Agentic Systems — Research Brief (2026-11-01)

Key Developments

Agent standards consolidate under one neutral foundation with ten projects
- What changed: The Agentic AI Foundation added four projects, bringing its total to ten, at its October 22 conference.
- Why it matters: Enterprise teams get one neutral venue to track for skills, sandbox, response-API and protocol standards.
- Sources: [1], [3], [5]
NIST publishes ten design tenets for giving AI agents distinct identities
- What changed: NIST researchers proposed ten design tenets for agent identity, authentication and authorization on October 27.
- Why it matters: Banks get a reference vocabulary for agent identity gap assessments ahead of planned NCCoE demonstrations.
- Sources: [6], [7]
Major US banks restrict third-party AI agents logging into customer accounts
- What changed: Banks reportedly began blocking third-party agents that use customers' own credentials, or limiting them to read-only access.
- Why it matters: Agent access to external systems is turning into an identity and authorization gate on deployment.
- Sources: [8], [9], [10]

Notable Papers / Models / Tools

Item	Date	Source	Summary
EvolveMAS: self-evolution for decentralized multi-agent systems (arXiv:2610.34450)	Oct 2026	[24]	Pre-retrieved candidate. Affiliation not shown in retrieved text, moderate confidence, abstract only. Each main agent gets a dedicated MemoryAgent that keeps structured memory outside the agent's own reasoning context. It updates episodic, semantic and working memory during an episode, then consolidates across episodes. Memory writes become a separately governable component you can log and audit. I did not see the benchmark gains.
DiscernMem: refining memories and learning when to use them (arXiv:2610.36652)	Oct 2026	[25]	Pre-retrieved candidate. Affiliation not shown, moderate confidence. A training-free method compares team runs with and without a memory to find defective rules, then tests repairs against earlier tasks to avoid regressions. A meta-memory records each memory's past uses and learns when to skip it. Gains over the strongest baselines were 0.51 to 4.32 points on AutoGen, CAMEL and MacNet, using a 4B model. Authors' own benchmarks.
Disparity Laundering: Consensus Without Fairness in Clinical Multi-Agent Systems (arXiv:2610.38215)	Oct 2026	[26]	Pre-retrieved candidate. Authors include Christopher C. Yang. I believe he is at Drexel, so moderate confidence. Across five model families and four aggregation topologies on 120 MIMIC-IV cases, all 20 configurations gave Black patients more acute triage under demographic swaps. Fairness instructions and masking did not close the gap. The authors argue that per-model or per-output audits cannot certify the committed multi-agent decision. Clinical, but directly relevant to credit and fraud-triage agent panels. Authors' own results.
The Model Knows Better: Defending Medical Multi-Agent Systems Against Prompt Injection (arXiv:2610.22594)	Oct 2026	[27]	Pre-retrieved candidate. Authors Sakib, Zhu and Uzuner. I believe they are at George Mason, so moderate confidence. One injected passage succeeded in up to 61% of cases, and multi-agent deliberation did not reliably protect against it. A training-free defense checks each clinical judgment against the patient findings alone and cut attack success to 4–7% on MedQA. Verifying conclusions against source facts may transfer to other domains. Results are self-reported.
Cryptographically Secure Agent-to-Agent Communication (arXiv:2610.23078)	Oct 2026	[28]	Pre-retrieved candidate. Affiliation not shown, moderate confidence, abstract only. A survey plus a zero-trust reference design. It combines decentralized identifiers, task-scoped verifiable credentials, mutually authenticated TLS with hybrid post-quantum key exchange, signed CBOR envelopes and context-aware monitoring. I saw no deployment evidence. Useful as a checklist beside the NIST tenets.
IE-Prop: estimating propagated risk in LLM multi-agent systems (arXiv:2610.33282)	Oct 2026	[29]	Pre-retrieved candidate. Affiliation not shown, moderate confidence. Learns separate effects for correct and incorrect upstream agents, then propagates per-agent error risk through the execution graph. Final-node AUROC rose about 0.05 on average over the baseline across three architectures and three benchmarks. A modest gain, but it points to trace-based risk scoring for agent handoffs.
Auditable Belief Updates as a Missing Safety Layer for LLM Multi-Agent Systems (arXiv:2610.38869)	Oct 2026	[30]	Pre-retrieved candidate. Affiliation not shown, moderate confidence. A position and architecture paper. Proposes externalizing agent beliefs into a structured store. A "Cognitive Firewall" bounds or rejects updates that are weakly evidenced. It also names manufactured consensus and cascading misinformation as group-level risks. Conceptual only, with no results I could verify.
Audited Pivot Scoring for truthful confidence reporting (arXiv:2610.33728)	Oct 2026	[32]	Pre-retrieved candidate. Affiliation not shown, moderate confidence. When reported confidence decides which agent gets downstream attention, agents inflate it. In the authors' experiments, LLM agents inflated confidence under Top-K allocation. The proposed mechanism uses sparse audits and proper scoring rules. Theory-heavy, with the authors' own experiments. Relevant to any orchestrator that routes by agent self-reported confidence.
MCP Failure Lab (Zenodo)	2026, date not shown	[31]	Pre-retrieved candidate. Single author, 0 citations, unaffiliated, unverified. A deliberately faulty MCP server with six injectable fault modes, plus fixtures for regression-testing client recovery. 32 runs across four platforms produced identical trace hashes per fixture cell. The release is small and synthetic, and no language model took part. Treat it as a test-harness idea, not evidence.
OpenCode MCP OAuth remote-code-execution flaw	Disclosed Oct 19, reported Oct 22, 2026	[17]	Tier 2 trade press. A malicious or hijacked remote MCP server could run code on a developer's Windows or WSL machine during sign-in. The server-supplied authorization URL was passed to a browser-launch helper. The fix reportedly landed in a refactor with no security note, which matters for patch tracking. Review which remote MCP servers coding agents may authenticate to.
Mastra @mastra/core 1.79.0	Oct 21, 2026	[18]	GitHub release notes, single source. Adds span aggregation, so per-tool p95 latency and per-agent token cost can be queried, plus time-to-first-chunk fields. Agent sessions are now addressed by session ID, which allows several sessions per resource. Operability work, not a new capability class.
LangGraph checkpoint-postgres 3.2.0 and langgraph 1.2.16	~Oct 13–16, 2026	[19]	Release aggregator, single source, slightly outside the 14-day window. Adds checkpoint pruning to the Postgres checkpointers. Long-running agent state in Postgres can now be trimmed, which matters for retention policy and storage growth.
CrewAI 1.15.28	Oct 14, 2026	[20]	Release aggregator, single source, slightly outside the 14-day window. Adds an evaluation command to locate where a stopped run failed, plus better context-window reporting. Small, but it targets failure localization in agent runs.
Databricks MemCurrent, behind Agent Bricks Memory and Genie	Oct 20, 2026	[14]	[Vendor marketing], single-vendor source. Combines episodic and derived memory with three access paths: plugins, on-demand tools and an offline consolidation pipeline. Databricks reports a tripled pass rate and 31% fewer tokens on its own internal benchmark. No independent validation.

