The Pulse
OpenA2A Records 420 Calls to Decoy MCP Servers
OpenA2A recorded 420 tool calls to its decoy MCP servers during the 30-day window ending October 19, up from nine as connection events fell. The report counts 425,975 TrapMyAgent events in that window, with AgentPwn interactions and callbac
AI.info Team · Written with AI · fact-checked ·
OpenA2A’s decoy MCP servers received 420 tool calls in the 30-day measurement window ending October 19, the security research group said in its latest report. That was up from nine in the previous window, even as connection events fell from 422,010 to 396,401. The report counts requests reaching a controlled decoy fleet; it does not establish that attackers succeeded against real systems.
More calls, fewer connections
The calls came from 19 distinct fingerprints, the report says. OpenA2A describes a near-daily cadence beginning September 26 and says it is publishing the total and fingerprint count, but no per-client breakdown. It says the requested tools included log search, shell execution, database queries, file reads, secret retrieval and user lookup.
Those requests matter to the report because a connection alone does not show an attempt to use a server’s capabilities. OpenA2A recorded 34 MCP resource reads alongside the 420 tool calls. TrapMyAgent recorded 425,975 events in the window; AgentPwn page interactions and callbacks are counted separately. The report recommends alerting on tool calls to servers expected to remain idle, rather than treating connection volume as the signal.
“That distinction is the finding: a connection is a knock, a resource read is one step past it and still short of an action, and a tool call is the action.”
ARIA, OpenA2A’s autonomous research system
The report stops short of identifying agents
OpenA2A also counted 2,813 callbacks from links embedded in benign injection payloads on its AgentPwn honeypot pages. Of those, 2,578 came from browsers and link previewers, while 235 came from clients declaring themselves content crawlers; none declared itself an autonomous agent. The report says those figures describe attributed callbacks, not proof that a client read or acted on the bait.
The distinction leaves an important blind spot: a system using an ordinary browser may appear in the browser category. “The claimed tier also has a blind spot the zero can't close: an agent driving a real browser presents as that browser.” OpenA2A does not name a vendor or claim that the measured activity came from a particular operator.
A2A handshakes rise, but tasks remain rare
The report records 27,247 Agent-to-Agent protocol handshakes, up from 15,670 in the preceding window, and says they made up 6.4% of TrapMyAgent events. The subsequent step—a task request—occurred once, compared with twice in the earlier window. OpenA2A characterizes the pattern as endpoint enumeration but says its sensor records the handshake, not the reason for it.
Separately, an October 19 sweep found 2,495 exposed MCP servers, compared with 1,997 on September 1. The report describes that as a 24.9% increase over 48 days, not a monthly change. It cautions that the exposure sweep and the decoy-server traffic measure different things, so the call count cannot be used to estimate activity across the exposed-server population.
What the measurements can support
OpenA2A’s central security recommendation is to record the tool name and arguments and review calls made to servers that should be idle. It also advises requiring scoped credentials for exposed endpoints and authenticating A2A handshakes before accepting tasks. Those are recommendations based on the report’s observations, not evidence that the measured calls caused an intrusion.
The report’s most concrete change is a shift from nine to 420 tool calls while MCP connections declined. For defenders monitoring their own servers, OpenA2A argues that the request to use a tool is a more actionable alert than the connection that preceded it.