State of AI Agent Security: The Tool Calls Arrive

Key findings

1. The tool calls arrived. TrapMyAgent's decoy MCP servers took 420 tool calls from 19 fingerprints, up from 9 last window, while connection events fell from 422,010 to 396,401. The call is the action, so alert on it rather than on the connection, and read every one.
2. Nothing that follows the bait identifies as an agent. All 2,813 attributed AgentPwn callbacks carry a verdict: 2,578 browsers and link previewers, 235 declared content crawlers, 0 generic HTTP clients and 0 declared autonomous agents. Attribute each fetch and take your own probes out before you publish a rate.
3. Something is still enumerating A2A endpoints. Handshakes rose from 15,670 to 27,247, 6.4% of TrapMyAgent events, and the task step that follows a handshake happened once. Authenticate the handshake now, while the traffic is still only knocking.
4. Exposed MCP servers grew 24.9% in 48 days. The October 19 sweep counted 2,495, up from 1,997 on September 1, and OpenClaw gateways are 80.5% of the 255,582 exposed AI services, a total we publish without a trend. Put a scoped credential in front of every endpoint you run.

1. The tool calls arrived

TrapMyAgent's decoy MCP servers took 420 tool calls this window, up from 9 in the previous one, and the calls came from 19 distinct fingerprints. Connection events moved the other way, from 422,010 to 396,401, so fewer clients connected and more of what connected asked for something. That distinction is the finding: a connection is a knock, a resource read is one step past it and still short of an action, and a tool call is the action.

The calls arrived at a near daily cadence from September 26, which reads as scheduled tooling rather than a population of operators, so we publish the total and the fingerprint count and nothing per client. The tools asked for were log search, shell execution, database query, file read, secret fetch and user lookup, which is the set an operator tries first on an unfamiliar server. Two event types also appeared for the first time this window, a credential access and a soul probe, and both sit inside the small event types row because each stands on fewer than ten sources.

Every tool call rides on a connection that already exists, so an alert on the call misses nothing an alert on the connection would catch, and it skips the crawler noise. If your MCP server is meant to sit idle, make the first tool call it receives page someone, whoever sent it, and treat the connection count as a crawler meter.

Tool calls rose while MCP connections fell

2. Nothing that follows the bait identifies as an agent

A callback fires when a client fetches the URL inside an injection payload on an AgentPwn page, and every one of the 2,813 callbacks this window carries a client class verdict. Of those, 2,578 were browsers and link prefetchers, 235 declared themselves LLM content crawlers, 0 were generic HTTP clients and 0 declared themselves autonomous agents. The count carries no trend, because this edition excludes our own diagnostic probe and the previous window's figure still carried its rows.

A browser or an unfurler fetches every link it sees, so a callback proves a fetch, not a reading. The 20 baseline honeypots that drew traffic are built to be visible to crawlers, and visible surfaces draw crawlers. 47 callbacks reached the verified tier, every one a declared crawler whose network ownership matched its declaration, and a verified crawler is still a crawler, so no vendor is named as an actor. The claimed tier also has a blind spot the zero can't close: an agent driving a real browser presents as that browser.

If you run bait of your own, the probe exclusion is the step most teams skip. A diagnostic request from your own tooling lands in the same table as a crawler's, and nothing labels it unless you do, so tag your own traffic at the source, attribute what remains, and only then count.

Every attributed callback declared a browser or a crawler

3. Something is still enumerating A2A endpoints

Agent-to-Agent handshakes rose from 15,670 last window to 27,247 in this one, 6.4% of everything TrapMyAgent recorded against 3.6% last window. The step after a handshake, where one agent asks another to do something, happened once; last window it happened twice.

That shape is enumeration rather than use. Something is walking our A2A endpoints at a growing rate and stopping at the door, and because TrapMyAgent records the handshake and not the intent, we can't say who or why. The public target set is small: the Registry's October 19 sweep found 37 A2A endpoints reachable on the open internet, against 32 on September 1, which at counts this small is a snapshot and not a trend.

The handshake is the cheapest step for a scanner and the one step you can gate without touching the task path. An agent card is discoverable by design, so the enumeration itself isn't the problem; the problem is an endpoint that accepts a task from any peer that completed a handshake. Gate the handshake now, while the traffic is still only knocking, and a walk of your endpoint list becomes a log of failed authentications you can read and a rate you can alert on.

