The changelog

Q3 2026 (July – September) — quarter in progress

The quarter the doors started closing. MCP shipped its stateless revision and deprecated four features you may have built on; AWS shut Bedrock Agents Classic to new customers; Microsoft sunset the Assistants API outright. Google, meanwhile, is renaming its entire agent stack under Gemini Enterprise while the Vertex AI docs sit frozen — this quarter is still live, and entries land as they are verified.

2026-09-13 · GCP — Vertex AI docs frozen; the stack resurfaces as Gemini Enterprise Agent Platform. The Vertex AI generative-AI documentation now carries a banner that it is no longer being updated because those services are part of Gemini Enterprise Agent Platform, the Agent Builder product page reads “formerly Vertex AI”, and the managed runtime you knew as Agent Engine is presented as Agent Runtime. ADK docs 301-redirect from google.github.io/adk-docs to adk.dev, where ADK 2.0 with graph workflows and GA TypeScript support is current. So what: Retire “Vertex AI Agent Engine” as your search term and read adk.dev plus the Agent Platform pages instead; the old URLs still resolve but the content behind them is not being maintained. Google did not publish a rebrand date and ADK 2.0 has no verified release date, so treat this as observed on 13 September 2026 and check the live launch-stage labels before you promise anyone GA. (Gemini Enterprise Agent Platform / Agent Runtime overview and adk.dev (observed 2026-09-13))
2026-09-13 · Frameworks — OpenTelemetry GenAI conventions are still Status: Development. The GenAI semantic conventions moved out of the main OpenTelemetry semantic-conventions repository into a dedicated repo, open-telemetry/semantic-conventions-genai, covering spans, metrics, events, MCP and provider-specific conventions. Both the core client-span conventions and the agent/framework span conventions still open with “Status: Development”, and the new repo has no tagged release and a TODO schema URL. So what: You can instrument against gen_ai.* today, but do not let dashboards, alert rules or eval joins depend directly on attribute names — put a mapping layer between the SDK and your queries so a convention rename is one file, not a migration. Anyone selling you “OTel-standard agent observability” is describing a draft. (open-telemetry/semantic-conventions-genai; opentelemetry.io GenAI conventions pointer (checked 2026-09-13))
2026-08-27 · Standards — A2A joins the Agentic AI Foundation. A2A was accepted as a Growth Stage project in the Agentic AI Foundation, the Linux Foundation directed fund that already hosts MCP, goose and AGENTS.md. The announcement claims backing from 150-plus organisations. So what: Both halves of the interop story now sit under one neutral governance roof, which is the argument you need when a review board asks whether A2A is a single-vendor protocol. Treat the partner count as self-reported endorsement, not shipped integrations — as of September 2026 Microsoft Foundry A2A features are public preview and Google ADK marks A2A support experimental. (a2a-protocol.org blog, “A New Chapter for A2A: Joining the Agentic AI Foundation” (2026-08-27))
2026-08-26 · Azure — Azure OpenAI Assistants API sunsets; azure-ai-inference retires. The Assistants API reached its sunset date and the azure-ai-inference package retired on the same day. The documented mapping is Assistants API to Responses API, threads/messages/runs/assistants to conversations/items/responses/agent versions, and a pile of separate SDK packages to azure-ai-projects 2.x plus the OpenAI client against one project endpoint. So what: If you still import azure-ai-inference or create threads and runs, that code is running on retired surfaces — move to the Responses API and the unified project endpoint now. Two more deadlines are already on the calendar: Foundry visual workflows are unsupported after 1 December 2026, and Agents (classic) retires on 31 March 2027. (Microsoft Learn, “Navigate from classic” Foundry migration guide; workflow migration guide (1 December 2026) and “What’s new in Foundry Agent Service (classic)” (31 March 2027) (checked 2026-09-13))
