OpenANA2A-TAuthorization-Topen-sourcekey
On 30 August, a2a-t-sdk-java released v1.1.0, officially described as "additional APIs to assist with generating the four types of templates and validating them". Reading the repository resource tree confirms that templates and slot definitions for all four extensions — Task-T, Notification-T, Negotiation-T and Authorization-T — are in place, bilingual in Chinese and English. The first Authorization-T scenario is "authorization policy management for network-changing operations": operation types are limited to create, modify, delete and query; each authorization policy binds a business scenario, a handling type, a named network-changing operation (tunnel tuning, for example) and a validity period that can be set to permanent; deletion requires the policy identifier. On 3 September the Python side merged the 1.1.0 alignment (PR #50, including a twelve-method negotiation service, 234 bilingual test corpus units and an ErrorCatalog). Why this matters for the agent gateway: Authorization-T lands as a prompt template plus slot validation rather than a protocol field, so security semantics still depend on the endpoint enforcing them voluntarily — the gap for gateway- or network-element-side enforcement remains, and that is exactly where the agent gateway sits. Source: official release on GitHub project-openan (2026-08-30).
national-standardsGB/Z-185AIPidentity-codekey
On 31 August, a special session to promote the "Artificial Intelligence — Agent Interconnection" series of national standards was held in Zhangjiang, Shanghai, led by the China Electronics Standardization Institute (CESI). At the meeting: the agent identity-code node management platform officially went live; the AI subcommittee of the national standards body issued agent identity-code nodes to thirty organisations including the China Electric Power Research Institute, iFLYTEK, Volcengine, Lenovo, ZTE, SenseTime, AsiaInfo Security and China Mobile Anhui; the AIP application and promotion campaign for the Yangtze River Delta region was launched with thirty ecosystem partners signing; and the AIP open-source reference implementation released V2.2, focused on monitoring observability, real-time interaction, permission access control, cryptographic algorithm iteration and engineering delivery. In the same session, Yang Kai, deputy director of the Security Research Institute at China Mobile Research, presented the mandatory national standard "Basic Requirements for Agent Application Security": the focus of agent security governance has shifted from controlling model output content to constraining autonomous execution behaviour, built around the four levers of identity, permission, tools and audit to make agents authorisable, constrainable and accountable. Why this matters: the AIP identity code builds on the OID hierarchical encoding system, while the IETF-side DAWN working group approaches identity via DNS TXT records (the AID draft) — two identity routes worth tracking against each other for cross-domain mutual recognition. Source: Shanghai Securities Journal / China Securities Net (2026-09-01).
group-standardtrusted-assessmentISCpublic-comment
On 2 September, the China Internet Society published the draft group standard "Trusted Internet Agent Capability Assessment Specification" for public comment, with a deadline of 1 October. This follows the earlier "AIoA — Networked Agent Gateway Capability Requirements" and now covers the trusted-assessment side, forming a capability-plus-assessment pairing for the gateway direction. Read against the 31 August national standard session and its message that security governance is shifting toward constraining autonomous execution, trusted assessment is becoming a high-frequency theme in domestic agent standardisation. Participation path: submit the society feedback form by email or fax, with name, organisation and contact details attached. Source: China Internet Society website (2026-09-02).
CAICTcampus-networktraffic-modelresearch
According to a 3 September report, the China Academy of Information and Communications Technology (CAICT) released a research report on 10-gigabit AI campus Ethernet, arguing that agents at scale are restructuring enterprise campus networks: the traffic model is inverting — traditional campuses are downlink-heavy, but once smart terminals embed multiple agents for autonomous multimodal interaction, uplink traffic rises sharply; a single agent can peak at 10 to 20 Mbps uplink and complex multimodal scenarios can exceed 100 Mbps, more than five times the 2 to 4 Mbps of conventional office audio-video traffic; the number of on-device agents is expected to move from one per person to five or ten per person, and the compounded concurrency drives exponential bandwidth growth, pushing campuses toward Wi-Fi 7 and 2.5G/10G wired access. The report also argues that the difficulty of controlling autonomous agent behaviour is forcing campus security toward an "intrinsic security" posture. Why this matters: this is the first systematic official framing in China of agents changing network traffic structure — uplink bandwidth, multimodal concurrency and agent density are three directly usable quantitative anchors for network-side research. Source: Feixiang (2026-09-03).
