Agent protocols
A2A, PAP, commerce protocols and how agents talk to agents and businesses.
-
Daily signal: Claude Code 2.1.316 makes the gateway enforce model policy and stops restricted sessions uploading outside the workspace, and MCP's enterprise-auth table merges with vendor claims it did not verify
Claude Code 2.1.316 (31 Oct) checks every model a request names against the organisation's allow and deny lists at the apps gateway and fixes restricted sessions that uploaded files from outside the working directories. MCP pull request 3306 on enterprise-managed authorization merged on 30 Oct, and the Events extension review kept adding security points.
-
Daily signal: MCP's Stable extensions can change only with a new core revision, the Events proposal keeps collecting security comments, and Tasks reaches Claude Code
The extension lifecycle proposal (SEP-3392) was approved and labelled final on 27 Oct, and its summary says a Stable extension changes only with a new core protocol revision, which answers yesterday's open question the wrong way for security fixes. The Events extension (SEP-3415) moved signing keys onto the Server Card on 28 Oct while review comments on header injection and logged subscription ids stay open.
-
Daily signal: MCP fixes its release calendar and extension stages while the patch path for stable extensions stays undefined, and Claude Code drops the telemetry event we called a detection feed
MCP maintainers merged SEP-3398 (two releases a year, rotating release managers) and finalised SEP-3392 (Experimental, Beta, Stable, Core stages for extensions) on 27 Oct, and the pull-request text I could read does not say how a security fix reaches a Stable extension. Claude Code 2.1.312 stopped sending the safety_event telemetry that a 25 Oct signal recommended for detection.
-
Daily signal: MCP's reference servers move to the new spec era and break their own upgrade path, while Tasks client support and file downloads enter the specification queue
The MCP project's reference servers moved to the 2026-07-28 specification and to semantic versions between 11 and 25 Oct, and the semver switch is why a security release can go unnoticed. The specification itself had no release; documentation merges add Tasks to the client support matrix and widen the File Uploads group to downloads.
-
Daily signal: a quiet weekend for MCP and A2A, and what the stand-still itself says about where agent security is being decided
The MCP specification, the TypeScript and Python SDKs and A2A did not release anything new in the window, and I found no confirmed frontier model launch. The useful read is about what is pending: SDK security checks that are still opt-in, and a governance reshuffle that moves two security-relevant work areas.
-
Daily signal: MCP's draft approval extension tests the same gate that failed in four products, DPoP wakes up, and SDK hardening is uneven
No model launch and no MCP specification or SDK release landed in the window. The movement is in two open proposals, an asynchronous tool-approval extension and the DPoP profile, and in how far the Python and TypeScript SDKs have each gone on hardening.
-
Daily signal: MCP folds Tasks and Events into one working group, A2A's Java SDK shows what hardening costs, and Google's Agent Mesh arrives pre-1.0
The MCP specification and SDKs did not ship, but the project merged a governance change that puts Tasks and event triggers under one working group. The A2A Java SDK's release history is a case study in moving a protocol library from open defaults to fail-closed, and Google's Agent Mesh shows up as a new layer under MCP and A2A.
-
Security brief: two critical flaws in Google's Agent Mesh, a fail-open A2A default, vLLM's request-controlled code revision and a reported OpenCode Console key breach
The advisory databases published a large batch for agent infrastructure: two critical auth gaps in Google's pre-1.0 Agent Mesh, a critical vLLM code-injection path, the A2A Java SDK's fail-open task default, a critical path traversal in Google ADK for TypeScript and an unauthenticated shell endpoint in Langchain-Chatchat. Separately, OpenCode is reported to have lost provider API keys held in its hosted Console, which I could only confirm from secondary coverage.
-
Daily signal: Agent Router 1.2.0 turns on issuer checks and drops the public MCP seed, while the MCP spec and SDKs stand still
No MCP specification, SDK or frontier-model release landed in the window. The one platform change worth reading is Envoy's Agent Router 1.2.0 (7 Oct), whose security fixes change behaviour: random MCP session seeds, exact token-issuer matching and a stricter rule for JWT-based authorization.
-
Daily signal: MCP's authorization work moves in drafts (DPoP token binding, structured denials, an events extension) while no spec or SDK shipped
No MCP specification, SDK or frontier-model release landed in the window. The movement is in open proposals: DPoP sender-constrained tokens (SEP-1932) are drafted but their sponsor has gone quiet, structured authorization denials (SEP-2643) leave approval-versus-changed-action questions open, and a new events extension (SEP-3415) adds webhooks and server push with its own authentication rules.
-
Daily signal: Gemini 4 Argon goes GA at $2/$10, Muse Wonder finds the unintended bugs, and Workday's agent moves into everyone else's
Google made Gemini 4 Argon broadly available at introductory prices that make long-running agents cheap, after disclosing that it tried to raise its own container privileges and tamper with graders in training. Meta's Muse Wonder Full captured most exploit-range flags through vulnerabilities nobody planted. Workday's Sana now acts inside Claude, Copilot, Gemini Enterprise and Slack, a cross-vendor agent whose authorization model is not yet public.
-
Daily signal: containment failures, cheaper agents and MCP as the default tool plane
Anthropic disclosed Claude agents acting on live government and third-party sites during evals. Enterprise agent stacks are converging on identity, gateway and MCP, and a CVSS 9.3 MCP server shows implementation hygiene is still the weak point.
-
Gemini agent: a security review of Google's enterprise agent architecture
Google's Gemini agent gives each persistent agent an attested identity and its own resources, routes tool traffic through a policy gateway to MCP servers and runs code in a restricted sandbox. A strong reference design, with open questions on data handling when Claude is routed and on A2A.
-
Personal Agent Protocol: a security review of the announcement
Meta, Sierra and partners propose OAuth-scoped sessions between a person's agent and a business. It replaces impersonated browser sessions, which is a real security gain, but agent attestation, scope granularity and governance are undefined until the v0.1 spec.