What Grey Noise Learned from Deploying MCP Honeypots
Summary: GreyNoise deployed a series of MCP honeypots mimicking plausible MCP deployments with full packet-level visibility, and every instance was discovered within days before activity leveled off into ordinary HTTP probes, SSH touches, and one-shot scans. Across the deployment, no MCP-specific payload or exploitation attempts appeared, though GreyNoise's MCP Scanner tag shows threat actors are increasingly discovering exposed MCP servers, and in October 2025 independent researchers demonstrated a prompt-hijacking flaw in a custom MCP build using a deprecated protocol handler as a contained proof-of-concept.
What's compelling: GreyNoise reports some threat actors are using MCP-style architectures to process stolen telemetry and correlate infrastructure, possibly faster than human analysts - a machine-speed offense against human-speed defense. The absence of targeted MCP attacks today is a baseline, not a guarantee, and it is the deviation from that baseline that will mark the point where interest becomes intent.
Read the original at GreyNoise Blog ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026