What this digest covers
Agents are moving from demos into infrastructure: protocols that connect them to tools, security guidance, containment tools, regulatory attention and new ways to charge for them. This report summarises what published sources said on those topics between mid-2025 and October 2026.
It is a digest, not original research. Figures come from the sources listed at the end, and many are vendors’ own claims. We mark our own readings as ours. Our case-study results are not used here as evidence about the market.
Key developments at a glance
| Date | Development | Source |
|---|---|---|
| Dec 9, 2025 | Anthropic donates MCP to the new Agentic AI Foundation under the Linux Foundation | Anthropic |
| June 25, 2026 | Akamai researchers analyse the MCP 2026-07-28 specification release candidate | SiliconANGLE |
| Sept 30, 2026 | Reports of an FTC investigation into AI companies over agents that exceed instructions | ABC News, SecurityWeek |
| Oct 1, 2026 | Funding stories on agent security testing and messaging-based agents | TechCrunch |
| Oct 7, 2026 | Microsoft Execution Containers reported generally available on Windows 11 | Windows Report, eSecurity Planet, Petri |
| Oct 10 to 22, 2026 | Cloudflare adds skills, events and step-up authorization to its MCP server and retires /sse | Cloudflare |
| Oct 21, 2026 | NVIDIA announces the OpenShell Reference Architecture | NVIDIA |
Protocols: MCP and A2A move to neutral homes
Two open protocols are emerging. According to SD Times, Google’s Agent2Agent (A2A) protocol is meant to let agents connect with any other agent built on it, and on June 23, 2025 it was reported that Google was donating A2A to the Linux Foundation. Anthropic’s Model Context Protocol (MCP) connects agents to data sources and applications. On December 9, 2025, Anthropic announced it was donating MCP to the Agentic AI Foundation under the Linux Foundation, co-founded by Anthropic, Block and OpenAI.
Anthropic says there are more than 10,000 active public MCP servers and that MCP is adopted by products including ChatGPT, Cursor, Gemini, Microsoft Copilot and Visual Studio Code. These adoption figures are Anthropic’s own.
Our own reading, not a finding from the sources: neutral hosting and wide support lower the risk of being locked into one vendor’s way of connecting agents, though standards are still young. Microsoft’s architecture guidance and Anthropic’s engineering post both say to use the least complexity that works, so a protocol is a tool for when you need it, not a goal.
Security: a safer protocol is not a safe deployment
SiliconANGLE reported on June 25, 2026 on Akamai research into the MCP 2026-07-28 specification. It describes the revision as the biggest architectural change to the protocol since Anthropic created it, with a 12-month deprecation window for some legacy features.
- Removed or limited: protocol-managed sessions that used the Mcp-Session-Id header, unsolicited server-initiated prompts, and legacy password and implicit OAuth grants, now replaced by mandatory OAuth 2.1 with PKCE.
- Opened up: Akamai’s researchers listed six areas for implementers: client-held state, unsigned _meta objects, header and body mismatch, x-mcp-header mapping, MCP Apps panels and long-running “hit-and-run” tasks.
The common thread is that checks the protocol used to perform now fall to whoever builds and runs the server. This is analysis of a specification, not a report of attacks in the wild.
OWASP has also started an MCP Top 10, in beta, covering secrets, over-broad permissions, tool poisoning, supply chain risk, command injection, prompt injection, weak authentication, missing logs, unapproved servers and data leaking between tasks. Its labels carry the 2025 edition and may change.
Vendors add controls: Cloudflare in October 2026
Cloudflare’s changelog records four changes to its MCP servers in October: skills served over MCP (October 10), Workers error alerts pushed to agents as events (October 13), step-up authorization (October 19) and retirement of the /sse endpoint in favour of /mcp (October 22).
Step-up authorization means a client can connect with minimal scopes and approve more only when a task needs them. Cloudflare also reports, in its February 2026 Code Mode post, that exposing its more than 2,500 API endpoints as separate tools would use about 1.17 million tokens of context, against about 1,000 tokens with its approach. All of this is vendor-reported and untested by us.
