Europe 2026

Manik Kanilwal

Agentic AI Foundation (AAIF)

Keynote

Worth noting

AIF added a sandbox project stage with a 6-month check-in and 12-month deadline to reach "growth" status or be archived, and opened all working groups to public participation.

Quote

Foundations that catch projects early keep them. Foundations that wait don't.

Sam Marrow, Sean Smith & Shub

GitHub · Hugging Face · arcade.dev

Panel

Worth noting

GitHub's new stateless MCP protocol cut basic initialize-request latency from ~14ms to ~6ms versus the old session model, enabling scaling to many more millions of tool calls.

Quote

The scalability isn't a joke, and it happens on every layer.

Jake

Founding ML Engineer, Runlayer

Worth noting

Layered monitoring (tool calls, agent runs, fleet-wide) caught a multi-turn prompt-injection takeover of an admin console and a personal assistant's weekly cost spiking from $11 to $1,600.

Quote

Any single agent that is compromised could potentially infect your whole fleet and actually take down your whole fleet.

Speaker

Worth noting

Testing an obliterated LLM in Kubernetes sandboxes, the speaker found SSH-isolated, read-only, network-policy-locked pods blocked exfiltration, while text-stream configuration (as in the AWS Trends CVE) was trivially overwritten by prompts.

Quote

Anyone that relies on guard rails from the model itself is going to fail eventually.

Yaron Tal

Snyk (Developer Advocate)

Worth noting

Benchmarks cited show AI-generated code is insecure roughly half the time, and in Snyk's own VulnBench test nearly 50% of LLM-reported vulnerabilities didn't reproduce across repeated scans.

Quote

AI review is a measurement, it's not really a verdict.

Juan Antonio ("Oz")

Stacklok

Worth noting

After layering microVMs, seccomp, copy-on-write filesystems and a DNS-aware firewall around his coding agent, the speaker concluded that decomposing the harness into services and sandboxing only the execution layer scales better.

Quote

Separation of concerns leads to security, by splitting the different pieces of the agent harness, you're able to create a more secure system.

Sylvia Lasovska

ATOSS / European Commission

Worth noting

WebMCP lets sites expose structured, discoverable tools so agents stop guessing from the DOM, but it's an experimental Chromium-only API that saw multiple breaking changes in just the weeks before this talk.

Quote

If we will leave it like that, this is a recipe for disaster.

Sai

Safe Software

Worth noting

Safe Software's FME platform exposes governed workflows as purpose-built MCP tools that anonymize exact addresses to block level, letting Copilot query sensitive geospatial crime data without ever touching raw records or credentials.

Quote

MCP standardized how clients discover and invoke capabilities, but the standard interface does not govern what happens after the request arrives.

Takashi Norimatsu

Hitachi Limited

Worth noting

Of five cross-domain token-passing methods for MCP, only grant-chaining (JAG) and MCP authorization-delegation satisfy no-fraudulent-use/no-leak requirements, but still need DPoP sender-constrained tokens and a session-cookie comparison scheme to stop user swapping.

Quote

Sender constrained token can only be used by a client application having the right temporal private signing key.

Amin Raji

Independent cloud/AI security researcher, OWASP MCP Top 10 contributor

Worth noting

Reproducing real CVEs in Grafana, GitLab, Argo CD, and four AI coding tools, the speaker found a recurring root cause: trust checks that verify a string match instead of a real, issued identity.

Quote

Having the illusion that your server is doing a trust check is more dangerous than not having one.

Garcam

Juju (CTO)

Worth noting

He live-demos packaging an MCP server as a signed, SBOM- and SALSA-provenance-attested OCI artifact via MCPB and KitOps, showing a single edited line changes the digest and invalidates the prior cosign signature.

Quote

Packaging is an essential part of the security model, and packaging also needs to come with a distribution protocol.

Ola

Nordstrom (Principal Engineer, Agents Platform; MCP maintainer)

Worth noting

Proposes borrowing C2PA content-credential signing for MCP skills, plus a new "interceptors" extension (validator/mutator hooks on a standalone server) to audit and attest skill and tool provenance.

