Internet-Wide Reconnaissance Scans Target MCP Servers and Claude/Cursor AI-Agent Credentials — Threadlinqs Intelligence
As of 2026-07-13, Internet-Wide Reconnaissance Scans Target MCP Servers and Claude/Cursor AI-Agent Credentials is a medium-severity reconnaissance threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 17 indicators of compromise.
Threat ID: TL-2026-1278 · Severity: MEDIUM · Status: ACTIVE · Category: RECONNAISSANCE
SANS Internet Storm Center (ISC Diary #33150) documented a distributed, 14-day internet-wide scanning campaign from 49 source IPs probing Model Context Protocol (MCP) server endpoints,
Between approximately 2026-06-29 and 2026-07-13, ISC handler Manuel Humberto Santander Peláez analyzed 14 days of Apache/ModSecurity logs from a single low-traffic web host (WordPress + custom backends + static site) and identified ~200 AI-agent-focused reconnaissance requests originating from 49 distinct source IPs — more source diversity than any other scan category observed on that host, indicating a distributed, coordinated campaign rather than a lone researcher.
The scanners issued two classes of probes. First, MCP protocol handshakes: a POST to /mcp carrying a well-formed JSON-RPC 2.0 'initialize' request ({"id":1,"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"client","version":"0"},"protocolVersion":"2025-03-26"}}) and a GET to /sse to detect Server-Sent-Events MCP transports. Using a real, protocol-correct handshake rather than a blind existence check lets an attacker not only detect a live MCP server but enumerate the tools and permissions it exposes to any caller that completes the handshake — described by the handler as 'a remote, machine-readable menu of everything an agent can touch, offered to anyone who completes the handshake.'
Second, targeted file-path enumeration for MCP client configuration and credential files that developer tooling (Claude Code, Cursor, VS Code MCP extensions) writes into project or home directories and which sometimes end up accidentally deployed inside a web root: /.claude/mcp.json, /.cursor/mcp.json, /.vscode/mcp.json, /.mcp/config.json, /.claude/settings.local.json, /.claude/.credentials.json, and /.config/claude/.credentials.json. The specificity and currency of this path list — matching the exact directory layout these tools use today — suggests the wordlist was built recently from firsthand knowledge of AI coding-assistant storage conventions rather than guessed.
A third probe class targeted unauthenticated LLM-serving interfaces directly: GET /v1/models (OpenAI-compatible model listing, used by many self-hosted/proxy LLM gateways) and GET /api/tags (Ollama's model-listing endpoint), both of which — if exposed without authentication — let an attacker enumerate and potentially invoke a victim's local or self-hosted model infrastructure.
Finally, the campaign incorporated SSRF probing against cloud instance-metadata services, rotating the fetch/proxy parameter name (url, uri, path, dest) against metadata.google.internal (GCP metadata + token endpoints) and 169.254.169.254 (the AWS/Azure/GCP link-local metadata IP), plus Kubernetes service-account token paths under /var/run/secrets/.../serviceaccount/token. This pattern strongly implies the attackers are hunting for MCP-fronted or agent-fronted 'fetch URL' tools that can be abused as SSRF proxies into a victim's cloud control plane — a known class of AI-agent tool-abuse risk, since many MCP/agent tool definitions expose a generic 'fetch a URL and return the content' capability with no destination allow-listing.
No successful exploitation, credential theft, or metadata-token exfiltration was confirmed on the monitored host; the campaign is assessed as pre-exploitation reconnaissance mapping the AI-agent/MCP attack surface at internet scale, consistent with independent measurement from Censys, which counted roughly 12,520 internet-accessible MCP services across 8,758 unique IPs by 2026-04-28 (growing to over 21,000 by 2026-05-06), with about 40% of the 12,520 running unauthenticated. This scanning activity sits alongside a broader wave of over 40 disclosed MCP-ecosystem CVEs between January and April 2026, including credential-exfiltration and remote-code-execution issues in Claude Code's own hook/MCP-trust model (CVE-2025-59536, CVE-2026-21852) and an unauthenticated command-execution endpoint in the nginx-ui MCP integration (CVE-2026-33032, CVSS 9.8) — evidence that opportunistic actors treat 'is there an MCP server or AI-agent config file here' as a newly profitable internet-wide scanning
Weaknesses (CWE)
CWE-306, CWE-918, CWE-522, CWE-284
Target sectors: technology, software-development, any-mcp-adopting-organization
Target regions: Global
Detections & IOCs
As of 2026-07-27, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 17 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
RECONNAISSANCE, MEDIUM, threat intelligence, cybersecurity, CVE-2025-59536, CVE-2026-21852, CVE-2026-33032, T1595.002, T1595.001, T1596, T1592.002, T1587.001, T1190, T1133, T1059, T1546, T1553