State of AI Agent Security: Volume Without Declared Agents

Key findings

1. Nothing that follows the bait identifies as an agent. Of 2,437 attributed callbacks, 2,130 were browsers and link previewers, 303 declared content crawlers, 4 HTTP libraries, and 0 declared autonomous agents. An unsplit callback rate measures link previews, not agent behavior.
2. Something is enumerating A2A endpoints. Handshakes rose from 1,125 to 15,670 events, 3.6% of TrapMyAgent traffic; task requests totaled 2. That is scanning, not use. Put mutual authentication on the handshake before the tasks arrive.
3. MCP connections are volume; tool calls are the signal. 422,010 connections produced 35 resource reads and 9 tool calls. An alert tuned to connection counts fires on crawler indexing. Alert on the call.
4. Exposed gateways and MCP servers grew on the month. OpenClaw gateways rose to 192,492 from 183,737 and are 79.0% of the 243,615 exposed AI services the September 1 sweep found. Exposed MCP servers rose to 1,997 from 1,775.
5. Recurrence doubled, and it is still scanners. 26.7% of fingerprints appeared in more than one session, up from 13.7%, but 98.3% of sessions classify as scanners. Segment out scanners before calling anything persistence.

1. Nothing that follows the bait identifies as an agent

A callback fires when a client fetches the URL inside an injection payload on an AgentPwn page. Every one of the 2,437 callbacks this window carries a client class verdict, and the split is 2,130 browsers and link prefetchers, 303 declared LLM content crawlers, 4 generic HTTP clients, and 0 declared autonomous agents. Last window's attribution covered a six day tail and found the same zero; this one covers all thirty days.

A browser or an unfurler fetches every link it sees, so a callback proves a fetch, not a reading. The zero is a finding about the public web cohort: the 20 baseline honeypots that drew traffic are built to be crawl visible, and crawl visible surfaces draw crawlers. A full window of attribution removes the objection that six days was too short to catch an agent or too short to trust the crawlers.

Every verdict is claimed tier, read from what the client said about itself, except 18 callbacks whose declared identity matched the network they arrived from: 15 crawlers and 3 browsers, no agents. Claimed tier also has a blind spot: an agent operating inside a real browser presents as that browser, so it would be counted among the 2,130 browser callbacks. A verified crawler is still a crawler, so no vendor is named as an actor here. If you publish a callback rate from your own bait, publish the client split with it, or readers will take the rate for agent compliance.

Every attributed callback declared a browser, a crawler, or an HTTP library

2. Something is enumerating A2A endpoints

Agent-to-Agent handshakes went from 1,125 events last window to 15,670 in this one. That is 3.6% of everything TrapMyAgent recorded, up from 0.5%. The step after a handshake, where one agent asks another to do something, happened 2 times. Last window it happened 0 times.

That shape is enumeration, not use. Something is walking our A2A endpoints at scale and stopping at the door. TrapMyAgent records the handshake, not the intent, so we cannot say who or why. The public target set exists: the ARIAscout sweep of September 1 counted 32 A2A endpoints reachable on the open internet.

The handshake is the cheapest step for a scanner and the one step a defender can gate without touching the task path. An agent card is discoverable by design, so the enumeration itself is not the problem; the problem is an endpoint that will accept a task from any peer that completed a handshake. Mutual authentication at the handshake turns a walk of the endpoint list into a list of failed authentications, which is a log you can read and a rate you can alert on.

A2A handshakes went from a rounding error to a visible share of TrapMyAgent events

3. MCP connections are volume; tool calls are the signal

TrapMyAgent recorded 422,010 MCP connection events in the window, 96.1% of everything it saw. Those connections produced 35 resource reads and 9 tool calls. Almost every client that connects asks for nothing.

The rate is in the same range on the same instrument. The baseline edition before this one counted 22 tool calls over a 98 day span. That is 0.22 a day; this window ran at 0.30 a day, and at counts this small the difference is within noise. Connections rose clearly over the same comparison, from about 9,000 a day (884,154 in 98 days) to about 14,100 a day (422,010 in these thirty days). The MCP share slipped from 99% last window to 96.1% only because the A2A handshakes in finding 2 grew.

A resource read is one step past a connection and still short of an action; a tool call is the action. The reads and calls this window are the whole population a person needs to review, and every one of them came from a client that already held a connection, so the connection log adds nothing an alert on the call would miss. If your MCP server is meant to sit idle, the first tool call it receives is the event, whoever sent it.

