OpenANA2A-TAuthorization-Topen-sourcekey
On 30 August, a2a-t-sdk-java released v1.1.0, officially described as "additional APIs to assist with generating the four types of templates and validating them". Reading the repository resource tree confirms that templates and slot definitions for all four extensions — Task-T, Notification-T, Negotiation-T and Authorization-T — are in place, bilingual in Chinese and English. The first Authorization-T scenario is "authorization policy management for network-changing operations": operation types are limited to create, modify, delete and query; each authorization policy binds a business scenario, a handling type, a named network-changing operation (tunnel tuning, for example) and a validity period that can be set to permanent; deletion requires the policy identifier. On 3 September the Python side merged the 1.1.0 alignment (PR #50, including a twelve-method negotiation service, 234 bilingual test corpus units and an ErrorCatalog). Why this matters for the agent gateway: Authorization-T lands as a prompt template plus slot validation rather than a protocol field, so security semantics still depend on the endpoint enforcing them voluntarily — the gap for gateway- or network-element-side enforcement remains, and that is exactly where the agent gateway sits. Source: official release on GitHub project-openan (2026-08-30).
national-standardsGB/Z-185AIPidentity-codekey
On 31 August, a special session to promote the "Artificial Intelligence — Agent Interconnection" series of national standards was held in Zhangjiang, Shanghai, led by the China Electronics Standardization Institute (CESI). At the meeting: the agent identity-code node management platform officially went live; the AI subcommittee of the national standards body issued agent identity-code nodes to thirty organisations including the China Electric Power Research Institute, iFLYTEK, Volcengine, Lenovo, ZTE, SenseTime, AsiaInfo Security and China Mobile Anhui; the AIP application and promotion campaign for the Yangtze River Delta region was launched with thirty ecosystem partners signing; and the AIP open-source reference implementation released V2.2, focused on monitoring observability, real-time interaction, permission access control, cryptographic algorithm iteration and engineering delivery. In the same session, Yang Kai, deputy director of the Security Research Institute at China Mobile Research, presented the mandatory national standard "Basic Requirements for Agent Application Security": the focus of agent security governance has shifted from controlling model output content to constraining autonomous execution behaviour, built around the four levers of identity, permission, tools and audit to make agents authorisable, constrainable and accountable. Why this matters: the AIP identity code builds on the OID hierarchical encoding system, while the IETF-side DAWN working group approaches identity via DNS TXT records (the AID draft) — two identity routes worth tracking against each other for cross-domain mutual recognition. Source: Shanghai Securities Journal / China Securities Net (2026-09-01).
group-standardtrusted-assessmentISCpublic-comment
On 2 September, the China Internet Society published the draft group standard "Trusted Internet Agent Capability Assessment Specification" for public comment, with a deadline of 1 October. This follows the earlier "AIoA — Networked Agent Gateway Capability Requirements" and now covers the trusted-assessment side, forming a capability-plus-assessment pairing for the gateway direction. Read against the 31 August national standard session and its message that security governance is shifting toward constraining autonomous execution, trusted assessment is becoming a high-frequency theme in domestic agent standardisation. Participation path: submit the society feedback form by email or fax, with name, organisation and contact details attached. Source: China Internet Society website (2026-09-02).
CAICTcampus-networktraffic-modelresearch
According to a 3 September report, the China Academy of Information and Communications Technology (CAICT) released a research report on 10-gigabit AI campus Ethernet, arguing that agents at scale are restructuring enterprise campus networks: the traffic model is inverting — traditional campuses are downlink-heavy, but once smart terminals embed multiple agents for autonomous multimodal interaction, uplink traffic rises sharply; a single agent can peak at 10 to 20 Mbps uplink and complex multimodal scenarios can exceed 100 Mbps, more than five times the 2 to 4 Mbps of conventional office audio-video traffic; the number of on-device agents is expected to move from one per person to five or ten per person, and the compounded concurrency drives exponential bandwidth growth, pushing campuses toward Wi-Fi 7 and 2.5G/10G wired access. The report also argues that the difficulty of controlling autonomous agent behaviour is forcing campus security toward an "intrinsic security" posture. Why this matters: this is the first systematic official framing in China of agents changing network traffic structure — uplink bandwidth, multimodal concurrency and agent density are three directly usable quantitative anchors for network-side research. Source: Feixiang (2026-09-03).