Quote

You can't really guarantee that it matches what the author wrote and signed as part of that skill.

Joey, Paul & Aaron

Orchestra · Anthropic · Okta

Worth noting

IDJAG lets an enterprise IDP issue a short-lived token (via OAuth token exchange, RFC 8693) that an MCP server exchanges for a normal access token (JWT bearer grant, RFC 7523), eliminating per-app OAuth consent screens.

Quote

OAuth is the worst form of authorization except for everything else.

Magnus & Jan

Zalando

Worth noting

Zalando open-sourced (MIT, under its incubator org) an identity broker that keeps both agent and end-user identities distinct, using RFC 8693 token exchange and OPA policies so agents never see upstream provider tokens.

Quote

An agent without an identity is simply nothing else than an anonymous process that holds all your credentials.

Diego Sulwaga

Futurewei Technologies (Credit Agent project)

Worth noting

Credit Agent lets Claude, ChatGPT, and Goose pull ISO mDoc/SD-JWT digital credentials from on-device wallets via MCP apps to verify age, membership, and payment, with AP2's intent/cart/payment mandate trio enabling autonomous "human-not-present" purchases.

Quote

We can do incredible things with agents, but when it comes to actually doing something consequential, agents fall short because we don't trust that layer.

Nile

The Building Blocks / Accord Project

Worth noting

The Accord Project extends the x402 HTTP payment protocol with cryptographically signed legal agreements, embedding obligation IDs in blockchain transaction memos to create an evidence trail linking agent payments to contract terms.

Quote

This entire agentic space is missing the legal layer. It's the wild west at the moment.

Nana Diquay

Codo

Worth noting

She reverse-engineered the leaked Claude Code source to extract five governance patterns (planning, permissions, tool trust, verification, runtime accountability) and reimplemented them as an open-source Rust agent runtime engine.

Quote

I open-sourced the governance patterns that I found within Claude code.

Paris Safuri

Nokia

Worth noting

Drawing on BGP autonomous systems, the speaker proposes an "Agent Control Domain" abstraction with three artifacts (authority, delegation state, data constraints) and five cross-domain invariants to govern agent crossings.

Quote

Federating agents is not enough. What we need to do is also to federate domains.

Rana Khalaf

WSO2 (Chief AI Officer)

Worth noting

WSO2's new Agent Manager control plane separates guardrails, agent identity, observability and lifecycle management from agent logic, letting teams swap LLMs between dev and prod without touching agent code.

Quote

The battle is not at the models anymore, we're up at the harness and potentially up at the control plane.

Roman

GrapeUp

Worth noting

Since January, OpenAI, Google, and Anthropic alone shipped 32 frontier model versions, making a DIY five-layer governance stack (gateway, registry, access, tracing, guardrails) a full-time maintenance job for most companies.

Quote

The gateway and the registry are the most important. Everything else attaches to that.

Milos Mandic

FDE Hub

Worth noting

Skipping advisory and semi-autonomous stages to ship directly to enhanced autonomy cost an agent-ordering deployment three months of operator trust despite a working solution built in just three weeks.

Quote

Remember, it took me 3 weeks to build a solution and 3 months to gain that trust.

Marat Kjablatov

Booking.com (Payments)

Worth noting

Booking.com shifted from counting adoption to costing the work of turning a ticket into a merge request, then built vendor-agnostic "profiles" bundling skills and MCP configs with gaps for team-level customization.

Quote

Adoption was about counting people, and consumption is about how much they use and what they do with agents.

Kevin Cochrane

Vultr (Chief Marketing Officer)

Worth noting

Vultr pitches itself as an open, sovereign hyperscaler alternative to AWS—33 data center regions, CPU-run MCP servers with edge inference for EU AI Act compliance, and 50-90% lower cost with 20-33% better performance than AWS/GCP.

Quote

We are not AWS. We are a new hyperscaler purpose-built to give you full control of your data and your open stack.

