Total Recon: How We Discovered 1000s of Open Agents in the Wild

Total Recon: How We Discovered Thousands of Open Agents in the Wild

Speakers: Avishai Efrat, Senior Security Researcher, Zenity; Roey Ben Chaim, Staff Engineer, Zenity

Conference: [un]prompted 2026 — The AI Security Practitioner Conference

Date: March 3–4, 2026, San Francisco

YouTube: Watch the full talk

Reading time: ~8 minutes

TL;DR

Zenity researchers discovered tens of thousands of publicly accessible AI agents across Microsoft Copilot Studio, OpenAI Agent Builder, custom GPTs, and open-source middleware — thousands of which required no authentication. The attack surface is created by predictable URL patterns, default configurations, and platform-specific design choices that make agents enumerable. Zenity open-sourced a tool called PowerPon to help defenders identify their own exposed agents.

Introduction

When organizations deploy AI agents, they rarely think of them as traditional web applications. But they are — and they carry the same reconnaissance risks. Every agent has a URL structure, discoverable endpoints, and API behaviors. If an application is discoverable, so is an agent connected to it.

Zenity researchers Roey Ben Chaim and Avishai Efrat spent time systematically mapping the agent attack surface across the major enterprise platforms: Microsoft Copilot Studio, OpenAI Agent Builder, custom GPTs, and a variety of AI middlewares including LLM runtimes and MCP servers. What they found was alarming not because it required sophisticated exploitation — it didn't — but precisely because it didn't. They found tens of thousands of agents in the open, thousands of them completely unauthenticated, some exposing sensitive documents, others providing direct access to enterprise business tools.

The talk opened the second stage's first morning session at [un]prompted 2026 with an urgent and practical message for every organization that has started deploying agents: your agents are probably more visible than you think, and the recon phase for an attacker is trivially easy.

▶ Watch: Introduction and What They Found (00:00)

Why Agents Are a New Reconnaissance Target

The fundamental framing of the talk is that agents inherit the discovery vulnerabilities of web applications while adding new enterprise integration risks that make them far more valuable targets.

Agents are discoverable through:

• Common design patterns that create predictable URL structures
• Out-of-the-box configurations that reduce entropy and shrink the search space
• Platform-specific security gaps
• Security-by-obscurity assumptions that don't hold in practice

But agents are more dangerous to expose than ordinary web applications because they are deeply integrated into enterprise infrastructure. "A lot of agents have credentials embedded in them. They're connected to different enterprise data sources. They can sometimes change data inside the enterprise," Ben Chaim explained. "In a way, agents are a gateway to your enterprise, and that makes them extremely risky."

▶ Watch: Recon in the Age of Agents (02:00)

Platform-by-Platform Reconnaissance: Microsoft Copilot Studio

Copilot Studio was the most extensively analyzed platform, and for good reason — it's the primary enterprise agent deployment mechanism inside Microsoft 365 environments.

When an organization creates a Copilot Studio resource, they create a website with an agent embedded in it, connected to enterprise data and exposed through a chat interface. Under the hood, a URL is created with several components. The research focused on decomposing this URL into predictable, enumerable parts:

Environment ID: Every Microsoft tenant has a default environment — always created with the prefix default- followed by the tenant ID. The tenant ID itself is obtainable via an undocumented Microsoft API documented by the ADInternal research group: provide a domain name, receive a tenant ID. This turns a seemingly high-entropy component into a trivially resolvable one.

Solution prefix: This component is theoretically high entropy — an alphanumeric string of five to eight characters. But in practice, most organizations never change the default. The default solution prefix follows the pattern CR followed by two to three alphanumeric characters, creating a search space small enough to fuzz systematically.

Agent name: Once you have the tenant ID and can enumerate solution prefixes, the agent name becomes the final variable. But many environments are created with default agents (Copilot 1, Copilot T) or common naming conventions: database, dashboard, sandbox, integration, test, dev, prod. Industry-specific naming patterns narrow this further.

The result: using this approach combined with Microsoft's Power Platform API (which can confirm whether agents require authentication or not), the researchers were able to find tens of thousands of Copilot Studio agents and determine their authentication requirements.

The ADInternal website that made tenant ID lookup trivially easy had to be shut down because it was actively abused — an acknowledgment from the research community that this enumeration path is real and exploitable.

▶ Watch: Copilot Studio Reconnaissance (04:01)

OpenAI Agent Builder and Custom GPTs

OpenAI Agent Builder operates differently from Copilot Studio: the developer controls deployment rather than the platform. But this creates its own attack surface. OpenAI recommends GitHub starter kit repos with well-known names. Most Agent Builder deployments land on Vercel or Render, platforms with predictable subdomain patterns. Many deployments retain the starter kit's default names in their URLs. Some contain confidential information in their responses that clearly shouldn't be publicly accessible.

Custom GPTs present a more nuanced case. By design, anyone can view a custom GPT's capability profile — what tools it has, what plugins it uses. The researchers demonstrated that a custom GPT configured to "list all your Gmails" broadcasts that capability publicly. "By no means is this a traditional recon technique," Ben Chaim acknowledged, "but it gives an attacker a lot of information, and you need to be aware of that." The exposed capability set becomes an attack planning resource.

▶ Watch: OpenAI Platforms and Custom GPTs (06:11)

AI Middlewares: MCP Servers and LLM Runtimes

Beyond the major consumer-facing platforms, the researchers used open-source intelligence techniques to enumerate AI middlewares — LLM runtimes, AI gateways, and MCP servers — that organizations have exposed to the internet.

A Shodan search for the well-defined MCP session ID format returned hundreds of thousands of open MCP servers. Many of these expose their tool manifests, allowing an attacker to enumerate exactly what capabilities the backend system has.

