Standard
Agent2Agent (A2A) is an open protocol, originally backed by Google, letting AI agents built on different frameworks communicate and coordinate tasks.
A2A has shipped a2a, an official command-line client built from its Go SDK's CLI, as one command surface for every A2A Protocol v1.0 agent. Scripts that broke when moved between drifting community and SDK clients now get one target to code against.
Reality
Syed Anas Mohiuddin found the same SSRF flaw in MCP servers from five unrelated organisations, including Google, JPMorgan and two governments. Each server turned an address supplied through an agent into an outbound request without checking where it resolved, and any team running its own tool servers can check for the same gap.
Reality
Roughly 130 pull requests, most of them refactoring, retire the Kubernetes Deployment that used to sit under every kagent agent. The tag string on the release says alpha1 and GitHub's flag on it says prerelease false.
Reality
A dev.to post works through what the stateless-service playbook does to an agent request. The common probe cadence restarts a pod after roughly 30 seconds of silence on /health, and one slow tool call takes longer than that.
Reality
Google's Agent Payments Protocol makes an agent's authority to pay a cryptographically signed mandate holding price limits, timing and other conditions. Whoever drafts those conditions is setting spend policy.
Reality
The spec's own boundary list says a verified catalog entry establishes which domain claims a capability and what trust material it published. It says nothing about whether the calling process is the agent it names.
Reality
AWS keeps its six pillars in the new Agentic AI Lens and reads them through five runtime behaviours, which leaves reviewers holding a design whose only enforceable artifact is the set of caps around a loop they cannot draw in advance.
Reality
Google ADK's output_key writes into whichever agent's session declared it, and in-process that session is shared. A branch-coverage gate that only ever runs the single-process topology cannot reach the failing path.
Reality
A discovery-only comparison of A2A agents on three clouds, measured in August 2026, found one protocol producing three auth models and one card whose sole declared interface URL is the container's bind address.
Reality
A grant of InvokeAgentRuntime will not fetch an A2A agent card on Bedrock AgentCore. And the card a Strands agent publishes there runs 2,109 bytes, most of it the agent's own instructions.
Reality
One line of Google ADK turns an agent into an A2A server. Deployed to Cloud Run and called from AWS and Azure, it advertised the address it binds instead of the address anyone can dial.
Reality
A Bedrock AgentCore agent serving Google and Azure callers over A2A pushes the vendor-specific work into the container contract rather than the agent. The credential claim is the part not yet shown.
Reality
One research agent, built three times on three hyperscaler frameworks with the same prompt and the same search tool, diverged in nine ways. None of them were protocol problems.
Reality