← All posts
Engineering7 min read

AGNTCon + MCPCon 2026 Recap: Lots of Noise, Little News. And That’s Good News

My takeaways from AGNTCon + MCPCon 2026: agent security dominated, gateways and sandboxes are multiplying, MCP beat A2A on stage, and the real question is no longer whether agents will fix incidents on their own, but how.

Nati ShalomNati ShalomCo-founder & CTO
Angie Jones, Vice President of the Agentic AI Foundation, opening the AGNTCon + MCPCon North America 2026 keynote in San Jose, with the Welcome slide on the main screen and the AGNTCon + MCPCon banner below

My takeaways from AGNTCon + MCPCon North America 2026 in San Jose: the risks are well known, the tools are multiplying, and the real question has moved from whether agents will fix things on their own to how.

Key takeaways from AGNTCon 2026

  • No Claude Code moment this time. The conversation moved to production maturity: efficiency and security. That is a sign of a maturing market.
  • Agent security was the main topic, from the OpenAI and Hugging Face incident to the PHP2Shell flaws.
  • Gateways and sandboxes are multiplying: OpenShell, agentshield, OpenSandbox. The need is real; the standard is not set yet.
  • MCP owned the stage. A2A barely came up, even from Google, which started it.
  • 81% of AAIF members run agents in production, but only 23% let them run on their own.
  • The dashboard is becoming a tool for verifying an agent’s answer, not for driving the investigation.
  • The question for buyers: was autonomy designed into the architecture, or added as a feature?

Why little news is good news

By little news, I mean nothing on the scale of the Claude Code moment, which changed how we think about AI coding and, later, how we build agents. This time the conversation was about production maturity, and mostly about two things: efficiency and security. When a market moves from breakthroughs to those questions, the problems are known, the direction is clear, and it comes down to execution.

Agent security dominated the conversation

The most talked-about topic was the danger of autonomous agents. Speakers came back again to the OpenAI and Hugging Face incident, where an agent broke into infrastructure even though its prompt said plainly that it was a simulation. Last week it was joined by PHP2Shell, two critical flaws in the PHP runtime itself, where exploit attempts were spotted four days before the flaws were even disclosed. And Dawn Song of UC Berkeley said from the stage what many people think: in the near term, AI will help attackers more than defenders.

Too many gateways and sandboxes, not yet a standard

In response, a lot of solutions are popping up: gateways and sandboxes such as NVIDIA’s OpenShell, agentshield, which Solo.io launched at the conference, and OpenSandbox, which Alibaba donated to the foundation. That points to a real need: putting clear limits around what an agent can do. But the sheer number of options makes me want to wait and see what becomes the standard. It reminds me of LangChain and LangGraph, which quickly turned into heavy frameworks that are overkill for most needs.

Google’s homework: can you swap a model in two days?

Interestingly, Google pointed the same way. In its talk on managing agents in the enterprise, it gave leaders some homework: check whether you can swap a model, a harness or an agent within two days, without losing your memory or your controls. In other words, do not tie yourself to one framework.

Google Cloud slide from AGNTCon + MCPCon 2026 asking enterprise leaders whether they can swap a model, a harness or an agent in under two days while keeping memory, history and controls

Figure 1: Google Cloud’s homework for enterprise leaders: can you swap a model, a harness or an agent in under two days, and keep your memory, history and controls? Source: AGNTCon + MCPCon 2026, Day 2.

MCP vs A2A: MCP owned the stage, A2A barely appeared

The same goes for protocols. MCP dominated the stage, and A2A barely came up. Even Google, which started A2A, presented it alongside MCP rather than instead of it. And the AWS DevOps Agent was not mentioned at all; AWS showed a project built on OpenSearch and MCP instead. Here too, it is too early to bet on a single standard.

Assisted is not a step toward autonomous

On the other hand, autonomous agents are clearly the future. Anyone who has been to San Francisco lately and seen Waymo knows it is already reality.

81% run agents in production, 23% let them run on their own

The common approach I saw: start with an assistant that keeps a human as the safety layer, then raise the level of autonomy step by step. The numbers from the conference reflect this too: 81% of AAIF members already run agents in production, but only 23% let them run on their own.

AAIF member survey shown on the AGNTCon 2026 main stage: 81% of members run AI agents in production, but only 23% let them run fully autonomously

Figure 2: The AAIF member survey on the main stage: agents are already a production market, with oversight treated as a design choice. Source: AGNTCon + MCPCon 2026, Day 1.

Why autonomy is a different architecture, not another feature

On paper that sounds good. But in cars, the move from assisted to autonomous is a completely different architecture, not another feature. An autonomous car has no driver, so it needs no steering wheel and no dashboard, and the cars look more like a minibus than a race car. Safety matters more than going from 0 to 100, so the whole ride can be designed differently. The result is safer driving.