MCPsecurityCVE-2026-59822AI-gatewaykey
The MCP Streamable HTTP endpoint of LiteLLM, a widely deployed open-source AI gateway and proxy, contains authentication bypass CVE-2026-59822: a faulty OAuth2 passthrough fallback path substitutes an empty UserAPIKeyAuth object when LiteLLM key validation fails, so an attacker with any fabricated Bearer token can enumerate and invoke the MCP tools and backend services configured on the gateway. CVSS 8.8, fixed in 1.84.0. CISA added it to the Known Exploited Vulnerabilities catalog on 2 September with a remediation deadline of 16 September; Wiz ninety-day honeypot telemetry shows attackers probing exposed instances with single-character tokens and chaining related flaws (including the MCP test-endpoint command injection CVE-2026-42271) to drop cryptominers and steal master keys from the running process. Why this matters for the agent gateway: the gateway concentrates provider keys, cloud permissions and MCP tool connections, so the post-compromise blast radius is enormous — the "AI gateway" became a target before the "agent gateway" did, but the attack surface structure is identical: concentrated credentials, tool reachability and a blurred authentication boundary. It is a ready-made case study for the security chapter. Source: GitHub security advisory GHSA-7488-6r32-c95q.
IETFCATALISTproblem-spacekey
Updated on 3 September, draft-yao-catalist-problem-space-analysis aims to identify the IETF-relevant problem space for agent protocols, candidate working-group homes, and internal and external coordination paths. The significance is that it is the IETF-level map: agent-related drafts had been scattered across DAWN, CATALIST, WIMSE, OAuth and other directions, each solving a local problem without a unified statement of the problem space. Why this matters: with the Chinese AIP national standard series on one side and the TM Forum A2A-T extension family on the other, this analysis is the reference text for a three-way comparison — which problems belong to the IETF (transport, addressing, identity, security) and which belong to upper-layer protocol organisations, and the division it proposes directly determines where gateway-related drafts should be sent. Source: IETF datatracker (2026-09-03).
IETFauthorizationauditdelegationAID
IETF agent-governance drafts refreshed densely this week; five representative ones: Agent Audit Trail (3 September, a standard JSON logging format for autonomous AI systems with mandatory fields); the Human Escalation Mechanism (3 September, how an agent authorised to act autonomously stops itself and escalates to a human when a decision exceeds its authorisation); Verifiable Attenuated Delegation for AI Agent Chains (3 September, verifiable scope-shrinking authority across chained delegations); the Agent Action Decision Protocol (1 September, separating per-action authorisation from identity and standing capabilities); and Agent Identity and Discovery (2 September, answering "given a domain, where is the agent and which protocol should a client speak" via DNS TXT). Why this matters: authorisation was the keyword of the week — AADP per-action authorisation and the OpenAN Authorization-T network-operation policy are the same problem approached two ways (a protocol extension versus a standalone decision protocol), and reading them side by side reveals how the standard cut should be made; the AAT logging format in turn echoes the audit lever in the Chinese mandatory standard. Source: IETF datatracker (2026-09-03).
IETFMoQQUICtransport
Draft-nandakumar-ai-agent-moq-transport, updated 3 September, defines a protocol abstraction layer letting Media over QUIC Transport (MOQT) serve as a unified transport substrate for inter-agent communication protocols; a companion proposal for MCP and Agent Skills over MoQ appeared the same week. Why this matters for the agent gateway: this is the deepest network-layer participation in agent protocols to date — A2A and MCP both sit on HTTP/SSE today, while the MoQ route would let agent traffic inherit multiplexing, connection migration and low head-of-line blocking from QUIC. For operators, identifying and shaping agent traffic inside QUIC is a new question, and a gateway that only understands HTTP-layer semantics will not catch this route. Source: IETF datatracker (2026-09-03).
