Google Handed Its Agent Protocol to a Neutral Foundation — The Trust Problem Didn't Go With It

Something quietly significant happened in the agentic AI world on August 17-18, 2026: Google handed over governance of Agent2Agent (A2A), the protocol it created to let AI agents from different vendors talk to each other, to the Linux Foundation’s Agentic AI Foundation (AAIF). That puts A2A in the same neutral foundation that already governs the Model Context Protocol (MCP), the standard for connecting agents to tools and data.

On the surface, this reads like plumbing news — a protocol changing hands between industry bodies. But it’s a meaningful signal for anyone building a multi-agent strategy right now: the rails that AI agents run on are consolidating under open governance, faster than most enterprise AI roadmaps assume. And buried in the coverage of the handover is a warning that matters more than the governance change itself — a security researcher calling A2A’s risk profile an “AI game of telephone.” That tension, between standardization and trust, is what this post digs into: what actually changed, why it matters for procurement, and why a neutral protocol still doesn’t answer the harder question of whether you can trust what your agents are telling each other.

What Actually Happened

The Agentic AI Foundation was formed on December 9, 2025, anchored by three founding contributions: Anthropic’s MCP, Block’s goose agent framework, and OpenAI’s AGENTS.md standard. Its platinum members read like a rare-alliance list — AWS, Anthropic, Block, Bloomberg, Cloudflare, Google, Microsoft, and OpenAI, companies that compete fiercely on models and cloud infrastructure but agreed the plumbing underneath agents shouldn’t belong to any one of them.

Google’s A2A protocol, first launched in April 2025 and contributed to the Linux Foundation as its own project later that year, has now been folded into AAIF alongside MCP. According to the foundation, A2A now has backing from more than 150 organizations and is already running in production across supply chain, financial services, and mobile platform integrations. AAIF’s CTO, Manik Surtani, framed the move as creating “a neutral home where the community can collaborate on the standards that will enable agents from different vendors, frameworks, and organizations to work together,” while Google Cloud VP Rao Surapaneni called it a way to “further empower enterprises to build and scale agentic systems on a truly open foundation.”

If you’ve read our earlier explainer on Agent-to-Agent (A2A) protocol, the short version of the distinction still holds: MCP is the vertical connection — an agent to its tools, files, and data sources — while A2A is the horizontal one, agent to agent, regardless of which vendor built each side. Our earlier piece on how MCP is redefining AI integration covers that vertical layer in more depth. What’s new here is that both layers now sit under the same neutral governance umbrella, which is a genuinely different starting point than either had a year ago.

Why Vendor Neutrality Actually Matters for Procurement

For enterprise buyers, this consolidation directly addresses a fear that’s been building for a while: betting your agent architecture on infrastructure one vendor can unilaterally change. The industry is visibly moving away from “pick one AI company and build your whole stack on their roadmap.”

With A2A and MCP both under AAIF, a company adopting either protocol isn’t adopting Google’s or Anthropic’s product decisions — it’s adopting a spec that a 150-plus-member, multi-vendor community has to agree to change. That matters practically: cross-cloud support already exists through Google Cloud, Microsoft Azure AI Foundry, and AWS Bedrock AgentCore, and A2A has been extended commercially into payments through a Google Cloud–PayPal partnership on the Agent Payments Protocol. An agent built on one cloud can, in principle, negotiate and transact with an agent on a competitor’s cloud without custom point-to-point integration work — the kind of governed, cross-vendor agent sprawl enterprises have been racing to get ahead of rather than clean up after the fact.

The “Game of Telephone” Problem Neutral Governance Doesn’t Solve

Here’s the catch, and it’s the part of this story that deserves more attention than the governance headline got. Mahesh Shanmugasundaram, a researcher at security firm Seekr, described the core risk in blunt terms: A2A chains risk becoming an “AI game of telephone,” where each agent treats the prior agent’s output as fully trusted input rather than a claim that needs verification.

Neutral governance standardizes the format agents use to talk — message structure, identity verification through signed agent cards (a feature added in A2A’s v1.0 stable release in March 2026), version negotiation, multi-tenancy. It says nothing about whether the content one agent hands to the next is accurate. That’s a governance win and a trust vacuum happening at the same time.