MCPsecurityCVE-2026-59822AI-gatewaykey
The MCP Streamable HTTP endpoint of LiteLLM, a widely deployed open-source AI gateway and proxy, contains authentication bypass CVE-2026-59822: a faulty OAuth2 passthrough fallback path substitutes an empty UserAPIKeyAuth object when LiteLLM key validation fails, so an attacker with any fabricated Bearer token can enumerate and invoke the MCP tools and backend services configured on the gateway. CVSS 8.8, fixed in 1.84.0. CISA added it to the Known Exploited Vulnerabilities catalog on 2 September with a remediation deadline of 16 September; Wiz ninety-day honeypot telemetry shows attackers probing exposed instances with single-character tokens and chaining related flaws (including the MCP test-endpoint command injection CVE-2026-42271) to drop cryptominers and steal master keys from the running process. Why this matters for the agent gateway: the gateway concentrates provider keys, cloud permissions and MCP tool connections, so the post-compromise blast radius is enormous — the "AI gateway" became a target before the "agent gateway" did, but the attack surface structure is identical: concentrated credentials, tool reachability and a blurred authentication boundary. It is a ready-made case study for the security chapter. Source: GitHub security advisory GHSA-7488-6r32-c95q.
IETFCATALISTproblem-spacekey
Updated on 3 September, draft-yao-catalist-problem-space-analysis aims to identify the IETF-relevant problem space for agent protocols, candidate working-group homes, and internal and external coordination paths. The significance is that it is the IETF-level map: agent-related drafts had been scattered across DAWN, CATALIST, WIMSE, OAuth and other directions, each solving a local problem without a unified statement of the problem space. Why this matters: with the Chinese AIP national standard series on one side and the TM Forum A2A-T extension family on the other, this analysis is the reference text for a three-way comparison — which problems belong to the IETF (transport, addressing, identity, security) and which belong to upper-layer protocol organisations, and the division it proposes directly determines where gateway-related drafts should be sent. Source: IETF datatracker (2026-09-03).
IETFauthorizationauditdelegationAID
IETF agent-governance drafts refreshed densely this week; five representative ones: Agent Audit Trail (3 September, a standard JSON logging format for autonomous AI systems with mandatory fields); the Human Escalation Mechanism (3 September, how an agent authorised to act autonomously stops itself and escalates to a human when a decision exceeds its authorisation); Verifiable Attenuated Delegation for AI Agent Chains (3 September, verifiable scope-shrinking authority across chained delegations); the Agent Action Decision Protocol (1 September, separating per-action authorisation from identity and standing capabilities); and Agent Identity and Discovery (2 September, answering "given a domain, where is the agent and which protocol should a client speak" via DNS TXT). Why this matters: authorisation was the keyword of the week — AADP per-action authorisation and the OpenAN Authorization-T network-operation policy are the same problem approached two ways (a protocol extension versus a standalone decision protocol), and reading them side by side reveals how the standard cut should be made; the AAT logging format in turn echoes the audit lever in the Chinese mandatory standard. Source: IETF datatracker (2026-09-03).
IETFMoQQUICtransport
Draft-nandakumar-ai-agent-moq-transport, updated 3 September, defines a protocol abstraction layer letting Media over QUIC Transport (MOQT) serve as a unified transport substrate for inter-agent communication protocols; a companion proposal for MCP and Agent Skills over MoQ appeared the same week. Why this matters for the agent gateway: this is the deepest network-layer participation in agent protocols to date — A2A and MCP both sit on HTTP/SSE today, while the MoQ route would let agent traffic inherit multiplexing, connection migration and low head-of-line blocking from QUIC. For operators, identifying and shaping agent traffic inside QUIC is a new question, and a gateway that only understands HTTP-layer semantics will not catch this route. Source: IETF datatracker (2026-09-03).
