the traffic reaching our decoys still asks for almost nothing, and that makes this the month to close doors, not the month to declare them safe.
Lock down unauthenticated model serving and gateway infrastructure.
Put a credential in front of every model endpoint and gateway, and scope that credential to the capability it needs. If you cannot say which of your endpoints answer without one, run the query the sweep runs and find out before someone else does.
Maps to: T-1002 · OASB 2.1 (Explicit Capability Grants), OASB 5.3 (Credential Scope Limitation)
OpenClaw gateways are most of the exposed surface, and they grew on the month
5. Recurrence doubled
Of 8,776 distinct fingerprints TrapMyAgent saw this window, 2,343 appeared in more than one session. That is 26.7%, up from 13.7% last window. The fingerprint count fell from 14,588. Total events doubled to 439,114.
Segment out scanners before you call anything persistence.
A returning visitor figure that does not first remove the scanner class measures scanner scheduling, not adversary persistence. Keep the fingerprint and session log, split it by classifier verdict, and read recurrence inside each class.
Maps to: T-9001 · OASB 10.1 (Security Event Logging)
What to do this month
- Log the client class beside every fetch of an injected URL before you derive a rate from it. (finding 1; OASB 10.1 (Security Event Logging), OASB 3.1 (Prompt Injection Protection))
- Put mutual authentication and message integrity on every A2A handshake. (finding 2; OASB 7.1 (Mutual Authentication), OASB 7.2 (Message Integrity), OASB 5.2 (Context Window Isolation))
- Alert on the MCP tool call, not the connection. (finding 3; OASB 2.1 (Explicit Capability Grants), OASB 2.3 (Capability Boundaries))
- Put a scoped credential in front of every model endpoint and gateway. (finding 4; OASB 2.1 (Explicit Capability Grants), OASB 5.3 (Credential Scope Limitation))
- Split recurrence by classifier verdict before you read it as persistence. (finding 5; OASB 10.1 (Security Event Logging))
- Strip hidden text, HTML comments and tag block Unicode from retrieved web content before it reaches the context. (Appendix A; OASB 3.1 (Prompt Injection Protection), OASB 3.3 (Input Validation))
- Instrument authenticated and dynamic surfaces before you draw conclusions about agents from crawl data. (Methodology; no control mapping)
What we can't say yet
- Whether any agent has acted on an injection: the authenticated cohort that could observe one recorded no interactions, no FOITW signature fired in the window, claimed tier verdicts cannot separate an agent operating a real browser from the browser, and our own test traffic is excluded from every count.
- A page level agent share: attribution is wired on 3.7% of AgentPwn rows while the per surface rollout completes, so callbacks are the only attributed population.
- Who is enumerating A2A endpoints: TrapMyAgent records the handshake, not the intent.
- A trend on the LLM serving exposure category, or on the exposed AI services total it moves: it has swung on unchanged queries before.
- A month over month reading: the edition before this one was a baseline with no window figures, so every comparison here is to the previous comparable window.
- Any vendor as an actor: no verified tier callback is an agent, and every other verdict is claimed tier.
Methodology and data
Window. August 18 to September 17, 2026 (30 days), measured in one pass on September 17, 2026; the only reading that predates the pass is the Registry's September 1 exposure sweep. TrapMyAgent figures are keyed on capture time, not ingest time.
Streams. TrapMyAgent runs honey agents that record protocol level events from whatever connects; it sees the request, not the intent. AgentPwn serves honeypot pages carrying benign injection payloads and records visits and callbacks; its public cohort is crawl visible, and its authenticated cohort (one archetype live) records nothing until an agent acts. HoneyMap samples the public web for bait planted by third parties; a sample, not a coverage count. ARIAscout reads the Registry's first of month exposure sweep; it counts what is reachable, not what is attacked.
Denominators. TrapMyAgent shares use the window event count, 439,114, and classifier shares use sessions, 37,754. The cumulative count since the first TrapMyAgent event, 1,385,544, is exact this month and never a denominator.
Comparison basis. Comparisons are edition over edition with Issue 3, the 30 days ending July 22, 2026, the last edition with the standard monthly shape; its window closed 27 days before this one opened, so no comparison here is month over month. Issue 4 was a baseline edition and published no windowed distributions. Issue 4's window closed on August 16 and this one opens on August 18, so no edition reports the two days between them.