The math behind why this matters is worse than intuition suggests. Research on compounding errors in multi-step AI workflows shows that even a high per-step accuracy degrades fast across a chain: a 10-step workflow where each step succeeds 95% of the time completes successfully only about 60% of the time overall, and that same analysis found a 20-step workflow at 95% per-step accuracy produced only a 36% success rate. Push it to 50 steps and the success rate drops under 8%. Academic work on runtime monitoring for multi-agent systems documents the same dynamic from a different angle: when one agent’s reasoning is passed to another as context, it can correct a mistake — but it can just as easily corrupt a correct answer, and downstream agents have no reliable way to tell which happened. This is precisely the dynamic we flagged in The Hallucination Tax: verification has to happen close to where a claim originates, not just at the final output, because by the time an error reaches the end of an agent chain, it’s dressed up as an authoritative conclusion.

A cross-vendor protocol makes this worse in one specific way: within a single vendor’s stack, at least one team owns the whole chain and can debug it end to end. Across a multi-vendor A2A chain — your procurement agent talking to a supplier’s negotiation agent talking to a logistics partner’s routing agent — no single party can see, let alone verify, the whole path an error might have traveled.

What This Means for Your Multi-Agent Architecture

None of this is a reason to avoid A2A or MCP — avoiding open, neutrally-governed standards in favor of proprietary lock-in is the worse trade. It’s a reason to treat “protocol adopted” and “system trustworthy” as two separate checkboxes, not one.

Three practical implications for anyone architecting multi-agent systems this year:

Put verification at hand-off points, not just at the end. If an agent is about to act on another agent’s output — especially one from outside your organization’s control — that’s the moment to check it, not after three more agents have built on top of it. The orchestrator pattern we’ve written about is a natural place to centralize this: a manager agent that validates hand-offs is far easier to audit than trust scattered across a dozen peer-to-peer agent conversations.

Use the identity layer the protocol now gives you. A2A’s signed agent cards, added in its v1.0 release, provide cryptographic proof of which organization an agent belongs to. That’s necessary but not sufficient — knowing who sent a message doesn’t tell you whether the message is correct — but it closes off a whole class of spoofing risk that existed before, and it costs you nothing to require it in any cross-vendor integration you build today.

Track protocol maturity separately from vendor maturity. A2A reaching stable governance under AAIF is a signal about the ecosystem, not a guarantee about any specific agent you plug into it. Vet the agents you connect to with the same scrutiny you’d apply to a new API integration or a new vendor contract — because that’s functionally what a cross-vendor A2A connection is.

The industry just took a real step toward AI agents that aren’t locked to a single company’s roadmap. That’s worth acknowledging as progress. But the next hard problem — verifying what agents tell each other, not just standardizing how they say it — is only getting started, and it’s not one a foundation can govern its way out of. It has to be built into how you architect the systems themselves.

Frequently Asked Questions

What’s the difference between A2A and MCP?

MCP connects an individual AI agent to the tools, files, and data it needs to do its job — the vertical connection. A2A connects one agent to another agent, potentially built by a different vendor on a different platform — the horizontal connection. Both now sit under the same neutral governance body, AAIF, but they solve different integration problems.

Does A2A joining a neutral foundation make it safer to use?

It reduces one specific risk — vendor lock-in and unilateral roadmap control — but it does not verify the accuracy of what agents communicate to each other. Governance and trustworthiness are separate problems; neutral governance addresses only the former.

What is a “signed agent card” and why does it matter?

It’s a cryptographically signed identity credential, added in A2A’s v1.0 specification, that lets an agent prove which organization built it. It prevents impersonation but doesn’t guarantee the content an agent sends is correct.

Should my company wait before adopting A2A or MCP?

No. Both protocols now have multi-vendor governance, production deployments across major industries, and support from every major cloud provider. The open question isn’t whether to adopt them, but how much verification you build around the agents you connect through them.

How much does per-step error compound in a multi-agent chain?

Research on compounding errors shows that even at a strong 95% per-step accuracy, a 10-step agent workflow succeeds only about 60% of the time overall, and a 20-step workflow drops to roughly 36%. Each additional hand-off between agents is an additional opportunity for an error to enter and persist.

Who is actually backing A2A now?

More than 150 organizations back the protocol as of its move to AAIF, with cross-cloud support from Google Cloud, Microsoft Azure AI Foundry, and AWS Bedrock AgentCore, and real deployments in supply chain, financial services, and mobile platform integrations.