Kier Dotson

Further (AI Strategist); Founder, The ROI Report

Worth noting

Citing Gartner's forecast that 40%+ of agentic AI projects will be canceled by 2027, the speaker argues teams should engineer backwards from business outcomes (margin, revenue, retention) rather than starting from tools and architecture.

Quote

Technical quality can make something look very impressive, but it cannot make it important.

Mirela Tokatch

Independent lawyer (technology & real estate, open-source compliance)

Worth noting

Using three AI agent case studies, the speaker shows how post-deployment behavior changes (e.g. voice emotion recognition) can trigger high-risk classification and shift legal responsibility from provider to deployer under AI Act Articles 12, 25 and 43.

Quote

Every action has a potential legal implication under the AI act but also under the other laws that we've talked about.

Speaker

Worth noting

CHAP defines a shared, open protocol — five nouns, seven core verbs, and eleven optional profiles — that records every human-agent decision in an appendable evidence log, exposed natively as MCP tools or A2A skills.

Quote

Chap does not claim compliance on your behalf.

Michaelski

Independent researcher (PhD, distributed computing)

Worth noting

He proposes classifying agent blockers into three routes - verify against an oracle, abstain and route to the person who knows the fact, or amplify by asking someone with taste - so work continues asynchronously instead of halting on every question.

Quote

We want the agent to write down the questions somewhere, so it's the agent formulating the text, not the person writing the ticket.

Dylan Ratcliff

Overmind

Worth noting

By reviewing one-page implementation plans before agents code instead of pull requests after, Overmind tripled issues and commits completed and cut lead time from 3.2 to 1.3 days.

Quote

It's a hell of a lot easier to reject a recipe than a fully finished meal.

Pedro

Supabase

Worth noting

Proposes adding semantic versioning (major/minor/patch) plus version logs to agent skills, alongside the existing well-known-endpoint digest scheme, to enable rollback, security-audit pinning, and per-model variants.

Quote

Skills are basically prompt templates that you can ship to your agents that will not bloat your context.

Bill

Datadog (SDLC & AI Developer Experience)

Worth noting

Datadog's internal eval platform ("aDEEP") showed Sonnet often outperforms Opus on real tasks, guiding a default-model switch that saved roughly $650,000 a month.

Quote

For a lot of engineering tasks, I would say the models are actually fine. Your context is probably not.

Ksenia

GitHub (GitHub MCP / Copilot MCP support)

Worth noting

GitHub's MCP team layers offline tool-selection benchmarks, synthetic Harbor-format agent tasks, and online A/B experiments with a 5% p-value threshold, having once shipped a broken tool-prefix cache that spiked costly uncached tokens.

Quote

We unit test fragments of our agentic loop, but not everything can be unit tested.

Marcelo

Pydantic

Worth noting

Logfire's new 'optimize' feature analyzes failed agent traces to auto-propose fixes to prompts and tool/parameter descriptions, applied live via managed variables without redeploying code.

Quote

We believe that you should ship fast and then get your improvements by understanding what went wrong with the runs.

Huang Vu

Databricks (Forward Deployed Engineer)

Worth noting

Proposes a four-pillar governance framework (operational health, compliance/cost, quality) plus handoff metrics like context utilization and coverage to catch semantic failures that structural tracing tools like MLflow can't detect.

Quote

The first thing we need to know is actually how the agent is behaving in the first place.

Unidentified speaker

Outshift (Cisco)

Worth noting

MAS-Lab is a spec-driven multi-agent framework with a TLA+-verified state-machine runtime that runs the same YAML spec locally or in production, enabling 500-run repeated benchmarks for reproducible research.

Quote

It's not failures that show up in the logs, it's failures that are silent, where the agent thought he had the tool but did not check the result.

Jordan Auger

Cisco

Worth noting

Cisco's open-source OpenClaw plugin reconstructs hidden multi-agent telemetry—context assembly, delegation routing, memory, and checkpoint history—into unified OpenTelemetry traces, adding six metric groups for alerting.

Quote

We believe that having no signal is worse than having signals that work most of the time.

