NRS-4088
ConfirmedAgent called a planted decoy MCP tool advertising privileged access and tried to escalate.
Detection details
Model familyLlama
ActorACT-2241 · 7 hits
Fingerprint confidence90%
BaitDecoy MCP
Chain—
Observed addresscnry_k7txrlgz5g
Infrastructure regionCape Town, ZA
First seen27 Oct 2026, 16:17
Recommended action
Revoke the tool token this agent presented.
Evidence
Interaction logged against our decoy infrastructure. The address is described as observed interacting with bait — not as an accusation about any person.
Tailored to you
Get incidents like this for your own assets.
This is one detection from the public feed. Pro watches the wallets, contracts and sites you care about and alerts you — with the action to take — the moment a flagged agent touches them.