June 2026 Summaries

The 2026 AI Engineer World's Fair showcases advancements in AI model development, tools, and infrastructure, with a focus on creating reliable and trustworthy systems. During the first day, workshops emphasized the transition from proving AI capabilities to ensuring their dependable application. Key themes included the evolution of trust into an engineering discipline, the expansion of context engineering beyond retrieval-augmented generation, and the establishment of a robust back office for the agent economy. Notably, trust is now seen as a crucial aspect of AI engineering, with sessions highlighting the need for rigorous evaluation and quality control in AI agents. Context engineering has progressed to encompass more than just retrieval-augmented generation, with discussions on how to effectively represent and manage external information. The expo floor featured companies offering products that collectively resemble the departments of a corporation, emphasizing the infrastructure needed to support widespread AI integration. Overall, the fair underscored the shift towards systems that enhance the utility and reliability of AI intelligence.

In addressing the critical question of credential security in AI agents, Arcade.dev offers a solution where the AI model never directly handles sensitive tokens, thereby mitigating risks associated with credential exposure. Instead, Arcade acts as an intermediary, securely managing the lifecycle of credentials and interfacing with systems like Salesforce, GitHub, or Workday. By keeping tokens out of the model's context window, Arcade prevents potential leaks through prompt injections and ensures that authorization is executed just-in-time via OAuth integration with existing identity providers like Okta, Ping, or Entra. This separation maintains least privilege access and is crucial for passing enterprise security reviews, as it provides a clear audit trail and reduces the threat model associated with AI agents. Ultimately, this approach allows AI models to function effectively while keeping secrets secure and visible to security teams, leading to broader adoption within organizations, exemplified by its successful implementation in a financial institution.

At the RSA Conference in March 2026, Cisco introduced a significant advancement by making Cisco Duo a central authorization authority for AI agents, enhancing security by mapping agents to human owners and checking policies on every tool call. This move, supported by developers at Arcade.dev, integrates Duo's existing identity and multi-factor authentication capabilities to verify agent actions in real time, ensuring sensitive data is protected. Arcade complements this by enforcing Duo's decisions at runtime, acting as a gatekeeper that requires Duo Push notifications for sensitive requests before actions are executed. This dual-layer security approach involves initial login and scope definition using Duo Single Sign-On, followed by a real-time, content-aware authorization step when a tool runs, providing granular control over agent actions. Through this integration, agent authorization becomes a runtime question of whether an agent can perform a specific action on behalf of a user, with Duo providing the authority and Arcade executing the enforcement.

Connecting Nous Research's Hermes Agent to a remote Model Context Protocol (MCP) server can be simplified using Arcade.dev's MCP gateway, which offers access to thousands of agent-optimized tools through a single endpoint, thus addressing challenges like configuration sprawl and credential management. Arcade's native OAuth authentication ensures secure handling of downstream credentials by vaulting them away from the agent process, minimizing the risk of exposure and token misuse. The integration of Arcade with Hermes allows a streamlined process by reducing the need for multiple separate connections and enhancing the agent's performance by translating natural language into precise API calls, thereby decreasing parameter hallucinations and token costs. To establish this connection, developers should configure Hermes with OAuth in the config.yaml file, authenticate through the Arcade gateway, and pre-authorize required tools using Arcade's tools.authorize API to ensure seamless operations and maintain a least-privilege principle by using tools.include and tools.exclude settings for restricting tool access.

OpenAI's announcement of GPT 5.6 introduces three versions—Sol, Terra, and Luna—each offering different capabilities and cost efficiencies, alongside a new ultra mode that utilizes multiple agents to handle tasks more collaboratively. Sol, being the flagship model, showcases enhanced reasoning controls, allowing it to delegate complex tasks among sub-agents, which marks a significant shift from relying on a singular, smarter model to a coordinated system of models. The rollout of these models is cautious, with OpenAI conducting a limited preview and involving the U.S. government in the process, highlighting concerns over safety and control in real-world applications. The introduction of reasoning controls and ultra mode enhances the system's ability to manage tasks efficiently, but also raises important questions about authorization and security, especially when multiple agents operate concurrently and potentially access various levels of sensitive information. This development signifies a move towards a more complex, workforce-like AI system, requiring new layers of governance and authorization to manage the expanded capabilities responsibly.

