Learn AI deeply. Question it honestly.
Build it for people.
What's materially changed?
August 17, 2026 · Linux Foundation
Google's A2A protocol formally joined the Agentic AI Foundation, the Linux Foundation body that already houses Anthropic's MCP (Axios had it first; Forbes has the technical read). MCP and A2A sit under one neutral governance structure for the first time. MCP defines how agents reach systems, while A2A defines how agents delegate to each other. Since its launch in December 2025, AAIF has grown from fewer than 40 members to more than 250, including Google, Microsoft, Amazon, Anthropic, OpenAI, Bloomberg, Shopify, and Block.
Before these standards, every connection was custom. If you wanted an assistant to read claim status out of your claims system of record, you built that integration for one vendor's assistant. Change assistants, and you built it again.
The concrete version: your team wraps claim status in a single MCP server. Today an assistant in Azure AI Foundry calls it. If that assistant moves to Databricks Agent Bricks or somewhere else next year, your server does not change. You swap the client, not the integration. That is what "no longer a bet on a vendor" means: the work your team does this year still holds if the platform changes next year.
A2A does the same thing one level up. An underwriting agent your team builds with Google's ADK can hand a task to a broker-service agent built with Microsoft Agent Framework, and neither team writes glue code for the handoff. Insurance is already named as an adopting vertical. This is a pattern with peers rather than a research project.
The "one vendor to rule them all" scenario is now the unlikely one. Two rival labs and three hyperscalers have committed to standards none of them individually controls. It also confirms the pace: MCP went from one company's November 2024 idea to industry infrastructure in under two years, and its July 2026 revision now sees close to half a billion SDK downloads a month.
Authorization. The transfer explicitly does not standardize enterprise authorization policy. We still own the policy decisions: on whose behalf the agent acts, what the agent may reach, and how we prove the agent's actions. Microsoft's security team makes the same point, and the failure mode is not hypothetical. In August 2025, compromised OAuth tokens tied to one AI chatbot integration exposed the Salesforce environments of more than 700 organizations, undetected for days because the traffic looked like normal chatbot activity.
Lock-in can also still reappear at the platform layer and through proprietary extensions, which is a contract problem rather than a protocol problem.
Mcp-Method and Mcp-Name. A gateway can authorize and meter per tool without parsing request bodies. That is per-tool policy enforcement you can buy with configuration rather than code.Read more: the MCP release post for protocol detail, A2A v1.0 for the agent-to-agent side, Microsoft on MCP security for what none of it solves.
"Now that protocols are in place, who on your team owns deciding what agents are allowed to reach?"
Real term, or did we make it up?
The three games in this issue are just for fun. Guess wildly and see how you do.
This month: MCP servers
You are going to hear "MCP" in a vendor meeting this year, probably several. As with all technology deep dives: our goal is to give you enough context to decide when it is useful, when you should invest, and when you should push back on the hype.
MCP is a shared format for how an AI assistant asks one of your systems for something, and how that system answers. It is not a model, not an agent, and not a product anyone sells you. It is a wire protocol: JSON-RPC 2.0 messages over a defined transport, plus a small vocabulary for describing what a system can do.
If you have been in enterprise IT long enough, you have already seen this shape. Before ODBC, connecting 10 applications to 12 databases meant writing 120 separate drivers, one for every pairing. ODBC cut that to 22 jobs: each application learned to speak ODBC once, and each database shipped one ODBC driver any application could use. Add a thirteenth database, and you write one driver, not ten.
MCP does the same thing for assistants and systems. Write one server for your claims system, and every compliant assistant can use it. Add a new assistant next year, and you write nothing at all.
Simplicity drove industry-wide adoption in eighteen months.
Your team writes get_claim_status once. Every assistant in the building can call it, whatever platform it runs on.
Before MCP, each of those three would have been its own connector, written against one vendor's assistant and maintained separately, with the access rules duplicated in three places and quietly drifting apart.
Tools: the actions a server offers, each with a name, a description of when to use it, and the inputs it accepts. The only part that can act on your systems.
Resources: read-only context the assistant can fetch by address, using a URI.
Prompts: reusable templates, usually slash commands.
The July 28, 2026 revision is the largest since launch. MCP went stateless. The initialize handshake and sessions are gone. Any request can land on any server instance behind a plain round-robin load balancer. Method and tool names now ride in the Mcp-Method and Mcp-Name HTTP headers. Your gateway or WAF can route, meter, and authorize per tool without parsing JSON bodies. Deprecated features now carry a twelve-month window, which gives teams time to plan upgrades rather than react to them.
Translation for the platform team: agent traffic finally looks like ordinary HTTP traffic, so the controls we already run can finally see it.
Tool descriptions and tool results enter the model's context as trusted text. That's the design. A poisoned description ships inside a package and fires on every invocation, for every user, silently, until someone notices. Any free-text field a customer can fill is a potential injection vector. Transport security does not touch this.
You reduce the blast radius by putting only narrow, purpose-built tools on the menu. Compare two you could build:
get_claim_status(claim_id) can only ever return a claim status. Your server checks who is asking, looks up one claim, and returns one field. A poisoned instruction can make it ask about the wrong claim. That is the worst it can do.
run_sql(query) is a blank check. The model composes any query it likes and your server runs it. A poisoned instruction can now reach the salary table, because you handed over the whole database rather than one answer.
Same protocol, same security, wildly different exposure. The menu is the control.
"MCP makes the assistant smarter." It does not change what the model can do. It gives the assistant reach. The model is exactly as capable as it was, but it can now touch things it could not touch before. Those are different problems with different budgets, so it helps to plan and fund them separately.
"Adopting a standard improves our security posture." Not on its own. A standard makes integration cheaper, which means more integrations, which means more surface. MCP is a security surface, not a security control. The controls are still yours to build, and there are now more places to put them.
Close enough still counts
Four numbers from recent research. Slide to your best guess. You score for how close you land.
What share of organizations report using AI in at least one business function?
What share of organizations say they are scaling an agentic AI system somewhere in the enterprise?
Among organizations that have fully integrated AI, what share report AI-driven revenue growth?
What share of the US population uses generative AI?
Sixteen terms, four groups of four
Find the four groups of 4. Four mistakes allowed. Run out and the board reveals itself!