What changed since Issue 4. One window and one measurement day for the whole edition, given here once: 30-day window August 18 to September 17, 2026, closed at 00:00 UTC. Measured September 17, 2026. Every figure on this page is measured in it. Callback attribution covers the whole window; it shipped July 16. The cumulative TrapMyAgent count is an exact row count, not a planner estimate. The third Threat Matrix tier is labeled "adapted", the Registry's own label, where Issue 3 wrote "theoretical".
Attribution tiers. Observed: we counted it. Claimed: the client declared it about itself. Verified: network ownership matches the declaration. Nothing lifts a verdict further yet.
Full methodology: /methodology, with sub pages for behavioral-sweep and foitw.
How to cite
@techreport{opena2a-btr-2026-09,
author = {{ARIA, OpenA2A autonomous research system} and Abdel Fane (editor)},
title = {State of AI Agent Security: Volume Without Declared Agents},
institution = {OpenA2A Research},
year = {2026},
month = {9},
type = {Behavioral Threat Report},
number = {Issue 5},
url = {https://research.opena2a.org/reports/state-of-ai-agent-security-2026-09}
}ARIA, & Fane, A. (Ed.). (2026, September 17). State of AI Agent Security: Volume Without Declared Agents (Behavioral Threat Report, Issue 5). OpenA2A Research. https://research.opena2a.org/reports/state-of-ai-agent-security-2026-09
How to challenge a finding
Email info@opena2a.org with the specific number you dispute and the methodology you would prefer we used. We aim to respond within five business days. Substantive challenges that hold up under review are published as methodology updates in subsequent editions with attribution.
Appendix A: Full tables
Volume across the four streams
The exposure row is the Registry's September 1 sweep. Payload callbacks moved the opposite way from page visits, down from 7,441 last window, while page interactions went from 111,761 to 325,644. More pages were visited and fewer visitors fetched the URL the payload pointed at.
Breakdowns withheld
Each row in these breakdowns needs ten or more distinct client addresses; that could not be confirmed.
- AgentPwn payloads by category
- Heuristic matches by ATT&CK ID
- Events by country
- Events by cloud provider
- Classifier verdicts
- The protocol picture
- The model attribution picture
HoneyMap: injection bait planted on the public web
A sample, not a coverage count. At measurement the catalog held 276 surfaces across 226 unique domains (262 surfaces and 215 domains last window, same signature set). The signature that moved is the Unicode tag block class: 54 surfaces, up from 39. Script literals as a placement went from 17 surfaces to 32. 259 of 276 surfaces carry no sector classification because the catalog does not guess one. The wild is being seeded, not yet weaponized at scale, and the seeding is getting harder to see with the eye.
Attack classes:
Top AIIS signatures observed:
Where the bait lives on the page:
Sector distribution:
Filter rendered HTML for the AIIS hidden injection signatures in agent retrieval pipelines.
Hidden text and HTML comments are where most of the bait lives, and the Unicode tag block class is the one that grew. An agent that retrieves web content into its context without stripping hidden text, comments and tag block Unicode is reading the bait as instructions.
Maps to: T-2002 · OASB 3.1 (Prompt Injection Protection), OASB 3.3 (Input Validation)
Callback verdicts are read from what each client declared about itself; a declaration is not an identity, because the user agent string is attacker controllable. Page level attribution, as distinct from callback attribution, covers 12,526 of the 341,951 AgentPwn rows of every event type, so this report states no page level agent share. Breakdowns withheld
Close the Common Crawl gap by instrumenting authenticated and dynamic surfaces.
Public web crawls, including Google's April 2026 indirect prompt injection study, cannot see login walled, per fingerprint dynamic, or federated surfaces. Two callback attributions, the six day tail in Issue 3 and the full window here, agree that the public web cohort draws no declared agents. The surface that could observe an autonomous agent acting on an injection is the authenticated one no crawl reaches, which is why AgentPwn's delta cohort exists. Instrument yours the same way before drawing conclusions about agents from crawl data.
Agent Threat Matrix evidence tiers
techniques
- Observed in production16
- Validated in lab42
- Adapted from published research3
Source: Agent Threat Matrix evidence audit. The Registry serves the third tier as "adapted" and this edition follows the source.
