Agent-to-Agent Protocols in 2026: A2A Reached 1.0, Three ACPs Died or Merged, and MCP Learned to Do Most of the Same Job
What Google's Agent2Agent protocol actually specifies at v1.0, what changed when it moved into the Agentic AI Foundation in August, which vendors have shipped it versus announced it, how MCP's July 2026 revision reproduced A2A's task lifecycle almost state for state, the first real CVE on an A2A surface, what the production data says about how rare multi-hop agent systems are, and a working server and client on the 1.1 SDK with the breaking changes listed.
14 minSep 8, 2026Open Weights in 2026: Chinese Labs Ship the Frontier, the Licenses Grew Clauses, and Brussels Started Enforcing
DeepSeek V4, Kimi K3, GLM-5.3, Qwen3.8 and Xiaomi's MiMo are the open frontier now; Meta went closed and came back; the licences quietly acquired revenue thresholds; the EU AI Office got its enforcement powers on 2 August. What I found when I read every licence file, with the Hugging Face API calls that check them.
16 minSep 8, 2026Confidential Computing for AI in 2026: Apple Moved to Google's TEEs, a $1,000 Interposer Broke the Keys, and Firecracker Still Can't Do It
What a hardware enclave actually promises for an AI workload, what it costs (4 to 28% depending on what you measure), what broke it this year (TEE.fail, Battering RAM, WireTap), who runs inference in one (Apple, Google, Meta, a dozen startups) and who doesn't say (OpenAI, Anthropic). Plus the state of SEV-SNP, TDX and Arm CCA in the kernel, why my microVM platform cannot offer it yet, and the commands to verify an attestation yourself.
15 minSep 8, 2026AI Found the Bugs: 23,000 Findings in a Month, a 3-Day Patch Mandate, and the End of curl's Bounty
From AIxCC's 18 real bugs in August 2025 to Project Glasswing's 23,019 findings by May 2026 and the first AI-written zero-day exploited in the wild. What the cyber reasoning systems, Big Sleep, Codex Security and Mythos Preview actually did, why bug bounties are drowning, why CISA now wants federal patches in three days, and a workflow for a small team that keeps the humans looking only at validated findings.
13 minSep 7, 2026Who Is This Agent? Non-Human Identity in 2026, From the RFCs to the Breaches
Machines outnumber humans 109 to 1 in the enterprise directory, the OAuth working group has 70 drafts in flight, MCP just deprecated dynamic registration, and an agent with an over-scoped token deleted a production database in nine seconds. What actually standardised this year, what shipped, and the delegation chain I would build.
16 minSep 6, 2026Post-Quantum Migration in 2026: What's Done, What's Stuck, and What to Do This Quarter
Two-thirds of browser traffic to Cloudflare is already post-quantum. Your SSH is too. Your certificates are not, and won't be until 2027. A field guide for infrastructure engineers, with verified commands and hard deadlines.
13 minSep 6, 2026The Worms Learned to Use Your AI Agent: A Year of npm Supply-Chain Attacks
From s1ngularity invoking Claude Code to hunt for wallets, to Shai-Hulud self-publishing across 500 packages, to IronWorm stealing AI API keys — the twelve months that changed how I install software.
13 minSep 6, 2026MCP Security in 2026: The Protocol Got Hardened. The Ecosystem Didn't.
A year of MCP CVEs, a rewritten spec, an NSA guidance sheet and an OWASP Top 10 — what actually changed, what didn't, and the six controls I'd insist on before an MCP server touches production.
12 minSep 2, 2026Isolation Is Not an Abuse Control: Lessons From My Fleet
A free-tier signup mined crypto on my microVM fleet in 27 minutes. Containment held perfectly and it changed nothing. What I built afterwards, in what order.
9 min