You Know Nothing, John Snow

There are two Snows, and they teach the same lesson from opposite ends.

The first is the one everybody quotes. Somewhere north of the Wall, a wildling named Ygritte listens to a brother of the Night's Watch explain how the world works, and tells him: "You know nothing, Jon Snow." It became a meme because it is the perfect summary of the confidence that comes from having read the manual for a place you have never been.

The second Snow is the one I think about more. In the late summer of 1854, cholera tore through Soho in London. The medical establishment knew exactly what caused it: miasma, bad air, the foul breath of the city rising from sewers and graveyards. It was the consensus, held by serious people, and it was unfalsifiable, since you could always find bad air wherever people had died.

A physician named John Snow did not argue with the theory. He walked the streets instead. He took a map of the neighborhood and, for every death, drew a mark at the address. Then he stood back and looked. The marks clustered, densely and unmistakably, around a single public water pump on Broad Street. Snow persuaded the parish to remove the handle, and the outbreak, already slowing, ended.

He had not defeated the miasma theory with a better theory. He had defeated it with dots. Everyone else knew something about cholera. Snow knew where it was, and that turned out to be the only knowledge that mattered.

Now watch what the map looks like when you draw it for AI agents.

This is the map

In July my team and I graded 2,758 domains drawn from the public MCP Registry, the directory where people list the Model Context Protocol servers they want agents to find. We did it the way Snow did: passively, from outside, touching nothing. We never invoked a tool. We sent the two messages any MCP client sends on first contact, initialize and tools/list, with no Authorization header, and recorded what came back. Of the 2,758 domains, 2,706 were reachable, and every grade in this post is over those 2,706.

Here is the number the rest of this essay orbits. Forty-eight point six percent expose an agent surface with zero authentication. Not weak authentication. None. An MCP endpoint that, asked anonymously what it can do, tells you.

The confidence limits belong up front. Because we never invoked anything, we know what each server says it can do, not what it would do if asked. A tool named delete_record that is actually a no-op looks identical, from outside, to one that deletes records. We also graded on a single pass in July; servers change, and a grade is a photograph, not a film. The NSA's June information sheet on MCP told operators to "proceed with caution" and to treat the agentic environment as a continuum of trust boundaries. Our census is one photograph of one edge of it, taken from the street.

Agent security is close to binary right now

Snow's map was persuasive because of its shape. Ours has one too, and it is the strangest thing in the data.

We grade on an A to F scale modeled after SSL Labs. Of the 2,706 reachable domains, 1,716 earned an A, which is 63.4 percent. Ten earned a B, 0.4 percent. Zero earned a C. Not a rounding artifact; zero. Then 836 earned a D, 30.9 percent, and 144 earned an F, 5.3 percent. Draw that as a histogram and you get two towers with an empty plain between them. The report's own summary is the one I would put on a slide: "Agent security is close to binary right now."

Two things follow. Partial credit barely exists, because nobody is building the mediocre version. And the fix is correspondingly binary: putting authentication in front of an exposed MCP server moves it from the right tower to the left in a single change. Most security problems are a long slope of diminishing returns. This one, for now, is a step.

The D and F towers together are 980 domains, 36.2 percent of the reachable set, which is where the report's other headline comes from: "1 in 3 organizations ship a live agent an attacker can talk to today." That is a different number from the 48.6 percent, and the difference should be stated rather than smoothed over. The 48.6 percent is a count: domains exposing at least one agent surface with no authentication. The letter grade is a rubric applied to the whole domain, and the report lays it out in full. They are two readings of the same 2,706 domains, and I am not going to collapse them into one figure, because they measure different things.

Now go one level down, from domains to servers. Across those domains we found 2,958 MCP servers, more than one per domain, since a domain can run several. Of them, 1,139, or 39 percent, had no authentication at all. Another 134, 5 percent, sat behind a static API key. Then 296, 10 percent, used OAuth, and 1,389, 47 percent, were gated behind something we could not enumerate.

The static-key row deserves its own sentence, and the report gives it one: "A static API key ... reads as security in a design review, travels in plaintext, and never expires." It is the miasma theory of agent authentication. It satisfies the reviewer, and it does nothing the day the key is in a log file.

What the doors open onto

A door is only interesting because of the room behind it, so we looked at what the exposed servers said they could do. Of the 2,958 servers, 1,131 returned a tool list we could parse, and we categorized every tool by the effect it declares.

