Internet-Wide Reconnaissance Scans Target MCP Servers and Claude/Cursor AI-Agent Credentials
Internet-Wide Reconnaissance Scans Target MCP Servers and (TL-2026-1278), also tracked as MCP Internet-Wide Recon Campaign, is a medium-severity reconnaissance threat, first published 2026-07-13. It has no confirmed attribution, affects Generic / Multi-vendor Internet-exposed Model Context Protocol (MCP), references 3 CVEs (CVE-2025-59536, CVE-2026-21852, CVE-2026-33032), maps to 20 MITRE ATT&CK techniques (T1046, T1059, T1133), and is covered by 9 detection rules and 17 indicators of compromise.
Key facts for TL-2026-1278
- Threat ID
- TL-2026-1278
- Also known as
- MCP Internet-Wide Recon Campaign, AI-Agent Credential Scanning Wave
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- RECONNAISSANCE
- First published
- 2026-07-13
- Last reviewed
- 2026-07-13
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, software-development, any-mcp-adopting-organization
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 17
SANS Internet Storm Center (ISC Diary #33150) documented a distributed, 14-day internet-wide scanning campaign from 49 source IPs probing Model Context Protocol (MCP) server endpoints, Claude/Cursor/VS Code MCP configuration and credential files, unauthenticated OpenAI-compatible and Ollama model endpoints, and cloud instance-metadata SSRF paths. No successful exploitation was confirmed — the activity is reconnaissance-stage, opportunistic mapping of the emerging AI-agent attack surface.
How Internet-Wide Reconnaissance Scans Target MCP Servers and works
Between approximately 2026-06-29 and 2026-07-13, ISC handler Manuel Humberto Santander Peláez analyzed 14 days of Apache/ModSecurity logs from a single low-traffic web host (WordPress + custom backends + static site) and identified ~200 AI-agent-focused reconnaissance requests originating from 49 distinct source IPs — more source diversity than any other scan category observed on that host, indicating a distributed, coordinated campaign rather than a lone researcher.
The scanners issued two classes of probes. First, MCP protocol handshakes: a POST to /mcp carrying a well-formed JSON-RPC 2.0 'initialize' request ({"id":1,"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"client","version":"0"},"protocolVersion":"2025-03-26"}}) and a GET to /sse to detect Server-Sent-Events MCP transports. Using a real, protocol-correct handshake rather than a blind existence check lets an attacker not only detect a live MCP server but enumerate the tools and permissions it exposes to any caller that completes the handshake — described by the handler as 'a remote, machine-readable menu of everything an agent can touch, offered to anyone who completes the handshake.'
Second, targeted file-path enumeration for MCP client configuration and credential files that developer tooling (Claude Code, Cursor, VS Code MCP extensions) writes into project or home directories and which sometimes end up accidentally deployed inside a web root: /.claude/mcp.json, /.cursor/mcp.json, /.vscode/mcp.json, /.mcp/config.json, /.claude/settings.local.json, /.claude/.credentials.json, and /.config/claude/.credentials.json. The specificity and currency of this path list — matching the exact directory layout these tools use today — suggests the wordlist was built recently from firsthand knowledge of AI coding-assistant storage conventions rather than guessed.
A third probe class targeted unauthenticated LLM-serving interfaces directly: GET /v1/models (OpenAI-compatible model listing, used by many self-hosted/proxy LLM gateways) and GET /api/tags (Ollama's model-listing endpoint), both of which — if exposed without authentication — let an attacker enumerate and potentially invoke a victim's local or self-hosted model infrastructure.
Finally, the campaign incorporated SSRF probing against cloud instance-metadata services, rotating the fetch/proxy parameter name (url, uri, path, dest) against metadata.google.internal (GCP metadata + token endpoints) and 169.254.169.254 (the AWS/Azure/GCP link-local metadata IP), plus Kubernetes service-account token paths under /var/run/secrets/.../serviceaccount/token. This pattern strongly implies the attackers are hunting for MCP-fronted or agent-fronted 'fetch URL' tools that can be abused as SSRF proxies into a victim's cloud control plane — a known class of AI-agent tool-abuse risk, since many MCP/agent tool definitions expose a generic 'fetch a URL and return the content' capability with no destination allow-listing.
