24 of 91 sessions were security. Not one of them proposed a better prompt.
Hey đź‘‹
Special issue. No news roundup this week.
I spent Thursday and Friday at AGNTCon + MCPCon Europe, at the RAI in Amsterdam, and I spoke on the Thursday afternoon. This issue is what two days of it looked like from the floor: what the program says about where agent security is actually going, and an honest account of how my own talk went.
The protocol half, stateless MCP and the OAuth changes and WebMCP, needs its own deep dive with the schema diffs in it. That lands next Saturday. This one is the conference.
What I counted
Five rooms ran in parallel for two days. Ninety-one talks, keynotes, panels and workshops, by my count off the published program, not counting breaks, sponsor demos and the lunch table topics. Nobody saw more than a fifth of it, including the people who were there both days.
So I did what I would do with any other corpus and counted it. Twenty-four of the 91 sessions were about security, identity, authorization, or governance as a property you can enforce rather than a document you can file. That is a bit over a quarter of the program at a conference that does not call itself a security conference.
Eight were squarely about agent identity, delegated authority or provenance:
- What IS an Agent’s Identity?, Christian Posta (Solo.io)
- Delegated Authorization for AI Agents, Sohan Maheshwar (AuthZed)
- ID-JAG: Solving OAuth Sprawl for Enterprise AI Agents, Joey Orlando (Archestra.AI), Aaron Parecki (Okta) and Paul Carleton (Anthropic)
- Economies of Scale for MCP and Agents: Why You Need an Identity Broker, Magnus Jungsbluth and Jan Brennenstuhl (Zalando)
- Gating High-Risk Agentic Actions at the Relying Party With Exogenous (Out-of-Band) Inputs, Andrew Bud (iProov)
- Attribution by Design: Skills, MCP, and Where Provenance Gets Built In, Ola Hungerford (Nordstrom, and an MCP maintainer)
- Potential Issues for Cross-domain Multi-hop API Calls, Takashi Norimatsu (Hitachi)
- Agents Can Pay. Can They Prove It?, Diego Zuluaga (Open Mobile Hub)
Nine if you count CHAP, Brightbeam AI’s protocol for making human approvals, overrides and handoffs replayable instead of leaving them in chat logs. The classification is mine, made from titles and abstracts, so argue with it if you like; the shape does not change much either way.
Two things stand out. Six of the eight ran on the Friday, which is not how a program committee schedules a theme it thinks is niche. And three of the security sessions, two of them from that list, went head to head in the same 15:00 slot on Friday. The track grew faster than the grid did.
Nobody proposed a better prompt
Here is the finding I did not expect to be able to state this cleanly. Across those 24 sessions, I did not see one whose proposed control was a better system prompt. Not one. I did not attend all 24, so read that as the abstracts plus the rooms I was in, but the pattern is consistent enough that I would defend it.
What people proposed instead was infrastructure. Liran Tal of Snyk put it most bluntly: rules and /security-review prompts “aren’t enough: they’re costly, brittle, and non-deterministic. Run them three times, get three answers.” Sheng Liang’s keynote made the same argument one layer up, that MCP gateways can intercept and filter tool calls and that alone is not enough, so you need visibility, consistent policy and centralised control. Juan Antonio Osorio ran coding agents inside sub-second hardware-isolated microVMs, on the theory that the workspace, the keys and the shell we hand these things should sit behind a kernel boundary. Siemens’ Seshu Tolety argued for governance as checkable properties on a running system rather than promises on a slide. Glenn ten Cate and Jorge Carvalho’s Agent-Smith, an open-source autonomous pentesting agent, caps cost, execution time and tool calls server side rather than asking the model to be careful.
The cleanest methodology of the two days came from Roy Belio of Red Hat, and it deserves a wider audience. Safety-aligned models refuse adversarial prompts, which means a refusal can look like a control working when nothing was tested at all. He removed the variable by running an abliterated Qwen3.5 with zero refusals and full cooperation, then ran garak probes across three hardening tiers against an agent in a live environment. That is how you find out whether your infrastructure stops an attack, rather than whether the model felt like declining that day. If you are writing agent security tests this quarter, steal that design.
Every control presented in Amsterdam that anyone claimed worked was outside the model. I have been making that argument in this newsletter for months from incident reports. It was pleasant, and slightly disorienting, to watch a two-day program arrive at it independently.
The identity question stopped being a question
Christian Posta framed it in the terms enterprises will actually ask: who is this agent, what is it allowed to do, and what has it done. A year ago that talk would have ended in an open question.
This year Zalando answered it with code. Magnus Jungsbluth and Jan Brennenstuhl described the agentic identity broker they built, open sourced and run, carrying delegation chains across in-house and third-party applications, with the explicit goal of keeping authentication and authorization out of individual agents and MCP servers. Their framing was economies of scale, borrowed from a decade of running thousands of microservices: push it into the infrastructure, because you are not going to solve it once per agent. That is the delegation model in production at real scale. It is no longer a position you have to argue for.