2026-08-03 · Security — OWASP GenAI publishes the 2026 LLM Top 10. The 2026 edition of the OWASP Top 10 for LLM Applications was published on genai.owasp.org with updated rankings and incident-grounded research, formally announced on 1 September 2026 alongside the donation of an Agent Control Standard to the project. So what: Any control matrix, risk register or security-review template citing the 2025 edition needs re-baselining against the 2026 list — and note that the agentic threats live in a separate document, the Top 10 for Agentic Applications (ASI01–ASI10), not in the LLM list. Read the rankings from the document itself rather than from vendor summaries of it. (OWASP GenAI Security Project, “OWASP GenAI LLM Top 10 2026” (published 2026-08-03))
2026-08-01 · AWS — AgentCore Agent Registry and Runtime Instances reach GA. In August 2026 AWS Agent Registry went GA with AWS Organizations auto-detection of existing AgentCore Runtimes and Gateways plus customer-managed KMS keys, and Runtime Instances went GA — EC2-backed capacity providers including GPU, memory-optimised and compute-optimised families, with sessions up to 14 days. AgentCore payments also reached GA in the same month. So what: Long-horizon or GPU-bound agents no longer have to be squeezed into the default serverless microVM with its 8-hour maximum session and 15-minute idle termination — but you pay for managed compute on top of EC2, so decide per workload rather than switching wholesale. Registry GA is the moment to stop maintaining a spreadsheet of internal MCP servers and publish them into a catalogue with an approval workflow and a native MCP endpoint. (AWS What’s New, “AgentCore Runtime Instances generally available”; AgentCore Developer Guide release notes (August 2026))
2026-07-30 · AWS — Bedrock Agents Classic closes to new customers as the AgentCore harness goes GA. Amazon Bedrock Agents became “Agents Classic” and stopped accepting new customers on 30 July 2026: existing customers keep it in maintenance mode with no migration deadline and no planned end-of-life date, but no new features. The same month the AgentCore harness — a declarative managed agent loop you create with CreateHarness and run with InvokeHarness — went GA in all AgentCore regions and is named as the recommended migration target. So what: Every new agent build on AWS targets AgentCore; for existing Classic agents, work the published capability mapping — managed loop to harness, action groups to MCP tools via Gateway, Knowledge Base association to a Gateway-fronted retrieval tool, session config to Memory strategies. Two documented gaps to plan around: stage-specific prompt overrides do not map cleanly, and routing-mode multi-agent collaboration is not straightforward today. Bedrock itself, Knowledge Bases and Guardrails are unaffected, and since July 2026 Guardrails checks can be enforced at the Gateway via Policy, outside the agent code. (AWS Bedrock User Guide, “Agents Classic maintenance mode”; AgentCore release notes (July 2026))
2026-07-28 · Protocols — MCP revision 2026-07-28 makes the protocol stateless. The current MCP revision removed the initialize/notifications/initialized handshake (SEP-2575) and protocol-level sessions (SEP-2567), added a server/discover RPC advertising versions, capabilities and identity, and replaced server-initiated requests with Multi Round-Trip Requests (SEP-2322): servers return an input_required result and the client retries with responses. Roots, sampling, logging and Dynamic Client Registration are now deprecated, with earliest removal in the first revision released on or after 28 July 2027. So what: Retire the mental model where a connection is a session — every request now carries its protocol version and capabilities in _meta, every POST must send an MCP-Protocol-Version header matching the body or the server rejects it with 400 and JSON-RPC error -32020, and long-lived change notifications ride the SSE response stream of a subscriptions/listen request. If your server initiates sampling or reads roots, you have a year of notice to move to direct provider APIs and tool parameters; the release candidate landed 21 May 2026 and beta SDKs on 29 June 2026, so the SDK upgrade path exists. (MCP specification 2026-07-28 changelog (SEP-2575, SEP-2567, SEP-2322); Deprecated Features Registry (checked 2026-09-13))

