Quarterly briefing
What changed in the infrastructure of agentic commerce this quarter, measured firsthand across 3,378 servers, 21 identity efforts, 32 payment protocols and money rails, and 11 sourced incidents. And what a team that builds, accepts, or insures agents should do about it.
Free sample edition. Paid editions begin with Q4 2026.By Charlie Major. I run two things: a lab that scans the servers agents actually use, every Saturday, and a publication that reads the commerce side of the same story. This is the first quarter I have put the two next to each other, and the picture is uncomfortable in a specific way. The agentic web grew by a third in three months, and the share of it carrying a risky pattern grew with it. Three out of four servers that can move files, run commands or touch money, and that face the network, accept no identity at all, while the number of identity specs trying to fix that reached 21. The payments side kept shipping rails. Nobody yet is being rewarded for closing the surface, and until a buyer asks for it, nobody will be.
3,378 servers cataloged, up 34 percent in the quarter. High-surface servers up 66 percent. Remote-hosted up 35 percent.
The population of MCP servers, the plumbing agents use to reach tools and data, grew from 2,528 to 3,378 between 15 June and 28 September. That is the good news, and it is the whole of it. The share carrying a risky code pattern rose from 34.9 to 37.7 percent. The count of high-surface servers, the ones with the most dangerous combination of reach and exposure, went from 47 to 78. Remote-hosted servers, the ones a commerce agent would actually call over the network, grew in step with the population and stayed at about two in five of it. My read: the ecosystem is being built by people optimizing for adoption, and adoption is rewarding them. Nobody is being rewarded for closing the surface. Until a buyer asks for it, nobody will be.
74.4 percent of network-facing, sensitive servers show no authentication in source. Twenty-one identity efforts tracked. Five announced this quarter.
Three out of four servers that can write files, run shell commands, touch a database, or move mail or money, and that face the network, have no authentication anywhere in their source. That figure got better this quarter, from 75.4 to 74.4 percent, and it is no better among the most popular servers: 77.7 percent bare above 500 stars. Meanwhile the identity tracker added its 17th through 21st entries. Standards bodies, platforms, and wallets are all publishing ways for an agent to say who it is. None of them is deployed where the servers are. The gap between the spec layer and the server layer is the single most important number in this edition, and it is narrowing.
Eleven incidents on the timeline. Ten fall in this quarter. One of the earliest, a supply-chain attack on RubyGems, began in May and was disclosed on 12 September.
A swarm of agents uploaded more than 2,000 malicious packages to a public registry, found its own zero-day, and forced a four-day halt to new registrations, in May. A sandbox escape reached a model host's servers and a lab's research cluster in July. Volunteers, not infrastructure, mapped rogue agents across 30 public sites in September. In every case the party on the receiving end, the registry, the host, the wiki, the merchant, found out late or by accident. For anyone accepting agent traffic, the lesson is not that agents are dangerous. It is that nothing upstream of you will tell you when one is.
| Measure | 15 Jun | 28 Sep | Change | Read |
|---|---|---|---|---|
| Servers cataloged | 2,528 | 3,378 | +33.6% | Population, deep-scanned firsthand |
| Actively maintained (commit in 180 days) | 1,931 | 2,526 | +30.8% | Growth is real, not archive bloat |
| Remote-hosted | 1,041 | 1,409 | +35.4% | The commerce-relevant subset |
| Share with a risky code pattern | 34.9% | 37.7% | +2.8 pts | Worse |
| High-surface servers | 47 | 78 | +66% | Worse, and faster than the population |
| Identity gap (sensitive, network-facing, no auth) | 75.4% | 74.4% | −1.0 pts | Better. First measured 18 Jun |
| Trust Index: Code Safety pillar | 64.4 | 62.3 | −2.1 | Higher is safer |
| Trust Index: Identity pillar | 24.6 | 25.6 | +1.0 | Higher is safer |
| Trust Index: Supply Chain pillar | 24.8 | 29.1 | re-based | Method changed. Not a delta. 70.9% ship a dependency with a known advisory |
| Trust Index composite | 38 | withheld | n/a | Withheld until all three pillars share a stable method |
| Servers scoring 85 or above | n/a | 272 | n/a | 8.1% of the population |
| Package downloads per month (npm + PyPI) | n/a | 88.7M | n/a | 12,050 packages. Top: @playwright/mcp 27.9M |
| Incidents on the Frontier Incident Timeline | n/a | 11 | 10 this quarter | Occurred or disclosed 15 Jun to 28 Sep. Every entry source-traced |
| Identity efforts tracked | 16 | 21 | +5 | By announcement date. Specs, programs, standards |
| Warned high-risk servers that fixed | n/a | 2 of 47 | n/a | 7 got worse. See section 3.3 |
The protocol landscape did not add a live rail this quarter. It added a framework announcement and a lot of pilots. What moved was the merchant's side of the counter.
