Agentic AI Foundation adds four projects, consolidating the agent infrastructure stack

Four new projects bring the foundation to ten

On October 22, 2026, the Agentic AI Foundation (AAIF) accepted four projects at once: Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face and OpenSandbox from Alibaba. According to an analysis on dev.to, the Linux Foundation-backed organization launched on December 9, 2025 with three founding projects — MCP, goose and AGENTS.md — and has grown to ten hosted projects, counting more than 250 members as of August 2026.

Together the portfolio covers nearly every layer of an agent deployment: MCP for tool and data access, A2A for agent-to-agent communication, Open Responses as a model interface, AGENTS.md and Agent Skills as formats that carry instructions, agentgateway and Agent Router as traffic control planes, goose as a runtime, and OpenEnv and OpenSandbox for evaluation and isolation.

Two protocols anchor the stack

MCP and A2A play complementary roles. MCP links an agent to non-agent systems such as databases, file systems and internal APIs, while A2A lets one agent delegate work to another — potentially run by a different company on a different model, using Agent Cards for discovery plus defined task and result exchange. A2A reached a stable v1.0 specification in March 2026 and became a Growth Stage AAIF project on August 17, 2026; the dev.to post reports more than 150 supporting organizations and production use in supply chains, financial services and mobile platforms. Shared governance does not merge the two specifications, which remain independent.

An official A2A CLI followed on October 1, 2026, built for scripts, CI pipelines and coding agents, with a test-only server mode that wraps any stdin/stdout program.

Consolidation without a security floor

The sharpest caveat comes from the Cloud Security Alliance (CSA). In an October 29, 2026 analysis cited by the dev.to piece, the CSA argues the AAIF solves governance, not security: the project list carries no maturity or security labels, and unlike the CNCF — where graduation requires an external security review — the foundation has no published baseline of mandatory threat models, uniform disclosure processes or third-party audits covering every project.

The CSA also flags a quiet migration hazard. An MCP revision dated July 28, 2026 removed protocol-level sessions, including the Mcp-Session-Id header. Tooling that correlates activity via session IDs, or applies policy during the initialization handshake, can lose visibility without reporting an error; the new attachment points are the Mcp-Method and Mcp-Name headers plus OpenTelemetry trace propagation.

Skills and instructions form an unverified supply chain

A2A v1.0 introduced signed Agent Cards, letting identity and advertised capabilities be verified cryptographically. The instruction formats have no equivalent: Agent Skills mandates name and description fields and offers an experimental allowed-tools field, but nothing for signatures, hashes, publisher identity or provenance, and AGENTS.md is deliberately lighter still.

The figures the post cites are blunt. A Snyk study from February 2026 examined 3,984 skills from public marketplaces: 534 (13.4 percent) had at least one critical issue, 1,467 (36.8 percent) at least one security issue, and 76 malicious payloads were manually confirmed. An OX Security analysis of 15,465 MCP servers found no consistent authorization model and no uniform lifecycle ownership.

Gateways concentrate the blast radius

Two of the ten projects are gateways. agentgateway routes LLM traffic through an OpenAI-compatible API, supports MCP tool servers and A2A, and enforces JWT, API-key and MCP authentication plus role-based authorization written in CEL. Agent Router, derived from the Envoy AI Gateway and moved into the AAIF on September 10, 2026, connects applications to models and MCP tools while managing backend credentials through its own policy resources. A component that terminates MCP, A2A and model traffic simultaneously concentrates risk, since one parsing bug or credential leak there touches every protocol — and coordinated cross-project vulnerability handling at foundation level is, per the post, not publicly documented.

Why it matters

The consolidation is strategically significant: it hands architecture teams a neutral steward for the agent stack and weakens vendors' ability to lock customers in through proprietary connectors. But ten artifacts with separate maintainers, release cycles and security histories under one roof is not, by itself, a security promise. The dev.to analysis frames the coming months around two questions: whether Agent Skills gains signature and provenance checks comparable to signed Agent Cards, and whether the foundation introduces a baseline of threat models, disclosure processes and conformance tests. Until then, adopting teams should inventory which of the ten components they run — including indirectly through vendor products — treat skills and AGENTS.md files as code that is reviewed, allowlisted and scanned, patch their policy gateway, reject unsigned Agent Cards from external parties, and shift monitoring to headers and trace context rather than session IDs.