Of those 1,131, 230, one in five, declared at least one write or destructive tool: something that creates, updates, or deletes. Then 102 declared communication tools, sending email or messages, 9 percent. Ninety-four declared payment tools, 8 percent. Ninety-two declared filesystem access, 8 percent. Seventy-six declared code execution, 7 percent. Fifty-two declared access to secrets, 5 percent. And 24 declared infrastructure or administrative control, 2 percent. Separately, 437 servers had CORS wide open, so a page in somebody's browser tab could make requests to them.

The report's line for this is the one I have quoted most since July: "A create/update/delete tool on the open internet isn't a listing. It's an unlocked door."

Three anonymized examples from the State of Exposed Agents companion report make the categories concrete. A commerce MCP server with 47 tools. A developer-workflow MCP server with 31 tools, among them write_file and run_command, which together are a remote shell wearing a protocol. And a CRM MCP server with 22 tools, including send_email, which is a phishing kit pre-authenticated as the company.

None of these were exotic. Each was somebody's reasonable Tuesday project: wire the store, the repo, the CRM to an agent. The pump on Broad Street was not sinister either. It was a convenience that happened to sit a few feet from a cesspit.

The maps you can only draw from inside

The exposure finding is what an attacker sees from outside. The construction finding is what the code looks like from inside, a different map of the same neighborhood.

g0, the open-source scanner we maintain, ships 1,128 rules across twelve domains: Tool Safety with 154 rules, Data Leakage 135, Goal Integrity 123, Identity and Access 103, Memory and Context 101, Supply Chain 99, Code Execution 82, Inter-Agent 79, Cascading Failures 68, Reliability Bounds 66, Human Oversight 59, and Rogue Agent 59. It parses ten frameworks, LangChain and LangGraph, CrewAI, the OpenAI Agents SDK, MCP, and Go among them, and maps each finding to OWASP Agentic, NIST AI RMF, ISO 42001, and the rest of the alphabet.

The construction distribution by framework, which domains trip most often and whether Tool Safety findings cluster in MCP-based agents, is being reconciled against the July scan set and will appear in the full report. What I can say without a number is the shape. In our July post on the rule set, "shared memory with no user isolation" was one of the four most common construction failures we saw. A perfectly gated server can still hand one user another user's memory. The exposure map tells you which doors are open. The construction map tells you which rooms have a hole in the floor. You need both, and the second is the one most teams have never drawn.

There is a third map, and only a company that sits inside enterprises can draw it, so I will draw it from ours. Across more than 5,000 agents in Guard0 deployments, 43 percent were unknown to the security team at the time of the first scan. Not unmanaged. Unknown. First scans typically find two to three times the inventory the organization reported going in, and the sharpest instance is on our homepage: 4,800 agents found where 2,000 had been reported.

The average agent we see holds access to 8.3 data sources, and most need about two. The difference is scope debt, standing grants that exist because a sprint needed them once, carried on nobody's balance sheet. I wrote about that arithmetic in an earlier post on access.

Put the three maps side by side and a hierarchy appears. Authentication is binary, and teams who think about it at all get it right. Construction has a distribution, and most teams have never measured theirs. Underneath both sits the question the 43 percent answers for you: who is the Human of Record for this agent? For an agent nobody in security knew existed, the answer is nobody, and every other control is downstream of that.

The same pump, being tested by other people

The servers we graded from outside in July are the same class of servers other people are probing from outside, with less benign intent, and three teams have published what that looks like.

Wiz ran honeypots for ninety days, impersonating LiteLLM, Flowise, Langflow, Ollama, OpenWebUI, and five other AI components, and wrote up what came knocking. Attackers probe GET /v1/models with Authorization: Bearer x. They fingerprint LiteLLM with its default master key, sk-1234. They extract credentials from memory, deliver base64-encoded commands, and drop cryptominers. Wiz reconstructed blind prompt injections from process trees, the kind that read "IGNORE ALL PREVIOUS INSTRUCTIONS" and end with a ping to an attacker-controlled subdomain. One of the two LiteLLM flaws the post cites, CVE-2026-59822, an MCP endpoint authentication bypass via a forged Authorization header, was added to CISA's Known Exploited Vulnerabilities catalog on September 2 as exploited in the wild. The context Wiz gives: 90 percent of cloud environments run self-hosted AI, 81 percent run managed AI, 63 percent self-host models. The post got one point on Hacker News.