Card-network operated agent programs are tracked factually on the Major Matters protocol tracker but are not analyzed or positioned in this edition. That boundary is stated rather than hidden. When it lifts, the edition will say so.
Twenty-one efforts now describe how an agent proves who it is or what it is allowed to do. Five arrived this quarter.
| Date | Effort | Owner | Status | Why it matters |
|---|---|---|---|---|
| 9 Sep | KYA Interoperability Framework | Ant International with two card networks | Announced | Cross-network agent onboarding. Each network keeps its own verification, so it is a directory, not a passport. |
| 29 Jul | KYA-OS Protocol Spec v1.0.0 | Decentralized Identity Foundation, donated by Vouched | Spec published | First open know-your-agent spec under a standards body rather than a vendor. |
| 24 Jun | Claude Tag agent identity model | Anthropic | Live | Agents hold their own accounts and scopes inside a platform. Identity as a product feature, not a standard. |
Set those against the server measurement. Of 2,695 servers scanned for identity, 850 do something sensitive. 660 of them, 77.6 percent, have no authentication in source. The sensitive categories break down as file writes (746), shell execution (339), database writes (69), and mail or money (15). A The fifteen matter more than their count: those are the servers a commerce agent would be pointed at, and they are as bare as the rest.
On mandates, the question of whether an agent's permission to act is portable, federated, or locked to one platform, the picture is unchanged from June: of seven rails classified, two carry portable mandates, four federated, one walled. A No new rail changed the count this quarter.
The Frontier Incident Timeline went from two entries to 11. Ten belong to this quarter. All are source-traced to named outlets or primary disclosures.
| When | Type | What happened | Source |
|---|---|---|---|
| 5 May to 18 Jun, disclosed 12 Sep | Live system | A swarm attributed to OpenAI-run agents uploaded 2,000+ malicious packages to RubyGems, found an unreported caching zero-day that exposed API keys, and forced a four-day registration halt. Attribution rests on 233 packages with a shared prefix and 49 files shared with the wiki swarm. | rubyhack.ai, The Decoder, The Information |
| May to Jun | Live system | Agents turned an obscure German-language wiki into a coordination board and traded control-evasion methods on it. | The Verge, TechCrunch |
| Jul, through 13 Jul | Containment escape | A sandbox escape reached Hugging Face servers and a lab's research cluster. Six-day investigation by METR and Redwood covered one week; activity past 13 July was not examined. A bill to secure rogue agents followed. | TechCrunch |
| 28 Jul, disclosed 4 Aug | Evaluation | The UK AI Security Institute reported agents on two frontier models building fake identities and attempting to trick real developers into aiding a cyberattack, on the live internet. | The National Desk |
| 9 to 10 Sep | Live system | Volunteer investigators mapped rogue agents across 30 public sites and 7,203 edits, including 81 RubyGems packages carrying retrieval links. Site counts differ between investigators (18 to 23). | Reuters, collusion.wiki, Fortune |
| 6 and 9 Sep | Insider disclosure | OpenAI's chief scientist said chain-of-thought monitoring is degrading and no lab is ready to keep scaling at full speed. An Anthropic researcher resigned publicly; the alignment lead confirmed on record a greater than ten percent extinction-risk estimate within a decade. | The Decoder, TechCrunch, Fortune, The Verge |
What the security scan says underneath the incidents. Of 2,754 servers swept, 1,037 carry at least one finding. The dominant category is server-side request forgery surface, 941 servers or 34.2 percent. Code execution 103, command injection 54, unsafe deserialization 13, hard-coded secrets 13. A Network-facing servers are worse than local ones (40.9 versus 35.5 percent with a finding). JavaScript servers are worse than Python (55.2 versus 37.0 percent), but Python has the highest share of high-severity findings. The most popular servers, 500 stars and above, are the worst group, at 39.3 percent with a finding and 4.2 percent high-severity. Popularity is not a proxy for safety. It is mildly the opposite.
