MCPwned - How Exposed AI Agents Became the Internet’s New Recon Toy

Eli Woodward starts from a simple observation: scanning traffic on the public internet has shifted toward AI services. Cheap cloud instances logging web ports began showing requests for model lists and chat completions, so he built a honeypot that imitates many AI stacks across multiple ports and regions, capturing paths, headers, model names, prompts and the API keys that visitors try.

In a 48-hour window the sensors logged nearly four thousand requests from a few hundred source addresses, including MCP probes and many attempts with leaked or default keys. Woodward walks through one LiteLLM gateway compromise. The attacker used a default master key, listed existing models, registered new ones that pointed at an attacker-controlled host so traffic would be relayed there, and checked the setup with a single-character prompt. He also describes MCP enumeration aimed at tool lists, resource files and local database endpoints, and a relay service that appeared to resell access to exposed model servers.

His conclusion is that most of the abuse is basic misconfiguration rather than prompt injection, and that Docker hosts and laptops running local inference servers are targets too. The practical takeaways are to rotate default keys, log and restrict MCP resource reads, close default inference ports, and treat AI gateways as production infrastructure that needs monitoring and hardening guidance.