Agentic AI Foundation Adds Projects as MCP Turns to Security

At AGNTCon + MCPCon North America 2026 in San Jose, the Agentic AI Foundation (AAIF) expanded its hosted portfolio from three founding projects to ten, incorporating major open-source donations from Anthropic, OpenAI, Hugging Face, and Alibaba. The two-day conference, held October 22–23 immediately following the PyTorch Conference, marked a clear transition from exploratory protocol extensions toward production security, workload identity, and runtime containment. With cumulative Model Context Protocol (MCP) SDK downloads surpassing 4.17 billion, maintainers and enterprise contributors established formal governance committees to address emerging vulnerabilities across autonomous agent environments.

Four new projects expand the Agentic AI Foundation

AAIF executive director Mazin Gilbert opened the conference by announcing three new governance committees alongside four newly hosted projects. Alibaba contributed OpenSandbox, an execution environment designed to isolate autonomous agents during tool execution. OpenAI contributed Open Responses, an open specification based on its Responses API aimed at providing interoperable request and response schemas across model providers. Anthropic transferred the Agent Skills standard to vendor-neutral governance following its integration across more than 70 agent platforms and one million published skills. Hugging Face added OpenEnv, a framework offering standardized reinforcement learning environments to train and evaluate agentic systems.

Manik Surtani, CTO of the foundation, emphasized the operational milestone during his keynote, reflecting on the foundation’s expansion from three founding projects to ten in its inaugural year. Surtani argued that software licenses alone do not keep infrastructure open, contrasting the multi-stakeholder governance of Kubernetes with single-vendor platform models. Surtani identified identity, attestation, auditability, and payments as the primary unresolved challenges currently facing agent ecosystems.

Industry analysts and observers greeted the announcements with pragmatic scrutiny. While Open Responses drew early commitments from AWS Bedrock, Databricks, Ollama, Nvidia, and vLLM, API fragmentation persists across proprietary model surfaces, including Anthropic’s Messages API and Google’s Interactions API. Technical commentators noted that foundation adoption alone does not resolve commercial misalignments or guarantee unified vendor interoperability.

Protocol scale shifts MCP priorities to enterprise security

The evolution of the Model Context Protocol reflected its expanding footprint in production systems. Den Delimarsky, lead maintainer of MCP at Anthropic, reported that cumulative SDK downloads reached 4.17 billion, up from approximately 3 billion reported a month earlier. This accelerated enterprise adoption has forced maintainers to confront AI agent security risks directly. Approximately one-third of the 116 conformance test scenarios in the MCP verification suite now evaluate security and identity enforcement.

The official MCP roadmap highlights five core priority areas: agent messaging, skill execution over MCP, verifiable agent identity, enterprise authorization, and an HTTP-native transport protocol. Enterprise-managed authorization is currently live in Claude, while specifications for proof-of-possession tokens and workload identity federation remain in active draft status. The project’s architectural goal is to enable agents to sign in and authenticate as independent entities rather than inheriting borrowed user permissions.

Architectural shifts toward stateless operation have also taken hold. David Soria Parra, co-creator of MCP at Anthropic, noted that stateless servers—introduced in the July 28 specification—now account for roughly 70% of MCP traffic on certain high-volume platforms. Soria Parra also highlighted long-running MCP tasks in Claude Code, which permit tool invocations to run asynchronously for hours or days without dropping connections.

Production tooling, agent identity, and offensive findings

Production data presented at the conference provided concrete operational benchmarks for teams maintaining MCP servers. OpenAI’s Thomas Sarlandie shared data from the ChatGPT plugin directory, noting that while there is no practical limit on total tool count, approximately 75% of published tool schemas measure under 1 kB. Conversely, unoptimized schemas can reach 260 kB for a single tool and up to 1.4 MB across a server, prompting OpenAI’s ingestion system to trim verbose argument descriptions. OpenAI now rejects submitted servers unless tools carry explicit annotations that allow clients to fast-track read-only requests while requiring user confirmation for destructive actions.

Client-side integration standards also advanced. Sarah Drasner presented Chrome’s WebMCP origin trial, a proposed standard enabling web applications to expose structured tools directly to browsing agents. Benchmarks demonstrate that declared tool execution runs 2.5 to 7.5 times faster than DOM scraping while providing untrusted-content hints that help agents isolate prompt injection attempts embedded in user comments. In collaborative environments, Block’s Bradley Axen demonstrated Buzz, an open-source workspace built on Nostr where humans and agents interact in shared channels using cryptographic identities and owner attestations.

The imperative for protocol-enforced boundaries was reinforced by security evaluations presented by UC Berkeley professor Dawn Song. Across the CyberGym and ExploitGym benchmarks, frontier models such as GPT-5.6 Sol generated approximately 230 working exploits across 869 targets in two hours, including more than 80 against targets protected by active security mitigations. Tim O’Reilly framed the issue as an exercise in mechanism design, arguing that trust must be anchored in verifiable gateways, cryptographic identity, and audit logging rather than model instructions.

What happens next

Engineering teams and infrastructure maintainers face several milestone releases over the coming months. Block is preparing to launch version 1.0 of the Buzz collaboration platform in mid-November, providing reference implementations for agent channel participation and cryptographic attestation. Simultaneously, the MCP working group will continue formalizing draft specifications for proof-of-possession tokens and workload identity federation.

For organizations deploying MCP servers, immediate operational hygiene requires trimming schema sizes, annotating tool mutability, and preparing access control architectures for native agent credentials. The next AGNTCon + MCPCon events are scheduled for San Francisco on April 28–29, 2027, followed by an international edition in London on September 15–16, 2027.