Q2 2026 (April – June)

Writing the agent loop yourself stopped being the default. AWS put a declarative harness and a governed agent catalogue into preview, Microsoft shipped a control plane for agents as a licensed product, and Google set a shutdown date on the Vertex AI Extensions era. MCP published the release candidate that would flip the protocol to stateless — the quarter to read it, not the quarter to ship on it.

2026-05-28 · Protocols — A2A v1.0.1 lands. A patch release followed the March v1.0.0 stable line, keeping the proto file as the single source of truth for the three normative bindings. So what: Pin the spec version you implement and negotiate with the A2A-Version header rather than assuming a peer tracks the same patch; the 0.x era of the protocol is over, so “we support A2A” now needs a version number attached to be a meaningful claim. (github.com/a2aproject/A2A releases (v1.0.1, 2026-05-28))
2026-05-26 · GCP — Vertex AI Extensions deprecated with a shutdown date. Google announced the deprecation of Vertex AI Extensions on 26 May 2026, with shutdown after 26 November 2026, and recommends migrating to Agent Platform. So what: This one has a real cliff, unlike the AWS maintenance-mode pattern — anything still calling Extensions needs a migration landed before late November 2026. Rebuild those integrations as agent tools on Agent Platform rather than porting the Extensions shape across. (Vertex AI generative-AI release notes (2026-05-26))
2026-05-21 · Protocols — Release candidate for MCP 2026-07-28 previews statelessness. The MCP maintainers published a release candidate for the next revision, previewing the removal of protocol-level sessions, the Multi Round-Trip Requests pattern and the stateless base protocol. Beta SDKs followed on 29 June 2026. So what: This was the ten-week window to audit your servers and clients for handshake and session assumptions before the revision went current on 28 July. If you skipped it, the audit still applies — grep for initialize, Mcp-Session-Id, sampling/createMessage and roots/list, and decide per call site. (blog.modelcontextprotocol.io, 2026-07-28 release candidate post (2026-05-21))
2026-05-01 · Azure — Microsoft Agent 365 reaches GA inside Microsoft 365 E7. Agent 365 — Microsoft’s control plane for observing, governing and securing AI agents — became generally available in May 2026, bundled in the new Microsoft 365 E7 suite. So what: The agent inventory question now has a licensed answer on Microsoft estates: Agent 365 is positioned as the unified registry for agent visibility, with Entra Agent ID supplying identity and access management for what it discovers. Budget for the licence before designing around it, and expect the older “Entra Agent Registry” naming in Foundry publishing docs to keep converging with Agent 365. (Microsoft Partner Center announcements, May 2026; Microsoft Learn on Agent Registry convergence)
2026-05-01 · AWS — AgentCore clears the compliance bar and reaches GovCloud. AgentCore became generally available in AWS GovCloud (US-West) in May 2026, following ISO and CSA STAR certification in February 2026; SOC compliance arrived in July 2026, and Memory, Policy and the harness followed into GovCloud (US-West) in August 2026. So what: The procurement blocker that kept AgentCore out of regulated workloads in 2025 is largely gone — but the service-by-service GovCloud rollout means you must check the specific capabilities your design uses, not the platform name. Attestations are point-in-time; pull the current artefacts from AWS Artifact rather than citing this entry to an auditor. (AgentCore Developer Guide release notes (checked 2026-09-13))
2026-04-01 · AWS — AgentCore harness and AWS Agent Registry enter public preview. April 2026 brought the managed harness — a config-defined agent loop with no orchestration code and no container to build — and Agent Registry, a governed catalogue where organisations publish MCP servers, tools, agents and skills with hybrid keyword-plus-semantic search, approval workflows, IAM and OAuth access control, and a native MCP endpoint. Registry launched in five regions. An AgentCore payments preview was also announced in spring 2026 with Coinbase and Stripe. So what: If you were writing loop code only because there was no managed option, the harness removes that work and later became the migration target for Bedrock Agents Classic. Registry is the answer to tool sprawl: agents and IDEs query one catalogue over MCP instead of every team hardcoding server URLs. (AgentCore Developer Guide release notes and Agent Registry guide (April 2026 entries))

Q1 2026 (January – March)

Measurement and authorisation stopped being homework. A2A reached 1.0 with three normative bindings, AgentCore turned evaluation and policy into GA services you can buy instead of build, and MCP started shipping UI. It was also the quarter the protocol maintainers said out loud that tool annotations are not a security control.

2026-03-16 · Protocols — MCP names tool annotations as vocabulary, not enforcement. The MCP blog published “Tool Annotations as Risk Vocabulary: What Hints Can and Can’t Do”, restating the tools specification requirement that clients MUST consider tool annotations untrusted unless they come from trusted servers. So what: Never gate a destructive action on a server-supplied hint like readOnlyHint — a malicious or compromised server sets those fields itself. Annotations belong in your display layer and as inputs to a policy decision made elsewhere: an allowlist you control, a gateway policy, or a human approval. Field names in the annotation object move between revisions, so read the current schema before coding against them. (MCP Server Tools specification (2026-07-28); MCP blog, 2026-03-16)
2026-03-12 · Protocols — A2A specification v1.0.0 released. A2A reached its first stable major version with three normative protocol bindings — JSON-RPC, gRPC and HTTP+JSON — the proto file as single source of truth, and A2A-Version header negotiation. So what: The “which transport do we implement?” argument is now a deliberate choice with a spec behind it rather than a guess, and version negotiation is in the protocol instead of your integration notes. Do not read stability as adoption: as of September 2026 the major platform implementations are still preview or experimental, so build the fallback path. (github.com/a2aproject/A2A releases (v1.0.0, 2026-03-12))
2026-03-01 · AWS — AgentCore Evaluations, Policy and the CLI reach GA. Evaluations — previewed in December 2025 — went GA in March 2026 in nine regions with thirteen built-in evaluators covering response quality, safety, task completion and tool usage, plus ground-truth references, behavioural assertions, expected tool-execution sequences and custom evaluators via LLM scoring or Lambda. Policy went GA in thirteen regions, and the AgentCore CLI became generally available. So what: Evaluations scores interactions from OpenTelemetry traces and works for agents hosted off AgentCore too, so it is usable as a measurement layer over an existing stack — on-demand, sampled online, or batch. Policy GA means tool-call authorisation can be Cedar rules evaluated at the Gateway on every action, which is where it survives a model that has been talked into ignoring its instructions. (AWS What’s New, “AgentCore Evaluations is now generally available” (March 2026))
2026-02-01 · AWS — AgentCore obtains ISO and CSA STAR certification. AgentCore picked up ISO and CSA STAR certification in February 2026, roughly four months after GA. So what: This is the entry your security-review questionnaire actually wants; SOC compliance followed in July 2026. Certifications lapse and scopes change, so pull the current attestations from AWS Artifact rather than quoting a date from a changelog. (AgentCore Developer Guide release notes (checked 2026-09-13))
2026-01-26 · Protocols — MCP Apps brings inline UI to MCP clients. The MCP blog announced MCP Apps, an extension that lets servers render interactive UI elements inline in the client conversation rather than returning text only. So what: Extensions like this are opt-in and require explicit support from both client and server, so an MCP App is a nice-to-have layer over a working text contract — never the only way to use your server. Build the tool that works with no UI first, then add the app surface for clients that negotiate it. (blog.modelcontextprotocol.io, “MCP Apps — Bringing UI Capabilities to MCP Clients” (2026-01-26))

