AI Agents October 2026: MCP Spreads as Security Gaps Widen

The month agents got jobs, and a lot of plumbing

In October 2026, AI agents stopped being mostly about what they could do and started being about where they could reach. In the space of a few weeks, every major lab shipped or previewed an agent built to keep running in the background. The Model Context Protocol (MCP), the connector standard underneath many of these agents, spread from developer tools into accounting, investor relations, crypto analytics and retail. Marketplaces for buying and sharing agents appeared in security, advertising and enterprise software. Security researchers kept finding holes along the way.

The main lesson of the month is that the agent race is now about infrastructure: identity, permissions, connectors and procurement. That infrastructure is spreading faster than anyone is governing it.

The platform giants converge on the "digital coworker"

Google Cloud made the biggest announcement. On October 8, at its Gemini at Work event, it introduced the Gemini agent, a single agent that answers questions, writes and runs code, creates content and coordinates sub-agents.11 VentureBeat reported that the agent can work on one objective for hours or days. Each agent also gets a persistent identity with its own storage and calendar presence.11 In its "coworker" mode, the agent gets its own Workspace account with email, calendar and Drive, and it can only see what teammates share with it. Reports also mention per-agent audit trails and spending caps.12 For now the release is limited: it is in private preview, with no general-availability date and no public price.11

OpenAI moved first. It introduced Dots, always-on agents with their own cloud computer, on September 29, a few days before October began.13 One roundup said Dots connect to more than 4,000 apps and run through ChatGPT, Slack and Teams.12 Sensitive actions, such as changing passwords or permanently deleting data, require explicit user consent.17 OpenAI also gave its Agents API a hosted browser for computer use.16 Microsoft announced Autopilot, an updated version of its Scout agent, which acts as a digital coworker with its own identity and configurable permissions.17 On October 21, CNBC reported that Anthropic was previewing Claude Duet, a personal agent that competes with Dots and Meta's Muse.12

These launches look alike on purpose. Google, Microsoft and OpenAI each give their agents a distinct identity, a persistent workspace and limits on what they can do. In practice, the industry has settled on treating an agent like a new employee, with an account and a manager, rather than like a chatbot window. Enterprise vendors are following the same template. Oracle extended its AI Agent Studio to industry applications on October 21 with no-code, low-code and pro-code building and support for multi-agent teams.8 Agents built there follow existing access controls and keep an audit trail.8 ZoomInfo launched Agent Teams, built on technology from its acquisition of DoubleO.ai, to run sales and marketing workflows across a company's systems.20

Coding tools moved even faster. Cursor shipped mobile remote control for agents, an app marketplace called Origin with more than 20 integrations including Cloudflare and Linear, and an Environments API beta. Its cloud agents can now manage up to 300 repositories per environment.14 Cursor also says its cloud agents now produce 56% of the pull requests that get merged.14 If that holds up, the majority of code changes on a major platform would come from agents rather than people typing.14

MCP becomes the default connector, and the default attack surface

MCP was everywhere this month. Walmart launched Agent Gateway, an MCP server that lets approved agents search its inventory and buy on a shopper's behalf. Customers can set per-agent spending limits or require approval for each purchase.10 TechCrunch pointed out that Walmart is taking the opposite approach to Amazon, which has started blocking AI agents from buying on its site.10 Qlik's MCP server appeared in Anthropic's Claude Directory.28 Financial Cents launched an MCP server for accounting firms.23 Notified opened a beta that connects PR and investor-relations data to Microsoft Copilot first, with ChatGPT, Claude and Gemini to follow.25 CryptoQuant released an MCP server that exposes more than 245 on-chain and market metrics.22 Coverage disagrees on how finished that product is: one outlet presented it as a launch, while another noted it was still in beta about five months after it was announced.2229

Adoption figures back up the trend. Radware, citing a Stacklok survey, said nearly half of software companies use MCP in production and 19% use it broadly.21 The protocol itself also changed. Under the 2026-07-28 specification, server instructions moved into discovery responses, and Claude Code shortens instructions to 2,048 characters by default.27