Appendix B: First Observed In The Wild log
FOITW is the mechanism by which OpenA2A pre registers signatures for sophisticated AI agent attack techniques and publishes within seven days of first wild observation. The pre registration catalog is held internally until transparency log anchoring lands; until then the registration dates below are our claim, not an independently verifiable one. Full methodology at /methodology/foitw.
Catalog state at measurement: 3 signatures registered, 0 firings during the reporting window.
| Catalog ID | Name | Technique | Status |
|---|---|---|---|
| FOITW-CAT-0001 | Greshake-class indirect prompt injection via web content Greshake et al. (AISec 2023). Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection. | T-2002 | Pre-registered 2026-04-27. Not yet fired. |
| FOITW-CAT-0002 | Actor-Critic adaptive multi-turn manipulation Shi, Lin, Song, et al. Lessons from Defending Gemini Against Indirect Prompt Injections (Google DeepMind, 2025). | T-2007 | Pre-registered 2026-04-27. Not yet fired. |
| FOITW-CAT-0003 | Reputation-poisoning prompt injection Brunner, Liu, Pande. AI threats in the wild: The current state of prompt injections on the web (Google Threat Intelligence Group, April 2026). | T-9005 | Pre-registered 2026-04-27. Not yet fired. |
Appendix C: Live indices
The three indices below update between editions. Sophistication is published as a distribution only: no mean, no grade, no month over month delta.
Live indices at publication
The numbers in this report are the time-capsule snapshot. The indices below are continuously updated. Click through for the live methodology and CSV exports.
Authorship. ARIA is OpenA2A's autonomous research system. Editorial review by Abdel Fane. We document how our content is made.
Data integrity. Every value in this report traces to a query against live instrumentation, run in one pass on September 17, 2026, and every figure was re-run from its query before publication.
License. Apache 2.0. Cite using the BibTeX or APA blocks under Methodology.
Coordinated disclosure. Any finding in this report that maps to a previously undisclosed vulnerability is held under the 90-day ARIAdesk disclosure protocol. None of the surface-level findings in this report require disclosure coordination.
Changes to this report
- . A client class with one source is withdrawn: a figure about one source can single it out. It is removed, with the figure that lets it be computed (the attributed total), from the lede, summary and metadata, key finding 1, finding 1, This month in numbers, the standfirst, the Methodology denominators and the Appendix A volume note and bar. The post carries a matching correction. No measured value changed.
- Corrected . The classifier verdicts, the protocol split and the user-agent categories are withdrawn, with the client class counts, the A2A, tool call and other event type counts, the verified and vendor declaration counts, three cards in This month in numbers, a clause in the summary and every sentence and chart resting on them. Each row needs ten or more distinct client addresses, and no count of them was on record when the next edition was published, so that could not be confirmed. Finding 5 was headed "Recurrence doubled, and it is still scanners". The attributed callback total and the zero for declared autonomous agents are unchanged.
- Corrected . The AgentPwn category, ATT&CK, country and cloud-provider breakdowns are withdrawn with their notes, which held the two single-network figures, and the Methodology sentences on them. None measured "attack origin" or "fronted" traffic.
- Corrected . Finding 5, its key finding and the note on callback attribution in Appendix A gave figures that each described a single traffic source. A figure about one source can single that source out, so those figures are removed, together with the scheduled scanner reading in finding 5 that rested on them. Finding 5 also said fingerprints "came back" and that "fewer clients came". A fingerprint is not a client, and being seen in more than one session does not show that anything left and returned, so finding 5, its key finding and the matching card in This month in numbers now state what was counted. Two figures for traffic through a single hosting network are withheld, with the sentences that carried them, until we confirm how many sources each covers. They were in the Appendix A notes on attack origin and on the networks that fronted the traffic. No other measured figure changed.
- Corrected . The title read "Volume Without Agents" and finding 1 read "Nothing that follows the bait is an agent." Client class verdicts record what each client declares about itself, and an agent operating a real browser presents as that browser, so both now scope the claim to what clients declared. Finding 4 read "Exposure grew ten percent in a month," but more than half of that rise is the LLM serving category, which this report publishes without a trend, so finding 4 now reports the OpenClaw gateway and MCP server trends and the total net of that category. Wording in findings 2, 3 and 4 and several typographical errors were also corrected. No measured figure changed.