Adoption reality, as of September 2026

Myth: “150+ organisations back it, so it must be in production everywhere”

The 150+ figure comes from the A2A project’s own August 2026 announcement — self-reported backing, not audited deployments. The same post names native support from Google Cloud, AWS Bedrock AgentCore Runtime, and Microsoft Azure AI Foundry, and adoption by ServiceNow, Salesforce, Atlassian, and SAP. Useful signal about momentum; not evidence that the specific integration you need is generally available.

Myth: “Preview is just a label — everyone runs previews in production”

Microsoft’s wording is specific: provided without an SLA and not recommended for production workloads. That is a supportability statement you inherit. It does not forbid a pilot — it means your rollback plan, your error budget, and your customer commitments cannot lean on it. Pilot behind a gate, keep the non-A2A path warm.

Myth: “My framework lists A2A support, so I can talk to any A2A agent”

Version, binding, modality, and optional capabilities all have to line up. A2A 1.0 defines three bindings and requires them to be functionally equivalent to the canonical proto model — but agents in the wild advertise different subsets: Microsoft Foundry’s incoming A2A endpoint supports only JSON-RPC on 1.0 (Microsoft Learn, checked September 2026). Streaming and push notifications are per-agent capability flags on top of that. “Supports A2A” is the beginning of a compatibility conversation, not the end of one.

Fact: A2A support in Microsoft’s framework line

Microsoft has publicly said Semantic Kernel speaks A2A (attributed on the A2A community page to a post by Microsoft AI platform product head Asha Sharma), and the successor Microsoft Agent Framework appears on the community page’s list of frameworks with built-in A2A integration. Treat the Semantic Kernel detail as likely rather than verified here — the primary Microsoft announcement was not fetched for this module, so check Microsoft’s own docs before you cite it.

How fast this moved — A2A in the protocol lane

• 2023-03-23 — ChatGPT plugins connect a model to third-party APIs:

  An OpenAPI manifest plus a natural-language description was all it took to hand a model somebody else’s API. Plugins proved the demand for tool integration and exposed the two problems a real protocol has to solve: discovery, and what happens when the tool’s output is hostile.

• 2023-06-13 — OpenAI ships function calling:

  Models return structured requests to call functions you declared as JSON Schema. Tool use stops being a prompt-parsing hack and becomes an API contract — the single enabling primitive for production agents, and the reason tool calling belongs to the platform rather than to your prompt.

• 2023-08-01 — OWASP publishes the first LLM Top 10:

  The first edition of the Top 10 for LLM Applications gave security teams shared names for these risks, with prompt injection at number one — where it stayed through the 2025 edition (the 2026 edition’s ordering is not confirmed here; read the document). It is where LLM security stopped being folklore and started being reviewable.

• 2024-11-05 — MCP specification revision 2024-11-05:

  The first protocol revision: the initialize handshake, stdio and HTTP+SSE transports, and the three primitives — tools, resources, prompts. It is now marked Final, and everything later in the MCP story is a revision to this shape.

• 2024-11-18 — OWASP Top 10 for LLM Applications, 2025 edition:

  The list that made LLM01 Prompt Injection the industry’s default first risk, running through LLM10 Unbounded Consumption. It is written for LLM applications rather than agents — the agentic list arrives a year later — but it is still the baseline vocabulary in security reviews.

• 2024-11-25 — Anthropic open-sources the Model Context Protocol:

  Spec, SDKs, local server support in Claude Desktop, and a repository of pre-built servers (Google Drive, Slack, GitHub, Git, Postgres, Puppeteer) shipped together, with Block, Apollo, Zed, Replit, Codeium, and Sourcegraph named as early adopters. Write the integration once, and any compliant client can use it — the reason the industry converged on it within a year.

• 2025-02-17 — OWASP publishes Agentic AI — Threats and Mitigations v1.0:

  The Agentic Security Initiative, launched on 15 December 2024, produced the first threat-model taxonomy aimed at agents rather than chatbots: memory poisoning, tool misuse, privilege compromise, cascading hallucination attacks, and eleven more. It is the vocabulary your threat model should borrow.

• 2025-03-26 — MCP 2025-03-26: OAuth authorization and Streamable HTTP:

  The revision that made MCP deployable over the network: an authorization framework built on OAuth 2.1 (still an IETF draft, not a published RFC), Streamable HTTP replacing HTTP+SSE, plus tool annotations and audio content. HTTP+SSE is deprecated from here — deprecated, not removed.

• 2025-04-09 — Google announces the Agent2Agent protocol:

  A2A launched at Cloud Next ’25 as a draft spec for agent-to-agent communication — agent cards for discovery, tasks for delegation — with 50-plus partners endorsing it and an explicit framing as complementary to MCP, not a competitor to it. Treat the partner count as endorsement, not shipped integrations.

