Google’s Agent2Agent protocol moves under the Agentic AI Foundation

What changed: Google’s Agent2Agent protocol for communication between independent AI agents is becoming a hosted project of the Agentic AI Foundation, the same specialist body that stewards the Model Context Protocol for connecting AI apps to tools and data. This shift places agent-to-agent messaging in a vendor-neutral home alongside other open agent standards.

Why it matters: Builders of multi-agent systems can now align on a shared protocol instead of wiring up bespoke messaging for each vendor stack, which should reduce integration cost and lock-in over time. Buyers evaluating “agent platforms” can use A2A support as a concrete test of interoperability rather than relying on vague claims about openness.

Try/watch: Map one or two of your highest-value agent workflows and identify where custom glue could be replaced with A2A once SDKs and libraries ship from the foundation or major vendors.

New payment rails and browser runtime let agents pay and browse more like humans

What changed: LangChain released AgentCore Payments middleware that catches HTTP 402 payment-required responses, checks charges against a session budget, signs transactions through Amazon Bedrock’s AgentCore, and retries calls without changes to agent code. Settlement runs over x402, a stablecoin-based micropayment scheme now stewarded at the Linux Foundation, while Cloudflare launched Kitesurf, a browser runtime built for AI agents that runs on its Workers platform, uses 3–7x less CPU and memory than Chromium, and integrates with x402 so agents can pay for web resources autonomously, with more than 20 companies already experimenting.

Why it matters: Teams building agents that need to call paid APIs or interact with websites behind paywalls get a ready-made pattern for budgets, receipts, and automated settlement instead of hand-rolled billing logic. Kitesurf’s lighter runtime and close link to Cloudflare’s edge can lower infrastructure costs for web-native agents while giving security teams a contained browser surface to monitor.

Try/watch: Start with a low-risk scenario, such as letting an internal agent top up test environments or buy small data pulls, enforcing strict per-session budgets and detailed logging before extending x402-based payments to production-facing workflows.

DeepSeek’s Harness framework targets modular, plug-in-first autonomous agents

What changed: DeepSeek launched a developer preview of DeepSeek Harness, a modular software framework designed to help developers build autonomous AI agents that can operate external software, execute code, and complete complex tasks with minimal supervision. Harness ships with a plug-in-first architecture and four operational modes—standard, code-focused, creative, and minimal—so teams can swap reasoning components and tailor behavior to different workloads.

Why it matters: Harness gives engineering teams a structured way to assemble agents from interchangeable parts instead of monolithic “do everything” bots, which can simplify debugging and compliance reviews. The code-focused mode, which can write and execute code across multiple applications simultaneously, offers a direct competitor to existing coding agents and may appeal to teams that want more control than closed SaaS tools provide.

Try/watch: Pilot Harness on a constrained workflow such as automating test generation or log triage, instrumenting each plug-in for telemetry and fallback so you can measure reliability before letting these agents touch production systems.

Zaptiva rolls out agentic AI services for autonomous digital workforces

What changed: Zaptiva announced an expansion of its Agentic AI Development Services, aimed at helping enterprises build and deploy autonomous AI agents that interpret information, make decisions, and execute actions across existing business systems. These agents can monitor activity in environments such as ERP, CRM, EDI, spreadsheets, APIs, accounting platforms, and legacy applications, then respond to changing conditions and escalate edge cases that still need human judgment.

Why it matters: For operators sitting on a mix of old and new systems, Zaptiva’s approach offers a way to layer AI agents directly into current workflows rather than waiting for a full system replacement. This can turn fragmented, manual processes—such as order-to-cash or claims handling—into semi-autonomous pipelines, while still keeping humans in the loop for exceptions.

Try/watch: Choose one cross-system process with clear rules and measurable outcomes, define guardrails and escalation thresholds, and work with a partner or internal team to deploy a pilot “digital worker” that runs alongside staff before committing to broader rollout.

Taiwan cyberattack shows agentic AI is now an operational threat, not just theory

What changed: Taiwan’s government confirmed that hackers deployed an autonomous AI system built from open-source agents to carry out a multi-day cyberattack on its agencies, mapping 21 government systems, compromising 85 accounts, and exfiltrating more than 2,500 personnel records over four days. Analysis by Israeli firm Dream and follow-on reporting shows the system coordinated up to eight AI agents that handled reconnaissance, credential attacks, and deciding next steps without continuous human control, forming part of a broader “agentic AI threat cluster” of seven incidents tracked since late 2025.

Why it matters: Security and IT leaders can no longer treat autonomous agents as a lab curiosity—offensive operators are already using agentic AI to automate reconnaissance, lateral movement, and data theft at machine speed. The cluster analysis highlights that identity and authentication exposures, such as discoverable federation endpoints and weak single sign-on configurations, are the primary entry points these agents exploit.

Try/watch: Run a targeted review of your identity surface and public documentation, deploy behavioral detection tuned for automated reconnaissance and rapid-fire credential testing, and rehearse incident playbooks that assume attackers can spin up many coordinated AI agents rather than a single human-driven intrusion.