# Internet-Wide Reconnaissance Scans Target MCP Servers and Claude/Cursor AI-Agent Credentials

> SANS Internet Storm Center (ISC Diary #33150) documented a distributed, 14-day internet-wide scanning campaign from 49 source IPs probing Model Context Protocol (MCP) server endpoints, Claude/Cursor/VS Code MCP configuration and credential files, unauthenticated OpenAI-compatible and Ollama model endpoints, and cloud instance-metadata SSRF paths. No successful exploitation was confirmed — the activity is reconnaissance-stage, opportunistic mapping of the emerging AI-agent attack surface.

- **Published:** 2026-07-13T00:00:00Z
- **Last reviewed:** 2026-07-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1278
- **ID:** TL-2026-1278
- **Severity:** MEDIUM
- **Category:** RECONNAISSANCE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 17 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-59536, CVE-2026-21852, CVE-2026-33032

## Description

Between approximately 2026-06-29 and 2026-07-13, ISC handler Manuel Humberto Santander Peláez analyzed 14 days of Apache/ModSecurity logs from a single low-traffic web host (WordPress + custom backends + static site) and identified ~200 AI-agent-focused reconnaissance requests originating from 49 distinct source IPs — more source diversity than any other scan category observed on that host, indicating a distributed, coordinated campaign rather than a lone researcher.

The scanners issued two classes of probes. First, MCP protocol handshakes: a POST to /mcp carrying a well-formed JSON-RPC 2.0 'initialize' request ({"id":1,"jsonrpc":"2.0","method":"initialize","params":{"capabilities":{},"clientInfo":{"name":"client","version":"0"},"protocolVersion":"2025-03-26"}}) and a GET to /sse to detect Server-Sent-Events MCP transports. Using a real, protocol-correct handshake rather than a blind existence check lets an attacker not only detect a live MCP server but enumerate the tools and permissions it exposes to any caller that completes the handshake — described by the handler as 'a remote, machine-readable menu of everything an agent can touch, offered to anyone who completes the handshake.'

Second, targeted file-path enumeration for MCP client configuration and credential files that developer tooling (Claude Code, Cursor, VS Code MCP extensions) writes into project or home directories and which sometimes end up accidentally deployed inside a web root: /.claude/mcp.json, /.cursor/mcp.json, /.vscode/mcp.json, /.mcp/config.json, /.claude/settings.local.json, /.claude/.credentials.json, and /.config/claude/.credentials.json. The specificity and currency of this path list — matching the exact directory layout these tools use today — suggests the wordlist was built recently from firsthand knowledge of AI coding-assistant storage conventions rather than guessed.

A third probe class targeted unauthenticated LLM-serving interfaces directly: GET /v1/models (OpenAI-compatible model listing, used by many self-hosted/proxy LLM gateways) and GET /api/tags (Ollama's model-listing endpoint), both of which — if exposed without authentication — let an attacker enumerate and potentially invoke a victim's local or self-hosted model infrastructure.

Finally, the campaign incorporated SSRF probing against cloud instance-metadata services, rotating the fetch/proxy parameter name (url, uri, path, dest) against metadata.google.internal (GCP metadata + token endpoints) and 169.254.169.254 (the AWS/Azure/GCP link-local metadata IP), plus Kubernetes service-account token paths under /var/run/secrets/.../serviceaccount/token. This pattern strongly implies the attackers are hunting for MCP-fronted or agent-fronted 'fetch URL' tools that can be abused as SSRF proxies into a victim's cloud control plane — a known class of AI-agent tool-abuse risk, since many MCP/agent tool definitions expose a generic 'fetch a URL and return the content' capability with no destination allow-listing.

No successful exploitation, credential theft, or metadata-token exfiltration was confirmed on the monitored host; the campaign is assessed as pre-exploitation reconnaissance mapping the AI-agent/MCP attack surface at internet scale, consistent with independent measurement from Censys, which counted roughly 12,520 internet-accessible MCP services across 8,758 unique IPs by 2026-04-28 (growing to over 21,000 by 2026-05-06), with about 40% of the 12,520 running unauthenticated. This scanning activity sits alongside a broader wave of over 40 disclosed MCP-ecosystem CVEs between January and April 2026, including credential-exfiltration and remote-code-execution issues in Claude Code's own hook/MCP-trust model (CVE-2025-59536, CVE-2026-21852) and an unauthenticated command-execution endpoint in the nginx-ui MCP integration (CVE-2026-33032, CVSS 9.8) — evidence that opportunistic actors treat 'is there an MCP server or AI-agent config file here' as a newly profitable internet-wide scanning category, with exploitation escalation a realistic near-term next step for any organization whose MCP endpoints, config files, or agent 'fetch' tools are exposed without authentication and destination controls.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1595.001 Scanning IP Blocks
- T1596 Search Open Technical Databases
- T1592.002 Software
- T1587.001 Malware
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1059 Command and Scripting Interpreter
- T1546 Event Triggered Execution
- T1553 Subvert Trust Controls
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1557 Adversary-in-the-Middle
- T1518 Software Discovery
- T1526 Cloud Service Discovery
- T1580 Cloud Infrastructure Discovery
- T1046 Network Service Discovery
- T1213 Data from Information Repositories
- T1602 Data from Configuration Repository
- T1567 Exfiltration Over Web Service

## Sources

- [Internet-Wide Scans Target MCP Servers, Claude Credentials, and Exposed AI Models](https://cybersecuritynews.com/internet-wide-scans-target-mcp-servers-claude-credentials/)
- [Someone Is Scanning for Your MCP Servers and AI Assistant Credentials (ISC Diary #33150)](https://isc.sans.edu/diary/rss/33150)
- [Caught in the Hook: RCE and API Token Exfiltration Through Claude Code Project Files (CVE-2025-59536)](https://research.checkpoint.com/2026/rce-and-api-token-exfiltration-through-claude-code-project-files-cve-2025-59536/)
- [MCP Servers on the Internet](https://censys.com/blog/mcp-servers-on-the-internet/)
- [NVD - CVE-2026-33032](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-33032)
- [The Vulnerable MCP Project: Comprehensive Model Context Protocol Security Database](https://vulnerablemcp.info/)
- [A Timeline of Model Context Protocol (MCP) Security Breaches](https://authzed.com/blog/timeline-mcp-breaches)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1278