AGNTCon + MCPCon 2026: Building The Open And Secure Internet Of Agents

San Jose has a long history of connecting technologies in unexpected ways. The first Chuck E. Cheese opened there in 1977, combining pizza, arcade games, and singing animatronic animals under one roof. The official history calls it the first family entertainment center to bring all three together.

It turned out to be a very effective system. The games gave families a reason to stay, the pizza gave them a reason to gather, and the giant singing mouse made the whole experience hard to forget.

Nearly 50 years later, more than 3,500 people came to San Jose for AGNTCon + MCPCon North America 2026. Across two days and more than 150 talks, the community explored another connected system: an open internet of AI agents.

The technical pieces are coming together quickly. Model Context Protocol, or MCP, connects agents to tools and data. OAuth grants access. Skills teach agents how to complete specialized work. Yet connection alone does not create trust. Agents also need durable identities, enforceable permissions, reliable context, and software supply chain controls.

Angie Jones opened the event on behalf of the Agentic AI Foundation with a call to build this internet of agents in the open. Here are just a few highlights from two packed days.

Keeping The Agentic Internet Open

One of the event's biggest questions appeared in the title of the opening keynote. Manik Surtani, CTO and co-founder of the Agentic AI Foundation, asked “Who Keeps It Open?”

Goose began inside Block, while MCP began inside Anthropic. Both grew far beyond their original companies. An open source license made the code available, but the founding companies still controlled important pieces such as trademarks and roadmaps.

That matters when the technology becomes shared infrastructure. Organizations need confidence that one competitor cannot suddenly redirect the project or close off a critical piece. The Agentic AI Foundation provides a neutral home where competing organizations can work on the common plumbing. At the time of the event, it had 305 members, ten projects, and eight working groups.

“Neutral governance makes open permanent.”

Agentic commerce makes the stakes especially clear. Agents will increasingly influence what gets purchased, where it comes from, and which service handles the transaction. Whoever controls the protocol can end up controlling a very valuable gate.

Open governance gives the community a way to build those rails together. Manik's call to action was straightforward: demand open systems, contribute to the commons, and build in the open.

MCP Is Growing Into Production Infrastructure

MCP gives AI applications a standard way to connect with external tools and data. David Soria Parra, co-creator of MCP and Member of Technical Staff at Anthropic, showed how quickly the protocol is moving beyond basic tool calls in “MCP and the Era of Connectivity.”

Production work rarely fits into one quick request and response. Some jobs continue for minutes, hours, or even days. MCP Tasks give long-running work a durable object that clients can check, while MCP Events let servers report progress. Elicitation gives the server a standard way to pause and ask a human for information or approval.

Anyone who has watched an agent confidently invent a missing value can appreciate the ability to make it stop and ask.

Skills are becoming part of this story as well. A server can expose a tool, while a skill explains the domain-specific process for using that tool correctly. Authorization can determine which skills a user receives after signing in. The connection then carries tools, knowledge, and policy together.

OAuth Meets A Lot More Clients

Connecting agents to services brings an old security question into a new environment: who is asking for access?

Aaron Parecki, Senior Director of Identity Standards at Okta, answered that question with a useful standards history lesson in “Evolution, not Revolution: How MCP is Reshaping OAuth.” Most of OAuth still works well for MCP. Client identification needed some attention.

Traditional OAuth applications receive a client ID when a developer registers them with a service. MCP clients can meet a server for the first time in production. Dynamic Client Registration, or DCR, initially solved this by letting each client register itself, but it could leave an authorization server managing thousands of records for what was really one application.

Client ID Metadata Documents, or CIMD, offer a more stable option. The client ID becomes a URL containing public information about the application, its operator, and its approved redirect addresses. MCP gave this older idea an urgent use case.

Of course, fetching metadata from a URL creates its own risks. Servers still need defenses against server-side request forgery, or SSRF, along with clear rules for localhost, redirects, and domains that change ownership. Every convenient new connection still needs a threat model.

Identity Must Survive Every Hop

Den Delimarsky, Member of Technical Staff at Anthropic and Lead Maintainer of MCP, reported 4.17 billion downloads since the reference servers and specification first appeared. A mistake at that scale can travel very far, very fast.

The maintainers are coordinating guidance across SDKs and languages, with a two-day target for triaging critical reports and seven days for fixing them. Conformance tests help turn the specification into a contract every implementation can verify.

Demonstrating Proof of Possession, or DPoP, binds a token to cryptographic material held by the intended client. A stolen token becomes far less useful when the attacker also needs the matching key. Workload Identity Federation replaces long-lived credentials with short-lived identities from the runtime. Workload Authorization Grants can preserve the identity of an individual agent as a request moves through a platform and into an MCP server.

That provides an answer shared service accounts often hide: which agent performed the action?

The Model Proposes; Policy Decides

Open standards and durable identities establish who is involved. The next challenge is controlling what an agent can actually do.

Dawn Song, Professor of Computer Science at UC Berkeley, presented research on the rapidly improving ability of AI systems to find and exploit vulnerabilities in “Towards Building Safe & Secure Agentic AI.”

CyberGym measures how well AI systems find vulnerabilities in large open source projects. ExploitGym examines autonomous exploitation. Together, the projects show that AI-driven attacks are becoming a practical security challenge.