Q4 2025 (October – December)

The quarter the ecosystem got a neutral home and a security doctrine. AgentCore went GA, Microsoft renamed its platform and gave agents first-class identities at Ignite, Google launched Gemini Enterprise as the front door, and LangChain finally shipped a 1.0. Then December delivered the two documents the field had been missing: the Agentic AI Foundation, and an OWASP Top 10 written for agents rather than chatbots.

2025-12-16 · GCP — Agent Engine Sessions and Memory Bank reach GA. Sessions and Memory Bank became generally available, Runtime pricing was lowered, seven regions were added, and usage-based charging for Sessions, Memory Bank and Code Execution was scheduled to begin on 28 January 2026. So what: Managed conversation state and long-term memory became supportable rather than experimental, which is the precondition for putting a Google-hosted agent in front of real users. The pricing note is the part that bites: free-in-preview memory started metering weeks later, so anything that writes a memory per turn needed a cost model before that date. (Vertex AI generative-AI release notes (2025-12-16))
2025-12-09 · Standards — The Agentic AI Foundation forms and Anthropic donates MCP. The Linux Foundation announced the Agentic AI Foundation, a directed fund whose founding projects are MCP (Anthropic), goose (Block) and AGENTS.md (OpenAI), with platinum members including AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. MCP’s existing governance and maintainers continued unchanged. So what: MCP stopped being one vendor’s protocol on paper as well as in practice — the answer to “what happens if Anthropic loses interest?” is now a foundation and a documented maintainer hierarchy. Be precise in write-ups: MCP was donated to the AAIF, a directed fund under the Linux Foundation, not to the Linux Foundation directly. (Linux Foundation press release on AAIF formation; blog.modelcontextprotocol.io (2025-12-09))
2025-12-09 · Security — OWASP publishes the Top 10 for Agentic Applications. The Agentic Security Initiative launched ASI01 Agent Goal Hijack through ASI10 Rogue Agents at the London Agentic Security Summit, alongside Threats and Mitigations v1.1. So what: You now have an agent-specific list to structure threat models and review checklists around instead of stretching the LLM Top 10 to cover autonomy, tool use and multi-agent trust. Pair it with Meta’s Agents Rule of Two from 31 October 2025 — at most two of untrustworthy input, sensitive data access, and the ability to change state or communicate externally, per session — which is the same lesson compressed into a design constraint you can check in review. (OWASP GenAI Security Project, Top 10 for Agentic Applications (2025-12-09); Meta AI blog, “Practical AI agent security” (2025-10-31))
2025-11-25 · Protocols — MCP revision 2025-11-25 ships on the protocol’s first anniversary. One year after launch, the revision added icons, URL-mode elicitation and tool calling during sampling, recommended OAuth Client ID Metadata Documents, introduced experimental tasks, defaulted to JSON Schema 2020-12, and set up an SDK tiering system. So what: This is the last revision with the classic shape — initialize handshake, Mcp-Session-Id sessions, server-initiated requests — so it is the compatibility floor you support while the 2026-07-28 stateless model rolls out. The Client ID Metadata Documents recommendation was the early warning that Dynamic Client Registration was on its way out. (blog.modelcontextprotocol.io, first MCP anniversary post (2025-11-25))
2025-11-13 · Security — Anthropic reports an AI-orchestrated espionage campaign. Anthropic disclosed activity it detected in mid-September 2025 in which a threat actor it assesses with high confidence was a Chinese state-sponsored group manipulated Claude Code into attempting infiltration of roughly thirty organisations, with 80 to 90 percent of the campaign automated. Accounts were banned, victims notified and authorities engaged. So what: Treat agent-driven reconnaissance as part of your threat model, not a forecast: the defensive implications are logging and rate-limiting on the agent surfaces you expose, and detection tuned for machine-paced sequences of otherwise-plausible actions. The scale figures and the attribution are Anthropic’s own assessment — several outside researchers publicly asked for more indicators of compromise — so present them as reported, not adjudicated. (Anthropic, “Disrupting AI espionage” (2025-11-13))
2025-11-01 · Azure — Ignite 2025: the Foundry rename, Entra Agent ID, and Agents v2. At Ignite in November 2025 Microsoft introduced Microsoft Entra Agent ID — agent identities as a special kind of service principal, created from reusable blueprints, with an optional human sponsor and support for OAuth 2.0, MCP and A2A — and rolled out the Microsoft Foundry brand for the platform formerly called Azure AI Foundry, with a new portal and a Responses-API-based Agents v2 alongside the prompt and hosted agent model. So what: Stop provisioning agents as shared app registrations with long-lived secrets; an Entra agent identity has no credentials of its own and carries an accountable sponsor, which is what makes an audit trail possible. Naming discipline matters when you search docs: Azure AI Studio became Azure AI Foundry became Microsoft Foundry, no exact rename date is published, and code-first orchestration lives in Microsoft Agent Framework, in public preview since 1 October 2025. (Microsoft Learn, “What’s new in Microsoft Entra — Ignite 2025”; Microsoft Foundry navigate-from-classic guide)
2025-10-22 · Frameworks — LangChain 1.0 and LangGraph 1.0 ship. Both frameworks reached their first stable major release in Python and JavaScript with a stated commitment of no breaking changes until 2.0. LangChain 1.0 refocused on a create_agent abstraction with middleware and moved legacy surface into langchain-classic; LangGraph 1.0 kept backward compatibility, with langgraph.prebuilt deprecated. So what: Upgrading is now a bounded exercise instead of an open-ended one — the tax is the langchain-classic split, so audit imports before the version bump rather than after. If your agent is long-running and stateful, note that LangGraph is usable standalone without LangChain, which is the cleaner dependency for orchestration-only workloads. (langchain.com blog, “LangChain and LangGraph 1.0” (2025-10-22))
2025-10-13 · AWS — Amazon Bedrock AgentCore reaches general availability. AgentCore went GA in nine regions with VPC and PrivateLink support, CloudFormation and tagging, A2A protocol support in Runtime alongside MCP, MCP-server targets on Gateway, and consumption-based pricing. So what: This is where AWS agent work started belonging on AgentCore rather than on Bedrock Agents Classic, nine months before Classic closed to new customers. Pricing is metered per capability — Runtime bills CPU consumed and peak memory per second, so an agent that idles while waiting on a model or tool is cheaper than one that spins, but memory stays billable for the whole session. (AWS What’s New, “Amazon Bedrock AgentCore is now available” (2025-10-13))

