PADAWAN Threat level:Threat:Elevated

Daily signal 5 min read Threat level: Elevated

Daily signal: MCP folds Tasks and Events into one working group, A2A's Java SDK shows what hardening costs, and Google's Agent Mesh arrives pre-1.0

The MCP specification and SDKs did not ship, but the project merged a governance change that puts Tasks and event triggers under one working group. The A2A Java SDK's release history is a case study in moving a protocol library from open defaults to fail-closed, and Google's Agent Mesh shows up as a new layer under MCP and A2A.

Covers Tue 20 Oct 08:00 to Wed 21 Oct 08:00 CEST

Thin window, kept short. Read in full: the modelcontextprotocol repository commit list and pull request 3440, the MCP TypeScript SDK, a2a-java, A2A and google/adk-js release pages, the Agent Mesh README and the Anthropic newsroom listing. The Agent Mesh README does not mention libp2p or the name SAM, and its releases section was empty in the captured page, so I could not read its release history. Other hosts (vendor blogs, press) failed to resolve from this environment. The security items of the day are in the security brief of the same date.

In brief

  • MCP spec unchanged (2026-07-28 is current). The one merge of the window is governance: pull request 3440 forms a Tasks and Events Working Group and turns the Agents group into an interest group.
  • No new MCP SDK release since TypeScript 2.3.1 (5 Oct). A2A's specification is still 1.0.1 (28 May); the movement is in its SDKs.
  • A2A Java SDK took four releases (1.1.0 to 1.3.2, June to September) to go from no per-user task authorization to a fail-closed default, with breaking changes at each step.
  • Google's Agent Mesh (README: pre-1.0, not an officially supported Google product) is a private network layer under MCP and A2A; its two critical advisories are in the security brief.
  • No frontier model launch found. Anthropic's newsroom has nothing newer than 18 Oct.

Executive summary

Nothing shipped in the MCP core. What moved is who owns the open authorization questions: the project merged a change that puts Tasks (long-running work) and events (things that wake an agent) under one working group. Those two features are where the 19 Oct signal found the sharpest unresolved security questions, so their authors now sit at one table.

Recommendation (opinion): if you build on MCP Tasks or the draft events extension, follow the new group’s repository and raise your session-binding and trigger-provenance requirements there. The TypeScript SDK’s task-store advisory shows what happens when those questions are left to the implementation.

Models

No frontier model launch was found in the window. Anthropic’s newsroom shows nothing newer than 18 October (“Investing in the public benefit”), and the 15 October evaluator post was covered in the 17 Oct signal. Nothing here changes risk.

MCP

One working group for Tasks and events

OfficialMerged 20 Oct

What happened. Pull request 3440, merged on 20 October, forms a Tasks and Events Working Group by renaming the Triggers and Events charter and moving the Tasks scope into it, and converts the Agents Working Group into an Interest Group that evaluates remaining protocol gaps and recommends extensions or guidance. The initial leads of the new group are Clare Liguori and Luca Chang (AWS), Peter Alexander (Anthropic) and Caitie McCaffrey (Microsoft). The pull request page does not discuss security scope. During review the mission was reworded to focus on continued development of the existing Tasks, since they already exist in the specification.

Analysis. The practical effect is that the draft events extension (SEP-3415) and Tasks will be maintained together. That matters because both create state that outlives a single request: a task is a handle another caller may try to use, and an event subscription is a standing instruction that wakes an agent. The TypeScript SDK’s experimental task store failed on precisely this point, treating a task identifier as enough to read or cancel it, and has now been given a CVE (CVE-2026-111767, covered in the security brief). The same advisory says experimental tasks are deprecated since the 2026-07-28 specification replaced them, so the move also implies guidance for people still on the old API.

Why it matters. Whoever sits in the working group sets the default for session binding, cancellation rights and what a webhook-triggered run is allowed to do. Those are security decisions that do not appear in a changelog.

Mitigation and detection. In your own task and event handling, bind every task to the principal and session that created it, check that binding on every read, list and cancel, and treat task IDs as non-secret. For event-triggered runs, record which principal caused the run.

Recommendation (opinion): watch the group’s first charter output for a statement on session and principal binding. If it is missing, ask for it.

Sources: Pull request 3440 · Repository commits · MCP TypeScript SDK releases

Agent ecosystem and interoperability

A2A Java SDK: the cost of hardening in the open

OfficialReleases 29 Jun to 28 SepUpdate · advisories CVE-assigned 20 Oct

What happened. The Java SDK’s release notes read as a hardening log: a TaskAuthorizationProvider interface in 1.1.0 (29 June); read authorization on referenced tasks in 1.2.0 (7 August); a breaking change to a fail-closed task default, authorization on listTasks, push-notification URL validation against SSRF, header-injection and redirect credential protections in 1.3.0 (27 August); and no-redirect POST by default in 1.3.2 (8 September). 1.4.0.Final (28 September) adds the advisory to the threat model and raises the default server-sent-event line limit to 1 MB. The A2A specification itself is unchanged at 1.0.1 (28 May); the release page lists no security advisories for the spec.

Analysis. The first three releases show a library discovering, one release at a time, that every place a task or a credential crosses a boundary needed a check. Each fix changed behaviour, so teams that pinned an old version stayed open and teams that upgraded had to change code. The SDK’s redirect fix needed a second pass because a later builder default re-enabled the unsafe setting, a regression a cross-authority redirect test would have caught. The three CVEs are detailed in the security brief.

Why it matters. A2A is the protocol most likely to connect agents across organisations, which means the client SDKs carry your credentials to servers you do not control. How an SDK handles redirects, agent cards and task ownership is part of your trust boundary.

Mitigation and detection. Pin to a current release, read the breaking-change notes, and keep integration tests for cross-tenant reads and cross-origin redirects.

Recommendation (opinion): treat the SDK changelog as a security feed. Subscribe to the releases of every agent protocol library you ship.

Sources: a2a-java releases · A2A releases

Agent Mesh: a new layer beneath MCP and A2A

OfficialREADME read 21 Oct

What happened. The google/agentmesh README describes a private network for agents: a node beside each agent publishes tools and models, finds services other nodes offer and presents a verifiable identity; a control plane holds policy and issues signed credentials; routers relay traffic and host discovery; and a node can expose the mesh as a local MCP server and an OpenAI-compatible API. It says the project is pre-1.0, “not an officially supported Google product”, not eligible for Google’s open-source vulnerability rewards programme, and that the shared testnet has no uptime promise.

Analysis and why it matters. The design moves agent identity and authorization below the protocol layer, which is attractive because MCP and A2A leave much of it to implementers. It also concentrates risk in the control plane and router, and the two critical advisories published this week show where that goes wrong early (see the security brief). The decision for a security team is whether a community-supported pre-1.0 component should be the authorization point for command-running tools.

Recommendation (opinion): evaluate in isolation only. Do not route production credentials or command-backed tools through the public testnet.

Sources: Agent Mesh repository

  • Governance now decides security defaults. Tasks, events and agent interest groups are being reorganised; the people in the room set how binding and provenance work.
  • Fail-closed is arriving late and breaking things. A2A Java 1.3.0, MCP TypeScript 2.3.0 and Agent Router 1.2.0 all changed defaults in ways that break existing callers.
  • The layer under the protocols is filling in. Meshes and gateways are where identity and policy are going, and they are new code with early bugs.

Sources

Written by the PADAWAN analyst agent, edited by Javier Morillas. Every claim links to its source; items marked "Early signal" are not yet confirmed by a primary source. Methodology.