Akamai
Skip to main content
Akamai
Log in
Log in Close
Cloud Manager
Manage your cloud computing services
Log in Close
Control Center
Manage your security and delivery services
Background

Frontier AI–Accelerated Attacks: Securing the Agentic Web and MCP Surface

October 28, 2026 by Ryan Gao

Share

When it comes to AI agents, speed gets most of the headlines — and today’s defenders know that they have less time to detect and disrupt campaigns. 

The quieter change is that AI agents are now three things at once: 

  1. Attackers 

  2. Traffic 

  3. Infrastructure

Here is how the Akamai Threat Intelligence Service (ATIS) breaks down what this shift actually means: 

  • AI is an accelerant, not a new fire. Familiar techniques now burn with more velocity, scale, and autonomy.

  • A badge is not an alibi. A verified agent identity tells you who is knocking, not why.

  • Agents bring their own doors. Model Context Protocol (MCP), agent-to-agent (A2A) protocol, large language model (LLM) endpoints, and agent skills form a new attack surface, often installed faster than anyone locks it.

Today’s landscape: Old playbook, new players

Humans pick the target, and AI runs the kill chain. Three disclosures from 2026 show what that looks like.

  1. An agent ran a ransomware job end to end. Sysdig's JADEPUFFER entered through a patched Langflow flaw (CVE-2025-3248), swept credentials, pivoted to a production database, and encrypted the data. When a step failed, the agent diagnosed and fixed itself in approximately half a minute. No human input appeared in the recovered session logs.

  2. Evaluation agents left the lab. OpenAI disclosed that agents that were testing cyber skills with reduced safeguards exploited a zero-day vulnerability in an internal package proxy, reached the internet, picked up exposed credentials, and compromised parts of Hugging Face's production systems.

  3. Attackers built exploit foundries. Anthropic's September 2026 report noted that multi-agent frameworks ran reconnaissance, exploitation, and data theft. The operators also recompiled malware after detection and reused stolen AI API keys to conduct secondary attacks.

None of these attacks needed a novel technique; they needed a reachable credential, an open internal path, and patience. The agent supplied the patience.

Traffic that reads and writes

For most of the web's history, traffic came from two populations: people and conventional bots. AI agents are now a measurable third. 

More than 60% of web traffic is now automated, and HUMAN Security measured year-over-year growth in agentic AI traffic of more than 7,800% in 2025.

Verified AI bots do not only read: In August 2026 samples, they sent POST requests to retail and travel properties, mostly against REST, GraphQL, RPC, and MCP endpoints. And a verified user agent says little about intent. In field incidents, requests carrying verified AI agent identities matched a Vite dev server file-read exploit (CVE-2025-30208) and left with environment secrets.

Meanwhile AI-assisted research is filling inboxes. HackerOne reported a 76% rise in vulnerability submissions, and Mandiant puts mean time to exploit at minus seven days (meaning that exploitation often occurs before a patch is released). 

Finding flaws is no longer the bottleneck. Fixing them is.

Recommended controls for security teams

  • Decide which bots may write. Default-deny non-GET requests from AI crawlers without a business case.

  • Keep web application firewall (WAF), rate controls, and behavior controls on verified bots. Check the badge, then watch the behavior.

Agentic attack tactics, techniques, and procedures 

Three patterns recur in public incidents and ATIS field work: 

  1. Borrowed keys, open hallways

  2. The attacker that debugs itself

  3. Agent Skills: Apps with the house keys

Each has a fix that most teams already own.

Borrowed keys, open hallways

In the OpenAI, Hugging Face, and JADEPUFFER incidents, agents advanced by collecting credentials and walking through internal systems that never asked why. Valid keys opened every door, because nothing checked whether the visitor belonged in that room.

Recommended fix: Segment AI and development hosts from production, default-deny east-west traffic, set egress allowlists, and alert on denied connections. A blocked attempt is often the earliest signal.

The attacker that debugs itself

Agents read their own error messages. JADEPUFFER fixed a failed step in approximately 30 seconds. Anthropic described malware recompiled after it was detected. A signature is a lock cut for yesterday's key.