The dashboard becomes a tool for verifying

I saw the same shift happening in operations. The AWS OpenSearch team described a 3 a.m. incident in which the agent investigates first, and the on-call engineer opens a dashboard only after the agent proposes a root cause, to check it. In their example, the agent said checkout was down for 15 minutes; the dashboard showed an hour. Their conclusion: the dashboard is not dead, but its role changes, from a tool for driving to a tool for verifying. Just like the screen in the back seat of a Waymo.

AWS OpenSearch team example of a 3 a.m. incident with an agent in the loop: the agent reports checkout down for 15 minutes while the trace on the dashboard shows an hour

Figure 3: “3 AM, with an agent in the loop.” The agent says checkout was down for 15 minutes; the trace shows an hour. The dashboard becomes the place to verify the agent’s answer. Source: AWS OpenSearch team, AGNTCon + MCPCon 2026, Day 2.

Humans in the loop cannot keep up

There is another problem with “human in the loop” as the safety layer: the human cannot keep up. Thomas Dohmke, GitHub’s former CEO, showed that teams using coding agents reach 57 pull requests a week, compared with 10, and more and more changes go in without human review.

Autonomy with more controls, not fewer

That is why at DataAgent, an autonomous SRE platform, we set out from the start with a remediation-first goal. That does not mean a system without controls. Quite the opposite: more controls, but most of them driven by policies rather than a person approving every step. As one speaker put it: do not trust the agent, trust the layers you build around it. That is the only way to fix incidents without waking you up at 3 a.m. And when a human does need to step in, it is focused: you approve a policy once, not every decision.

This is a journey, not a leap, and it still has to be proven, one fault class at a time. And that is the good part about little news: the question is no longer whether agents will fix incidents on their own, but how.

So for anyone evaluating solutions today, I would suggest asking one question: was autonomy designed into the architecture, or added as another feature?

What was announced at AGNTCon + MCPCon 2026

FAQ

What is AGNTCon + MCPCon?

AGNTCon + MCPCon is the flagship conference of the Agentic AI Foundation (AAIF), part of the Linux Foundation. It brings together the companies and developers building infrastructure for interoperable, production-ready AI agents, including MCP. The 2026 North America edition ran October 22 to 23 in San Jose, California.

What is the difference between MCP and A2A?

MCP (Model Context Protocol) connects an agent to its tools, APIs and data. A2A (Agent2Agent) lets independent agents discover each other, delegate tasks and share results. The A2A project itself describes the two as complementary, not competing: one is agent-to-tool, the other agent-to-agent.

What are MCP Tasks?

MCP Tasks is an extension to the MCP specification for tool calls that take minutes or longer, such as CI pipelines or human approvals. Instead of holding a connection open, the server returns a durable task ID that the client can poll, answer when input is needed, and resume after a restart.

What does an agent sandbox or gateway actually do?

It puts hard limits around what an agent can touch. NVIDIA’s OpenShell, for example, runs agents in sandboxes with kernel-level isolation and uses declarative YAML policies to restrict access to files, credentials and networks. agentshield works from the other side: it maps attack paths through existing Kubernetes and AWS infrastructure and enforces rules against agents you do not control.

Should SRE teams let agents fix production incidents on their own?

Not all at once. Start where correctness is cheap to check, one fault class at a time, and let policies, not per-step approvals, define what the agent may do. A human approves the policy once; the agent acts within it and verifies the result.

References

AGNTCon + MCPCon North America 2026 (full recordings: Day 1, Day 2)

  • Abhishek Choudhary (TrueFoundry) on the OpenAI and Hugging Face incident: Day 1, 5:08
  • Dawn Song (UC Berkeley) on AI helping attackers: Day 1, 4:45
  • AAIF: the new projects in the foundation, including OpenSandbox, and the member survey (81% in production, 23% fully autonomous): Day 1, 0:19 and 0:24
  • David Soria Parra (Anthropic) on MCP Tasks: Day 1, 0:51
  • Rao Surapaneni (Google Cloud) on agent governance and the swap drill: Day 2, 1:19
  • Thomas Dohmke (Entire) on 57 pull requests a week: Day 2, 0:58
  • Karthik Karunanithi (IBM), “trust the layers”: Day 2, 2:20
  • AWS OpenSearch team, “Are Dashboards Dead?”: Day 2, 4:50

Tools and other sources

See remediation-first in your own stack

Install an agent and watch DataAgent map your topology. No credentials, no commitment.

Try it for freeBook a demo

Keep reading

Cookie Settings