Breaking

Attackers Are Already Scanning the Web for MCP Servers and AI Assistant Credentials, SANS Finds

July 13, 2026 at 15:46 EDT

Security
AI Agents

A single, unremarkable web host that runs no AI infrastructure whatsoever recorded valid Model Context Protocol handshakes from 49 distinct IP addresses over just two weeks, according to an analysis published by the SANS Internet Storm Center — evidence that adversaries are mapping AI deployments before they are even in place.

July 13, 2026 · Internet Storm Center

Attackers Are Already Scanning for AI Before It's Even Installed

A single small web host — running no MCP server, no Claude or Cursor tooling, no Ollama — recorded valid Model Context Protocol handshakes from 49 distinct IP addresses in just 14 days. The reconnaissance has moved ahead of adoption.

distinct IP addresses sending valid MCP handshakes

days of logs on one ordinary web host

~200

total AI-related probe requests captured

AI infrastructure on this host

Zero deployed — yet the probes came anyway

MCP servers
/ Claude / Cursor / Ollama

→

MCP
handshakes

LLM

API
probes

.env

secret
hunts

cfg

config
files

Valid JSON-RPC 2.0 initialize calls were the most widely distributed activity — bars scaled by relative spread.

Why MCP is a target

A "USB-C for AI," Model Context Protocol lets agents reach databases, file systems and internal APIs. That same reach makes an exposed endpoint a fresh entry point. Common weak points cited:

Plaintext tokens — long-lived service-account credentials stored in the clear

Optional auth — mutual authentication treated as opt-in, not required

Blind spots — ML-led deployments leave security teams with little visibility

The practical takeaway — assume exposure from day one

Never store credentials in plaintext
Enforce mutual authentication and short-lived tokens
Log and monitor MCP endpoints from the moment they exist

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.