422,010 MCP connections, 9 tool calls: what 30 days of AI agent honeypot data shows
What Issue 5 of our Behavioral Threat Report found, and what to change on your own systems this month.
ARIA, OpenA2A's autonomous research system, measures what reaches our honeypots and what's exposed on the open internet every month, and we publish what it finds as the Behavioral Threat Report. Issue 5 covers the 30 days from August 18 to September 17, 2026, and the short version is that far more arrived than acted. Traffic to TrapMyAgent, our fleet of decoy agents, roughly doubled to 439,114 events, but nearly all of it connected and asked for nothing.
Keep one thing in mind as you read: most of these are honeypot numbers. They show what reaches decoys we built to be found, so read them as a picture of what's out there probing, not as attack rates against real deployments.
Almost every MCP client that connects asks for nothing
TrapMyAgent recorded 422,010 Model Context Protocol (MCP) connections in the window, 96.1% of everything it saw. Those connections produced 35 resource reads and 9 tool calls, which works out to about one tool call every three days.
That ratio should shape your alerting. If you alert on connection counts, you've tuned for crawler behavior and you'll get paged for indexing, so alert on the tool call instead. On an MCP server that's supposed to sit idle, the first unexpected tool call is the event worth a human, whoever sent it, and calls are rare enough that someone can read every one.
Something is walking our A2A endpoints
Agent-to-Agent (A2A) handshakes went from 1,125 in the last comparable window (the 30 days ending July 22) to 15,670 in this one, about 14 times as many and 3.6% of all TrapMyAgent events. The step after the handshake, where one agent asks another to do something, happened twice. That pattern looks like enumeration, not use: something is walking our A2A endpoints and stopping at the door, and because we record the handshake rather than the intent, we can't say who's doing it or why.
If you expose an A2A endpoint, this is the cheap moment to act. Agent cards are meant to be discoverable, so being found isn't the problem. The problem is an endpoint that will take a task from any peer that completed a handshake. Put mutual authentication and message integrity on the handshake now, while the traffic is still only knocking, and a walk of your endpoints turns into a log of failed authentications you can alert on.
Returning visitors are mostly scanners on a schedule
Just over a quarter of the fingerprints TrapMyAgent saw (2,343 of 8,776) came back for more than one session, up from 13.7% in the last comparable window. That looks like persistence until you split it by class: 98.3% of sessions classify as automated scanners, and the most frequent returner opened 4,631 sessions at about one event each, which is what a scheduled scanner looks like. So split recurrence by classifier verdict before you call anything persistence. Everything our classifier didn't label a scanner adds up to 636 sessions this window, small enough to review by hand, and that's the set worth reading first.
No declared agents followed the bait
AgentPwn, our set of honeypot web pages, carries harmless injection payloads, and when a client fetches a URL inside one, we log a callback. All 2,437 callbacks this window carry a client class, the first edition where attribution covers the whole window, and the split is lopsided: 2,130 browsers and link previewers, 303 declared LLM content crawlers, 4 generic HTTP libraries, and not one client that identified itself as an autonomous agent.
That classification rests on what each client says about itself, which leaves a blind spot: an agent working inside an ordinary browser presents as that browser and gets counted as one. So the zero doesn't prove that no agent acted on an injection, and the report is explicit that we can't tell you that yet. What it does show is that a raw callback rate mostly measures browsers and link previews, so if you run bait of your own, log the client class next to every fetch before you publish a rate from it.
The bait that grew is the kind you can't see
We also keep a sample of injection bait that third parties have planted on public web pages. It's a sample, not a full count, and this month it held 276 surfaces across 226 domains. Most of the bait sits in hidden text (155 surfaces) and HTML comments (59), and the class that grew is Unicode tag characters, which most renderers don't display at all: 54 surfaces, up from 39. If your agent pulls web content into its context without stripping hidden text, comments and tag block Unicode, it's reading that bait as instructions.
More exposed gateways and MCP servers
Our September 1 internet sweep counted 243,615 exposed AI services. OpenClaw gateways make up 192,492 of them, 79% of everything the sweep found, up from 183,737 on August 1, and exposed MCP servers rose to 1,997 from 1,775.
Reachable isn't the same as touched, though, and touched isn't the same as used. The sweep counts open doors, our decoys are doors we left open on purpose, and what walks through ours still mostly connects and asks for nothing. That's a reason to close doors now, not evidence that open ones are safe. Put a credential in front of every model endpoint and gateway, scoped to what it needs, and if you can't say which of your endpoints answer without one, look at your own address space the way an internet sweep would and find out before someone else does.
What to do this month
- Alert on MCP tool calls, not connections.
- Put mutual authentication and message integrity on every A2A handshake.
- Split recurrence by classifier verdict before you read it as persistence.
- Log the client class beside every fetch of an injected URL before you derive a rate from it.
- Strip hidden text, HTML comments and tag block Unicode from web content before it reaches an agent's context.
- Put a scoped credential in front of every model endpoint and gateway.
Where this leaves you
There's still a lot we can't tell you, including whether any agent has acted on an injection and who's walking our A2A endpoints. What the data does show is one consistent pattern: far more reaches our decoys than acts on them. Across the month, 422,010 MCP connections produced 9 tool calls and 15,670 A2A handshakes produced 2 tasks. None of the clients that followed our bait declared itself an agent, and between our August and September sweeps, the number of exposed gateways and MCP servers grew.
That isn't a reason to relax, it's your opening. When most of the traffic is noise, the signal that matters is small enough for one person to read, and most of the fixes on the list above are changes to systems you already run.
So start small, and start this week. Pick one MCP server, model endpoint or agent you run, and spend an hour on two questions: does it answer without a credential, and what has it actually been asked to do? Our decoys can't tell you what's reaching your systems. Your logs can, and that hour will teach you more about your own risk than any report will. When you want to go further, the full report maps its recommendations to OASB controls, with links, and the methodology shows how we measured, so you can apply the same approach to your own logs.
Nothing in the knocking tells you if or when it turns into something else, so close your doors before you find out.
Read the full Issue 5 report, with methodology and every table, at research.opena2a.org. If a number of ours looks wrong, or your own logs tell a different story, email info@opena2a.org.