Our own reading, not a finding from the sources: scoped access, signed alerts and a single supported endpoint are the controls a security reviewer would ask for, and it is useful to see them arriving in platforms.
Containment: limits enforced outside the agent
Two announcements share one idea: do not rely on the agent to police itself.
- Microsoft Execution Containers (MXC). Windows Report, eSecurity Planet and Petri report general availability on Windows 11 on October 7, 2026. Policies limit which files, network destinations and resources an agent can reach, with enforcement outside the agent. Learning and Permissive modes record attempted access so a team can refine a policy before enforcing it. Reported as not yet generally available: central policy management through Intune for process containers and Entra-based agent identity. We could not open Microsoft’s own announcement page, so check Microsoft’s documentation before relying on details.
- NVIDIA OpenShell Reference Architecture. Announced October 21, 2026 at GTC Berlin, described by NVIDIA as a way to “build, contain, observe and enforce safe agents”. It pairs software with hardware, including BlueField-4 DPUs running NVIDIA Sentry for enforcement outside the agent’s own software. Reporting says the software is open source under Apache 2.0. The safety and cost claims are NVIDIA’s own, and no prices were published.
Participation by other companies in a reference architecture is not the same as production deployment. Watch for named deployments.
Regulatory and trust signals
ABC News and SecurityWeek reported on September 30, 2026 that the US Federal Trade Commission has opened an investigation into AI companies including OpenAI and Anthropic. SecurityWeek, citing the New York Post, said an FTC spokesperson confirmed it and that it focuses on agents going beyond human instructions. Details are thin and nothing reported is a finding against any company.
Fortune reported on October 2 that two GovAI researchers say the most powerful models are often run in labs with key safeguards switched off, so published safety tests may not reflect behaviour in practice. These accounts relate to controlled tests, not customer deployments.
Agents reach customers, and the market splits its bets
TechCrunch reported on October 1, 2026 that Armadin raised $255.5 million to run always-on agent swarms for security testing, and that Photon raised $4.5 million to build agents that work inside messaging apps. Photon’s claims of more than 40,000 developers and tenfold revenue growth in four months are the company’s own. Airbnb’s CEO told TechCrunch he sees interoperability through MCP as the prize but said that using Airbnb through consumer agents “doesn't work very well” yet.
On how teams work, The Pragmatic Engineer’s March 2026 survey of 906 engineers found 70% used two to four AI tools at once. The a16z survey of 100 Global 2000 CIOs, published January 30, 2026, found 81% of enterprises using three or more model families. Samples differ, so do not compare the two directly. They suggest mixing tools is normal.
Pricing: no price lists, three models
None of the sources above publishes an agent price list. NVIDIA reported efficiency gains for its infrastructure but no prices. Gartner, as reported by W.Media, expects over 40% of agentic AI projects to be cancelled by the end of 2027 because of escalating costs, unclear business value or inadequate risk controls.
What exists is a framework. Our published buying guidance, which is practical guidance and not market data, compares three models.
| Model | You pay for | Hardest question |
|---|---|---|
| Per seat | Access for a named user | How many seats do we need? |
| Per task | Each unit of work | What counts as one task? |
| Per outcome | A result you defined | Who decides it was delivered, and what happens to failed attempts? |
Our own suggestion, not a finding from the sources: compare suppliers by asking each to price one real workflow, and ask how failed and retried work is billed.
Limits of this digest
- Many figures are vendor claims. We have not tested the products mentioned.
- Security findings are analysis of specifications and beta lists, not incident data.
- The FTC story is a set of reports, and details may change.
- We found no independent data on agent prices.
- Surveys use different samples and dates and should not be compared directly.
What to do
Our own suggestion, not a finding from the sources:
- Ask each supplier which MCP version their servers run, how they verify client-supplied state and what is logged when an agent calls a tool.
- Give agents the least access that works, and prefer limits enforced outside the agent.
- Observe before you enforce: record what the agent does for a period, then write the policy.
- Name an owner, keep a log and require approval for high-impact steps.
