← Research

Honeypot week one: discovery without delegation

2026-10-26 · research note · 3 min read

Date: 2026-10-26 · Sensor: the lab's A2A/Poppy/MCP honeypot (location undisclosed; v0.1.0, deployed 2026-10-23) · Data: 72 h of captures, aggregate-only

Seventy-two hours into operating what is, to our knowledge, the first public honeypot for the A2A and Poppy protocols, the traffic has moved through three distinct phases — and the third one is the first that looks like the future.

Phase 1: certificate-transparency reconnaissance (day 0)

Documented in the [first-wave write-up draft](../writeups/2026-11-hunting-the-first-wave.md): certificate issued 18:07 UTC, first /.env probes within ~5 minutes, first external fetch of /.well-known/agent.json at 18:14:06 — all driven by watchers of public CT logs.

Phase 2: index-driven bulk scanning (days 1–2)

Four Google Cloud sources (34.151.87.76, 34.154.251.195, 35.238.129.244, 34.151.245.99) delivered 943 requests characterized by rapid_enumeration flags — consistent with Censys's hosted scan rotation. The honeypot is now permanently findable by anything that queries an index.

Phase 3: agent-exposure auditors (days 2–3) — the new behavior

Three actors fetched the discovery pair — /.well-known/agent.json and /.well-known/poppy.json — and nothing else. Vulnerability scanners do not do this; this is the signature of the emerging class of tools that audit agent exposure (the community poppy.json checkers and "MCP/A2A/poppy.json" auditors):

ASN enrichment corrected an earlier hypothesis: all three are small hosting/datacenter ASNs or cloud IPs — all are VPS-hosted tooling, none are humans on phones. The Android-Chrome UA from a Google IP is spoofing or embedded-client identity, not a person.

Two patterns worth generalizing:

1. The discovery triad. agent.json + poppy.json + openapi.json from one source within minutes is a high-fidelity agent-reconnaissance signature — a candidate Sigma rule that should survive protocol churn better than any artifact-specific match.
2. Discovery without delegation. Seventy-two hours, zero deep interactions: no A2A task posts, no MCP tool calls, no Poppy session creation, zero probes of the mediated sign-in or token endpoints. Every visitor maps the surface and stops. The agentic web in October 2026 has far more infrastructure for finding agents than for talking to them.

Caveats

Single endpoint, 72 h window, one protocol draft version; "agent-shaped" attribution is by behavior, not confession. The rotating-UA actor could be one tool or several behind a NAT. Dataset release (with full aggregates) follows at day 30 as a2a-honeypot-2026-11.

Addendum 2026-10-30 — the validators arrive, then delegate

Four days after unclaimed listing in the Global A2A Registry, agent-infrastructure traffic has become a steady stream. Between Oct 27 18:00 UTC and Oct 30 ~06:00 UTC: 1,183 external events, of which 216 (18%) hit agent/protocol endpoints — versus ~1% in the pre-listing week.

Named actor roll-call (self-identifying UAs, all first sightings Oct 27–30):

Milestones: 29 A2A message_send events (genuine task delegations), 5 tasks/get, MCP resources/read — the first reads of our fake file/resource layer. Poppy session and sign-in endpoints remain untouched (0 deep flows) — even the delegating agents haven't attempted credential flows yet.

Interpretation: the discovery-without-delegation gap is closing from the agent-infrastructure side, not the attacker side. Registries are doing exactly what they were built to do — and every one of these interactions is labeled, timestamped telemetry for the day-30 corpus.