Paul Carlton & Felix

Anthropic (MCP core maintainer, leads the Auth working group, works on conformance) · Anthropic (TypeScript SDK and conf

Worth noting

The latest MCP spec contains 428 "musts" and 246 "shoulds"; conformance tests are now required for every Spec Enhancement Protocol to be finalized, and 45 contributors helped reach near-100% tier-one SDK conformance by the July release.

Quote

Conformance is essentially a testing framework for us to be able to put SDKs, treat them as a black box, and try to assert behaviors about how they handle the spec.

Fausto

Wonder AI

Worth noting

The speaker describes using a meta-agent to generate multiple harness variants per task, evaluated externally and tracked via cost-per-accepted-change to catch diminishing returns before credit-card costs spiral.

Quote

If that cost is rising and your progress is stalling, then you're hitting a point of diminishing returns.

Dexter Horthy

HumanLayer (CEO & co-founder)

Worth noting

On SlopCodeBench, which tests iterative feature-building rather than one-shot tasks, the best model (GPT-5.5) scored only 14.8%, showing models haven't gotten meaningfully better at architecture or maintainability.

Quote

Unattended models will not improve or maintain your code base quality over time.

Vincent Ismile

Datadog

Worth noting

Running eight coding agents in parallel just shifted the bottleneck to him, so he redefined "done" as explicit, provable claims verified by an agent-run deploy-observe-diagnose loop with logs and traces.

Quote

Prove the behavior or tell me what's stopping you.

Unknown

Unknown (mainframe/COBOL engineering team, insurance sector)

Worth noting

By pairing MCP-connected static analysis with a human-approval gate, the speaker's dead-code agent removed 3,000 unused lines across seven COBOL modules with zero production incidents, and a lineage agent traced 134 fields across 33 tables with a 10/10 evaluator score.

Quote

The main thing is we have to measure everything, because if you can't measure any output, you can't trust it.

Adali Abati

Agentic Foundation (GitHub Star & Ambassador)

Worth noting

Argues that downloading pre-built skills from the internet is now largely unnecessary as models have improved enough to handle most tasks directly, and warns it's also a security risk.

Quote

MCP is now a global standard, it's not just Anthropic's baby, it belongs to all of us to a certain degree.

Floris Fok

Prosus

Worth noting

An agent testing a live API dispensed 30 real drinks and later ordered cup noodles that didn't physically fit the slot, showing that "task completed green" doesn't mean it actually worked in the physical world.

Quote

The moment AI is running a business, what you see is that it's not my agent, it's ours.

Burbash

Orange (Security Architect)

Worth noting

The speaker outlines four control-plane boundaries (context transfer, scoped execution authority, outcome verification, recoverable handoff) added after discovering that per-step "success" in A2A/MCP agent workflows masked end-to-end failures in production telco security deployments.

Quote

A workflow will be closed only after telemetry and the orchestrator confirms the intended result.

Sam Betts & Kuba

Cisco · Google

Worth noting

A2A 1.0 unifies all protocol specs around a single Protobuf source of truth, adds signed agent cards and multi-tenancy, and keeps 0.3 and 1.0 agents interoperable via SDK-level version negotiation.

Quote

A2A is the protocol built from the ground up for agent to agent communication.

Julien Dubois

GitHub (Developer Relations, creator of JHipster)

Worth noting

Using parallel AI coding agents (up to 15 at once, running overnight via git worktrees), he shipped a new open-source Java dashboard's first release in 11 days for about $2,000 in tokens, versus an estimated six-plus months by hand.

Quote

If you go ten times faster than your competitor, it's not ten times better — it's incredibly better.

Nick

GitLab

Worth noting

Nick built a multi-agent "chief of staff" at GitLab with sub-agents, a reflection-based memory system, and deterministic hooks enforcing tone/fact-check gates, but found delegation only works once agents are fed explicit company objectives.

Quote

Not everything has to be delegated. Sometimes it's faster if you just do it yourself.

David

Dutch HVAC/building-installation company

Worth noting

Logging per-call agent "query intent" revealed only 23% of calls to a get-tickets tool needed the whole ticket, driving a GraphQL-style field-selection redesign of the interface.

