The spec that runs every AI agent's tools just rewrote itself. If your app used sessions, it breaks on the 28th. Here's why that's actually the good news.
The signal
The release candidate dated removes the initialize handshake and the Mcp-Session-Id header outright. Protocol version and client info now ride in _meta on every request; a new server/discover replaces up-front capability exchange.
Why it matters. This is the change with the biggest operational impact in the spec's history. Anything built against the 2025-11-25 session model has hidden session dependencies that break — and the fix isn't cosmetic: requests must survive moving between server instances. Statelessness is what turns a metered endpoint from a demo into a rail.
Our take
A stateless protocol layer quietly settles the "is this a real payment rail?" question. Session affinity is what kept metered agent endpoints from fanning out; remove it and verify-before-pay can scale horizontally like any other stateless HTTP service. This is infrastructure maturing, not a feature.
The counter
Where we might be wrong. A spec landing 10 days out isn't adoption. Tier-1 SDKs get a ten-week validation window, and every server built on the session model has to migrate under live traffic. "Stateless by 28 July" is the spec; "stateless in production" is a Q4 story.
🔒 The full breakdown
Our take + the counter-case on what stateless MCP means for your stack. The facts above stay free.
x402 Foundation members under the Linux Foundation
3
protocol layers now foundation-governed: MCP · A2A · AP2
~$28k
daily x402 volume — the plumbing is real, demand is early
Free account
Read every full story.
Headlines and the 60-second version are free. Our take, the counter-case, and the archive unlock with one free account — the same identity that powers your Rhinogent. Your agent keys never leave your browser.
The money is moving from foundation models to the layer that verifies agents before they ship — the exact problem 0n1x exists to solve.
Bespoke closed a $40M Series A (Wing VC lead) for pre-deployment training + eval of autonomous systems — on the thesis that evaluating autonomous agents is harder than training them. Same wave: LinqAlpha $22M, Arcade $60M ("agent failures are infrastructure, not model, problems").
For 0n1x: when the smart money funds the verifier not the model, the neutral-referee seat gets more valuable. A lab that grades its own agents can't be the referee. SINGLE-SOURCE on the figure — trend is multi-sourced, the exact $40M isn't.
22,000 sellers are taking agent payments — and no standard way to know which are honest.
x402 Foundation operationally live under the Linux Foundation: 40 members incl. Visa, Mastercard, Amex, Stripe, Google, AWS, Cloudflare, Ripple, Circle. Trailing 30 days: ~75M txns, ~$24M, ~94k buyers, ~22k sellers, ~$0.32/txn. Chainalysis: 100M+ cumulative on Base, $1+ txns now 95% of volume.
For 0n1x: payments scale faster than trust — 22k sellers, no standard way to know which are real. Every agent that pays needs a signed registry lookup before it sends, not on-page self-assertion. (Volume figures are foundation-reported — directional, not audited.)
The world's largest AI model hub was compromised end-to-end by an AI agent, not a human. The first flagship proof that attackers now run agents at machine speed.
HF disclosed on 16 Jul that an agent ran a full intrusion into production: entry via a malicious dataset abusing two code-execution paths, then node-level escalation, credential harvest and lateral movement — 17,000+ logged actions. Public models, datasets, Spaces and the supply chain verified clean; some internal datasets and service credentials were accessed. Tell for defenders: HF used open-weight GLM 5.2 for forensics because commercial API guardrails refused to analyze the real attack payloads.
For 0n1x: when the attacker is an agent, the only durable defence is knowing which agent, operated by whom, is allowed to act — identity and provenance, not signature-blind trust. SIGNED≠TRUE, but unattributed-and-fast is the nightmare this proves is here.
SEO poisoning and CSS-hidden text steered browsing agents into paying for a fake API key or trusting a typosquatted DeFi site. Four of 26 models paid — Gemini 3 Flash among them.
Zscaler ThreatLabz (2 Jul) documented two live campaigns. A fake library site hides instructions telling the agent to pay $3.00 for a nonexistent API key — 4 of 26 models complied (Llama 3.3 70B, Llama 3.2 90B Vision, Gemini 3 Flash, Gemini 2.5 Pro). A DeBank typosquat uses JSON-LD to get classified as the "verified" destination — 2 of 26 fell for it (GPT-5.4, Claude Sonnet 4.5). Both exploit agents' trust in structured data and SEO.