IETFSPRINGSRv6high-availability
Updated 28 August, draft-ietf-spring-sr-redundancy-protection defines redundancy protection as a generalised mechanism for service high availability in Segment Routing networks, using a Live-Live dual-path approach. A side note for the agent gateway direction: this draft belongs to the same family as the SRv6 egress protection work on the RTGWG side, and SRv6 high availability is advancing on two fronts — egress protection solves detour around a failed node, redundancy protection solves seamless dual-active switching; both are ready-made availability building blocks for carrying agent east-west traffic, and an agent gateway that sinks into the network layer would compose directly from these mechanisms. Source: IETF datatracker (2026-08-28).
researcharXiv6Gauditprotocol
Three papers worth reading this week. Agents That Model Agents (1 September) proposes five principles for a theory of mind between LLM agents managing 6G radio access networks, noting that current architectures assume inter-agent messages convey objective facts while they actually carry intent and strategy — directly relevant to telecom network management. The Natural Language Interaction Protocol and Standard for AI Agents (3 September) attempts to define a natural-language interaction protocol across frameworks, taking the route opposite to structured protocols. Agent Flight Recorder (1 September) borrows from aviation black boxes, using on-chain-anchored tamper-evident audit trails to record the full behaviour of long-horizon agents, answering the accountability problem of sequential "deleted the production database" failures. Read together: interaction semantics (structured versus natural language) and behavioural accountability are precisely the two faces of an agent gateway that talks protocols upward and governs behaviour downward. Source: arXiv (2026-09-01 and 03).
A2AAAIFLinux-Foundationgovernancekey
On 27 August, the Agent2Agent (A2A) protocol announced it had officially been accepted as a Growth Stage project at the Agentic AI Foundation (AAIF, under the Linux Foundation). The official framing is crisp: MCP is the vertical integration layer connecting agents to internal tools and databases, while A2A is the horizontal protocol for peer-to-peer collaboration across frameworks and vendors; an agent publishes a structured Agent Card detailing its capabilities and contact methods, and other independent agents can securely read it, negotiate modalities and delegate tasks. Ecosystem numbers: over 150 organisations back the protocol, Google Cloud, AWS Bedrock AgentCore Runtime and Microsoft Azure AI Foundry ship native support, ServiceNow, Salesforce, Atlassian and SAP use it to connect workflows across their products, and frameworks including LangGraph, CrewAI, Pydantic AI, AG2 and IBM BeeAI support it. Why this matters for the agent gateway: AAIF now hosts MCP, A2A, goose and AGENTS.md together, so the open protocol layer is consolidating under one neutral foundation — while A2A-T (OpenAN) anchors its extension URIs in the TM Forum namespace and the Chinese AIP series runs on the national standard track. Three governance systems in parallel means cross-system interoperation, above all identity and authorisation mapping, becomes unavoidable — and translation is precisely what a gateway is for. Source: Agentic AI Foundation official blog (2026-08-27).