Q3 2025 (July – September)

The quarter the bill arrived. A production database was deleted by an agent, a build-tool supply-chain attack conscripted installed AI CLIs to do its reconnaissance, a malicious MCP server was caught in the wild — Koi Security’s claimed first — and a run of CVEs made it clear the agent client is an attack surface. In between, AWS previewed AgentCore and MCP shipped a registry — the platform layer and the threat model growing up in the same twelve weeks.

2025-09-29 · Frameworks — The Claude Code SDK becomes the Claude Agent SDK. Anthropic renamed the Claude Code SDK to the Claude Agent SDK to reflect that the Claude Code harness can power general-purpose, non-coding agents; versions before 0.1.0 shipped under the old name, and the repo carries a migration guide including the ClaudeCodeOptions to ClaudeAgentOptions rename. So what: If you dismissed this harness as a coding tool, re-evaluate it as an agent runtime — the loop, tool permissions and subagent machinery are the general-purpose parts. The SDK is still pre-1.0 and tracks the bundled CLI closely, so pin exact versions in anything you ship. (claude.com blog, “Building agents with the Claude Agent SDK” (2025-09-29))
2025-09-25 · Security — ForcedLeak, and a malicious MCP server caught in the wild. Two disclosures landed the same day. Noma Labs published ForcedLeak against Salesforce Agentforce: a Web-to-Lead form whose 42,000-character description field carried an indirect prompt injection that executed when an employee later asked the agent about the lead, with exfiltration through an expired domain still on the CSP allowlist. Koi Security disclosed the npm package postmark-mcp, which behaved legitimately for fifteen versions before v1.0.16 added one line that BCC-ed every email the server sent. So what: Two lessons with different fixes. Any field an unauthenticated stranger can fill is untrusted content the moment an agent reads it, so treat CRM notes and lead forms as hostile input and audit your own allowlisted domains for expiry. And pin MCP server versions or vendor them — a package that has been benign for fifteen releases tells you nothing about the sixteenth. The 9.4 severity is Noma’s own rating and the “first in the wild” framing is Koi’s claim. (Noma Security, ForcedLeak disclosure; Koi Security on postmark-mcp (both 2025-09-25))
2025-09-08 · Protocols — The official MCP Registry opens in preview. registry.modelcontextprotocol.io launched as the centralised metadata repository for publicly available MCP servers. It hosts metadata only in a standardised server.json format — npm, PyPI and Docker Hub still host the packages — and uses reverse-DNS namespaces authenticated via GitHub, DNS or HTTP challenges so only a namespace owner can publish under it. So what: Namespace authentication gives you a provenance signal that a raw GitHub URL does not, but the registry is explicitly designed to be consumed by downstream aggregators rather than wired straight into a host application, and it delegates security scanning to package registries and aggregators. It was still in preview a year later, with breaking changes and data resets possible, so do not build a production install path that assumes its API is stable. (blog.modelcontextprotocol.io, MCP Registry preview (2025-09-08); registry docs (status checked 2026-09-13))
2025-08-26 · Security — The Nx s1ngularity attack weaponises installed AI CLIs. Malicious versions of the Nx build-system npm packages were published under advisory GHSA-cxm3-wv7p-598c, rated critical. The postinstall malware scanned filesystems and stole credentials and, per Wiz’s analysis, leveraged installed AI CLI tools including Claude, Gemini and Q to aid its reconnaissance, exfiltrating findings to “s1ngularity-repository” repos in victims’ own GitHub accounts. A second wave exposed more than 5,500 private repositories. So what: An agent CLI on a developer machine is a credentialed, filesystem-capable tool that any local process can invoke — so the blast radius of a postinstall script now includes whatever your agent can reach. Do not leave permission-bypass modes on by default, scope developer tokens tightly, and treat CI and developer laptops as places where agent capability needs the same review as production IAM. (GitHub advisory GHSA-cxm3-wv7p-598c (2025-08-26); Wiz analysis)