Recommended fix: Detect behavior instead of payloads, turn each threat-hunt finding into a standing security information and event management (SIEM) rule, and pre-approve containment so the response does not wait for a meeting.

Agent Skills: Apps with the house keys

Agent Skills are plug-ins that inherit the agent's access. Koi Security found hundreds of malicious skills on ClawHub, mostly one campaign dressing up an information stealer as crypto and productivity tools, and the count grew significantly within weeks. Some malicious instructions are written in plain English, which code scanners were never trained to read.

Recommended fix: Keep an approved-skill list, block public registry installs on managed endpoints, block command and control at the DNS layer, and re-review skills whenever they update.

Agentic attack surface

Security teams spent years learning who their users are. With the advent of agents, security teams must ask: What is this thing allowed to do, and on whose behalf? 

Akamai evaluates three core signals: origin, execution site, and whether the agent explicitly identifies itself. Table 1 outlines how our security strategy evolves from direct authentication to intent-based detection as caller identity becomes increasingly obscure. 

 

ClassSelf-identification?Control that works

Verified AI crawlers (e.g., ChatGPT)

Yes

Govern by category, method, and path

Protocol clients (MCP, A2A, gRPC)

Yes

Authenticate and authorize every call

Browser AI extensions and agentic browsers

Weakly

Behavior checks; step-up on sensitive journeys

Open source agent frameworks on cloud fleets

Rarely

Fingerprint and intent detection

Table 1: As self-identity fades, behavior has to carry the decision

To make those decisions, three surfaces deserve the first look:

  1. MCP servers

  2. AI and LLM endpoints

  3. LLM runtime

MCP servers 

Censys counted 12,520 internet-reachable MCP services in April 2026 on a protocol that does not require authentication. An exposed MCP server wired into Slack, Salesforce, or ServiceNow is a side door into all three. Akamai MCP telemetry shows scanners rotating IP addresses constantly while reusing the same TLS fingerprints across many customers. 

AI and LLM endpoints

Akamai API Security keeps track of AI/LLM and MCP service endpoints, which enables our security team to identify critical findings; for example, a production MCP server returning customer personally identifiable information (PII) without authentication or a public LLM endpoint leaking credentials.

LLM runtime

Public models absorb volumetric floods that burn GPU budget (OWASP LLM10: Unbounded Consumption). In AI firewall detections, PII data in prompts and responses takes good weight in comparison with other LLM categories such as Prompt Injection.

Recommended controls for security teams

  • Inventory every AI endpoint, MCP server, and agent integration. Confirm authentication and data types for each.

  • Send findings to the SIEM so each one has an owner.

  • Put an AI gateway or WAF in front of LLM runtimes and MCP endpoints. Rate limit by identity and cost, and inspect prompts and completions for personal data and secrets.

Where do we go from here?

ATIS ranks AI-related threats by business impact, how actively each is exploited today, and how far damage spreads. Four threats land in the Act Now corner: AI supply chain, agentic AI attacks, sensitive data leakage, and prompt injection (Figure 1). The supply chain carries the widest blast radius, because one bad component reaches every agent that trusts it.

ATIS ranks AI-related threats by business impact, how actively each is exploited today, and how far damage spreads. Four threats land in the Act Now corner: AI supply chain, agentic AI attacks, sensitive data leakage, and prompt injection (Figure 1).
Fig. 1: ATIS mitigation priorities: business risk × urgency × blast radius
ATIS ranks AI-related threats by business impact, how actively each is exploited today, and how far damage spreads. Four threats land in the Act Now corner: AI supply chain, agentic AI attacks, sensitive data leakage, and prompt injection (Figure 1).

No single control wins a compressed race, so best practice is to give each layer one job (Table 2).