agentgatewayMCPA2Aopen-sourceAAIFkey
agentgateway (Rust, Apache-2.0, over 4,700 stars) released v1.5.0 (GA on 27 August), with a banner on its site announcing it has joined the Agentic AI Foundation; contributing companies include Solo.io, Microsoft, Alibaba, Adobe, AWS, Cisco, Salesforce, Huawei, Amdocs and iFLYTEK. The product pitch is one high-performance gateway for three traffic classes: traditional service traffic (HTTP, gRPC and TCP with mTLS and OIDC built in), LLM provider traffic (multi-model routing, credentialing and failover) and AI-native protocols (native MCP and A2A support) — no more stitching an API gateway, an LLM gateway and an MCP gateway together. v1.5.0 highlights: API-key-scoped LLM budgets, native Gemini inbound APIs, Anthropic Messages to OpenAI Responses conversion, SPIFFE Workload API identities, guardrails extended to tool calls with OpenAI inline moderation, and much clearer UI and trace views of multi-turn agent activity. Why this matters for the agent gateway: this is the open-source benchmark for the productised agent gateway — the governance surface now bundles budgets, identity, guardrails and audit, with A2A and MCP native in the data plane; read against the domestic assessment system listing "agent gateway" as its own evaluation category, product and standard are chasing each other. Source: agentgateway website and official GitHub release (2026-08-27).
4 items Internet of Agents Watch · 2026-09-04
Guangming-DailyIoAexplainerIETFkey
On 26 March 2026, Guangming Daily ran "Internet of Agents: prototypes are here, new questions remain" (reporters Cui Xingyi and Wang Meiying, correspondent Wang Shuhe) as a full page in its New Science & Technology section — a marker of IoA entering mainstream national-media coverage. On framing, Mao Wei, director of the National Engineering Research Center for the Internet Domain System, offered the accessible version: "TCP/IP is our common language; the Internet of Agents is not about switching to a different language, but about writing new articles with it" — making agents the core interaction object that can converse with people, call tools and collaborate with peers. The "prototypes are here" evidence chain: Ma Yan of BUPT cites "AI orders your milk tea", where a team of agents handles understanding, shopping and payment; Li Hongtao of the National Engineering Laboratory for Domain Name Management sums it up as "the old internet connected people and information, while the IoA connects a workforce of digital employees that can get jobs done on their own", with deployments already in aquaculture and production scenarios. The open questions matter most for the standards community: Li Xing of Tsinghua asks how to tell an agent doing something odd apart — hallucination or compromise? The feature explicitly notes that at IETF 125, inter-agent interoperability and keeping agents within bounds were hot topics — mainstream-media explainers and IETF standardisation are converging on the same window, and the two threads are worth reading against each other. Source: Guangming Daily, 26 March 2026, page 16 (reporters Cui Xingyi and Wang Meiying); lead traced via the WeChat account "Wangxin Shandong".
CensysMCPsecuritymeasurementkey
Internet mapping company Censys published a blog post (27 May 2026) measuring MCP servers exposed to the public internet: starting to collect data on 24 April 2026, within four days it observed 12,520 internet-accessible MCP services across 8,758 unique IPs, 56 countries and 425 autonomous systems; 11,379 of them exposed at least one tool, for a total of 81,908 exposed capabilities (tools, resources and prompts); by the 6 May update the dataset had passed 21,000 — nearly doubling in about eight days. The risk structure is clear: the MCP specification does not require authentication by default, so a public exposure is effectively an unauthenticated RPC endpoint; 1,056 "data access" services expose direct SQL/NoSQL/vector-database interfaces (many advertising arbitrary SQL execution), 687 "system control" services offer command execution and shell access, and roughly 90 tools are literally named run_command or execute_command; desktop-takeover capabilities (screenshots, keyboard and mouse control) and payment processing are exposed too. Censys stresses it only enumerated capabilities without executing anything, and some extreme cases are likely honeypots — yet the conclusion stands: unauthenticated MCP servers are "low-hanging fruit", and organisations are deploying faster than they build security understanding. Why it matters here: this dataset is the latest quantitative argument for the agent gateway as a security enforcement point — authentication, audit and tool-level access control are exactly the gaps the MCP spec leaves open and that gateways and trust layers (such as ATH) are positioned to fill. Source: Censys blog (27 May 2026); lead traced via the WeChat account "Tianyu Zhiyi".