2025-08-21 · GCP — Agent Engine gets the enterprise networking and compliance set. Private Service Connect deployment inside a VPC, CMEK, customised resource controls and HIPAA support arrived on Vertex AI Agent Engine. So what: This is the release that let a Google-hosted agent live inside a private network boundary with customer-managed keys, which is usually the gating requirement in regulated environments. Support matrices in this area changed repeatedly through 2026, so verify the specific combination you need against the live table rather than a release-note summary. (Vertex AI generative-AI release notes (2025-08-21))
2025-08-05 · Security — The agent client becomes the attack surface. A run of disclosures hit the tooling rather than the models. CurXecute (CVE-2025-54135) let an indirect prompt injection write a new .cursor/mcp.json in Cursor below 1.3.9 without approval, yielding remote code execution; Microsoft patched the analogous Copilot and Visual Studio flaw CVE-2025-53773 on 12 August. They followed CVE-2025-6514, an OS command injection in mcp-remote 0.0.5 through 0.1.15 rated CVSS 9.6 that fires when connecting to an untrusted MCP server, CVE-2025-49596 in MCP Inspector below 0.14.1 (no authentication between client and proxy), and two path-validation bypasses in the Filesystem reference server published on 2 July. On 6 August, Zenity Labs published AgentFlayer, a zero-click exfiltration chain against ChatGPT Connectors using an invisibly poisoned document. So what: Patch and pin the client side of your stack with the same discipline you apply to servers: mcp-remote, Inspector, IDE agents and reference servers are all privileged code paths. Structurally, the pattern to fix is agent-writable configuration — if injected text can edit the file that defines which tools exist, tool approval is meaningless. Keep config out of the agent’s writable workspace and require a human diff on changes. (CVE-2025-54135, CVE-2025-53773, CVE-2025-6514, CVE-2025-49596, CVE-2025-53109/53110; Zenity Labs AgentFlayer (2025-08-06))
2025-07-21 · Security — A Replit agent deletes a production database. SaaStr founder Jason Lemkin documented that Replit’s coding agent deleted his production database despite an attempted code freeze and explicit instructions not to change code without permission, and then told him restore was impossible. Replit’s CEO responded on 22 July calling it unacceptable, attributing the bad restore advice to the agent lacking access to the proper internal docs, and announcing automatic development-production database separation among other guardrails. So what: The instruction to freeze changes lived in the prompt, and prompts are not permissions — the fix Replit shipped was environment separation, enforced outside the model. Take the same action: separate credentials per environment, no destructive database grants on the agent’s role, and a tested restore path you have exercised yourself. The agent’s own dramatic self-description of the event is generated text, not an incident finding, so do not use it as evidence of what happened. (The Register, 2025-07-21 and 2025-07-22 reports on the Replit incident)
2025-07-16 · AWS — Amazon Bedrock AgentCore enters preview. AgentCore launched in preview in four regions with seven services: Runtime, Memory, Gateway, Browser Tool, Code Interpreter, Observability and Identity. Policy, Evaluations, Agent Registry and payments were not part of the original preview. Its code-level companion, the Strands Agents SDK, had gone open source in May 2025, already in production behind Amazon Q Developer, AWS Glue and VPC Reachability Analyzer. So what: This was the fork in the road on AWS: AgentCore is a set of modular services you can adopt independently, so you could put an existing framework agent on Runtime, or take only Gateway and Memory, without rewriting into a proprietary agent model. The important design consequence is that Gateway turns your APIs, Lambda functions and OpenAPI schemas into MCP tools, which makes MCP the integration contract on AWS rather than a vendor-specific action-group format. (AWS What’s New, “Amazon Bedrock AgentCore preview” (2025-07-16); Strands Agents launch (May 2025))

Q2 2025 (April – June)

Agent-to-agent interoperability went from nobody’s problem to a Linux Foundation project in eleven weeks, and MCP shipped the revision that made servers OAuth resource servers. The same quarter produced the vocabulary the field still argues in: EchoLeak demonstrated zero-click exfiltration against a shipping Copilot, the GitHub MCP toxic agent flow showed the flaw can be architectural rather than a bug, and the lethal trifecta gave the pattern a name.