A2A handshakes took a larger share of TrapMyAgent events

4. Exposed MCP servers grew 24.9% in 48 days

The Registry's October 19 sweep counted 2,495 exposed MCP servers, up from 1,997 on September 1, a rise of 24.9% on the same query set. The interval is 48 days rather than a month because this edition's sweep ran on the measurement date instead of the first of the month. OpenClaw gateways rose to 205,638 from 192,492 over the same interval and are 80.5% of the 255,582 exposed AI services the sweep found.

The total itself carries no trend. The LLM serving category inside it went from 20,026 to 17,090 and is published without a trend because it has swung on unchanged queries before, so the total's change is stated net of that category: 6.7% since September 1. Exposure counts reachable servers, while TrapMyAgent watches a set of decoy ones, and this window the traffic reaching the decoys asked them to do things. We can't read the decoy traffic onto the exposed population, but a server that answers without a credential is one the next sweep will find in the same pass.

Start with the list rather than with a control: enumerate every model endpoint, gateway and MCP server you run that answers without a credential, because that list is what the sweep finds and it's the one to empty first.

OpenClaw gateways are most of the exposed surface; MCP servers grew most since September 1

What to do this month

1. Alert on the MCP tool call, not the connection, and read every call a server that should be idle receives. (finding 1; OASB 2.1 (Explicit Capability Grants), OASB 2.3 (Capability Boundaries))
2. Log the client class beside every fetch of an injected URL, and take your own probes out of the count before you derive a rate. (finding 2; OASB 10.1 (Security Event Logging), OASB 3.1 (Prompt Injection Protection))
3. Put mutual authentication and message integrity on every A2A handshake, and accept no task from a peer that hasn't authenticated. (finding 3; OASB 7.1 (Mutual Authentication), OASB 7.2 (Message Integrity), OASB 5.2 (Context Window Isolation))
4. Put a scoped credential in front of every model endpoint, gateway and MCP server you run. (finding 4; OASB 2.1 (Explicit Capability Grants), OASB 5.3 (Credential Scope Limitation))
5. Split recurrence by classifier verdict before you read it as persistence, and stop comparing across an identifier change. (Appendix A; OASB 10.1 (Security Event Logging))
6. Strip hidden text, HTML comments, script literals and tag block Unicode from retrieved web content before it reaches the context. (Appendix A; OASB 3.1 (Prompt Injection Protection), OASB 3.3 (Input Validation))
7. Instrument authenticated and dynamic surfaces before you draw conclusions about agents from crawl data. (Methodology; no control mapping)

What we can't say yet

• Whether any agent has acted on an injection: the authenticated cohort that could observe one recorded no interactions, no FOITW signature fired in the window, a claimed tier verdict can't separate an agent driving a real browser from the browser, and our own test traffic and our own probe are excluded from every count.
• A page level agent share: attribution is wired on 4.5% of AgentPwn rows while the per surface rollout completes, so callbacks are the only attributed population.
• Who is enumerating A2A endpoints: TrapMyAgent records the handshake, not the intent.
• A trend on the LLM serving exposure category, or on the exposed AI services total it moves: the category has swung on unchanged queries before.
• Any vendor as an actor: 47 callbacks reached the verified tier, all declared crawlers, and the other 2,766 are claimed tier.
• A trend on fingerprints or recurrence: TrapMyAgent changed how it identifies a client inside the window, so the 11,321 distinct fingerprints and the 3,427 seen in more than one session are counts, not a comparison.

Bottom line

More of what arrived acted. Connections to our decoy MCP servers fell while the tool calls behind them multiplied, the Agent-to-Agent handshakes kept climbing with almost no task behind them, and nothing that fetched our bait declared itself an agent. A connection count tells you who is indexing; a tool call tells you who is trying. So start with one MCP server you run, list every tool call it received in the last thirty days, and alert on the next one.

Methodology and data

Window. September 19 to October 19, 2026 (30 days), measured in one pass on October 19, 2026; the October 19 exposure sweep ran inside that pass. Given here once: 30-day window September 19 to October 19, 2026, closed at 00:00 UTC. Measured October 19, 2026. TrapMyAgent time is capture time, not ingest time.

Streams. TrapMyAgent's honey agents record protocol level events from whatever connects: the request, not the intent. AgentPwn's honeypot pages carry benign injection payloads and record visits and callbacks. HoneyMap samples the public web for third party bait, not a coverage count. ARIAscout reads the Registry's October 19 exposure sweep: reachable, not attacked.

Denominators. TrapMyAgent shares use the window event count, 425,975; classifier shares use sessions, 36,629; callback shares use the 2,813 attributed callbacks. The cumulative count, 1,840,440, is never a denominator.