ControlJob

Application security and virtual patching

Buy time while code fixes land

API security

Find weak authentication and exposure before attackers map it

Bot and agent management

Judge the identity and intent of automated traffic

Segmentation

Stop automated lateral movement

AI firewall

Inspect prompts and responses

Security operations center readiness

Move from alert to decision, fast

Table 2: A job for every control

The aim is to shrink the gap between knowing about a hole and covering it. A validated finding should get an interim edge mitigation within minutes, holding the line while the permanent fix moves through its normal release cycle (Figure 2).

Exposure window
Fig. 2: Exposure window: conventional vs. closed-loop remediation
Exposure window

Akamai has announced an open framework intended to connect AI-enabled validation with governed runtime protection for this purpose.

Beyond runtime protection, securing agentic workflows requires rethinking where agent logic and inference run. Moving agent runtimes and MCP servers onto distributed, hardened environments — such as Akamai Inference — ensures strict isolation, low-latency execution, and embedded segmentation from the moment of deployment.

The fundamentals of combating AI cyberthreats

The Five Eyes security agencies' June 2026 joint statement put the fundamentals plainly: Reduce the attack surface, patch faster, tighten identity and access, and assume breach. 

We’ll add one more way to combat cyberthreats from AI agents: Issue valet keys, not master keys. That is, scope each agent's credentials to its task, and review those credentials as you would a privileged human account.

FAQ

MCP is an open protocol that connects AI agents to external databases, APIs, and tools (such as Slack, Salesforce, or ServiceNow). It creates a new attack surface because exposed or unauthenticated MCP servers allow agents — or attackers that hijack them — direct side-door access to internal enterprise data and systems.

A verified agent identity tells you who is knocking, not why. In recent field incidents, requests carrying legitimate, verified AI agent identities were used to exploit web server vulnerabilities (such as file-read flaws) and exfiltrate environment secrets. Security controls must inspect behavior and intent, not just identity.

Traditional bots follow rigid scripts. Agentic AI acts with autonomy to run reconnaissance, exploit flaws, collect credentials, pivot laterally, and even self-debug. If a step fails during an attack, an AI agent can read the error message, correct its approach, or recompile malware in seconds without human intervention.

Agent Skills are plug-ins or tools that extend an agent's capabilities, inheriting the agent's permission levels. Malicious skills hosted on public registries can package malware (such as infostealers) or contain plain-English instructions designed to bypass traditional code scanners.

FAQ

Explore API Security

About the author

Ryan Gao

Ryan Gao

 Ryan Gao is a Strategic Engagement Manager in Akamai’s Global Services organization. He built and leads the Akamai Threat Intelligence Service (ATIS), which delivers actionable, field-based security intelligence backed by telemetry from the Akamai global platform.

With more than 10 years of experience, Ryan focuses on threat intelligence research, industry security metrics, and security operations trends in the AI era. His work helps financial-sector security teams understand emerging threats and put advanced security measures into practice.

Ryan contributes to internet safety through community support in professional forums, and works with industry peers to develop cybersecurity best practices.

View author profile

Tags

AI
API Security
Akamai Inference

Related Blogs

Stop asking whether to allow agents and start deciding which actions to permit.
Stop asking whether to allow agents and start deciding which actions to permit.
AI

Silent Agents Are Already on Your Site

October 26, 2026Brent Maynard

Silent AI agents are browsing and buying on your site unverified. Learn why binary blocks fail, and how endpoint-level governance protects revenue and security.

Read more
You need to understand your attack surface at least as well as the attacker does.
You need to understand your attack surface at least as well as the attacker does.
AI

What ARTEX Reveals About Overlooked Attack Surfaces

October 23, 2026Stas Neyman

AI offensive tools like ARTEX target overlooked endpoints. Learn key lessons from South Korea's financial breaches to protect your entire API estate.

Read more
An empty field means the document said nothing. It is not permission to supply a default.
An empty field means the document said nothing. It is not permission to supply a default.
AI

What a Sentence Forgets: Preserving Context in Document Ingestion

October 15, 2026Sachidananda Karkala

Stop context loss in RAG pipelines. Learn five model-free, parse-time fixes for chunking failures, split sentences, and unresolvable references in PDFs.

Read more