MCP shifts from a connection protocol to an identity problem as the AAIF grows to ten projects

By InfoQ · October 26, 2026.

The Agentic AI Foundation (AAIF) added four projects at AGNTCon + MCPCon North America 2026, held in San Jose on October 22 and 23. It thus goes from three founding projects to ten in its first year, according to the foundation's own announcement. The new additions are OpenSandbox (Alibaba, an isolated environment for running agents), Open Responses (OpenAI, an open specification for interoperable LLM interfaces), Agent Skills (Anthropic) and OpenEnv (Hugging Face, a framework of reinforcement learning environments for training and evaluating agents).

The figure that explains the event's shift in focus: according to Den Delimarsky, lead maintainer of the protocol at Anthropic, cumulative downloads of the MCP (Model Context Protocol, the standard for connecting models to tools and data) SDKs have reached 4.17 billion, up from about 3 billion a month earlier. Delimarsky said this raises the stakes of every security breach. About a third of the 116 conformance scenarios now test security. Enterprise-managed authorization is live in Claude, and its roadmap marks that feature as stable, leaves proof-of-possession tokens and workload identity federation in draft, and points toward agents that identify as themselves.

There were more technical pieces. David Soria Parra, co-creator of MCP, announced support for MCP tasks in Claude Code so that tool calls can run for minutes, hours or days. The July 28 specification introduced stateless servers, and according to the speaker some platforms already see about 70% of traffic in that mode. From OpenAI, Thomas Sarlandie explained that they reject servers whose tools lack annotations, which make it possible to speed up reads and request confirmation for destructive actions. And Chrome presented WebMCP, a proposed standard in origin trial that lets websites declare tools to agents instead of agents scraping the DOM; according to Sarah Drasner, actions are 2.5 to 7.5 times faster.

On security, Dawn Song (UC Berkeley) argued that frontier AI will help attackers more than defenders in the short term. She cited that on ExploitGym, GPT-5.6 Sol generated about 230 working exploits against 869 targets in two hours, and more than 80 with standard mitigations enabled. The article itself cautions that several figures from the event were claims made on stage without published data; they should be treated as indications, not verified measurements.

**Our take.** Thesis: the bottleneck for agents is no longer model capability or the connector, but trust. When a protocol grows 1.4-fold in a month, the question is no longer "can it connect?" but "who is this agent, on whose behalf is it acting and what can it do?" That the roadmap ends with agents having their own identity, rather than a borrowed user token, is the underlying shift. It fits with what we're already seeing in agentic commerce: whoever controls identity and authorization controls intermediation.

There is also a legitimate note of caution. Tim O'Reilly called for shifting trust from the model to protocols, gateways and verifiable identity, and Manik Surtani, CTO of the AAIF, noted that a license isn't enough to keep infrastructure open: Kubernetes went to a neutral foundation, Android did not. But outside coverage was cooler: The Register's headline said vendor-affiliated technology was being adopted by a friendly, funded foundation, and The New Stack pointed out that Anthropic and Google are sticking with their own APIs rather than Open Responses. Neutrality will be proven in governance, not in the number of projects. And several security extensions remain in draft.

Practical implications, broadly: annotate every tool, keep schemas small and design for agents with their own identity. Dohmke (Entire) added another tension: teams using coding agents produce about 57 pull requests a week versus about 10, and review becomes the bottleneck. His proposal is to store agent session logs in Git alongside the commits.

In the short term, this means a growing attack surface and a race in which attackers need just one flaw. In the long term, the same identity, attestation and auditing infrastructure is what will make it possible to delegate real work to agents with guarantees, and that delegation is one of the paths toward the abundance we champion. Building the trust plumbing first isn't glamorous, but it is what determines whether we get there without upheaval.