No successful exploitation, credential theft, or metadata-token exfiltration was confirmed on the monitored host; the campaign is assessed as pre-exploitation reconnaissance mapping the AI-agent/MCP attack surface at internet scale, consistent with independent measurement from Censys, which counted roughly 12,520 internet-accessible MCP services across 8,758 unique IPs by 2026-04-28 (growing to over 21,000 by 2026-05-06), with about 40% of the 12,520 running unauthenticated. This scanning activity sits alongside a broader wave of over 40 disclosed MCP-ecosystem CVEs between January and April 2026, including credential-exfiltration and remote-code-execution issues in Claude Code's own hook/MCP-trust model (CVE-2025-59536, CVE-2026-21852) and an unauthenticated command-execution endpoint in the nginx-ui MCP integration (CVE-2026-33032, CVSS 9.8) — evidence that opportunistic actors treat 'is there an MCP server or AI-agent config file here' as a newly profitable internet-wide scanning category, with exploitation escalation a realistic near-term next step for any organization whose MCP endpoints, config files, or agent 'fetch' tools are exposed without authentication and destination controls.
MITRE ATT&CK techniques used in TL-2026-1278
Discovery
T1046 Network Service Discovery; T1518 Software Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Collection
T1213 Data from Information Repositories; T1602 Data from Configuration Repository
Persistence
T1546 Event Triggered Execution
Credential Access
T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API; T1557 Adversary-in-the-Middle
defense-impairment
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
Reconnaissance
T1592.002 Software; T1595.001 Scanning IP Blocks; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases
Affected products and versions in Internet-Wide Reconnaissance Scans Target MCP Servers and
- Generic / Multi-vendor — Internet-exposed Model Context Protocol (MCP) servers
Vulnerable versions: any MCP server reachable from the public internet without authentication
Fixed in: MCP servers placed behind authentication and network access controls - Anthropic — Claude Code (hooks / MCP trust model)
Vulnerable versions: versions predating the CVE-2025-59536 / CVE-2026-21852 fixes
Fixed in: versions with deferred MCP execution, delayed base-URL requests, and hardened trust dialog - 0xJacky — nginx-ui
Vulnerable versions: <= 2.3.5
Fixed in: versions requiring authentication on /mcp_message - Generic — Self-hosted / proxied OpenAI-compatible and Ollama model-serving endpoints
Vulnerable versions: deployments exposing /v1/models or /api/tags without authentication
Fixed in: deployments requiring authentication on model-listing/inference endpoints
Remediation for Internet-Wide Reconnaissance Scans Target MCP Servers and
Patches
- Update Claude Code to the version addressing CVE-2025-59536 / CVE-2026-21852 (deferred MCP execution until explicit user trust approval; delayed outbound API requests until after trust confirmation; hardened trust-dialog warnings)
- Update nginx-ui to a version beyond 2.3.5 that requires authentication on the /mcp_message endpoint (CVE-2026-33032)
Immediate actions
- Search web-server and reverse-proxy access logs for POST /mcp and GET /sse requests, and for GET requests to /.claude/mcp.json, /.cursor/mcp.json, /.vscode/mcp.json, /.mcp/config.json, /.claude/settings.local.json, /.claude/.credentials.json, and /.config/claude/.credentials.json
- Confirm no AI-agent configuration or credential files (mcp.json, settings.local.json, .credentials.json, and equivalents for Cursor/VS Code) are served from any public web root
- Externally test for exposed /v1/models and /api/tags endpoints and take unauthenticated LLM-serving interfaces offline or behind auth
- Block or rate-limit inbound requests to internal MCP endpoints from the public internet at the network/WAF layer where MCP is not intended to be internet-facing
Workarounds
- Disable enableAllProjectMcpServers / any auto-approval MCP setting in Claude Code / editor configuration so MCP servers require explicit per-project user consent
- Do not set ANTHROPIC_BASE_URL (or equivalent provider base-URL environment variables) from untrusted repository configuration; treat any repo-supplied override of an API base URL as a credential-exfiltration risk
- Remove or relocate any .claude/, .cursor/, .vscode/ MCP config/credential directories out of directories served by a web server
Longer-term hardening
- Enforce authentication (API keys, mTLS, or OAuth) on every MCP server and require it before any tool/capability is enumerable via the initialize handshake
- Never deploy MCP servers directly on the public internet unless strictly required; place them behind a VPN, private network, or authenticating reverse proxy
- Adopt IMDSv2-only on AWS (disable IMDSv1 token-less access) and enable GCP metadata header enforcement (Metadata-Flavor: Google requirement / VPC-level blocking) to blunt metadata SSRF even if a fetch-capable tool is compromised
- Add destination allow-lists / deny-lists (block 169.254.169.254, metadata.google.internal, RFC1918, and link-local ranges) to any agent or MCP tool that performs an outbound HTTP fetch on behalf of a model
- Track and patch MCP SDK and MCP-integrated product CVEs (Python/TypeScript/Java/Rust MCP SDKs, Claude Code hooks/MCP trust model, third-party MCP integrations like nginx-ui) as part of routine dependency management
CVEs associated with Internet-Wide Reconnaissance Scans Target MCP Servers and
Weaknesses (CWE) in Internet-Wide Reconnaissance Scans Target MCP Servers and
CWE-306, CWE-918, CWE-522, CWE-284
Timeline of Internet-Wide Reconnaissance Scans Target MCP Servers and
- Check Point Research discloses CVE-2025-59536 and CVE-2026-21852: Claude Code project-controlled hooks and MCP configuration files enabling automatic command execution and API-key/token exfiltration via redirected ANTHROPIC_BASE_URL before project trust is confirmed.
