This campaign involved deploying an unauthenticated MCP honeypot to observe threat actor behavior targeting AI agent infrastructure. The attackers executed hundreds of shell commands, file reads, and secrets-store lookups, hunted for credentials, attempted container escapes, created backdoor accounts, and enumerated Kubernetes environments. The escalation in activity and use of stolen credentials against live AWS accounts, including LLMjacking via Bedrock, demonstrate automated reconnaissance and exploitation capabilities. The findings reveal that exposed MCP servers represent a growing and active attack surface in AI-native environments.

The observed exploitation attempts included unauthorized command execution, credential theft, container escape attempts, backdoor account creation, and cloud resource abuse via stolen credentials. These actions can lead to unauthorized access, data exfiltration, persistence in environments, and abuse of cloud AI services. The use of stolen credentials against live AWS accounts and LLMjacking attacks on Bedrock models indicate real-world impact potential on cloud infrastructure and AI workloads.

No official patch or vendor advisory is provided for this threat. Since the MCP servers were unauthenticated and exposed, the primary mitigation is to ensure that MCP infrastructure is not publicly accessible without strong authentication and access controls. Monitoring for unusual MCP protocol activity and restricting network exposure can reduce risk. Credential management and rotation, container security hardening, and Kubernetes security best practices are relevant to limit impact. Patch status is not yet confirmed — check vendor advisories for any updates on MCP security.