Technical Deep-Dive

NIST's agent identity tenets and the control-plane split they imply. NIST's October 27 blog post sets out an initial ten design tenets for managing agents in identity and access systems, across enterprise and consumer use [6]. I read excerpts and secondary coverage, not every tenet. The central moves are as follows. Agents get a distinct identity, separate from any human or service account. Their credential lifecycle is managed separately from human principals. Least and zero standing privilege applies, so an agent holding a valid token can still be interrupted if it is hijacked mid-task. High-risk actions trigger human escalation. Monitoring uses agent-specific metrics and thresholds [6][7]. The architectural claim is the most decision-relevant part. The system that decides what an agent attempts must be separated from the system that controls what it may access, and guardrails alone are insufficient against prompt injection and privilege escalation [7]. That separation is meant to be enforced around the agent and between it and the systems, data, credentials and environments it touches [6].

The bank story shows why this matters. Agents that sign in with a customer's own username and password inherit that person's full identity. Banks reportedly cannot always tell an authorized agent from a rogue one, and they are moving toward read-only access as an interim control [8][9]. Under NIST's framing, that is a failure of distinct identification and scoped authority, not a weakness of any model. The OpenCode flaw is a developer-side analogue. A hostile MCP server got code execution during sign-in, and that code ran with the developer's own access [17].