The enterprise plumbing moved too. ID-JAG, the Identity Assertion JWT Authorization Grant behind MCP’s Enterprise-Managed Authorization, got a session from the people who built it, and their framing of the problem was the honest one: per-user, per-service consent does not scale to thousands of employees, so the decision has to move into the IdP. The missing piece they named themselves is SaaS authorization servers supporting the flow.
And Takashi Norimatsu of Hitachi, a Keycloak maintainer, did the least glamorous and most useful thing on the list: he reported concrete flaws in the mechanisms we are all about to depend on. Elicitation in URL mode can cause user swapping. Token exchange across domains has its own failure modes. This is what a protocol needs and rarely gets, which is someone from the identity world reading the spec carefully enough to find the seams.
The gap nobody has a control for
Andrew Bud of iProov gave the talk I keep thinking about, and it is a confused deputy framing worth borrowing wholesale.
An agent arrives at a relying party with valid tokens, a passkey, an inherited session, legitimate tool credentials. Everything authenticates. But its instructions have been shaped by prompt injection, so the action it is requesting is not the one its principal intended. The request is authenticated. Consent to the action was never obtained. For the relying party that is a repudiation risk, and it sits exactly where the money and the irreversible actions are.
His argument for why this is hard: any signal the agent or its device can produce is endogenous to the compromised context. If the attacker shaped the instructions, the attacker can shape the attestation. So a relying party gating a high-risk action needs an input the agent cannot generate, evaluated before execution rather than after. Out-of-band, by construction.
Two other sessions sat on the same fault line. Ola Hungerford, an MCP maintainer, argued in Attribution by Design that provenance either travels with the knowledge or its absence becomes the default, and that the standards being written right now, Skills and MCP and the mix of the two, are the decision point. Steven Mih made the legal version: the EU AI Act requires high-risk systems to keep automatic records (Article 12) and retain logs for at least six months (Article 19), but as he put it, the Act can require the logs to exist and cannot require them to be trustworthy. A log is only as good as the party keeping it.
Put those three next to the attribution test from issue #26, and the shape is the same one every time. We can now say who the agent is. We still cannot prove what it was asked to do, by whom, or that the record of it is worth anything in a dispute.
Catch Them Early
The governance note, and the one with an action attached for anyone who maintains something.
Manik Surtani, CTO of the Agentic AI Foundation, used his Friday keynote to say the foundation had inherited CNCF’s entry bar without CNCF’s conditions: a bar designed for a mature industry, applied to a field just over a year old. The result was that the only door open admitted work that had already won, while the projects most in need of a neutral home were turned away at the exact moment governance would have helped them.
The new Sandbox phase is the fix. It asks for a working implementation, a named active maintainer, and either early external interest or a credible technical thesis. It gives you, in the foundation’s own words, “a home and a neutral flag, nothing more”: infrastructure, no funding, no marketing. Growth is the real gate, and it is three conditions at once: production use by two unaffiliated organisations, commits from two or more organisations over six months, and a written plan accepted by a technical committee sponsor. Six month checkpoint, twelve months to apply, archival discussion if you miss it.
The part I respect is that they made it falsifiable. “We will publish three counters at every annual review: acceptances, graduations, archivals.” And: if the archival counter is still zero in two years, that is a signal they are being too conservative. Hold them to it, because most foundations never publish the denominator.
The foundation hosts six projects today: MCP, A2A, goose, AGENTS.md, agentgateway and Agent Router. It runs eight working groups, two of which are Identity & Trust and Security & Privacy, and both are open to anyone, with no membership and no paperwork.
If you maintain an agentic security tool and have been waiting until it looks impressive enough, the bar moved specifically so that you would not wait.
My own talk, honestly
I spoke on Thursday at 16:20 in the Emerald Room, against Nokia’s agent control plane talk and a 95-minute governance workshop, which is a slot that teaches you humility about audience size. The deck and the companion notes are up: What a Year of Breaking MCP Tells Builders →
One sentence carried the talk: every trust check I looked at compared a string to something nobody had issued, verified or bound to an identity. Three anchors, three servers, the same four beats each time. The session: a session identifier I generated myself was accepted by Grafana MCP, which then acted with the configured service account and, through a caller-controlled X-Grafana-URL with no destination allowlist, reached the cloud metadata endpoint. The network: a personal access token authenticating a GitLab MCP server downstream, doing no work at all on the inbound side, with wildcard CORS and a 0.0.0.0 bind, so any page the operator visits can call all 86 tools. The approval: four independent vendors shipping code that ran before the trust dialog appeared, inside one year.
Three controls, which is the whole takeaway and short enough to act on: verify the publisher before you verify the content; authenticate inbound separately from downstream; snapshot the definition surface and block on drift.