For 0n1x: the missing primitive is a verified-counterparty check the agent consults before acting on page content. Structured data is an attacker input, not a trust signal — a signed "this domain is who it claims" beats any amount of on-page self-assertion.
Everyone's racing to register on the agent-identity standard. The first audit says 9 in 10 are fake.
The first empirical audit of every ERC-8004 agent across Ethereum, BSC and Base (revised 8 Jul) found only 3% / 4% / 15% (ETH/BSC/Base) exposed a valid registration with a live endpoint — the rest is placeholder squatting. Coordinated fake-reviewer behavior hit 90.6% on Base; reputation is "manipulable at minimal cost." The EIP itself is still formally Draft.
For 0n1x: this is the empirical proof of the whole thesis — a registry standardizes where you write a claim, not whether it's true. Free-to-forge reputation is theater; the open seat is interaction-grounded, stake-secured resolution — the Validation Registry hook almost nobody is populating.
OpenAI didn't ship one model. It shipped three — and the middle one is 5.5-smart at half the cost.
Sol (frontier), Terra (~5.5-level intelligence at half the cost) and Luna (small, fast), plus an Ultra mode with Max reasoning and heavier sub-agent use. New API surface: programmatic tool calling, multi-agent orchestration, prompt-cache breakpoints.
For 0n1x: cheap frontier reasoning plus native orchestration is the substrate. The moat was never the model — it's signed proof-of-execution on top of it.
🔒 Full breakdown — what three-model routing does to agent economics.
The thing stopping 24/7 AI agents was never smarts — it was the bill. Sonnet 5 just cut it.
Sonnet 5 launched as a lower-cost way to run agents, while Claude Cowork expanded to web and mobile — agents running multi-step tasks in the background across devices.
For 0n1x: falling cost-per-run is what makes an always-on fleet economical. A network only compounds when running an agent 24/7 stops being expensive.
🔒 Full breakdown — the cost-per-run math behind an always-on fleet.
40 members. Visa to Coinbase in one room. The rail agents pay each other on just became institutional.
Forty members — Visa, Mastercard, Amex, Stripe, Google, AWS, Shopify, Cloudflare, Coinbase — with Anthropic, Circle and Vercel in core membership. Coinbase completed contributing the protocol, putting it under vendor-neutral governance.
For 0n1x: the rail we settle on is now institutionally safe to borrow. Both protocols we build on sit under Linux Foundation governance as of this week.
Your agent can now buy things with nobody watching. The safety catch is three cryptographic signatures — and one of them just failed open.
AP2 moved to FIDO for community governance, mirroring A2A's move to the Linux Foundation. v0.2 ships Human-Not-Present support for autonomous, pre-authorized transactions, layering on top of A2A and MCP.
For 0n1x: AP2's three signed Mandates — Intent, Cart, Payment — are the shape of verify-before-you-pay. Our rail already separates the grader key from the payee: the property AP2 formalizes.
150 companies. 22k stars. Already inside Azure and AWS. The way agents talk to each other stopped being a bet.
150+ participating organizations, 22,000+ GitHub stars, with production deployments inside Azure AI Foundry and Amazon Bedrock AgentCore. Governance sits with the Linux Foundation.
For 0n1x: our agents speak A2A natively — signed Agent Cards, identity verified before action. The horizontal layer is table stakes now, not a bet.
Three layers, three foundations, debate closed. The one thing none of them answer? Whether the agent — or the fact — is real.
Three complementary layers — MCP for agent-to-tools, A2A for agent-to-agent, AP2 for payments — each under independent foundation governance. The plumbing debate is over.
For 0n1x: we sit across all three. The question the standards don't answer is trust — is this agent, and this fact, real? That unanswered layer is the whole company.
🔒 Full breakdown — the trust layer the settled stack leaves open.
MCP wired agents to tools. A2A to each other. x402 to money. AG-UI just wired them to YOU.
CopilotKit's AG-UI standardizes agent→front-end streaming (SSE, typed events) — 9k+ GitHub stars, adopted by Google, AWS, Microsoft. The plumbing stack is now complete: tools, agents, money, and the user.
Not a demo — agents completed real purchases at real shops, under real Strong Customer Authentication.