Early reference implementations show what "credentials outside the agent" can look like. Google says its Agent Compute Engine runs each agent in a microVM and keeps backend credentials out of the sandbox. Per Futurum's reading, its Agent Gateway checks user, agent and node identities before attaching credentials to outbound requests. Futurum also notes that GKE and Cloud Run support is listed as coming soon, and that the gateway is documented as available only for agents on Google's own platform [11]. That is a vendor design with analyst commentary, not independent validation. Alibaba's OpenSandbox, now an AAIF project, offers an open alternative with a sandbox lifecycle and execution API plus Docker and Kubernetes runtimes [23]. Neither implements NIST's tenets by name, so I would not call either "compliant".

Limitations are significant. A blog post is not a draft standard, and NIST says it will inform NCCoE demonstrations [7]. Nothing here defines conformance tests, delegation semantics across organizations, or how an external bank would verify an agent's identity at login. The FCA is also pointing at agent identity and delegated authority as topics for a future "trusted framework" [15]. The practical step is to run a gap assessment of current agent deployments against these ten tenets. The first question to ask is whether any agent runs on a human's credentials.

Landscape Trends

[Agentic Systems × Safety, Assurance & Governance] Identity is becoming the common control point across standards, regulators and banks. In one week NIST published agent identity tenets [6]. The FCA said it will work with industry and frontier labs on a trusted framework covering agent identity, delegated authority, accountability and execution [15][16]. Banks began restricting agents that borrow customer credentials [8][9]. The AAIF conference program reportedly shifted from protocol features toward security and identity, with open problems in attestation, audit and payments, though some security extensions remain drafts [3]. What is converging is the question to ask, not a shared specification. Each body asks who the agent is and who authorized it. Nobody has published a common answer yet.
[Agentic Systems × Enterprise GenAI Adoption] Internal agent scale is outrunning external agent access. UBS says employees run more than 12,700 personal agents, with 608 live AI use cases, up 81% year on year [21]. The same sector is blocking outside agents from customer accounts [8][9]. The split suggests banks will scale agents they control, with their own identity and logging, well before they accept agents they do not control. The UBS coverage does not say how those personal agents are governed [21], so the figure measures activity, not controlled adoption.
Callback to 2026-10-25 (ToFu and EAIR, tool trust boundary): reinforced. That brief examined trust at the MCP tool boundary. This cycle adds a field example of a client trusting a server-supplied value. A server-supplied OAuth URL led to code execution in a coding agent, and the fix reportedly shipped inside a refactor with no security note [17]. Trust failures run both ways between client and server. Teams that track MCP exposure only through CVE feeds will miss silent fixes like this one.
Protocol governance is concentrating under the AAIF while identity, attestation and cross-cloud policy remain plans. The AAIF now hosts ten projects, including MCP, A2A, Agent Skills, Open Responses and OpenSandbox [1]. Anthropic says more than 70 agent platforms already integrated Agent Skills [4]. AWS says Open Responses has compliance tests and versioning, though the spec is still evolving [2]. These are vendor statements about adoption, not independent measures. Google's cross-cloud governance claim, for example, is still limited to its own platform in the documentation [11].
[Agentic Systems × LLM Production Infrastructure] Frameworks are competing on operability, and sandboxes are becoming a platform layer. The latest Mastra release adds per-tool latency and per-agent cost aggregation [18]. LangGraph can now prune Postgres checkpoints [19]. CrewAI added a command to localize failed runs [20]. Google's microVM sandbox and Alibaba's OpenSandbox, which the AAIF now hosts, treat agent execution as an isolated runtime with brokered credentials [11][23]. Cisco's open-sourced Quarry (alpha) applies a rule language to multi-step agent behavior, including MCP interactions [12][13]. This is the shape of agent-specific tracing and detection. It is all vendor or single-source evidence, so none of it shows category maturity.

