Who Owns the Plumbing When AI Agents Start Paying the Bills?

Key Highlights

• The Agentic AI Foundation added four contributed projects at AGNTCon + MCPCon North America in San Jose: Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face, and OpenSandbox from Alibaba. That takes AAIF from three launch projects in December 2025 to ten.
• In his keynote, "Who Keeps It Open?", AAIF CTO Manik Surtani argued that an open license alone does not keep infrastructure open, contrasting Android with Kubernetes.
• Surtani named agent identity, attestation, audit, and payments as the open problems, and none of those layers was among the four new projects.
• In a conversation with us the following day, Surtani described fine-grained delegation of identity and authority as the most important capability the industry has yet to deliver convincingly.
• Our interpretation is that the keynote was addressed to the foundation's largest members as much as to outside developers.

The News

At AGNTCon + MCPCon North America in San Jose on 22 October, Agentic AI Foundation CTO Manik Surtani used his keynote to warn that if the industry is not careful, one company ends up owning the plumbing and everyone else pays rent. The same day, AAIF announced four projects contributed by Anthropic, OpenAI, Hugging Face, and Alibaba, taking the foundation from three launch projects to ten.

For enterprise buyers, the pairing offers a clearer map of which agent layers are moving under neutral governance and which remain unclaimed. The keynote is available on the Day 1 livestream (https://www.youtube.com/watch?v=iNV5-YkPHW4).

Analyst Take

Surtani's question sounds philosophical, but for anyone signing agent contracts it is a procurement question. Every CIO deploying agents is betting on which interfaces will still be portable in three years, and this keynote offered the clearest account we have heard of how that bet could go wrong. His Android versus Kubernetes contrast is the right one: both were open source, only one left its creator's control, and operators lived with very different results.

The skeptic's case deserves its full weight. The contributing vendors donated formats and specifications while keeping their revenue-bearing surfaces. Anthropic still defines its own Messages API, and Google its Interactions API. On that reading, the foundation is where vendors park layers they have already decided to commoditize.

That read strikes us as accurate, and also beside the point, because Kubernetes followed the same pattern. In our view, Google gave away orchestration and kept the cloud, and buyers still came out ahead because the layer where switching happens stayed neutral.

Surtani has made a version of this argument from the inside. When we spoke on 23 October, he recalled his time as head of open source at Block. Even with Jack Dorsey as executive sponsor and ardent open source supporter, he had to persuade product leaders that releasing what they regarded as proprietary IP would enlarge the market their own businesses competed in. He sees AAIF making the same case across entire companies rather than product lines. It helps that many members already know the terrain from CNCF, W3C, and IETF. Neutral governance, in that sense, is the product. The open question is whether the next layer where switching happens lands in the same place.

What Was Announced

The four projects map to separate seams in the agent stack. Agent Skills is an open format for giving agents new capabilities and domain expertise. Open Responses is a specification for interoperable interfaces across model providers, built on the OpenAI Responses API. OpenEnv is a framework for building reinforcement learning environments. OpenSandbox is a general-purpose sandbox platform for AI applications.

Operators should keep one distinction in view: Open Responses targets interoperability at the interface, not uniform model capability or output. Code becomes portable, results do not necessarily follow, and teams that miss the difference tend to discover it during their first migration.

Adoption tells its own story. Open Responses already has support from AWS Bedrock, Databricks, Ollama, Nvidia, and vLLM, while Anthropic and Google continue to run their own native APIs. A neutral specification that two of the largest model providers have not adopted is the most direct test of how far neutrality reaches on its own.

What ties the four together is a design choice: AAIF is collecting the contracts between components rather than the components themselves, and contracts are where lock-in lives. Anyone who has negotiated an enterprise database renewal knows the license text rarely sets the price of leaving; control of the interfaces does.

Surtani's own working method fits that design. He told us he declines requests for a reference agentic stack or blueprint, on the reasoning that any answer given today would be wrong tomorrow. Instead, he points builders to what is working in practice and advises them to expect to change it. Open protocols, in his framing, are what keep that change affordable, provided a small set of invariants holds.

The keynote supplied the governance argument behind that pattern. Surtani argued, in substance, that a project whose keys sit with one company has its openness settled one release at a time, and that a single-vendor protocol is effectively private property. Executive Director Mazin Gilbert also announced three new governance committees, following September changes that loosened incoming project criteria and opened working groups to non-members.

Surtani was equally clear with us about where the foundation stops. AAIF stays out of the underlying infrastructure stack. Projects move between it and CNCF in both directions when one home is the better fit, which he characterized as collaboration rather than competition for territory.

Market Analysis

Much of the remaining program pointed toward the layers Surtani flagged. Anthropic's Den Delimarsky, the MCP lead maintainer, stated that cumulative SDK downloads are at 4.17 billion. He also said about a third of the protocol's 116 conformance scenarios now test security, and his auth roadmap ends with agents that sign in as themselves. Block's Bradley Axen showed Buzz, which gives each agent its own identity plus an attestation naming its owner.

Tim O'Reilly urged moving trust out of the model and into protocols, gateways, and verifiable identity, while UC Berkeley's Dawn Song argued that frontier AI will help attackers more than defenders in the near term.

Surtani was candid that this is where the work is least finished. He named delegated identity as the most important area still lacking a convincing answer: a way to grant an agent authority for one specific task over one specific time window, and then prove the agent stayed inside those bounds. He expects the stakes to be highest in agentic commerce.

Competitive pressure is likely to concentrate there. Identity issuance, attestation, and payment settlement are chokepoints every agent transaction has to pass through, favoring large identity, payments, and cloud incumbents that already run those businesses.

Membership stands at 305 after roughly ten months, and members appear to be asking less about neutrality and more about agent security, identity, and authentication.

Looking Ahead

The key trend we'll be monitoring is whether the trust layer follows the interface layer into neutral governance. Delimarsky's auth roadmap, with proof-of-possession tokens and workload identity federation in draft, looks like the earliest visible test. Buzz 1.0, due in mid-November, should indicate whether owner attestation travels beyond a single vendor's workspace.