IETFSPRINGSRv6high-availability
Updated 28 August, draft-ietf-spring-sr-redundancy-protection defines redundancy protection as a generalised mechanism for service high availability in Segment Routing networks, using a Live-Live dual-path approach. A side note for the agent gateway direction: this draft belongs to the same family as the SRv6 egress protection work on the RTGWG side, and SRv6 high availability is advancing on two fronts — egress protection solves detour around a failed node, redundancy protection solves seamless dual-active switching; both are ready-made availability building blocks for carrying agent east-west traffic, and an agent gateway that sinks into the network layer would compose directly from these mechanisms. Source: IETF datatracker (2026-08-28).
researcharXiv6Gauditprotocol
Three papers worth reading this week. Agents That Model Agents (1 September) proposes five principles for a theory of mind between LLM agents managing 6G radio access networks, noting that current architectures assume inter-agent messages convey objective facts while they actually carry intent and strategy — directly relevant to telecom network management. The Natural Language Interaction Protocol and Standard for AI Agents (3 September) attempts to define a natural-language interaction protocol across frameworks, taking the route opposite to structured protocols. Agent Flight Recorder (1 September) borrows from aviation black boxes, using on-chain-anchored tamper-evident audit trails to record the full behaviour of long-horizon agents, answering the accountability problem of sequential "deleted the production database" failures. Read together: interaction semantics (structured versus natural language) and behavioural accountability are precisely the two faces of an agent gateway that talks protocols upward and governs behaviour downward. Source: arXiv (2026-09-01 and 03).
A2AAAIFLinux-Foundationgovernancekey
On 27 August, the Agent2Agent (A2A) protocol announced it had officially been accepted as a Growth Stage project at the Agentic AI Foundation (AAIF, under the Linux Foundation). The official framing is crisp: MCP is the vertical integration layer connecting agents to internal tools and databases, while A2A is the horizontal protocol for peer-to-peer collaboration across frameworks and vendors; an agent publishes a structured Agent Card detailing its capabilities and contact methods, and other independent agents can securely read it, negotiate modalities and delegate tasks. Ecosystem numbers: over 150 organisations back the protocol, Google Cloud, AWS Bedrock AgentCore Runtime and Microsoft Azure AI Foundry ship native support, ServiceNow, Salesforce, Atlassian and SAP use it to connect workflows across their products, and frameworks including LangGraph, CrewAI, Pydantic AI, AG2 and IBM BeeAI support it. Why this matters for the agent gateway: AAIF now hosts MCP, A2A, goose and AGENTS.md together, so the open protocol layer is consolidating under one neutral foundation — while A2A-T (OpenAN) anchors its extension URIs in the TM Forum namespace and the Chinese AIP series runs on the national standard track. Three governance systems in parallel means cross-system interoperation, above all identity and authorisation mapping, becomes unavoidable — and translation is precisely what a gateway is for. Source: Agentic AI Foundation official blog (2026-08-27).
agentgatewayMCPA2Aopen-sourceAAIFkey
agentgateway (Rust, Apache-2.0, over 4,700 stars) released v1.5.0 (GA on 27 August), with a banner on its site announcing it has joined the Agentic AI Foundation; contributing companies include Solo.io, Microsoft, Alibaba, Adobe, AWS, Cisco, Salesforce, Huawei, Amdocs and iFLYTEK. The product pitch is one high-performance gateway for three traffic classes: traditional service traffic (HTTP, gRPC and TCP with mTLS and OIDC built in), LLM provider traffic (multi-model routing, credentialing and failover) and AI-native protocols (native MCP and A2A support) — no more stitching an API gateway, an LLM gateway and an MCP gateway together. v1.5.0 highlights: API-key-scoped LLM budgets, native Gemini inbound APIs, Anthropic Messages to OpenAI Responses conversion, SPIFFE Workload API identities, guardrails extended to tool calls with OpenAI inline moderation, and much clearer UI and trace views of multi-turn agent activity. Why this matters for the agent gateway: this is the open-source benchmark for the productised agent gateway — the governance surface now bundles budgets, identity, guardrails and audit, with A2A and MCP native in the data plane; read against the domestic assessment system listing "agent gateway" as its own evaluation category, product and standard are chasing each other. Source: agentgateway website and official GitHub release (2026-08-27).