The same models can also help defenders generate formal proofs, verify software properties, and improve detections. The larger lesson is that probabilistic systems become much safer when deterministic controls can independently check their work. High-risk interactions are the natural place to start, especially where an agent can move money, expose sensitive data, or affect physical systems.

Uchi Uchibeke, founder and CEO of APort, showed this approach in action. His team invited 1,149 people to attack agents in a public capture-the-flag exercise, producing 4,371 human-written attacks and 225,964 completed evaluations across 14 models.

Attackers repeatedly convinced models operating under permissive policies to propose prohibited actions. A restrictive policy blocked every payment attack across 879 attempts. The agent could suggest an action, but an independent authorization check decided whether it could execute.

The model proposes. Policy decides.

Prompts provide instructions. Sandboxes limit which resources an agent can reach. Authorization checks whether a specific action is allowed right now. Post-action checks preserve evidence for detection and investigation. Each layer creates another opportunity to prevent or contain a bad outcome.

Regulated industries also need evidence explaining why an action was allowed. Lucas Beeler, Senior Solutions Architect at Aerospike, presented an architecture for producing that evidence in “Beyond LLMs in a Loop: Building Trusted Agents in Regulated Industries.”

In this model, the LLM translates human intent into a declarative plan. Other systems gather evidence about the environment and applicable rules. Automated reasoning checks whether the plan is internally consistent and agrees with the organization's defined universe.

If policy sets the maximum permitted exposure at $80 million, a plan proposing $92 million fails before execution. A human reviewer then sees the plan and the evidence supporting it. The model explains; policy enforces; the reviewer decides.

Agent Supply Chains Need Continuous Trust

Software supply chain security already asks where a package came from and whether anyone changed it. Agents add a new wrinkle: a tool's instructions and behavior can change after a user approves it.

Charit Upadhyay, Senior Site Reliability Engineer at Adobe, demonstrated this problem in “MCP Rug Pulls in the Wild: Live Attacks and How to Stop Them.”

Charit demonstrated an MCP package that behaved safely for 15 versions and gained thousands of users. A later patch added three malicious lines telling the agent to exfiltrate inbox data and hide the activity. The tool name and schema stayed the same, so the original approval still appeared valid.

His proposed defenses include signing tool definitions, detecting changes, and monitoring runtime behavior. Package signatures identify the publisher. Definition integrity verifies that the tool still represents what the user approved. A changed definition should trigger a new review.

Agent skills create a related risk. Liran Tal, Head of Developer Relations and Community at Snyk, showed how a skill file can turn an agent into a confused deputy in “Your AI Agent Installed Malware Because a SKILL.md Told It To.”

A skill might look like a harmless Markdown document, but its instructions can download files, install dependencies, run commands, and contact external servers. The user trusts the agent. The agent trusts the skill. A malicious instruction can exploit that chain to reach the user's machine and credentials.

Liran's threat model covers data at rest, resource access, execution context, toxic data flows, and trust boundaries. Behavioral analysis can help reveal what a skill is trying to accomplish, including malicious actions hidden behind plausible setup steps.

Michael R. Larson, Senior Applied AI Software Engineer at Christensen Solutions, followed with a practical process for “Shipping Agent Skills Safely: CI/CD, Evals, and Guardrails.” His guidance will sound familiar to anyone who has built a software delivery pipeline: version the skill, evaluate it, review it, and release it.

Start with five to ten representative tasks and known failure modes. Add deterministic assertions. Test adversarial input and portability across agent platforms. Run the evaluation again whenever the skill or model changes. Skills are software for agents, and established software supply chain practices provide a strong starting point for making them safer.

Agents Still Need The Right Context

An agent can access the right systems and still produce the wrong answer when it lacks business context. Amit Naik, Vice President of AI Architecture at CData, demonstrated this problem in “Stop Making Agents Guess: Engineering Context at the Gateway.”

He asked three agents, “What enterprise revenue is at risk this quarter?” Sales operations answered $6.8 million. Finance said $2.1 million. Customer success returned $4.9 million. All three responded confidently because each system understood revenue risk differently.

Enterprise context includes where contracts live, how accounts connect to support tickets, what “risk” means, and even when the quarter begins. People absorb this knowledge over time. Agents need a reliable way to retrieve it.

A context engine at the gateway can give authorized agents the same approved definitions and relationships. It can also provide only the knowledge needed for one precise call instead of loading an entire schema. Amit reported a 90 percent reduction in token use in the evaluated setup. More importantly, shared definitions help prevent three agents from confidently producing three incompatible answers.

Building A Trustworthy Internet Of Agents

Across all these talks, one lesson kept surfacing: the agentic future depends on more than smarter models.

Open protocols let tools and services work together. Neutral governance keeps shared infrastructure open. Durable identities show which agent is acting, even when a request crosses multiple systems. Deterministic authorization checks consequential actions before execution.

Tools and skills need signatures, evaluations, and continuous monitoring. Gateways need enough context to help agents understand the organizations they serve. Humans need clear points where they can approve, correct, or stop the work.

The good news is that none of these problems must be solved alone. Open source communities, standards bodies, researchers, vendors, and practitioners are already building the controls together. Community is an operational control, especially when the infrastructure affects everyone.

San Jose's first Chuck E. Cheese became memorable by connecting food, games, and entertainment into one coordinated experience. Nearly five decades later, agent builders gathered in the same city to connect models, tools, data, identity, and infrastructure. Pizza and animatronic mice are optional this time. Open standards and strong security controls are essential.