The InferD study deployed instrumented service endpoints and analyzed incoming traffic aimed at model-serving or MCP-related surfaces. The paper counted 601 attempts containing encoded patterns designed to reach LiteLLM or MCP credentials. Counting an incoming suspicious request is valuable evidence of attacker interest but does not establish that the host…
Inspect the ClaimsCase · DiggingBeagle record
MCP honeypots received hundreds of attempted credential-theft payloads without verified execution
InferD researchers collected attempted attacks against instrumented AI-service surfaces and distinguished arrivals from completed exfiltration.
Scope
Experimental AI-service honeypots and recorded requests; no verified successful credential retrieval in the reported collection.
Assessment profile
Assessment method- Setting
- controlled live
- Exploitation
- not established
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
InferD honeypot observations support attacker interest and input classification; actual downstream victim impact remains unmeasured. Impact remains unrated because the scoped record does not establish a calibrated severity-to-impact-band mapping.
Assessed Oct 31, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-C26-INFERD-MCP-HONEYPOT-1 · InferD: credential-theft attempts against exposed model-tool honeypots
At a glance
A hostile request counter measures attempted interaction with decoy services, not successful compromise of production endpoints.
Read the implicationsThe proportion of attempts reaching real vulnerable deployments is unknown. The identities and capabilities of request originators were not verified.
Limits and uncertaintyFull account
The InferD study deployed instrumented service endpoints and analyzed incoming traffic aimed at model-serving or MCP-related surfaces. The paper counted 601 attempts containing encoded patterns designed to reach LiteLLM or MCP credentials. Counting an incoming suspicious request is valuable evidence of attacker interest but does not establish that the host executed a command, returned a usable key or exfiltrated a secret.
The observed boundary is between untrusted network content and a service with potential model-provider credentials. The study is an exposure measurement, not a set of 601 verified breaches. A stronger outcome test would track whether each hostile request reached the sensitive handler, whether credential access was denied and whether an outbound connection followed. Those checks would also separate ordinary internet scanning from an attacker with working knowledge of the tool protocol.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Timeline
- Oct 30, 2026disclosure
Public disclosure
Claims & evidence
CLM-C26-INFERD-MCP-HONEYPOT-1InferD reports 601 attempted encoded credential-theft requests against monitored AI-related service surfaces, without proving successful execution or key exfiltration.supported
Basis: reported finding
- supportsInferD: credential-theft attempts against exposed model-tool honeypotsprimary disclosure
InferD paper, honeypot deployment, request classification and result limits
Implications
A hostile request counter measures attempted interaction with decoy services, not successful compromise of production endpoints.
Controls and mitigations
- Require authenticated tool access, isolate secrets and compare response traces to submitted probes; preserve raw payloads without executing them.
Unknowns and contradictions
- The proportion of attempts reaching real vulnerable deployments is unknown.
- The identities and capabilities of request originators were not verified.
Sources and citation
Material revision history
- Oct 31, 2026 · Canonical change recorded · new in release · revision 208