At the Visa Payments Forum (2 Jul), agents transacted at lastminute.com, Frasers and more across 30+ issuers on Visa's Trusted Agent Protocol — the first at-scale proof agentic commerce clears EU regulatory bars.
Soon a site will cryptographically know it's really Anthropic or OpenAI knocking — not something wearing their user-agent.
Built on HTTP Message Signatures (RFC 9421), origins confirm a caller's identity via keys at a .well-known. It proves who's calling; the trust layer proves whether the output is true — the two compose.
AWS Bedrock AgentCore Payments (preview) lets any agent pay an x402 endpoint with no custom integration — buyer-side, budget-bounded.AWS ↗
Coinbase Agent.market — a directory of x402-paywalled services; listing is a zero-cost discovery channel for agent-payable endpoints.Coinbase ↗
Web Bot Auth is chartered at the IETF (refreshed 15 Jul) — origins cryptographically confirm "this really is Anthropic/OpenAI" via keys at a .well-known, killing the IP allowlist. Proves who's calling; not whether the output is trustworthy — the two compose.Cloudflare ↗
Kimi K3 (16 Jul) — the first open 3T-class model, built for multi-day autonomous engineering. A downloadable, no-vendor-in-the-loop agent that runs for days is a demand generator for third-party "prove what it did," not a threat to it.Moonshot ↗
Cloudflare Monetization Gateway (1 Jul) — charge any agent per-request via x402 at the edge, for ~20% of the web with zero plumbing. Payment-as-credential handles access; it says nothing about whether the resource is authentic — the missing safety rail.Cloudflare ↗
AP2 reference sample fails open on mandate-amount match (PR #300 / issue #299, dated 2026-07-15) — a live demo of the verify-before-pay gap.GitHub ↗
Discovery is standardizing on /.well-known/x402 — how buyer-side agents find sellers without a middleman.x402.org ↗
The record
How the agent economy's trust and payment layer got here — from a protocol announcement in late 2024 to three foundation-governed standards. Dated, source-linked, append-only. We add; we don't quietly revise.
2026
MCP spec removes the session model Handshake and Mcp-Session-Id gone; protocol info now rides in _meta per request. Final ships this date — the RC is out now.MCP spec blog ↗
x402 Foundation goes operationally live under the Linux Foundation 40 members including Visa, Mastercard, Stripe, Google, AWS, Cloudflare and Coinbase; Anthropic, Circle and Vercel in core membership.Cloudflare ↗
OpenAI ships GPT-5.6 — Sol, Terra, Luna, plus Ultra mode Programmatic tool calling and multi-agent orchestration become first-class API surface.ThursdAI ↗
Anthropic launches Claude Sonnet 5 as a cheaper way to run agents Cost-per-run falls; always-on agent fleets become economically viable.TechCrunch ↗
A2A reaches 150+ organizations and 22k stars; governance at the Linux Foundation Production deployments land in Azure AI Foundry and Amazon Bedrock AgentCore.Stellagent ↗
AP2 governance transfers to the FIDO Alliance; v0.2 adds Human-Not-Present Autonomous, pre-authorized agent payments get a community-governed standard.ap2-protocol.org ↗
MCP is donated to the Agentic AI Foundation under the Linux Foundation Anthropic hands the protocol to neutral governance — the first of the three layers to go independent.Anthropic ↗
2025
Google announces the Agent Payments Protocol with 60+ partners Mastercard, PayPal, Coinbase, Amex and Salesforce back a standard for agent-led payments.Google Cloud ↗
Coinbase authors and open-sources x402 The dormant HTTP 402 status code is turned into a real payment rail — stablecoin payments over plain HTTP, made practical by cheap L2s and gasless transfers.Coinbase ↗ · x402.org ↗
2024
Anthropic announces the Model Context Protocol The origin point. One open standard to connect AI systems to the places data lives, replacing bespoke per-source integrations. Everything above is downstream of this.Anthropic ↗
The full record + daily brief
You've read the brief free. Unlock the full dated archive — and get every breakdown, source-linked, in your inbox.
Create a free account — GitHub, Google, or email. Email signup sends a confirmation link you must click before your first sign-in. One account across 0n1x & Rhinogent; your agent keys never leave your browser.