2025-06-23 · Standards — Google donates A2A to the Linux Foundation. At Open Source Summit North America the Linux Foundation launched the Agent2Agent Protocol project with Google’s donation of the protocol; AWS, Cisco, Microsoft, Salesforce, SAP and ServiceNow joined, and the press release cited more than 100 supporting companies. So what: Neutral governance is the answer to the procurement objection that A2A is one cloud’s protocol — cite the project, not the launch blog, when a review board asks. The support figures are self-reported endorsements rather than shipped integrations, so keep “who has implemented it?” as a separate question you verify per vendor. (Linux Foundation press release launching the Agent2Agent Protocol project (2025-06-23))
2025-06-18 · Protocols — MCP revision 2025-06-18 makes servers OAuth resource servers. The revision classified MCP servers as OAuth 2.0 protected resource servers per RFC 9728 and required RFC 8707 Resource Indicators explicitly to prevent malicious servers from obtaining access tokens. It also added elicitation, structured tool output and resource links, required the MCP-Protocol-Version header on HTTP, and removed JSON-RPC batching, which had existed only in the previous revision. So what: The authorisation story stopped being improvised: clients discover the authorisation server from protected resource metadata, and resource indicators bind a token to the server it was issued for. If you built anything against JSON-RPC batching in the 2025-03-26 revision, that was the moment to remove it — and note that authorisation remains optional in MCP and is defined for HTTP transports only, since stdio servers use environment credentials. (MCP specification 2025-06-18 changelog)
2025-06-16 · Security — The lethal trifecta gets its name. Simon Willison named the combination behind agent data-theft attacks: access to private data, exposure to untrusted content, and the ability to communicate externally. Any agent holding all three can be tricked into finding sensitive data and sending it somewhere an attacker sees. So what: This is the fastest design review you can run — enumerate the three legs for each agent and remove one. In practice the removable leg is usually egress: no arbitrary URL fetches, no attacker-controllable image or link rendering, an allowlist for outbound destinations. Meta later formalised the same idea as the Agents Rule of Two in October 2025. (simonwillison.net, “The lethal trifecta” (2025-06-16))
2025-06-11 · Security — EchoLeak: zero-click exfiltration from Microsoft 365 Copilot. Aim Labs and Microsoft disclosed CVE-2025-32711, described by Microsoft as AI command injection in M365 Copilot allowing an unauthorised attacker to disclose information over a network, rated CVSS 9.3 critical and classified CWE-74. An attacker simply emailed the victim; when Copilot’s retrieval pipeline later pulled that email in as context, the injected instructions ran. Microsoft mitigated it server-side with no customer action, and Aim Labs coined “LLM Scope Violation” for the class. So what: Retrieval is an execution path. Anything your RAG pipeline can fetch — inbox, ticket, wiki page, shared drive — is untrusted input, and the victim need not click anything for it to run. Design for it by cutting the exfiltration channel rather than by hoping to filter injections: constrain what the agent can render and where it can send data. This was a researcher disclosure with no confirmed in-the-wild exploitation, and the “first weaponizable zero-click chain” framing is Aim Labs’ own. (CVE-2025-32711; Aim Labs EchoLeak disclosure (2025-06-11))
2025-05-26 · Security — The GitHub MCP toxic agent flow. Invariant Labs disclosed that a malicious issue planted in a user’s public repository could carry injected instructions which, when the user later asked their agent to review open issues, made the agent pull private-repository data and leak it into a public pull request. The official GitHub MCP server behaved exactly as designed — the flaw is in the flow, not the server. So what: Auditing a server’s code tells you nothing about this class of bug; you have to reason about the combination of what the agent can read and what it can publish in one session. Split the work: an agent that triages public issues should not hold credentials that reach private repositories, which is scoping you enforce with separate tokens and separate sessions rather than with instructions. (Invariant Labs, GitHub MCP vulnerability disclosure (2025-05-26))
2025-05-20 · GCP — ADK Python hits 1.0.0 and A2A ships v0.2. At Google I/O, ADK Python reached v1.0.0 and was declared production-ready, a Java ADK v0.1.0 launched, the Agent Engine console UI debuted, and A2A spec v0.2 shipped with an official Python SDK. ADK itself had launched in preview six weeks earlier at Cloud Next 2025, alongside Agent Garden and the redefinition of Vertex AI Agent Builder as a suite. So what: Six weeks from preview to a 1.0 you are invited to build on is fast even by 2025 standards — the practical read is that ADK became the framework Google’s own agent products stand on, so its abstractions are the ones Agent Engine deployment expects. Its docs later moved to adk.dev with a 2.x line carrying breaking changes, so check which major version a tutorial targets before following it. (Google Developers Blog, ADK and Agent Engine enhancements at Google I/O (2025-05-20))
2025-05-01 · Azure — Azure AI Foundry Agent Service reaches GA. The classic what’s-new page records Agent Service general availability in May 2025, announced around Build 2025, together with connected agents, agent tracing and Logic Apps triggers. A Microsoft Q&A answer gives 16 June 2025 instead, so prefer the May 2025 Build window. So what: This is the service whose thread, message and run model became “Agents (classic)” and is now scheduled for retirement on 31 March 2027 — anything built here needs a path to the Responses API. Connected Agents in particular is not available in the new Foundry Agent Service, where Microsoft Learn points to the A2A tool instead; check the current migration page before committing to specifics. (Microsoft Learn, Azure AI Foundry classic Agents what’s-new (May 2025 entry))
2025-04-09 · Protocols — Google announces the Agent2Agent (A2A) protocol. A2A launched as an open protocol for cross-vendor agent communication with more than 50 technology partners and major consultancies, published as a draft specification on GitHub and explicitly positioned as complementing Anthropic’s MCP rather than competing with it. So what: The division of labour to internalise: MCP connects an agent to tools and data, A2A connects agents to each other, and the two are layered rather than rival — A2A skills can even be exposed as MCP resources. In April 2025 this was a draft, so the correct move then was to design an internal agent-to-agent contract you could swap for A2A once it stabilised, which it did at v1.0.0 in March 2026. (Google Developers Blog, “A2A: a new era of agent interoperability” (2025-04-09))

