The tool calls arrived

Last window, the story from our honeypot fleet was mostly knocking. Automated scanners connected to our decoy MCP servers and left, crawlers fetched the links out of our bait pages, and something walked our Agent-to-Agent endpoints and stopped at the handshake. The decoy MCP servers took 9 tool calls in thirty days.

This window they took 420, from 19 fingerprints, and connections to those same servers fell from 422,010 to 396,401. So fewer clients showed up, and more of the ones that did asked the server to do something. That's the finding Issue 6 is named for, and it's the one I'd want you to take into your own logs this week.

What we found

The tool calls arrived. A connection to an MCP server is a knock, a resource read is one step past it, and a tool call is the action. The 420 calls this window asked for log search, shell execution, database query, file read, secret fetch and user lookup, which is the set an operator tries first on a server they don't know. They arrived at a near daily cadence from September 26, which reads as scheduled tooling rather than a crowd of people, so we publish the total and the fingerprint count and nothing per client. The practical point is that a connection threshold is tuned to crawlers and will page you on indexing, while a tool call to a server that should be idle is the event worth a human, and 420 in a month is still few enough for one person to read every one.

Nothing that follows the bait identifies as an agent. A callback fires when a client fetches the URL inside an injection payload on one of our AgentPwn pages. Every one of the 2,813 callbacks this window carries a client class verdict: 2,578 browsers and link previewers, 235 declared content crawlers, 0 generic HTTP clients and 0 declared autonomous agents. 47 reached our verified tier, meaning the network the request came from matched what the client claimed to be, and every one of those was a crawler, so no vendor is named as an actor. This count carries no trend because we took our own diagnostic probe out of it this edition and the previous window's figure still had the probe's rows in it. If you run bait of your own, that exclusion is the step most teams skip.

Something is still enumerating A2A endpoints. Agent-to-Agent handshakes rose from 15,670 last window to 27,247, from 3.6% of everything TrapMyAgent recorded to 6.4%, and the step after the handshake, where one agent asks another to do something, happened once. That shape is enumeration rather than use. We record the handshake and not the intent, so I can't tell you who or why, but I can tell you the handshake is the cheapest step for a scanner and the one step you can gate without touching the task path.

Exposed MCP servers grew 24.9% since September 1. The Registry's October 19 sweep found 2,495 MCP servers reachable on the open internet without a credential, up from 1,997 on September 1 on the same query set. OpenClaw gateways rose to 205,638 and are 80.5% of the 255,582 exposed AI services the sweep found. We publish that total without a trend because one category inside it, LLM serving, has swung on unchanged queries before, and a trend built on a number that moves on its own isn't one.

What the zero means, and what it doesn't

The easy reading of "0 declared autonomous agents" is that agents aren't out there acting on injected content. That's not what the number says, and I'd rather you didn't repeat it that way.

A callback proves a client fetched a URL. It doesn't prove the client read the page around it or acted on an instruction in it, because a browser or a link unfurler fetches every link it sees regardless of the hidden text beside it. The zero is a count of clients that declared themselves agents in their user agent, and no adversarial agent declares itself. An agent driving a real browser presents as that browser, which is a blind spot the claimed tier can't close. So the number that would actually matter, clients that acted on injected content rather than fetching it reflexively, isn't in this table, because no sensor in the public cohort isolates it yet.

What the public cohort can say is narrower and still useful: across two full windows of callback attribution, the public web drew declared browsers and crawlers and no declared agents. The surface that could observe an autonomous agent acting on an injection is the authenticated one no crawl reaches, which is why I keep telling people to instrument their own authenticated and dynamic surfaces instead of drawing conclusions about agents from crawl data. That limit is the one I'm most focused on closing in the fleet.

What to do this month

The first six map to specific OASB controls and Agent Threat Matrix techniques in the report, so your team can trace the why.

1. Alert on the MCP tool call, not the connection. If a server you run is supposed to sit idle, make the first tool call it receives page someone, log the tool name and the arguments beside the connection, and read every call it got in the last thirty days.
2. Attribute before you count. Log the client class beside every fetch of an injected URL, and take your own probes out before you derive a rate. A callback rate published without that split measures link unfurling, not agent compliance.
3. Authenticate A2A handshakes now, not when they carry tasks. Put mutual authentication and message integrity on the handshake while the traffic reaching it is still only knocking, and accept no task from a peer that hasn't authenticated.
4. Put a scoped credential in front of every model endpoint, gateway and MCP server you run. If you can't say which of yours answer without one, run the query the sweep runs and find out before someone else does.
5. Segment out scanners before you call anything persistence, and stop comparing recurrence across an identifier change. Ours changed inside this window, so our fingerprint counts are counts, not a comparison.
6. Strip hidden text, HTML comments, script literals and tag block Unicode from retrieved web content before it reaches the context. Those last two are where the bait on the public web grew this window.
7. Instrument authenticated and dynamic surfaces before you draw conclusions about agents from crawl data.

How we measured it, and where to read the rest

Every figure above comes from a thirty day window, September 19 to October 19, 2026, measured in one pass on October 19 with the window bounds fixed. Four streams feed it: TrapMyAgent's honey agents record protocol level events from whatever connects, AgentPwn's honeypot pages carry benign injection payloads and record visits and callbacks, HoneyMap samples the public web for third party bait, and ARIAscout reads the Registry's exposure sweep, which ran on the same date inside the pass. Observed means we counted it, claimed means the client declared it, and verified means the network it came from matched the declaration. Nothing lifts a verdict further yet.

Some things are deliberately not in the report. The breakdowns by payload category, ATT&CK technique, country and cloud provider are withheld because a row needs ten or more distinct client addresses behind it and that floor isn't confirmed for this edition. Fingerprints and recurrence carry no trend because TrapMyAgent changed how it identifies a client inside the window. AgentPwn counts carry no trend because we removed our own probe. I'd rather publish a smaller set of numbers I can defend than a larger one I can't.

The full report, with the tables, the control mappings and the methodology, is at research.opena2a.org, and it's Apache 2.0, so cite it, fork it, or argue with it. If a number looks wrong to you, the methodology section tells you how to challenge it: send the figure you dispute and the method you'd prefer to info@opena2a.org, and challenges that hold up get published as methodology updates with attribution. That's the standard we hold ourselves to while we build the trust layer for AI agents, and it's the one I'd ask you to hold us to as well.