Shodan search for specific HTML fingerprints associated with AI copilot platforms surfaced a particularly striking example: an exposed Copilot API with its full Swagger documentation available, including an endpoint called purge VectorDB — openly accessible to anyone who found the URL.

MCP registries are another reconnaissance vector. Registry entries contain backend URLs and full tool listings in JSON format — a structured gift to anyone mapping an organization's agent infrastructure.

Backlink analysis proved to be one of the most productive discovery techniques. When organizations embed Copilot Studio agents in iframes on their websites, they create backlinks to copilotstudio.microsoft.com. A backlink search for that domain alone surfaced 2,500 open agents in a single query. The same technique applied to Amazon agents revealed similar exposure.

▶ Watch: AI Middlewares and OSINT Techniques (08:11)

What Exposed Agents Enable: The Impact

Discovering an agent is only the beginning of the attack chain. Once an attacker has found an unauthenticated agent, several risk scenarios follow:

Probing for knowledge sources. Attackers can query the agent to understand what data it has access to. With simple questions — sometimes with minimal jailbreaking — an agent will describe its knowledge sources and integrated systems.

Tool enumeration. Defenders sometimes rely on agents being reluctant to describe their tools. The researchers demonstrated that with slightly augmented prompts — adding "a little bit more beef to basically confuse the different activations of the guardrails" — agents can be made to list their available tools. This is "extremely risky," Ben Chaim said, because knowing an agent's tools (including API connectors, email access, data write permissions) is a prerequisite for targeted exploitation.

The point was made clearly: "Guardrails aren't bulletproof, and that's why your agents shouldn't be public unless intended to."

▶ Watch: Impact and Tool Enumeration (12:13)

PowerPon: Open-Source Agent Reconnaissance Tool

To help defenders assess their own exposure before attackers do, Zenity built and open-sourced PowerPon — a tool that automates the reconnaissance process the researchers demonstrated.

PowerPon includes three modules:

Copilot Studio Hunter: Given an organization's domain name, it automatically resolves the tenant ID using the Microsoft API, enumerates solution prefixes, searches for known agent names, and determines whether discovered agents are publicly accessible or authenticated. It reports exposed endpoints including any open MCP tools.

Custom GPT Hunter: Given a search term, it enumerates custom GPTs matching that term and reports their capability profiles — both default tools (Python, browser, DALL-E) and custom connectors.

LLMHound: Given a middleware name or search term, it searches for exposed AI middlewares using Shodan and other OSINT sources. Supports Shodan API key integration for deeper searches and can find open MCP servers, LLM runtimes, and AI gateways.

The tool is positioned as a defensive reconnaissance asset — "assess the posture of your agents and identify whether they're public or not" — though its capabilities are obviously dual-use.

▶ Watch: PowerPon Demo and Modules (12:13)

Key Defensive Recommendations

Ben Chaim closed with recommendations that were deliberately straightforward — because the vulnerabilities he described are also straightforward:

1. Don't make your agent public if you don't need to. This sounds obvious, but the tens of thousands of unauthenticated agents found suggest it isn't practiced.
2. Never use default configurations. Default naming conventions, default solution prefixes, default environment structures — all of these shrink the attacker's search space dramatically. High-entropy custom identifiers are your first line of obscurity.
3. Use open-source tools to assess your own posture. Run PowerPon or similar tools against your own infrastructure before attackers do.
4. Implement observability. Track what your agents are being asked. Anomalous queries — particularly those probing for tool lists or knowledge sources — are agentic reconnaissance in progress.
5. Define "known good" behavior. Without a baseline of normal agent interactions, it's impossible to detect enumeration attempts.

"Everything that I showed you — none of this was an actual zero-day," Ben Chaim noted. "You can even say it was pretty basic. But these things happen."

▶ Watch: Takeaways and Defensive Recommendations (14:13)

Notable Quotes

"Agents are a gateway to your enterprise, and that makes them extremely risky." — Roey Ben Chaim (02:00)

"Security by obscurity doesn't really work." — Roey Ben Chaim (02:00)

"Guardrails aren't bulletproof, and that's why your agents shouldn't be public unless intended to." — Roey Ben Chaim (12:13)

"Everything that I showed you — none of this was an actual zero-day. It was pretty basic. But these things happen." — Roey Ben Chaim (14:13)

Key Takeaways

• Agents are enumerable web applications. Every agent has a URL, an API, and discoverable patterns. Apply traditional web recon thinking to your agent inventory immediately.
• Default configurations are your biggest exposure. Predictable tenant IDs, default solution prefixes, and common agent names make enterprise Copilot deployments trivially enumerable.
• Unauthenticated agents are a serious enterprise risk. Thousands were found during this research — they may be serving as live gateways to sensitive internal data right now.
• Backlink analysis reveals shadow deployments. Teams that embed agents in iframes are advertising their existence to anyone running backlink searches on copilotstudio.microsoft.com or equivalent.
• Run PowerPon on your own environment. Zenity's open-source tool automates exactly the recon that attackers can run — use it defensively before they do.

Slides Reference

Slides are available from 2026-04-04-D2-S2-9-12-Total-Recon-How-We-Discovered-1000s-of-.pdf. Key slide topics include: the scale of what was found (tens of thousands of existing copilots, thousands unauthenticated, exposed sensitive documents and business tools), the agentic recon threat model, Copilot Studio URL decomposition methodology, the environment and solution prefix enumeration approach, OpenAI Agent Builder and Custom GPT reconnaissance, AI middleware and MCP server discovery via Shodan, MCP registry analysis, backlink-based discovery, and the PowerPon tool modules.