Almost every MCP client that connects asks for nothing

4. Exposed gateways and MCP servers grew on the month

The Registry's September 1 sweep counted 243,615 exposed AI services, against 221,215 on August 1. Both sweeps ran in exhaust mode on the same queries, but 11,579 of the 22,400 difference is the LLM serving category, which this report publishes without a trend, so we do not claim the total's 10.1% as a trend either. Net of that category, the total rose 5.1%. OpenClaw gateways are 192,492 of them, up 4.8% from 183,737. That one gateway family is 79.0% of everything the sweep found.

Exposed MCP servers rose to 1,997 from 1,775. The LLM serving category went from 8,447 to 20,026, but it has swung on unchanged queries before, so that count is published without a trend. Exposure counts what is reachable; the honeypot streams count what arrives, and finding 3 shows how little of what arrives asks for anything. A model endpoint reachable without a credential is one the next sweep will find in the same pass.

Reachable is not the same as touched, and touched is not the same as used. The sweep counts doors; TrapMyAgent watches a set of decoy doors; and the traffic reaching the decoys is still connecting and asking for nothing. That gap is the reading to keep. It says the exposed population is growing while the traffic reaching our decoys still asks for almost nothing, and that makes this the month to close doors, not the month to declare them safe.

OpenClaw gateways are most of the exposed surface, and they grew on the month

5. Recurrence doubled, and it is still scanners

Of 8,776 distinct fingerprints TrapMyAgent saw this window, 2,343 appeared in more than one session. That is 26.7%, up from 13.7% last window. The fingerprint count fell from 14,588. Total events doubled to 439,114.

Scanners still dominate: 98.3% of sessions classify as automated scanners (99.5% last window).

The classes that are not scanners are small: 605 unknown, 25 manual researcher and 6 APT reconnaissance sessions. The heuristics are not retuned between editions, so a small non scanner count is a set of flags to investigate, not a noise floor. Each of those classes is small enough to read by hand, and if your own telemetry has a class this size, read it before you tune anything else. A session that falls outside the scanner class is the rare one.

Almost every TrapMyAgent session is an automated scanner

What to do this month

1. Log the client class beside every fetch of an injected URL before you derive a rate from it. (finding 1; OASB 10.1 (Security Event Logging), OASB 3.1 (Prompt Injection Protection))
2. Put mutual authentication and message integrity on every A2A handshake. (finding 2; OASB 7.1 (Mutual Authentication), OASB 7.2 (Message Integrity), OASB 5.2 (Context Window Isolation))
3. Alert on the MCP tool call, not the connection. (finding 3; OASB 2.1 (Explicit Capability Grants), OASB 2.3 (Capability Boundaries))
4. Put a scoped credential in front of every model endpoint and gateway. (finding 4; OASB 2.1 (Explicit Capability Grants), OASB 5.3 (Credential Scope Limitation))
5. Split recurrence by classifier verdict before you read it as persistence. (finding 5; OASB 10.1 (Security Event Logging))
6. Strip hidden text, HTML comments and tag block Unicode from retrieved web content before it reaches the context. (Appendix A; OASB 3.1 (Prompt Injection Protection), OASB 3.3 (Input Validation))
7. Instrument authenticated and dynamic surfaces before you draw conclusions about agents from crawl data. (Methodology; no control mapping)

What we can't say yet

• Whether any agent has acted on an injection: the authenticated cohort that could observe one recorded no interactions, no FOITW signature fired in the window, claimed tier verdicts cannot separate an agent operating a real browser from the browser, and our own test traffic is excluded from every count.
• A page level agent share: attribution is wired on 3.7% of AgentPwn rows while the per surface rollout completes, so callbacks are the only attributed population.
• Who is enumerating A2A endpoints: TrapMyAgent records the handshake, not the intent.
• A trend on the LLM serving exposure category, or on the exposed AI services total it moves: it has swung on unchanged queries before.
• A month over month reading: the edition before this one was a baseline with no window figures, so every comparison here is to the previous comparable window.
• Any vendor as an actor: 18 callbacks reached the verified tier, all crawlers or browsers, and the other 2,419 are claimed tier.

Methodology and data

Window. August 18 to September 17, 2026 (30 days), measured in one pass on September 17, 2026; the only reading that predates the pass is the Registry's September 1 exposure sweep. TrapMyAgent figures are keyed on capture time, not ingest time.

