Cybersecurity Threats Reach New Heights as AI-Related Scanning Surges Online
A disturbing trend has emerged in the world of cybersecurity, as researchers have discovered a widespread scanning effort targeting Model Context Protocol (MCP) servers and AI assistant credentials. The scans, which appear to be distributed and systematic, are not just limited to probing for vulnerabilities but are actively attempting to establish connections with servers that expose sensitive information.
The findings come from an analysis of 14 days’ worth of Apache and ModSecurity logs from a small web host. Initially, the goal was to understand the “background radiation” of internet scanning in 2026, but what was uncovered was something entirely different. Amidst the usual WordPress xmlrpc floods, .env probing, and Git config fishing, researchers discovered a category of scanning that had not been documented before.
The scans are specifically looking for MCP servers, AI assistant configuration files, and locally exposed Large Language Model (LLM) endpoints on servers that do not run these services. This is not just a case of random probing; the scanners are using valid JSON-RPC 2.0 bodies to perform a Model Context Protocol initialize call. This indicates that the scanners are not just blindly requesting URLs but are actively attempting to establish connections with MCP servers.
The implications are dire. An exposed and unauthenticated MCP server is essentially a remote, machine-readable menu of everything an AI agent can touch, offered to anyone who completes the handshake. With this access, attackers could potentially enumerate tools, data sources, and internal APIs, leading to catastrophic consequences for organizations that rely on these systems.
Furthermore, alongside live-server handshakes, the scanners are aggressively fishing for configuration and credential files belonging to AI coding assistants. These files, when deployed to a web root, can leak sensitive information about projects or home directories. The paths requested by the scanners were specific and current, indicating that someone built this wordlist recently and from real knowledge of how these tools store their settings.
The use of HEAD requests for credential files is a telling sign. By checking whether the file exists without downloading its contents, the scanner is optimizing bandwidth usage, suggesting a mature, wide campaign rather than a one-off curiosity.
In practical terms, this means that organizations that rely on AI agents and MCP servers must take immediate action to secure their systems. This includes ensuring that MCP servers are properly configured and authenticated, limiting access to sensitive information, and implementing robust security measures to detect and prevent unauthorized access attempts. Developers should also be aware of the potential risks associated with deploying AI coding assistant files to web roots and take steps to prevent accidental exposure.
As cybersecurity threats continue to evolve, it is clear that organizations must stay vigilant and proactive in protecting themselves against these emerging risks. By staying informed and taking necessary precautions, we can mitigate the impact of these attacks and ensure the continued security of our online presence.
Source: SANS ISC — 2026-07-13