AAIF Reaches Ten Projects as MCP Shifts Focus to Security at AGNTCon + MCPCon 2026

From Three Founding Projects to Ten in One Year

On October 22 and 23, 2026, in San Jose, United States, AGNTCon + MCPCon North America 2026 took place, an event that followed the PyTorch Conference at the same venue. There, the Agentic AI Foundation (AAIF) announced four new projects, raising the total from three founding projects to ten in the foundation's first year of existence, according to an InfoQ report.

Mazin Gilbert, executive director of AAIF, opened the event by announcing the projects and three new governance committees. The four additions are:

• OpenSandbox (Alibaba): a secure sandbox for running agents.
• Open Responses (OpenAI): an open specification for interoperable LLM interfaces.
• Agent Skills (Anthropic): a standard for agent skills, donated to the foundation.
• OpenEnv (Hugging Face): a framework for reinforcement learning environments used to train and evaluate agents.

Manik Surtani, the foundation's CTO, summed up the milestone:

A year ago, AAIF launched with three projects and a bet that agentic AI needed a neutral home to thrive. Today we host 10.

Manik Surtani, CTO of the Agentic AI Foundation

In a separate talk, "Who Keeps It Open?", Surtani compared the fate of Android, which ended up under the control of a single company, with that of Kubernetes, which Google migrated to a neutral foundation. For him, the open problems now lie in identity, attestation, auditing, and payments, no longer just in code licensing.

Coverage off the stage was more skeptical. The New Stack noted that Open Responses already has support from AWS Bedrock, Databricks, Ollama, Nvidia, and vLLM, but that Anthropic keeps its own Messages API and Google its own Interactions API, meaning interface fragmentation continues. The Register took the same line and closed its coverage with a warning:

This enthusiastic (or credulous) embrace of AI agents may be a bit too rapid for some industries.

The Register, AGNTCon + MCPCon 2026 coverage

MCP Gains Long-Running Tasks and Security Compliance

David Soria Parra, co-creator of MCP at Anthropic, argued that models today need less help staying focused and more connectivity. The July 28, 2026 specification added support for stateless servers, which raised fears among developers that MCP would become just another API. Soria Parra said that, on some platforms, about 70% of traffic already runs in this mode.

At the same event, Soria Parra announced support for long-running tasks ('MCP tasks') in Claude Code, allowing tool calls to run for minutes, hours, or even days, instead of seconds. Anthropic also donated the Agent Skills standard mentioned above to the foundation. The project's roadmap lists five priority areas, ranging from agent-to-agent messaging and skills over MCP to identity and a native HTTP transport.

Den Delimarsky, lead maintainer of the protocol at Anthropic, revealed that cumulative downloads of MCP SDKs reached 4.17 billion, up from about 3 billion a month earlier. For him, the jump raises the stakes of any security breach. Today, about a third of the protocol's 116 compliance scenarios test security, and managed authorization for enterprises is already available in Claude.

In the authentication roadmap, this feature appears as stable, while proof-of-possession tokens and workload identity federation remain in draft. The final design envisions agents that log in as themselves, no longer borrowing a human user's identity.

Security: Models Are Already Finding Zero-Day Vulnerabilities

Dawn Song, a professor at UC Berkeley, brought the hardest data point of the event: in her view, frontier AI will help attackers more than defenders in the short term. The CyberGym benchmark, created by her team, covers more than 1,500 vulnerabilities across nearly 200 open source projects, and current models are already finding zero-day flaws in that set.

In ExploitGym, GPT-5.6 Sol produced about 230 working exploits against 869 targets in two hours. Even with standard security mitigations enabled, the number still exceeded 80. Since an attacker only needs one breach to succeed, Song advocated for secure-by-construction systems, with AI-generated proofs, and cited a new observatory that tracks this capability race.

What This Changes for Those Running MCP Servers in Production

Thomas Sarlandie, of OpenAI, showed what ChatGPT's plugin directory reveals about MCP servers in production: there is no practical limit on the number of tools, but oversized schemas get trimmed, starting with argument descriptions. About three in four tool schemas in published servers are under 1 kB, while the largest reach 260 kB for a single tool and 1.4 MB for an entire server.

OpenAI rejects submitted servers unless every tool carries annotations, which let ChatGPT speed up read-only calls and ask for confirmation on destructive actions. Only 56% of plugins use server instructions, which Sarlandie said is safe to keep under 1,000 characters.

For those who build or maintain an MCP server today, the practical takeaway from the event was direct:

• Annotate every tool, distinguishing what is read-only from what is a destructive action.
• Keep schemas small, trimming redundant descriptions before the platform trims them for you.
• Plan for the agent's own identity, instead of delegating a borrowed user token.
• Treat server instructions as short, objective text, not as a manual.

WebMCP and the Fight for Identity Outside the Protocol

Sarah Drasner, of Chrome, presented WebMCP, a proposed web standard that is already in origin trial and lets sites expose tools directly to agents, without requiring them to scrape the DOM. Drasner cited benchmarks in which actions were 2.5 to 7.5 times faster with this model, and noted that "read-only" and "untrusted content" hints help the agent resist prompt injection hidden in user comments. According to her, WebMCP complements MCP, it does not replace it.

Bradley Axen, of Block and creator of goose, demoed Buzz, an open source workspace where people and agents share the same channels. Each agent receives its own identity plus an attestation naming its owner, and can read channels but not direct messages. Buzz already counts 80,000 communities and 36,000 stars on GitHub, with version 1.0 expected for mid-November 2026.

Thomas Dohmke, former GitHub CEO and now CEO of Entire, said agents have turned code review into the new bottleneck: teams that use coding agents produce about 57 pull requests per week, versus roughly 10 for teams that do not. Dohmke's proposal is to store agents' session logs in Git, linked to commits, so that reviewers can compare the change with the original intent.

What Is Still Left to Solve

J.R. Storment, executive director of the Tokenomics Foundation, founded 11 weeks before the event, asked the audience to stop counting tokens. Cost per task is already a better metric than cost per token, and cost per outcome is even better, but the measure that truly matters, according to him, is the value generated for the business.

Tim O'Reilly called MCP an architecture of participation (architecture of participation, in the original) for AI, in the Unix tradition. For him, the AI economy still lacks its own trust mechanisms, the way the web needed pay-per-click and secure payments to mature. O'Reilly advocated for mechanism design, or "reverse game theory": starting from the desired outcome and working backward to the rules that produce that outcome.

InfoQ's own warning is worth noting: several figures presented on stage are not accompanied by published data, and some security extensions are still just drafts. Those who want to dig deeper can watch the recordings of the first and second day keynotes, or follow the foundation's project pages. The next editions of AGNTCon + MCPCon are scheduled for San Francisco, on April 28 and 29, 2027, and for London, on September 15 and 16, 2027.