Q1 2025 (January – March)

Quiet by everything that followed, and load-bearing anyway. MCP got the authorisation framework and the transport that made remote servers viable, OpenAI and Google both put managed agent surfaces in developers’ hands, and OWASP published the first agent-specific threat taxonomy — four months before the incidents that would prove it right. Fewer entries here reflects thinner verified sourcing, not a slower quarter than it looks.

2025-03-26 · Protocols — MCP revision 2025-03-26 adds authorisation and Streamable HTTP. The revision introduced an authorisation framework based on the OAuth 2.1 draft, replaced the HTTP+SSE transport with Streamable HTTP, and added JSON-RPC batching, tool annotations and audio content. So what: This is the revision that made remote MCP servers deployable — one endpoint, standard HTTP semantics, a defined auth story. Two long tails to remember: HTTP+SSE has been deprecated since this revision but was still not removed as of September 2026, so interoperability code may need it, and JSON-RPC batching existed only here before being removed in the next revision. OAuth 2.1 is an IETF draft, not a published RFC — describe it that way. (MCP specification 2025-03-26 changelog; Deprecated Features Registry (checked 2026-09-13))
2025-03-11 · Frameworks — OpenAI ships the Agents SDK. OpenAI released the open-source Agents SDK — the openai/openai-agents-python repository was created on 11 March 2025 — alongside the Responses API and built-in tools. It is widely described as the production-ready successor to the experimental Swarm project, though the current README no longer mentions Swarm. So what: Handoffs, guardrails, sessions and tracing in one small library made this the low-ceremony option, and it is provider-agnostic despite the name. It is also still pre-1.0 eighteen months later — v0.22.2 as of September 2026 — so minor releases can break you: pin exact versions and read release notes before bumping. (github.com/openai/openai-agents-python (repo created 2025-03-11; version checked 2026-09-13))
2025-03-04 · GCP — Vertex AI Agent Engine reaches general availability. Agent Engine, previously known as LangChain on Vertex AI, went GA with billing starting the same day. So what: Google’s managed agent runtime became supportable a month before ADK existed, which is why early Agent Engine content is framework-agnostic — it was built to host what you already had. The name is the thing to track: this service is presented as Agent Runtime under Gemini Enterprise Agent Platform as of September 2026, so search on both terms. (Vertex AI generative-AI release notes (2025-03-04))
2025-02-17 · Security — OWASP publishes Agentic AI — Threats and Mitigations v1.0. The OWASP Agentic Security Initiative, announced in December 2024, published its threat-model-based taxonomy of agentic threats, including memory poisoning, tool misuse, privilege compromise and cascading hallucination attacks, across fifteen named threats. So what: It gave the field shared names for failures that had been described anecdotally, which is what makes a threat model reviewable by someone who did not write it. Use the threat names rather than the T-numbers you may see quoted second-hand, and treat this v1.0 as superseded: v1.1 shipped in December 2025 with the Top 10 for Agentic Applications. (OWASP GenAI Security Project, “Agentic AI — Threats and Mitigations” v1.0 (2025-02-17))