Vendor Landscape

Google Cloud, Agent Compute Engine (announced Oct 22): A managed microVM sandbox per agent with credentials held outside it. Google says governance will extend to other clouds and local coding agents, but the documentation limits the gateway to its own platform for now [11]. [Tier 2 sources only]
Cisco, Project Quarry (open-sourced ~Oct 29, alpha): A neurosymbolic rule language and engine for detecting multi-step agent attacks. It covers tool use and MCP interactions, and it already runs inside Cisco AI Defense. Syntax may change before a stable release. Cisco recommends human review of agent-generated rules before enforcement [12][13]. [Tier 2 sources only]
AWS, Amazon Bedrock AgentCore CLI 1.0 (Oct 28): The CLI reached general availability. It can work directly with harnesses, runtimes, memory, identity, gateways and payments [22]. [Tier 2 sources only]
AAIF membership: Seven new Gold members joined, including Royal Bank of Canada, Ant Group and Vercel. RBC stated an interest in standards for how agents authenticate, transact and operate responsibly [5].

Sources

Linux Foundation, "Agentic AI Foundation Announces Four New Projects: Agent Skills, Open Responses, OpenEnv, and OpenSandbox" (Oct 22, 2026) — https://www.linuxfoundation.org/press/agentic-ai-foundation-announces-four-new-projects-agent-skills-open-responses-openenv-and-opensandbox [Tier 1 — standards body/foundation]
AWS Open Source Blog, "Open Responses Joins AAIF with AWS Support" (Oct 22, 2026) — https://aws.amazon.com/blogs/opensource/open-responses-joins-aaif-with-aws-support/ [Tier 2 — vendor announcement]
InfoQ, "AGNTCon + MCPCon 2026: Agentic AI Foundation Adds Four Projects as MCP Turns to Security" (~Oct 26, 2026) — https://www.infoq.com/news/2026/10/agntcon-mcpcon-2026/ [Tier 2 — enterprise tech news]
Anthropic, "Donating Agent Skills to the Agentic AI Foundation" (Oct 22, 2026) — https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation [Tier 2 — vendor announcement]
Linux Foundation, "Agentic AI Foundation Surpasses 300 Members in Less Than One Year" (Oct 22, 2026) — https://www.linuxfoundation.org/press/agentic-ai-foundation-surpasses-300-members-in-less-than-one-year [Tier 1 — standards body/foundation]
NIST Cybersecurity Insights blog, "Design Tenets for Agent Identity Management Systems" (Oct 27, 2026) — https://www.nist.gov/blogs/cybersecurity-insights/design-tenets-agent-identity-management-systems [Tier 1 — standards body]
Industrial Cyber, "NIST outlines 10 design tenets to strengthen AI agent identity and access management" (~Oct 28–29, 2026) — https://industrialcyber.co/nist/nist-outlines-10-design-tenets-to-strengthen-ai-agent-identity-and-access-management-proposes-safeguards/ [Tier 2 — trade press]
Axios, "Scoop: Unvetted AI agents are accessing U.S. bank accounts" (Oct 22, 2026) — https://www.axios.com/2026/10/22/ai-agents-banks-unauthorized-accounts-access [Tier 1 — independent journalism, anonymous sources]
AI News, "Banks block AI agents as US open banking rule stalls" (~Oct 30, 2026) — https://www.artificialintelligence-news.com/news/banks-block-ai-agents-open-banking-rule/ [Tier 2 — trade press recap of Axios and Reuters]
BankInfoSecurity, "AI Agent Identity Crisis Forces Banks to Restrict Access" (~Oct 30, 2026) — https://bankinfosecurity.com/ai-agent-identity-crisis-forces-banks-to-restrict-access-a-33266 [Tier 2 — trade press]
Futurum Group, "Google Agent Compute Engine Puts Cross-Cloud Governance to a Parity Test" (Oct 30, 2026) — https://futurumgroup.com/insights/google-agent-compute-engine-puts-cross-cloud-governance-to-a-parity-test/ [Tier 2 — analyst commentary on vendor announcement]
Cisco Blogs, "A Shared Language for Agent Defense: Introducing Project Quarry" (~Oct 29, 2026) — https://blogs.cisco.com/ai/project-quarry-agent-security-detections [Tier 2 — vendor announcement]