Streams. TrapMyAgent runs honey agents that record protocol level events from whatever connects; it sees the request, not the intent. AgentPwn serves honeypot pages carrying benign injection payloads and records visits and callbacks; its public cohort is crawl visible, and its authenticated cohort (one archetype live) records nothing until an agent acts. HoneyMap samples the public web for bait planted by third parties; a sample, not a coverage count. ARIAscout reads the Registry's first of month exposure sweep; it counts what is reachable, not what is attacked.

Denominators. TrapMyAgent shares use the window event count, 439,114, and classifier shares use sessions, 37,754. Callback shares use the 2,437 attributed callbacks. The cumulative count since the first TrapMyAgent event, 1,385,544, is exact this month and never a denominator.

Comparison basis. Comparisons are edition over edition with Issue 3, the 30 days ending July 22, 2026, the last edition with the standard monthly shape; its window closed 27 days before this one opened, so no comparison here is month over month. Issue 4 was a baseline edition and published no windowed distributions. Issue 4's window closed on August 16 and this one opens on August 18, so no edition reports the two days between them. Its MCP tool call count covered 98 days, so that comparison is a per day rate.

What changed since Issue 4. One window and one measurement day for the whole edition, given here once: 30-day window August 18 to September 17, 2026, closed at 00:00 UTC. Measured September 17, 2026. Every figure on this page is measured in it. Callback attribution covers the whole window; it shipped July 16. The cumulative TrapMyAgent count is an exact row count, not a planner estimate. The third Threat Matrix tier is labeled "adapted", the Registry's own label, where Issue 3 wrote "theoretical".

Attribution tiers. Observed: we counted it. Claimed: the client declared it about itself. Verified: network ownership matches the declaration. Nothing lifts a verdict further yet.

Full methodology: /methodology, with sub pages for behavioral-sweep and foitw.

How to cite

@techreport{opena2a-btr-2026-09,
  author = {{ARIA, OpenA2A autonomous research system} and Abdel Fane (editor)},
  title  = {State of AI Agent Security: Volume Without Declared Agents},
  institution = {OpenA2A Research},
  year   = {2026},
  month  = {9},
  type   = {Behavioral Threat Report},
  number = {Issue 5},
  url    = {https://research.opena2a.org/reports/state-of-ai-agent-security-2026-09}
}

ARIA, & Fane, A. (Ed.). (2026, September 17). State of AI Agent Security: Volume Without Declared Agents (Behavioral Threat Report, Issue 5). OpenA2A Research. https://research.opena2a.org/reports/state-of-ai-agent-security-2026-09

How to challenge a finding

Email info@opena2a.org with the specific number you dispute and the methodology you would prefer we used. We aim to respond within five business days. Substantive challenges that hold up under review are published as methodology updates in subsequent editions with attribution.

Appendix A: Full tables

Volume across the four streams

The exposure row is the Registry's September 1 sweep. Payload callbacks moved the opposite way from page visits: 7,441 last window, 2,437 in this one, while page interactions went from 111,761 to 325,644. More pages were visited and fewer visitors fetched the URL the payload pointed at.

HoneyMap: injection bait planted on the public web

A sample, not a coverage count. At measurement the catalog held 276 surfaces across 226 unique domains (262 surfaces and 215 domains last window, same signature set). The signature that moved is the Unicode tag block class: 54 surfaces, up from 39. Script literals as a placement went from 17 surfaces to 32. 259 of 276 surfaces carry no sector classification because the catalog does not guess one. The wild is being seeded, not yet weaponized at scale, and the seeding is getting harder to see with the eye.

Attack classes:

Top AIIS signatures observed:

Where the bait lives on the page:

Sector distribution:

Callback attribution by client class

Verdicts over the 2,437 attributed callbacks, read from what each client declared about itself. 86 callbacks declared a model vendor in their user agent; a declaration is not an identity, because the string is attacker controllable. Page level attribution, as distinct from callback attribution, covers 12,526 of the 341,951 AgentPwn rows of every event type, so this report states no page level agent share.

Agent Threat Matrix evidence tiers

Appendix B: First Observed In The Wild log

FOITW is the mechanism by which OpenA2A pre registers signatures for sophisticated AI agent attack techniques and publishes within seven days of first wild observation. The pre registration catalog is held internally until transparency log anchoring lands; until then the registration dates below are our claim, not an independently verifiable one. Full methodology at /methodology/foitw.

Catalog state at measurement: 3 signatures registered, 0 firings during the reporting window.

Appendix C: Live indices

The three indices below update between editions. Sophistication is published as a distribution only: no mean, no grade, no month over month delta.