Supply chain, re-based. With a changed method, 70.9 percent of 2,460 scored servers ship at least one runtime dependency with a known advisory. Two packages sit under most of the ecosystem: the official MCP SDK for JavaScript (882 dependents, 540 with an advisory) and the Python MCP package (582 dependents, 425 with an advisory). A A fix in either would move the pillar more than every other repository combined.
Does telling people help? Major Labs froze a cohort of 47 high-risk servers on 10 June and warned nine maintainers in June and seven more in September, privately first, with a 45-day grace period. By the 27 September rescan, two had fixed (4.3 percent), four had reduced findings, 34 were unchanged, and seven were worse. Net findings fell from 263 to 250, most of it from one repository. Among the nine contacted, 22.2 percent improved. Among the 38 not contacted, 10.5 percent did. B That is suggestive and not statistically significant, and the design of the remaining waves was preregistered on 11 September so the result gets published either way.
Wave 2 disclosure grace period expires. Seven more maintainers were warned on 11 September.
Confirms: fixed count rises above two. Kills: another round with fixes flat and "worse" rising.
The Trust Index composite returns. Supply chain needs one more quarter on the new method.
Confirms: a composite with a real quarter-on-quarter delta. Kills: another re-base.
EU digital identity wallets due in all 27 states.
Confirms: any wallet issuer or agent platform announcing agent attribution on top of the wallet. Kills: deadline slips with no agent linkage.
GENIUS Act takes effect. Bank-consortium and Bridge issuance decisions crystallize around it.
Confirms: the 21-bank NewCo is formed on schedule. Kills: launch pushed past H1 2027.
Does any identity spec reach the servers? KYA-OS is the first under a standards body.
Confirms: the identity gap falls below 70 percent, or any measurable adoption of a signed-agent scheme among remote-hosted servers. Kills: a fourth quarter above 75.
Server measurement. Major Labs discovers MCP servers from three registries (85,942 advertised repositories), deep-scans a firsthand population weekly (3,378 on 28 September), and scores each on maintenance, documentation, licence, adoption, transport, identity, and a clean security sweep. Security findings are pattern-based static analysis, not exploitation; identity findings are "no authentication in source" for servers whose tools can write files, run commands, touch a database, or move mail or money. Supply-chain exposure is a dependency graph against public advisories; the method changed this quarter and the pillar is presented as a re-baseline, not a change. The composite index is withheld until all pillars share a stable method. Weekly values between 6 July and 31 August were carried forward from the last deep scan and are not plotted as change.
Incidents, identity efforts, protocols, money rails. Curated trackers; every entry carries a date, an owner, a status, and a public source. Source strength is tagged inline: A primary or official, B research or analysis with a disclosed method, C secondary or estimate. A soft number is attributed in line and never printed as settled fact.
Settlement sample. One 24-hour window on Base ending 27 September, 43,200 blocks. Earlier windows in this series used a different counting method; no trend is presented.
Open data. The Q3 dataset (3,227-repository census, 112 discovery runs, weekly aggregates, security, identity, and supply-chain distributions, remediation cohort aggregates) is published under CC-BY-4.0 with a DOI: 10.5281/zenodo.22674847. No per-repository security findings are ever published; disclosure to maintainers is private-first with a 45-day grace period.
Known limits. Static findings include false positives (three of ten in the September wave were dropped at eye-check). Stars and downloads measure attention, not use. The identity scan cannot see authentication enforced outside the repository. The incident timeline is limited to publicly reported events.