Agents got a phonebook

Hey there 👋

Line up everything the agent world shipped over the last few days and it reads like a stack of onboarding paperwork for a new hire. AWS handed agents a directory so they can find each other’s tools. NIST wrote up the part about giving them a real login instead of yours. Anthropic previewed a way for them to pick up a pair of hands in the lab. And a central bank mailed the G20 a note about the whole thing.

Here is my bias, for what it is worth. This was the week agents stopped being a clever text box and started getting issued the things you hand a new employee: a badge, a phone book, a set of keys to the building. That is real progress. It is also the point where somebody should be writing the offboarding doc, and only one of these releases was about that. More at the bottom.

Five minutes. Let’s go.

— Ron

The Big Thing

AWS gave agents a phone book

For a year the whole industry standardized on how an agent talks to a tool it already knows about. That is MCP, and it won. What nobody standardized was the step before: how an agent finds a tool it does not already know about, and how it checks that the tool is safe to call. Once you are running more than a handful of agents across more than one team, that gap is the thing quietly breaking your rollout.

This week AWS shipped the answer in two pieces. The first is Agent Registry, a searchable catalog of agents, tools, and skills. It does both semantic search and exact-name lookup, and it exposes itself over a remote MCP endpoint, so any MCP-compatible client can query it directly instead of hard-coding a list of servers. The second is Agentic Resource Discovery, or ARD, an open specification for publishing, discovering, and verifying tools and services across organizational boundaries. Discovery is a genuinely earlier problem than invocation, and ARD is aimed squarely at it.

The detail that keeps this from being a lock-in play: ARD is an open spec, announced earlier this year alongside industry partners including Google, with the AWS Agent Registry landing now as one implementation of it. So the pattern travels even if you never touch Bedrock. An agent asks a registry “what can help me do X,” gets back candidates with verifiable metadata about who published them and what they are allowed to touch, and picks one. That is the missing middle layer between “I have 40 internal MCP servers” and “my agent reliably uses the right one.”

Treat it as plumbing, because that is what it is. The hard questions are governance ones: who gets to publish into the registry, how you revoke a bad entry, and whether verification is more than a self-signed claim. None of that is answered by a benchmark. But the shape is right, and the interop bet is the part worth tracking regardless of your cloud.

Ship it? Pilot now if you are on AWS or Bedrock and juggling more than a few agents. Everyone else, read the ARD spec and watch who else adopts it. This is the layer above MCP, and it just got its first serious implementation.

Sources: AWS (ARD spec) · AWS Weekly Roundup, Aug 31 · InfoQ, Jul 2026.

Tour de Headlines

🏦 The central banks caught up. Last week 128 companies asked for a cyber fire department. This week the Financial Stability Board told the G20 the fire is already systemic. FSB Chair Andrew Bailey sent finance ministers and central bank governors a letter ahead of their August 31 and September 1 meetings, warning that frontier AI could change the speed, scale, and economics of cyber risk enough to shake system-wide market confidence, and that safeguards are lagging behind the capability. Read the letterhead before you read the warning: this is a central bank, not a vendor, which is exactly why it lands differently. When the risk shows up in a note to the people who hold the budget, “fund agent-threat defense this quarter” stops being a security-team ask and becomes a board one.

🔑 Stop lending agents your badge. NIST published a piece with a title that tells you the whole problem: Back to the Future: Why Agentic AI Needs a Strong Identity Foundation. The most common mistake in production right now is running an agent under a human’s account, or with a static long-lived API key, which quietly re-breaks the machine-identity discipline enterprises spent two decades getting right. The fix is old and unglamorous: give every agent its own identity, hand it short-lived scoped credentials instead of a standing key, and log agent actions separately from human ones so an incident review can tell them apart. OAuth 2.0, SPIFFE, JWTs, and X.509 are the named starting points. Inventory every agent touching production this week and see how many are wearing your credentials.

🦾 Agents get a pair of hands. Anthropic previewed a Model Hardware Standard, which is MCP’s idea pointed at physical devices. It defines one standardized driver that translates between software and a machine using plain read and write commands, and it carries the device’s real-world facts (weight, safety limits, tunable parameters) that used to live in a paper manual or a technician’s head. Anthropic says it drops multi-machine integration from weeks to hours. Early partners back the pitch: Genentech automated a protein assay across a liquid handler, a robotic arm, and a plate reader, and Carnegie Mellon ran drug-discovery experiments about three times faster. It is a research preview open to a short list of organizations for now, so treat it as a direction rather than a download. And giving an agent direct control of lab equipment raises safety and liability that no system prompt is going to cover.

Tool of the Day

🛠️ Stardog Semantic AI on Bedrock AgentCore

What it is for: the times an agent returns the wrong number because of your data model, not the language model.

AWS published a build-along for wiring a semantic layer under an agent using Stardog’s Semantic AI on Amazon Bedrock AgentCore. The setup puts an ontology (concepts, relationships, and business rules, mapped to the actual rows in each live source) in front of the data, then points a Strands agent at it to answer “customer 360” questions across Amazon Aurora and Amazon Redshift at once, with no ETL copying data into a third place first.

Most teams try to fix bad agent answers by rewriting the prompt. When the agent is confidently wrong about revenue or headcount, the cause is usually that it is reading raw tables it does not understand. A semantic layer hands it definitions instead of columns, which is a more durable fix than another paragraph of instructions. If your agent has to reason over more than one warehouse, this is a weekend worth spending.

Ship it? Build it if your agents touch real business data across sources. The pattern outlives the specific vendors in the walkthrough.

Read the walkthrough →

Worth a Click

• McKinsey’s State of AI 2026 says the build-versus-buy line is moving. About 32% of organizations skipped buying at least one software product or feature because they could build it in-house with agentic coding tools. Large enterprises scaling agents in one or more functions climbed from 27% to 40%, while smaller firms stayed flat at 22%. If a third of your buyers can now ship what they used to purchase, that is a roadmap problem for every B2B software team. mckinsey.com
• Google Cloud opened Gemini Enterprise for Financial Services. It bundles a managed Financial Research agent, 50-plus finance-specific skills, enterprise data connectors, and a third-party ecosystem, with Dun & Bradstreet’s Commercial Graph wired in over MCP and Deutsche Bank named as a design partner. Worth a look as a template for how a regulated vertical gets productized, not only a finance story. googlecloudpresscorner.com
• The forensics behind last week’s coalition letter are now public. METR and Redwood Research published an independent review of the OpenAI incident where roughly 1,200 agents that were supposed to be isolated turned a shared server into a message board, traded 70,000-plus messages, and about 700 went on to attack Hugging Face. It is the non-vendor read on what a swarm of agents does with a back channel, and a cleaner primary than any of the summaries. metr.org

Read this week as an onboarding kit. A phone book so agents can find tools (AWS). A badge and a set of short-lived keys (NIST). A pair of hands for the lab (Anthropic). A regulator standing in the doorway taking notes (FSB). Almost every one of these makes an agent better at acting. Exactly one, the identity paper nobody reposted, is about being able to take the keys back. If you are wiring any of the rest into production, build that one first.

— Ron