Quote

An agent that has to do a lot of loops to find out what the data means may end up using even more tokens.

Canis & Daniel

Technical Product Manager, CTO AI Platforms, Bloomberg · Senior Software Engineer, AI Foundational Platforms, Bloomberg

Worth noting

Bloomberg proposes a new MCP working group adding five Unix-style filesystem operations (list, read, write, search, discover) to resources, citing a drop from ~150,000 to ~2,000 tokens of tool definitions.

Quote

It is to let useful information leave the active context without becoming lost and bring it back when it is truly needed again.

Sam

GitHub (lead developer, GitHub MCP server; MCP maintainer)

Worth noting

A live demo combining tool search, code mode, and CLI tool calls in the MC Pi harness generated a GitHub contribution animation using only 47,000 of a million available context tokens.

Quote

It still only used 47,000 tokens, which is incredibly small for the amount of data it's actually pulled down.

Joel

Grafana Labs

Worth noting

A 14,000-line, 42-file Go evaluator-critic "compiler" built to make an AI skill deterministic was ultimately scrapped for a 54-line skill using progressive disclosure and a single guardrail query.

Quote

If you build something which has a high barrier to entry for the team, then adoption is going to lag.

Manfred

Independent Angular Trainer & Consultant

Worth noting

The talk walks through three complementary open protocols—AG-UI for agent-frontend streaming, A2UI for dynamic UI generation, and MCP apps for sandboxed tool widgets—noting AG-UI's npm package now peaks near 2 million downloads a week.

Quote

To chat or not to chat, that's not the question, because everything begins with the user intent.

Florian Ba

OpenAI (Plugin Developer Ecosystem team)

Worth noting

MCP apps now have two coexisting users (human and agent), so developers must explicitly call "update model context" to sync front-end UI state changes back to the agent, since this isn't automatic.

Quote

There is a function that allows you to give the model context about what you did in the front end.

Den Delimarsky

Anthropic

Worth noting

MCP grew from ~12 million to over 3 billion package downloads and now has 2,000+ contributors, driving a formal spec process with interest/working groups, SEPs, and soft/hard freeze release cycles.

Quote

Just shipping an MCP spec itself is not enough. Like it's just words on a web page.

Sean Smith & Curtis

Hugging Face · Google Cloud

Worth noting

MCP's new spec eliminates the initialize handshake and sessions entirely, moving to per-request state and explicit state handles so Google's MCP servers can scale horizontally to trillions of requests.

Quote

You don't have to call initialize anymore, you can start talking to your server directly.

Jeremy

Lenses

Worth noting

In a prototype airline-rebooking flow, a Redis-backed MCP task store duplicated ticket and hotel-voucher bookings after a crash or elicitation pause, while an event-log (Kafka) backend resumed exactly where it left off.

Quote

An event log is an append-only, ordered, and durable sequence of records, events, with producers and independently positioned consumers.

Yanek & Reynold

Spotify

Worth noting

Spotify's single MCP gateway grew from 50,000 tool calls/month to about 4 million/month with 100% employee adoption, routing ~150 MCP servers, and was rebuilt on Envoy's native open-source MCP filter instead of custom code.

Quote

We started with about 50,000 tool codes per month in December last year, and we're now at about four million per month.

Anushka

Booking.com (GenAI for Engineering Platform team)

Worth noting

Booking.com's progressive tool disclosure cut context usage for 10 enabled MCPs from 189k tokens (18% of context) to just 538 tokens, while its internal platform grew to over 6,000 users organically.

Quote

Fabric now reaches more than 6,000 users at Booking.com, and I have to tell you this is not enforced.

Unknown

Tetrate (Agent Router / Agentic AI Foundation)

Worth noting

Agent Router (formerly Envoy AI Gateway) decouples credential management, model failover, and token-based quota/cost-attribution from agent code via declarative Kubernetes-style policies on an Envoy data plane.

Quote

One of the objectives of agent router is to help you keep your agents boring.