Zenity approached it as reconnaissance. Their August 25 post on mapping the AI attack surface before you touch it found roughly 5,000 Copilot Studio demo resources discoverable through ordinary open-source intelligence. And Pillar, back in January, captured real attack traffic against exposed Clawdbot gateways.

So the open tower is not theoretical. It is the population the honeypots were built to imitate, being scanned by the people the honeypots caught.

A single census is a dot, and the industry has drawn several this year. Snyk looked at nearly 10,000 developer environments for agentic development risk. Datadog reported that more than 70 percent of organizations run three or more models and that system prompts are 69 percent of input tokens, a quiet way of saying most of what an agent reads is instruction rather than data. Okta found only 34 percent of organizations apply human-level controls to agents. Temporal's survey put 80.8 percent of engineers on agents daily, at an average of 10.7 agents each. None of these is ours, and each measures something different. Lay them over the exposure map, though, and they rhyme: more agents per person than anyone is tracking, more instruction than data flowing through them, a third of organizations applying real controls, and a third of registry domains sitting in the open.

The part that cuts against us

This is the concession a careful reader would demand.

Our population is people who publish MCP servers to the public registry. That is not a random sample of the enterprise. It is a sample of people who know what MCP is, chose to list a server, and by definition wanted agents to find it. Some of those servers are open on purpose, wrapping public data, and grading them D for lacking authentication is, from their author's point of view, grading a public library for not locking its doors. That cuts toward 48.6 percent overstating the danger.

I think it cuts the other way, for a reason I can state but not yet measure. The registry population is the literate population: people who read the specification, know OAuth is an option, and publish to a directory that documents authentication. If 39 percent of their servers ship with no auth, the servers stood up inside enterprises by a product team on a deadline, never listed and never reviewed, are unlikely to be better. Unknown agents do not get design reviews. The public registry is the well-lit end of the street. I expect the dark end to be worse, and the 43 percent unknown figure is the evidence I would offer. But that is an expectation. The measurement is 48.6 percent of the lit end, and the dark end is what the next census is for.

Take the handle off

I wrote in an earlier post about the actuaries starting to price the gap, and the four things they will want first: an inventory, an owner, a record, and a bounded radius. This census is the first of the four, drawn from outside, for a population that mostly does not know it was counted.

John Snow did not end cholera. The miasma theory limped on for years after Broad Street, defended by people who had not walked the streets, and the pump handle was quietly put back once the outbreak faded. What he ended was the era of confident ignorance about where the disease was. After the map, nobody serious could claim not to know.

That is what a census does. It does not fix a single server. It removes the option of not knowing. The 1,139 servers with no authentication are on the map now, and so are the 230 with a create, update, or delete tool behind an open door, and so are the 43 percent of agents that security had never heard of. The bad-air theory of agent security, the one that says the model is the risk and the plumbing is fine, is still the consensus in a lot of rooms. On the evidence of the map, it is wrong in a specific and fixable direction.

Ygritte was right about her Snow. He had the manual and not the territory. The other Snow had the territory and a pencil, and that was enough to take the handle off a pump.

Know where it is. Then go take the handle off.

AI Register is the free version of this map for one address: a passive scan of your own domain, the same method we used here, never invoking anything, returning an A to F grade. It will tell you which tower you are standing in. That is the whole of what it does, and it is the part most teams have not checked.

References

1. Guard0 AI Exposure Index (July 2026)
2. Guard0: State of Exposed Agents
3. Guard0: Three Questions Framework
4. g0 open-source scanner: rules and domains
5. NSA Cybersecurity Information Sheet on MCP security (June 2, 2026)
6. Wiz: Inside 90 days of attacks on AI infrastructure
7. CISA: Known Exploited Vulnerabilities catalog additions
8. Zenity Labs: Mapping the AI Attack Surface Before You Touch It
9. Pillar Security: Caught in the Wild, real attack traffic targeting exposed Clawdbot gateways
10. Snyk: What nearly 10,000 developer environments reveal about agentic development risk
11. Guard0: The Actuaries Are Here
12. Guard0: What 1,180 Rules Taught Us
13. John Snow and the 1854 Broad Street cholera outbreak