- Independent research reports over 42,000 OpenClaw instances exposed on the public internet, including over 1,000 unauthenticated MCP endpoints leaking API keys, Slack credentials, and chat histories, marking early evidence of mass MCP exposure.
- Security researchers report 30+ MCP-related CVEs disclosed within a 60-day window, reflecting systemic authentication, input-validation, and credential-management gaps across MCP SDK implementations (Python, TypeScript, Java, Rust).
- Censys measures roughly 12,520 internet-accessible MCP services across 8,758 unique IP addresses, finding approximately 40% run without authentication.
- Censys updates its count to over 21,000 internet-accessible MCP servers, showing continued rapid growth of the exposed MCP attack surface.
- Approximate start of the 14-day logging window later analyzed by SANS ISC, during which a monitored low-traffic web host began receiving MCP-handshake and AI-config-file reconnaissance requests from 49 distinct source IPs.
- CVE-2026-33032 disclosed: an unauthenticated /mcp_message endpoint in nginx-ui <= 2.3.5 allows any network attacker to invoke MCP tools including nginx config modification and restart (CVSS 9.8).
- Cyber Security News publishes coverage of the ISC diary, summarizing the campaign's targeted file paths, endpoints, and recommended mitigations for defenders.
- SANS Internet Storm Center publishes ISC Diary #33150, 'Someone Is Scanning for Your MCP Servers and AI Assistant Credentials,' detailing the ~200-request, 49-source-IP campaign targeting MCP handshakes, Claude/Cursor/VS Code config and credential files, unauthenticated LLM endpoints, and cloud-metadata SSRF paths.
Sources cited for Internet-Wide Reconnaissance Scans Target MCP Servers and
- Internet-Wide Scans Target MCP Servers, Claude Credentials, and Exposed AI Models
- Someone Is Scanning for Your MCP Servers and AI Assistant Credentials (ISC Diary #33150)
- Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files (CVE-2025-59536)
- MCP Servers on the Internet
- NVD - CVE-2026-33032
- The Vulnerable MCP Project: Comprehensive Model Context Protocol Security Database
- A Timeline of Model Context Protocol (MCP) Security Breaches
Threats related to Internet-Wide Reconnaissance Scans Target MCP Servers and
- CVE-2026-64849 — MLflow Server-Side Request Forgery (SSRF) Vulnerability in Model Registry Webhooks
- Nginx UI Authentication Bypass via Unauthenticated MCP Endpoint (CVE-2026-33032)
- OpenAI Models Chain Eight JFrog Artifactory Zero-Days to Escape Sandbox and Breach Hugging Face
- Claude Code Symlink Flaw in Startup Memory Loader Enables Silent File Exfiltration via CLAUDE.md Imports
- GitHub Enterprise Server 3.20.3 — Pre-Auth SSRF in Upload Endpoint (CVE-2026-9312) + Bundled "Dirty Frag" Kernel LPEs (CVE-2026-43284, CVE-2026-43500) + Mandatory GPG Signing Key Rotation
Detection coverage for TL-2026-1278
As of 2026-07-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1278 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.