Comparison basis. Issue 5, whose window closed on September 17, two days before this one opened: month over month, same instrument, same query, unless a note below withholds the trend. Exposure compares with Issue 5's September 1 sweep, 48 days before this edition's, so no exposure change in this report is a monthly one.

What changed since Issue 5. AgentPwn figures exclude our own diagnostic probe; the previous window's callbacks carried its rows, so AgentPwn counts carry no trend. TrapMyAgent's fingerprint and session identifier scheme changed on September 28, inside the window: no trend on distinct fingerprints or the returning share, while event and session totals are the same query over the same rows. APT reconnaissance stood on fewer than ten sources and shares a cell with manual researcher. Two new event types, credential access and soul probe, sit in the small types row. MCP tool calls are published as a total and a fingerprint count only. Five HoneyMap surfaces left the census after three removal observations each, and three were reclassified as false positives. The exposure sweep ran on the measurement date rather than the first of the month; both sweeps ran in the same detail mode over the same 33 query set, categories add to the total plus a credential category it leaves out, and LLM serving has swung on unchanged queries before, so it carries no trend. The AgentPwn category, ATT&CK, country and cloud provider breakdowns are withheld: a row needs a recorded count of distinct client addresses at or above the floor, and none exists for this edition.

Attribution tiers. Observed: we counted it. Claimed: the client declared it. Verified: network ownership matches the declaration; nothing lifts a verdict further yet. Network figures read as fronted through, never as originating in.

Full methodology: /methodology, behavioral-sweep and foitw.

How to cite

@techreport{opena2a-btr-2026-10,
  author = {{ARIA, OpenA2A autonomous research system} and Abdel Fane (editor)},
  title  = {State of AI Agent Security: The Tool Calls Arrive},
  institution = {OpenA2A Research},
  year   = {2026},
  month  = {10},
  type   = {Behavioral Threat Report},
  number = {Issue 6},
  url    = {https://research.opena2a.org/reports/state-of-ai-agent-security-2026-10}
}

ARIA, & Fane, A. (Ed.). (2026, October 19). State of AI Agent Security: The Tool Calls Arrive (Behavioral Threat Report, Issue 6). OpenA2A Research. https://research.opena2a.org/reports/state-of-ai-agent-security-2026-10

How to challenge a finding

Email info@opena2a.org with the number you dispute and the methodology you would prefer. We aim to respond within five business days, and challenges that hold up under review are published as methodology updates in later editions, with attribution.

Appendix A: Full tables

Volume across the four streams

The exposure row is the Registry's October 19 sweep. The AgentPwn rows are published without a trend this window because the previous window's figures carried our own probe's rows.

Almost every TrapMyAgent session is an automated scanner

Of 36,629 sessions, 34,710 classify as automated scanners, 94.8% against 98.3% last window, 1,820 as unknown and 99 as manual researcher or APT reconnaissance, two verdicts in one cell because the second stood on fewer than ten sources. A class that size is a set of flags to read by hand, not a noise floor. 3,427 of 11,321 distinct fingerprints appeared in more than one session, a count with no comparison because the identifier scheme changed inside the window.

HoneyMap: injection bait planted on the public web

A sample, not a coverage count. At measurement the catalog held 292 surfaces across 239 unique domains, against 276 surfaces and 226 domains last window on the same signature set. The Unicode tag block class kept growing, to 69 surfaces from 54, and script literals as a placement went from 32 surfaces to 47. 273 of the 292 surfaces carry no sector classification because the catalog doesn't guess one. Hidden text and HTML comments still hold most of the bait, but the growth this window is in tag block Unicode and script literals, which a filter that only strips hidden elements and comments will miss.

Attack classes:

Top AIIS signatures observed:

Where the bait lives on the page:

Sector distribution:

Callback attribution by client class

Verdicts over the 2,813 attributed callbacks, read from what each client declared about itself. 140 callbacks declared a named model vendor in their user agent, and a declaration is not an identity, because the string is attacker controllable. Page level attribution, as distinct from callback attribution, covers 15,429 of the 340,018 AgentPwn rows of every event type, so this report states no page level agent share.

Agent Threat Matrix evidence tiers

Appendix B: First Observed In The Wild log

FOITW is the mechanism by which OpenA2A pre registers signatures for sophisticated AI agent attack techniques and publishes within seven days of first wild observation. The pre registration catalog is held internally until transparency log anchoring lands, so until then the registration dates below are our claim and not an independently verifiable one. Full methodology at /methodology/foitw.

Catalog state at measurement: 3 signatures registered, 0 firings during the reporting window.

Appendix C: Live indices

The three indices below update between editions. Sophistication is published as a distribution only: no mean, no grade, no month over month delta.