Every Agent Protocol Now Lives Under One Roof — and None of Them Make an Agent Trustworthy (2026)
By Surya Pratap
August 20, 2026
11 min read
AI & Technology
August 20, 2026
11 min read
What consolidated, and what did notHover to exploreGoogle has contributed the Agent2Agent protocol to the Agentic AI Foundation. A2A already sat under Linux Foundation governance; this moves it into the foundation built specifically for agentic AI, alongside Anthropic's Model Context Protocol, OpenAI's AGENTS.md and Block's goose.
That is the whole news, and on the surface it is procedural. It matters anyway, because it closes a question founders have been quietly carrying since 2025 — and because it makes a different, harder question impossible to keep avoiding.
The Agentic AI Foundation was formed on December 9, 2025 under the Linux Foundation, anchored by three donated projects: MCP from Anthropic, for connecting models to tools and data; AGENTS.md from OpenAI, the convention for giving coding agents project-specific guidance; and goose from Block, a local-first agent framework.
A2A is the fourth, and it fills the obvious hole. MCP is agent-to-tool. A2A is agent-to-agent across trust boundaries — discovery, authentication, and interaction between agents that know nothing about each other's implementation.
The membership curve is the part worth looking at:
| Date | AAIF members |
|---|---|
| December 2025, at launch | fewer than 40 |
| April 2026 | 170+ |
| August 2026 | 250+ |
Platinum members are AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft and OpenAI. The gold tier includes Cisco, Datadog, Docker, IBM, JetBrains, Okta, Oracle, Salesforce, SAP, Shopify, Snowflake and Twilio.
Why competitors co-governing a standard is the signal, not the membership count
A vendor-owned protocol carries a risk you cannot price: the sponsor changes strategy and the standard becomes a liability you built on. Neutral governance does not make a protocol good, but it does remove that specific failure mode — and when the platinum tier contains firms competing directly with each other, no single one of them can unilaterally break it. That is the property founders were actually waiting for.
Rewind eighteen months. Choosing an agent protocol in early 2025 meant guessing which vendor's standard would survive, knowing that picking wrong meant a rewrite. That was a real and reasonable reason to wait.
A2A's own path shows how that resolved. Google launched it in April 2025 with backing from more than a hundred companies, transferred the specification and SDKs to the Linux Foundation in June 2025, absorbed IBM's competing Agent Communication Protocol in August 2025, shipped A2A 1.0 in March 2026, and has now handed it to AAIF. Consolidation, not fragmentation — the opposite of what the 2025 protocol wars looked like from the inside.
A2A 1.0 is also a serious specification rather than a sketch. It added multitenancy, version negotiation, multi-protocol bindings, and signed agent cards — cryptographic identity for the agent you are talking to. It ships inside Google Cloud, Microsoft Azure AI Foundry and AWS Bedrock AgentCore, and is used by Huawei in its Celia assistant, by Tencent in WeChat, and by PayPal as the base for its agent payments work.
If you deferred this decision because the standards looked unsettled, they are settled enough now. That is a genuine change and it is the practical takeaway of the announcement.
Here is where I want to be careful, because the press release framing and the engineering reality diverge.
Standardised transport is not trust. A2A specifies how an agent discovers another agent, authenticates it, and exchanges messages. It does not specify — and cannot specify — whether the content of those messages is correct.
The sharpest version of this critique came from Mahesh Shanmugasundaram of Seekr, who described the risk as an "AI game of telephone," where "each agent treats the prior agent's output as 100% trusted input vs. a claim to be verified." His point is that without mandatory evidence-based evaluation at each hop, cascading failure becomes "structurally worse than teams expect."
That is not a criticism of A2A. It is a description of what a transport protocol is for. But it lands harder now precisely because the protocol problem got solved: the friction that was accidentally limiting how many agents you chained together has been removed, and nothing replaced it as a brake.
A signed agent card establishes which agent is speaking. It establishes nothing about whether that agent is right. Conflating the two is the most expensive mistake available in multi-agent architecture this year, and the vocabulary invites it — "verified", "trusted" and "authenticated" all appear in the spec, and none of them mean correct.
The arithmetic is unforgiving and worth doing explicitly, because it is rarely written down.
If each agent in a chain is independently 95% reliable on its step, a three-agent chain is about 86% reliable end to end, and a five-agent chain is about 77%. Those are optimistic numbers — they assume errors are independent, and in practice they are not. A confidently wrong output from agent one becomes agent two's premise, and agent two has no mechanism to doubt it.
This is why "we added another agent" so often makes a demo more impressive and a product less dependable. The demo runs the happy path once. The product runs the chain ten thousand times.
Where to put verification when the transport is free
Two figures are circulating and they measure different things.
AAIF has more than 250 member organisations. A2A has more than 150 supporting organisations. Both are real, and both are counts of support, not deployment.
The Linux Foundation's own announcement referenced active production deployments across supply chain, financial services, insurance and IT operations — and did not publish a single deployment count or usage metric. That is not evasive; it is normal for a foundation, which usually cannot see its members' production systems. But it does mean the honest summary is: institutional adoption is broad and well-evidenced, and production adoption is real but unquantified.
Membership counts tell you a protocol will still exist in three years. They tell you nothing about whether it is battle-tested for your workload, and it is worth not letting the first fact quietly stand in for the second.
If you are already running agents that call other agents, the useful hour this week is listing every hop and marking which ones have a check that can actually stop the call. In most systems the answer is none of them, and the list is more persuasive than any argument in this article.
Signed agent cards are a real improvement and worth adopting for exactly what they provide: you can now establish that the agent you are talking to is the one you think it is. That closes impersonation, which was a genuine hole.
It does not close instruction injection through agent output. An authenticated agent that has itself been compromised, or that has simply read something malicious from a page or a document, will pass that content onward with a valid signature attached. The signature travels with the payload; it does not inspect it. Everything in our agent security guide about treating model-visible content as untrusted applies unchanged, and applies to inter-agent messages too.
The protocol layer for agents has consolidated faster and more cleanly than most people expected. Four projects that could have become four competing camps now sit under one neutral foundation with 250+ members, and the largest competing platforms co-govern them. If you were waiting for the standards to settle before building, that wait is over.
What did not consolidate — and what no protocol can — is any notion of whether an agent's output deserves to be believed. A2A gives you a reliable pipe and a cryptographic answer to who is speaking. The answer to is this right has to come from you, at the boundaries you choose, with checks that can stop the call.
Adopt the standard. Then go build the thing the standard deliberately left out.
Sources: Linux Foundation, on the formation of the Agentic AI Foundation and its founding projects · Techstrong.ai, on Google moving A2A under the Agentic AI Foundation · Linux Foundation, on A2A passing 150 organisations and first-year production use · Linux Foundation, on the launch of the Agent2Agent project · Axios, on A2A's new home · A2A protocol specification
IdeaToMVP Academy
4-week live cohort for founders. Learn to ship AI agents, scope MVPs, and automate your business — taught by the same team that writes these guides.
