MCP shifts from a connection protocol to an identity problem: the AAIF grows to ten projects

By InfoQ · October 26, 2026.

The Agentic AI Foundation (AAIF) added four projects at AGNTCon + MCPCon North America 2026, held in San Jose on October 22 and 23. That takes it from three founding projects to ten in its first year, according to the foundation's own announcement. The new additions are OpenSandbox (Alibaba, an isolated environment for running agents), Open Responses (OpenAI, an open specification for interoperable LLM interfaces), Agent Skills (Anthropic) and OpenEnv (Hugging Face, a framework of reinforcement learning environments for training and evaluating agents).

The figure that explains the event's shift in focus: according to Den Delimarsky, lead maintainer of the protocol at Anthropic, cumulative downloads of the MCP SDKs (Model Context Protocol, the standard for connecting models to tools and data) have reached 4.17 billion, up from about 3 billion a month earlier. Delimarsky said this raises the stakes of every security breach. About a third of the 116 conformance scenarios now test security. Enterprise-managed authorization is live in Claude. The roadmap marks that feature as stable, leaves proof-of-possession tokens and workload identity federation in draft, and points toward agents that identify as themselves.

There were more technical pieces. David Soria Parra, co-creator of MCP, announced support for MCP tasks in Claude Code so that tool calls can last minutes, hours or days. The July 28 specification introduced stateless servers, and according to the speaker some platforms already see about 70% of their traffic in that mode. For OpenAI, Thomas Sarlandie explained that they reject servers whose tools lack annotations, which make it possible to speed up reads and request confirmation for destructive actions. And Chrome introduced WebMCP, a proposed standard in origin trial that lets websites declare tools to agents instead of having agents scrape the DOM. According to Sarah Drasner, it makes actions 2.5 to 7.5 times faster.

On security, Dawn Song (UC Berkeley) argued that frontier AI will help attackers more than defenders in the short term. She noted that on ExploitGym, GPT-5.6 Sol generated about 230 working exploits against 869 targets in two hours, and more than 80 with standard mitigations enabled. The article itself warns that several figures from the event were claims made on stage without published data. They should be treated as indications, not as verified measurements.

**Our take.** Thesis: the bottleneck for agents is no longer model capability or the connector but trust. When a protocol grows 1.4-fold in a month, the question stops being "can it connect?" and becomes "who is this agent, whom does it act for and what can it do?" The underlying shift is that the roadmap ends in agents with their own identity rather than a borrowed user token. That fits with what we already see in agentic commerce: whoever controls identity and authorization controls intermediation.

There is also a legitimate note of caution. Tim O'Reilly called for moving trust from the model to protocols, gateways and verifiable identity. Manik Surtani, CTO of the AAIF, noted that a license isn't enough to keep infrastructure open: Kubernetes went to a neutral foundation, Android didn't. But the outside press was cooler. The Register ran a headline saying vendor-affiliated technology is being adopted by a friendly, funded foundation, and The New Stack pointed out that Anthropic and Google are sticking with their own APIs rather than Open Responses. Neutrality will be proven in governance, not in the number of projects. And several security extensions are still in draft.

Practical implications, broadly: annotate every tool, keep schemas small and design for agents with their own identity. Dohmke (Entire) raised another tension: teams using coding agents produce about 57 pull requests a week versus about 10, and review becomes the bottleneck. His proposal is to store agent session logs in Git alongside the commits.

In the short term, this means a growing attack surface and a race in which attackers need only one flaw. In the long term, that same identity, attestation and auditing infrastructure is what will make it possible to delegate real work to agents with guarantees, and that delegation is one of the paths toward the abundance we champion. Building the trust plumbing first isn't flashy, but it's what decides whether we get there without nasty surprises.