The security reporting was much less upbeat, and it is the most important thread of the month. Ox Security analyzed 15,465 MCP servers across three public registries. Nearly 16% of the 5,095 unique hostnames resolved to servers outside the US, including in Russia and China. More than 2% no longer resolve at all, which means an attacker could buy the domain and impersonate the server.26 In a test with Claude Code, a single "always-allow" permission let a malicious server read sensitive files such as .env without any further prompt. Anthropic said that is documented behavior.26 Separately, Pillar Security disclosed a critical flaw in the OpenCode coding agent: a malicious MCP server could run code on Windows and WSL machines when a developer signed in. The vendor fixed it quietly, without a CVE, and argued that user-configured MCP servers are outside its trust boundary.30

The same disagreement shows up in both cases. Security researchers treat MCP-level risks as flaws the vendor should fix. Anthropic and Anomaly, the company behind OpenCode, treat them as the user's responsibility. Until one side gives way, security vendors will fill the gap. Radware launched MCP Server Protection, which covers protocol abuse, tool enumeration and denial-of-service attacks.2124 Nvidia introduced an Open Agent Safety Platform with more than 100 partners.16 Cisco and Nvidia are combining their tools to run coding agents in sandboxes.18

Marketplaces: from app stores to procurement tools

Agent marketplaces took several different forms. Netskope's AgentSkope Marketplace is mainly a purchasing tool. It replaces buying agents one at a time with a single catalog and a shared pool of capacity credits.12 Adyen open-sourced a command-line tool, also called Agent Marketplace. It shares skills, subagents, hooks and MCP servers across eight coding tools, including Claude Code, Codex and Cursor, and scans resources for hidden text and risky capabilities before they are published.3 Adyen says plainly that these checks lower risk but do not prove a resource is safe.3 NEAR AI's Agent Market holds a buyer's payment until the work is accepted, and builders keep ownership of their agents.9 Sierra said it had joined the OpenAI Marketplace and launched a partner ecosystem.19

Advertising may be the clearest test of agent-to-agent trading. Optable launched an Agentic Marketplace that connects buyer and seller agents and charges no extra transaction fees to customers who invoice each other directly.6 At the same event, Emarketer projections put agentic media buying at only $100 million in 2026, rising to $29.5 billion in 2028.6 Alkimi's monthly review said agent-to-agent buying moved from one-off demos to repeat campaigns, with most deals in TV. Fox, NBCUniversal with Carat, and LG with Magnite all announced agent-led buying.15

Protocols for agents meeting businesses

New standards are aimed at the point where an agent deals with a business. Sierra and Meta announced the Personal Agent Protocol on October 6. Partners include Shopify, Stripe and Walmart, and Sierra published a draft, called Poppy, on October 9.1913 Shopify now lets authorized browser agents complete checkout using WebMCP.17 In advertising, the AdCP 3.2 standard reached a stable release, and the public comment period for IAB Tech Lab's OpenProposal closed on October 22.15

Open source: consolidation and maturity

Open-source agent frameworks are consolidating more than they are multiplying. Microsoft Agent Framework, which merged AutoGen and Semantic Kernel, reached 1.0 in April and is now the officially recommended successor. AutoGen is in maintenance mode.3338 Cursor acquired Continue, and that project's repository is now archived.33 A review of repositories in October found steady releases across LangGraph, CrewAI, the OpenAI Agents SDK, Google ADK, Pydantic AI, Strands and Mastra. Most of them support MCP and offer some way for a human to approve steps.32 Reports disagree on release history, though. One comparison dates Google ADK's launch to April 2026.39 Another says ADK 2.0 for Python shipped in May, which implies the framework existed well before that.32 Readers should check specific dates against the original repositories.

Among ready-to-run open-source agents, OpenClaw has more than 392,000 GitHub stars by one count.37 OpenCode has passed 208,000 stars, according to its own homepage.33 Simular released Agent S4 on October 20 and claims the best open-source result on the OSWorld V2 computer-use benchmark.34

What to watch

Looking across all of this coverage, agents now have more access than they have oversight. Vendors are giving agents identities, wallets and checkout rights. The protocol connecting them has no built-in concept of geographic region, and vendors and researchers disagree about who is responsible when a server is malicious.26 The companies best placed for the next phase are the ones that combine broad reach with strict controls, such as Walmart's per-agent spending caps and Oracle's audit trails.108 Expect governance features, rather than new capabilities, to be the main selling point in agent announcements through the end of 2026.