• 2025-06-18 — MCP 2025-06-18: elicitation, structured output, resource-server model:

  JSON-RPC batching came out; elicitation (the server asking the user for input mid-call), structured tool output, and resource links went in. Security-wise this is the important one: MCP servers are classified as OAuth resource servers (RFC 9728) and must honour Resource Indicators (RFC 8707), which is what stops a token issued for one server being replayed at another.

• 2025-06-23 — Google donates A2A to the Linux Foundation:

  The Agent2Agent Protocol project launched at Open Source Summit North America with AWS, Cisco, Microsoft, Salesforce, SAP, and ServiceNow joining — a protocol owned by one cloud is not a standard anyone else builds on. The IBM-originated Agent Communication Protocol later folded into A2A rather than competing with it.

• 2025-07-28 — OWASP Securing Agentic Applications Guide 1.0:

  The build-side companion to the threat taxonomy: concrete guidance for the people shipping agents rather than the people reviewing them. Pair it with the Multi-Agentic System Threat Modeling Guide published on 24 April 2025 when your design has more than one agent in it.

• 2025-07-30 — A2A specification v0.3.0:

  The last major pre-1.0 release, widening A2A beyond its original JSON-RPC-and-SSE design toward the gRPC and HTTP+JSON bindings that become normative in v1.0. Anything you built against a 0.x revision needs a version check before you call it interoperable.

• 2025-07-31 — MCP publishes a formal governance model:

  “Building to Last” introduced a maintainer hierarchy and a SEP proposal process — the machinery a protocol needs before competitors will commit engineering to it. Governance is why MCP revisions arrive on a schedule instead of by announcement.

• 2025-09-08 — The official MCP Registry opens in preview:

  A central metadata repository for public MCP servers — the discovery layer the ecosystem had been faking with README lists. As of September 2026 it is still preview, and the project warns that breaking changes or data resets may occur, so do not build a production dependency on its API shape.

• 2025-11-25 — MCP 2025-11-25 lands on the protocol’s first anniversary:

  Icons, URL-mode elicitation, tool calling during sampling, Client ID Metadata Documents, experimental tasks, JSON Schema 2020-12 as the default dialect, and an SDK tiering system. One year, four revisions — treat the revision string in your client as a compatibility fact, not a footnote.

• 2025-12-09 — The Agentic AI Foundation forms; Anthropic donates MCP:

  AAIF launched as a directed fund under the Linux Foundation with founding projects MCP, goose, and AGENTS.md, and platinum members including AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI. MCP’s maintainers and governance carried on unchanged — the donation transfers the trademark and neutrality, not the roadmap.

• 2025-12-09 — OWASP Top 10 for Agentic Applications:

  ASI01 Agent Goal Hijack through ASI10 Rogue Agents — a list whose failure modes are behavioural rather than input-validation bugs, launched at the London Agentic Security Summit with Threats and Mitigations v1.1. Do not confuse it with the community “AAI”-numbered lists circulating on GitHub.

• 2026-03-12 — A2A specification v1.0.0:

  The first stable major: three normative bindings (JSON-RPC, gRPC, HTTP+JSON), the proto file as the single source of truth, and A2A-Version header negotiation. v1.0.1 followed on 28 May 2026. Adoption still lags the spec — as of September 2026 Microsoft Foundry’s A2A features are public preview and Google ADK marks A2A support experimental.

• 2026-07-28 — MCP 2026-07-28: the protocol goes stateless:

  The current revision removes the initialize handshake and protocol-level sessions, adds server/discover, replaces server-initiated requests with MRTR, and introduces subscriptions/listen. Roots, sampling, logging, and Dynamic Client Registration are deprecated — deprecated, with removal no earlier than 28 July 2027. A release candidate had been published on 21 May 2026.

• 2026-08-03 — OWASP GenAI LLM Top 10, 2026 edition:

  The LLM list was refreshed with incident-grounded research and new rankings, formally announced on 1 September 2026 together with the donation of an Agent Control Standard to OWASP. Check the document itself for the current ordering rather than trusting summaries of it, including this one.

• 2026-08-27 — A2A joins the Agentic AI Foundation:

  A2A was accepted as a Growth Stage project in AAIF, putting it under the same neutral roof as MCP, goose, and AGENTS.md. The two halves of the agent protocol stack now share governance — the announcement claims 150-plus supporting organisations, which is endorsement rather than deployment.

• 2026-09-01 — OpenTelemetry’s GenAI conventions are still “Development”:

  The gen-ai span, agent, and framework conventions moved to a dedicated repo (open-telemetry/semantic-conventions-genai) covering spans, metrics, events, MCP, and provider specifics — and every document still carries Status: Development, with no tagged release. Instrument with them, but expect attribute names to shift; checked 13 September 2026.