Total Recon - How We Discovered 1000s of open Agents in The Wild

The Zenity Labs speakers open by noting that attacks on AI agents already happen in the wild, from agent-to-agent abuse to threat actors probing AI systems for their capabilities. Their focus is how attackers find these agents at all. They argue agents are applications that expose knowledge, tools and identities, so classic attack surface discovery applies, and predictable naming and default settings are the weak points.

For each platform they used a different discovery method. In OpenAI's Agent Builder, starter-kit naming on a hosting platform made subdomains guessable through fuzzing common prefixes and suffixes, and a session secret confirmed a live agent. Hundreds were found, some with sensitive documents. In Microsoft Copilot Studio, agent URLs embed a tenant-linked default environment and a short solution prefix that is often left at its default, which shrinks the search space. Recurring words in agent names then finished the job, yielding thousands of agents. Internet scanning for the MCP session header turned up about 100,000 MCP servers, and backlink searches for embedded Copilot pages found roughly 5,000 agents. Asking agents directly for their tools sometimes worked, and prompt injection got past guardrails the team called soft.

The defender takeaways are to stop relying on obscurity and default names, keep an inventory of public agents, MCP servers and skills, and log agent access so repeated prompts or capability probing show up as discovery signals. The researchers released PowerPwn, an open-source recon tool for testing your own exposure, and said the work maps to OWASP's agentic guidance and MITRE ATLAS. They warned that anything newly public gets probed quickly.