The part I am most glad I did was cut a finding. I had planned to tell the room that more capable models are easier to poison. Going back through the 2026 data, it does not hold up cleanly: MCPTox and Raccoon support it, and Wharton GAIL’s 40,000 grading trials, a June agentic injection evaluation and Cisco’s fifteen-model study all complicate it, with reasoning mode moving one model from 88.3% to 43.5%. So I said that from the stage instead, and landed on the claim the evidence does support: model choice is not the control, the failure is structural, and structural failures need protocol and host fixes.
Now the honest part about the delivery, same as I did for fwd:cloudsec two weeks ago.
What went right. I was more relaxed and better paced than last time, and I opened without hunting for words. People took photographs of the slides, which I did not expect and which is the only real-time feedback signal you get in a breakout room.
What went wrong, from the third slide on. My explanations were not understandable, and I say that as the person giving them. I was narrating a point before the line that carried it had appeared on the slide, because I was reading notes instead of telling the story. The diagnosis is the same as the symptom: the story was not rehearsed to the point where I could tell it without the deck. At fwd:cloudsec I fixed delivery by rehearsing ideas rather than sentences. In Amsterdam that was not enough, because the deck had a build order and I had not rehearsed against it.
The comparison that stayed with me is the caliber of the room. Most of the speakers came from Anthropic, GitHub, Google, AWS, Hugging Face. Mostly US-based, mostly native English speakers, and, the part that actually matters, all reporting work they do full-time. I was presenting research I do on the side. That is not an excuse, it is a diagnosis, and it points at exactly one fix.
So: the talk is a credential, given who else was on that program. The next CFP I send goes in backed by findings I built, tested and disclosed, not by a survey of other people’s.
What I’m changing
Three things, written here so you can hold me to them.
Go deeper rather than wider. Fewer news reactions, more original work: CVEs found and disclosed, labs published, protocol changes proposed with schema diffs attached.
Get inside the community rather than reporting on it. Almost every project presented in Amsterdam asked for contributors from the stage. Identity & Trust and Security & Privacy are the two AAIF working groups where my work already lives, and showing up costs nothing but time.
Rehearse the story, not the slides. Separate problem, same root cause: if I cannot tell it walking to the venue with no deck, it is not ready.
One thing to do this week
Not a check this week. A contribution.
Pick one: join an AAIF working group and turn up to the next call (Identity & Trust or Security & Privacy if you read this newsletter); or, if you maintain something agentic that works and has a maintainer, apply to Sandbox; or add a transcript to the community archive below, because five parallel tracks means the recordings are the only way most of us see four-fifths of it.
The bar moved down deliberately. Walking through the door is now the cheapest thing on this list.
Tooling worth knowing
- AGNTCon + MCPCon transcript archive: community effort to turn all the sessions into searchable text. Five rooms ran in parallel, so nobody saw more than a fifth of it. It needs contributions. github →
- Agent-Smith and Seraph: open-source offensive agent and defensive LLM proxy, with a skills library aligned to OWASP ASVS 5.0 and MITRE ATT&CK. Useful as reference architecture whether or not you run them. nullpointer.studio →
- mcp-attack-labs: my lab code for the MCP attack classes behind the talk, tool description poisoning, cross-server shadowing and the rug pull, reproducible end to end. github →
- Agent Security Scorecard: my free self-assessment against the OWASP Agentic Top 10, about 12 minutes, no login. Score your agents →
What I’m watching
→ The recordings and the slide archive. Slides are attached to the sessions that shared them on the program page already, and the video usually follows. When the security sessions are up I will link the five worth your time.
→ Most MCP servers are empty. David Golverdingen of Warmtebouw analysed 856 tools across 103 MCP servers and found 97% of tool descriptions carry what he calls a critical smell. He runs nine production servers at a 350-person Dutch HVAC company, so this is not a lab result. If that number holds up, tool description quality is a security problem as much as a usability one, and it is sitting in everybody’s catalog right now.
→ The AAIF counters. Acceptances, graduations, archivals, published at every annual review. That is a falsifiable promise about whether Sandbox becomes a pipeline or a parking lot, and it is checkable in a year.
→ Next issue, Saturday. The protocol half of Amsterdam: what the 2026-07-28 stateless spec changes for security, why dynamic client registration was deprecated and what the replacement makes your authorization server fetch, and the WebMCP numbers.
If you were in the Emerald Room on Thursday, I want the feedback more than the compliment. Reply and tell me where you lost the thread.
Cheers, Amine
If a colleague deploys agents in production, forward this to them.
Sources
- AGNTCon + MCPCon Europe 2026 program with session descriptions, Sched
- AGNTCon + MCPCon Europe, Linux Foundation
- What a Year of Breaking MCP Tells Builders, my session: companion notes, the deck, and the three controls
- AAIF Introduces Sandbox Phase for Early Agentic AI Projects, Agentic AI Foundation
- Agentic AI Foundation projects and working groups
- NullPointer: Agent-Smith and Seraph
- Community transcript archive