- Keep tool definitions and workflows portable so you can change vendor.
- Start with one workflow. Our 30-day pilot guide shows how.
For more, see the MCP and AI agent security checklist and the AI agents for business whitepaper. We build custom AI agent development; you can book a call.
Sources
- Donating the Model Context Protocol and establishing the Agentic AI Foundation, Anthropic, December 9, 2025
- Google’s Agent2Agent protocol finds new home at the Linux Foundation, SD Times, June 23, 2025
- New MCP specification kills old risks, opens fresh attack surfaces, Akamai finds, SiliconANGLE, June 25, 2026
- Model Context Protocol, project site
- MCP Top 10 project, OWASP (beta, 2025 edition labels)
- Cloudflare API MCP server serves Cloudflare skills, Cloudflare changelog, October 10, 2026
- Cloudflare API MCP server sends Workers Issues as MCP Events, Cloudflare changelog, October 13, 2026
- Cloudflare API MCP server now supports step-up authorization, Cloudflare changelog, October 19, 2026
- Cloudflare MCP servers no longer serve /sse, Cloudflare changelog, October 22, 2026
- Code Mode: give agents an entire API in 1,000 tokens, Matt Carey, Cloudflare blog, February 20, 2026
- Microsoft Execution Containers (MXC) Is Now Generally Available on Windows 11, Windows Report
- Microsoft Execution Containers for AI Agents Reach GA on Windows 11, eSecurity Planet
- Microsoft Makes Execution Containers Generally Available for AI Agents, Petri
- NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents, NVIDIA, October 21, 2026
- FTC opens probe into safety of AI, including Anthropic and OpenAI, ABC News, September 30, 2026
- FTC is Investigating OpenAI and Anthropic Over Possible Risks to Consumers, SecurityWeek, September 30, 2026
- We can’t trust them completely: AI research fellows warn that labs are running models with the safeguards off behind closed doors, Fortune, October 2, 2026
- Kevin Mandia’s new agent swarm security startup Armadin raises $255.5M, TechCrunch, October 1, 2026
- Photon held a funeral for mobile apps. Now it has $4.5M to help replace them with agents, TechCrunch, October 1, 2026
- Brian Chesky interview: AI agents need their own operating system, TechCrunch, October 1, 2026
- Over 40 percent of Agentic AI projects could face the axe by end of 2027: Gartner, W.Media, June 27, 2025
- AI Tooling for Software Engineers in 2026, The Pragmatic Engineer, March 3, 2026
- Leaders, gainers and unexpected winners in the Enterprise AI arms race, Andreessen Horowitz, January 30, 2026
- AI Agent Pricing: Per Seat, Per Task or Per Outcome?, Zunkiree Labs (buying guidance, not market data)
Frequently asked questions
Is this original research?
No. It is a digest of published sources, listed at the end, with our reading marked as ours. Many figures come from vendors and are their own claims; we say so where it applies.
What changed in the Model Context Protocol in 2026?
A major revision dated 2026-07-28. SiliconANGLE, reporting on Akamai's research, says it removes protocol-managed sessions, limits unsolicited server prompts and requires OAuth 2.1 with PKCE, while adding new attack surfaces that implementers must handle. Akamai's analysis is of the specification, not of attacks seen in the wild.
Are there agent price lists in the sources?
No. None of the sources digested here publishes agent price lists. Our own buying guidance describes per seat, per task and per outcome models, and NVIDIA published no prices for its new infrastructure. Compare suppliers by pricing one real workflow.
What should a small business do with this news?
Ask suppliers which protocol versions they run, what the agent can access, what is logged and who is accountable. Limit access, enforce limits outside the agent where you can, and start with one workflow. Our suggestions are in the final section.
What you get:
- A dated table of the key agent infrastructure developments from 2025 to October 2026
- What the MCP 2026-07-28 specification removed and what researchers say it opened up
- How Microsoft and NVIDIA approach containment outside the agent
- A plain account of the pricing models and the gaps in public price data
- A short action list for buyers, with every claim traced to a listed source