The420.in, "Cisco Open-Sources Quarry To Detect Multi-Step Attacks By AI Agents" (~Oct 29, 2026) — https://the420.in/cyber-crime/cisco-open-sources-quarry-to-detect-multi-step-attacks-by-ai-agents/ [Tier 2 — trade press]
Databricks, "MemCurrent: Designing Persistent Memory for Production Agents" (Oct 20, 2026) — https://www.databricks.com/blog/memcurrent-designing-persistent-memory-production-agents [Tier 3 — [Vendor marketing], vendor-reported benchmark]
FCA, Jessica Rusu speech, "Building the future of finance in the age of AI" (Oct 19, 2026) — https://www.fca.org.uk/news/speeches/building-future-finance-age-ai [Tier 1 — regulator primary]
Freshfields, "AI in financial services: FCA good and poor practice and the road to agentic finance" (Oct 22, 2026) — https://www.freshfields.com/en/our-thinking/briefings/2026/10/ai-in-financial-services-fca-good-and-poor-practice-and-the-road-to-agentic-finance [Tier 2 — law-firm analysis]
The Hacker News, "OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSL" (Oct 22, 2026) — https://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html [Tier 2 — security trade press]
GitHub, mastra-ai/mastra, @mastra/core@1.79.0 release notes (Oct 21, 2026) — https://github.com/mastra-ai/mastra/releases/tag/%40mastra/core%401.79.0 [Tier 2 — GitHub release]
Releasebot, LangChain/LangGraph release notes, October 2026 — https://releasebot.io/updates/langchain-ai [Tier 2 — release aggregator]
Releasebot, CrewAI release notes, October 2026 — https://releasebot.io/updates/crewai [Tier 2 — release aggregator]
PYMNTS, "UBS Employees Run 12,700 AI Agents as Bank Automation Accelerates" (~Oct 29, 2026) — https://www.pymnts.com/news/banking/2026/ubs-employees-run-12700-ai-agents-as-bank-automation-accelerates/ [Tier 2 — trade press on company results]
AWS What's New, "Amazon Bedrock AgentCore CLI version 1.0 is now available" (Oct 28, 2026) — https://aws.amazon.com/about-aws/whats-new/2026/10/amazon-bedrock-agentcore-cli-version-1-0-available/ [Tier 2 — vendor announcement]
GitHub, alibaba/OpenSandbox README (accessed Nov 1, 2026) — https://github.com/alibaba/OpenSandbox [Tier 2 — project documentation]
EvolveMAS: A Unified Self-Evolution Framework for Decentralized Multi-Agent Systems, arXiv:2610.34450 (Oct 2026) — https://arxiv.org/abs/2610.34450 [Tier 1 — arXiv preprint, affiliation unverified]
Remembering Is Not Enough (DiscernMem), arXiv:2610.36652 (Oct 2026) — https://arxiv.org/abs/2610.36652 [Tier 1 — arXiv preprint, affiliation unverified]
Disparity Laundering: Consensus Without Fairness in Clinical Multi-Agent Systems, arXiv:2610.38215 (Oct 2026) — https://arxiv.org/abs/2610.38215 [Tier 1 — arXiv preprint, affiliation unverified]
The Model Knows Better: Defending Medical Multi-Agent Systems Against Prompt Injection, arXiv:2610.22594 (Oct 2026) — https://arxiv.org/abs/2610.22594 [Tier 1 — arXiv preprint, affiliation unverified]
Cryptographically Secure Agent-to-Agent Communication in Multi-Agent Systems, arXiv:2610.23078 (Oct 2026) — https://arxiv.org/abs/2610.23078 [Tier 1 — arXiv preprint, affiliation unverified]
Estimation of Propagated Risk in LLM-based Multi-Agent Systems, arXiv:2610.33282 (Oct 2026) — https://arxiv.org/abs/2610.33282 [Tier 1 — arXiv preprint, affiliation unverified]
Auditable Belief Updates as a Missing Safety Layer for LLM-Powered Multi-Agent Systems, arXiv:2610.38869 (Oct 2026) — https://arxiv.org/abs/2610.38869 [Tier 1 — arXiv preprint, affiliation unverified]
MCP Failure Lab (Zenodo, A. Alvord, 2026) — https://openalex.org/W7224123285 [Tier 3 — unaffiliated Zenodo item, unverified]
Strategic Calibration in LLM Multi-Agent Systems: Audited Pivot Scoring for Truthful Elicitation, arXiv:2610.33728 (Oct 2026) — https://arxiv.org/abs/2610.33728 [Tier 1 — arXiv preprint, affiliation unverified]