Morgan-StanleyMCPCALMfinancekey
At QCon London 2026, Jim Gough, Distinguished Engineer and architect of the Morgan Stanley API program, and Andreea Niculcea, who leads the self-service capability team, revealed how a five-year enterprise API program had to be substantially rethought over the past year — because MCP went from obscurity to industry standard in roughly eighteen months, fundamentally changing who, or what, consumes your APIs. The business-side shift is blunt: nobody ever got excited about an OpenAPI spec, but MCP specs have people jumping up and down — business users want to query trades, risk and portfolio positions in natural language and let an agent figure out how to fetch the answers. Scaling pain shows up fast: with dozens of tools, overlapping descriptions confuse agents into retries and waste tokens (in the live demo Claude went through multiple naming variations before finding the right symbol prefix for a Vodafone trade), pushing the industry toward specialised MCP gateways with business context — a shift away from the "dumb pipes" philosophy that served classic API gateways well. The answer at Morgan Stanley is CALM (Common Architecture Language Model), an open-source project under FINOS: architectures defined as code via a JSON schema, patterns as organisational templates, and the platform generating everything needed for deployment from a single source of truth. The live demo deployed a REST API and an MCP server from a CALM pattern, layered on a compliance guardrail — a denied-symbols list that hard-rejected a Claude query for restricted financial instruments — plus deployment gates with build-time structural validation via Spectral rulesets. Quantified impact: the first API took roughly two years to reach production; with CALM and automated security approvals that is down to one or two weeks, with zero-downtime upgrades across a hundred-plus deployments. The closing demo ran the Google A2A protocol alongside MCP — a portfolio rebalancer discovering trading agents by skill and booking trades autonomously — with the takeaway that A2A will not replace MCP; the adapter layer keeps shifting while APIs remain the stable contract underneath. Why it matters here: financial-grade compliance guardrails and deployment gates are hard evidence that "the gateway as the security enforcement point" survives the most regulated environments. Source: InfoQ, "Morgan Stanley Rethinks Its API Program for the MCP Era" (March 2026, coverage of the QCon London 2026 talk); lead traced via the WeChat account "Beijing 101 Middle School Class 1-3".
CAICTresearch-reportinternet-of-agentskey
At the 2026 World AI Conference forum "From Large Models to Agents: Toward a New Era of Autonomous Intelligence" on 18 July, the Cloud Computing Open Source Industry Alliance and the Cloud Computing and Digitalisation Research Institute of CAICT released the Internet Agent Development Report (2026), presented by Li Wei, deputy director of the institute. The core judgement: the internet is shifting from connecting humans to connecting agents as its primary subjects. The report adopts a four-stage evolution path — generative AI, single agents, multi-agent collaboration, and the Internet of Agents — and frames the IoA stage as agents breaking platform and system boundaries, relying on unified network protocols for heterogeneous interconnection, autonomously delivering cross-platform, cross-scenario and cross-organisation services, and moving the internet from "information interconnection" to "intelligent interconnection". An internet agent is defined as a software system that serves via the internet (inward-facing search or outward-facing information services), executes tasks autonomously, and interacts with applications, tools and other agents. On security, the report catalogues six classes of networking risk — identity, permission, behaviour, data, supply chain and accountability — mapped to a four-dimension trusted protection mechanism (trusted identity authentication, intrinsic security, runtime environment and interaction behaviour); on governance, it argues for a full-lifecycle loop covering development, access, service and security, using trusted assessment, registration and filing, network-wide observation, human intervention and emergency response to govern AI with AI. The release context matters: a draft revision of the Internet Information Service Management Rules by the CAC already names agents as a service vehicle, so regulatory boundaries are being drawn now. Why it matters here: the six-risk, four-trust framework is a ready-made capability benchmark for gateway-class products, sharing DNA with the CAICT agent gateway assessment system this site already tracks. Source: China Securities Journal via cs.com.cn (21 July 2026); lead traced via the WeChat account "AI Kepu Guan".
This brief was AI-assisted in collection and summarization, then human-reviewed before publication.