In March 2026, a single infrastructure protocol quietly crossed 97 million installs and got handed to the Linux Foundation for open governance. That’s the moment agentic AI moved from experimental to infrastructure. Here’s what changed, what it means, and what the security industry is now panicking about.
There’s a useful analogy for what happened to AI infrastructure in the first quarter of 2026, and it involves HTTP.
When HTTP became the standard protocol for web communication in the early 1990s, it didn’t happen through a dramatic announcement or a single company winning the browser wars. It happened because a common standard made it possible for any browser to access any server — and suddenly the web became a thing that could be built on rather than a thing that had to be built from scratch every time.
In March 2026, Anthropic’s Model Context Protocol crossed 97 million installs and was handed to the Linux Foundation for open governance. Every major AI provider — OpenAI, Google, Amazon, Microsoft, Meta — now ships MCP-compatible tooling. The Agentic AI Foundation, formed under the Linux Foundation, has received contributions from Anthropic’s MCP, OpenAI’s AGENTS.md, and Block’s goose framework.
When competing labs contribute infrastructure to a neutral body, something significant is happening. The HTTP moment for agentic AI may have just arrived.
What MCP Actually Does, In Plain English
Model Context Protocol is the standard that allows AI agents to connect to external tools, databases, and APIs in a consistent, interoperable way.
Before MCP, building an AI agent that could, say, read from your Salesforce CRM, update a Google Sheet, and send a Slack notification required custom integration code for each connection. Every organisation, every developer, every company building AI-powered workflows had to figure out the plumbing from scratch.
MCP standardises the plumbing. An agent with MCP can connect to any MCP-compatible tool — and the library of compatible tools now includes essentially every major enterprise software platform. Just as HTTP enabled any browser to access any server, MCP enables any agent to use any compatible tool.
The practical impact: building an AI agent that can take a goal (“process all new support tickets, categorise them by urgency, draft responses, route to appropriate team members, and log outcomes”) and execute it across multiple systems is now a matter of connecting the right MCP servers — not months of custom development.
Gartner predicts that 40% of enterprise applications will embed AI agents by end of 2026, up from less than 5% in 2025. That number seems aggressive until you consider that the infrastructure to build those agents is now standardised, widely deployed, and actively governed by a neutral foundation. The barriers to agent deployment are genuinely lower than they were six months ago.
Google’s A2A Protocol: The Next Layer
MCP is about agents connecting to tools. Google’s Agent-to-Agent protocol (A2A) is about agents talking to each other.
A2A defines how agents from different vendors and different platforms communicate, enabling cross-platform agent collaboration that wasn’t possible before. An agent built on OpenAI’s infrastructure and an agent built on Google’s infrastructure can now coordinate on a shared task.
IBM’s Kate Blair, who leads IBM’s BeeAI and Agent Stack initiatives, puts it plainly: “2026 is when these patterns are going to come out of the lab and into real life.” Both IBM projects have been contributed to the Linux Foundation, reinforcing the open-governance direction.
The A2A project is about to hit its first major release. The combination of MCP (agent-to-tool) and A2A (agent-to-agent) creates the basic infrastructure for multi-agent systems that can handle genuinely complex, multi-step workflows across organisational boundaries.
The enterprise market for agentic AI is projected to surge from $7.8 billion today to over $52 billion by 2030.
The 15-to-60 Minute Agent
Something equally significant happened to who can build agents.
Low-code and no-code platforms have collapsed the barrier to entry so dramatically that deploying a working AI agent now takes between 15 and 60 minutes on most modern platforms. No programming required. You describe the goal, connect the tools via MCP, test it, deploy it.
80% of IT teams already use low-code tools. The combination of MCP standardisation and no-code deployment tools means that the ability to build AI agents capable of executing real business workflows is no longer confined to software engineers.
This matters enormously for enterprise adoption. The limiting factor on technology adoption is rarely the technology itself — it’s the ability to deploy and maintain it without requiring specialised skills. When you reduce agent deployment to 15 minutes of configuration by a non-technical user, you’ve removed the bottleneck that was keeping agents out of the mainstream.
By 2028, an estimated 38% of organisations will have AI agents embedded directly within human teams. Not alongside — within. Agents that are assigned tasks, tracked, given identities in systems, and managed the way a contractor or junior employee would be managed.
IBM’s prediction is worth noting: “In the coming years, agentic AI and other non-human identities will outnumber human users in the organisation significantly.” If accurate, this fundamentally changes what “managing a workforce” means.
The Part Nobody in the Agentic Community Wants to Talk About
At the RSAC 2026 cybersecurity conference in San Francisco, a different conversation was happening about the same technology.
“Every day there is news now where agents are doing something funky with enterprise data,” said Rehan Jalil, President of Products and Data at Veeam Software. “Whether it’s exposing sensitive data, or deleting data… or deleting an entire repo of data. It’s happening.”
The 1H 2026 State of AI and API Security Report, which surveyed over 300 security leaders, found something alarming: 48.9% of organisations are entirely blind to machine-to-machine traffic and cannot monitor their AI agents. Nearly half of the companies deploying agents have no visibility into what those agents are actually doing.
47% of organisations have delayed a production release due to concerns about securing APIs exposed to autonomous AI systems.
The security industry’s response is a new category called Agentic Security Posture Management — tools designed specifically to discover, govern, and monitor AI agents and MCP servers. Legacy Web Application Firewalls were built for human-predictable traffic. An AI agent querying 50 APIs simultaneously, making logical decisions about what data to retrieve based on context, looks nothing like a human user session. Traditional security tools simply can’t see it.
The specific vulnerability that RSAC speakers kept returning to: “Shadow AI” — autonomous agents dynamically creating undocumented endpoints or leveraging MCP servers outside the security team’s view, exposing sensitive data without formal oversight. This is not a hypothetical threat. It’s what happens when you give powerful, connected agents to a large organisation and don’t build the governance infrastructure alongside the deployment.
The organisations that are navigating this well are the ones that are building governance from the start — defining what each agent is authorised to access, what it can do, what it cannot do, and maintaining audit trails of agent actions. The organisations that aren’t are discovering the consequences in production.
From Instruction-Based to Intent-Based
The cleanest framing for what the agentic shift means comes from a description that’s been circulating in the developer community this year.
Traditional computing: you specify every instruction. The computer executes exactly what you told it.
Agentic computing: you state a goal. The agent figures out the steps, selects the tools, coordinates with other agents, executes across systems, and delivers results.
The shift from instruction-based to intent-based computing is not incremental. It changes the relationship between human and machine in the same way that the shift from command-line interfaces to graphical user interfaces changed personal computing — not by adding capability, but by making existing capability accessible to an entirely different population of users and use cases.
The infrastructure is now in place: MCP for tool connectivity, A2A for agent collaboration, low-code platforms for deployment, and — this is the part that still needs work — governance frameworks that make it possible to trust agents with consequential tasks.
The companies and practitioners who figure out that last piece will be the ones who capture the bulk of the value from everything else. The MCP install count crossed 97 million in March. The question for April and beyond is what gets built on top of it.