AI agents require access to an organization's private tools, which often reside behind secure, internal networks, posing challenges in networking and governance. While major AI platforms like Anthropic, OpenAI, and Cloudflare have developed solutions to tackle the networking issue by enabling AI clients to connect to internal tools without opening inbound ports, they typically leave governance—such as authentication, credential management, and access control—up to the user. Arcade Warp Pipes offers a managed service that addresses both networking and governance by connecting external AI clients to private tools through a secure, outbound connection, maintaining internal network security, and handling authentication and access control via the Arcade runtime. This allows organizations to facilitate AI-to-tool interactions securely without needing to manage the networking aspect themselves, offering a streamlined solution for integrating AI with internal enterprise tools.

Claude Tag, developed by Anthropic, is a shared AI agent integrated within Slack that automates tasks such as bug investigation, metric retrieval, and support ticket management by leveraging conversation context and connected tools. Unlike a personal chatbot, Claude Tag operates publicly within Slack channels, allowing team members to tag @Claude for multi-step tasks, with results posted back in-thread. This guide outlines how to recreate the core interaction pattern of Claude Tag using Python, Slack Bolt, and Arcade, focusing on implementing a high-value workflow like incident triage. The process involves setting up a Slack app, authorizing tool access through Arcade, and building a tool-calling agent loop that uses a language model to process requests and execute tasks with secure, authorized access to systems like GitHub, Datadog, and PagerDuty. The tutorial emphasizes starting with a narrow, read-only workflow to build trust and gradually expanding the agent's capabilities while ensuring governance through explicit safeguards, logging, and controlled tool access.

Enterprise-Managed Authorization (EMA) centralizes access provisioning by making an organization's identity provider the authoritative decision-maker for Multi-Cloud Platform (MCP) server access, thus eliminating the need for per-server OAuth consent prompts. However, while EMA efficiently manages connection-time governance by determining who may connect to what, it does not provide authorization for individual tool calls, which is critical in preventing attacks like prompt injection that exploit capabilities already present in an agent's environment. These attacks highlight the need for per-action authorization, which evaluates whether a specific tool call should proceed based on the intersection of organization policy, user delegation, and agent capability, checked at execution time. This form of authorization is necessary to limit the blast radius of such attacks and ensure that actions match user intent. Despite advancements in OAuth, including Rich Authorization Requests (RAR), they remain insufficient for transaction-specific authorization in AI agents, demonstrating a need for runtime enforcement mechanisms. Implementing per-action authorization involves using a pre-execution interceptor to evaluate policy at the execution level, ensuring secure action handling without replacing existing corporate identity infrastructures like EMA, and integrating tools such as Microsoft's Agent Governance Toolkit and platforms like Arcade.dev to provide comprehensive runtime security.

Anthropic's recent adoption of Enterprise-Managed Authorization (EMA), a Model Context Protocol (MCP) extension, marks a significant advancement in simplifying the connection of enterprise AI agents by allowing identity providers to centrally manage server access, streamlining the user login process without individual OAuth prompts. This development, which has also been embraced by companies such as Microsoft and Okta, enhances security and operational efficiency by ensuring that employees receive necessary tools from the outset while enabling centralized control over access permissions. EMA's integration with Arcade.dev, which authorizes every action AI agents perform within enterprise tools, provides a robust framework for managing AI agent activities, fostering greater collaboration between security teams and end users. However, EMA is still in its early stages, with limited adoption, primarily supported by identity providers like Okta and a few MCP servers, and it currently lacks support for custom servers due to the need for third-party grant access. Despite these limitations, early access is available for teams interested in leveraging this evolving ecosystem, promising a future of more secure and efficient enterprise AI operations.

A new solution has been developed to transfer files from a personal device to a remote server without routing the data through an AI agent's context window, which traditionally inflates data size and complicates processing. This method involves having the AI agent generate a reference, such as a file path, instead of embedding the actual file data in its output, thereby avoiding the tokenization problem associated with large file sizes. A hook program on the user's machine recognizes this file path and substitutes the actual file data before sending the request out, ensuring the AI never handles the file bytes directly. This approach, which does not require server changes and preserves security by not granting the AI unnecessary data access, is being formalized in the Machine Communication Protocol (MCP) to standardize file handling in AI systems. The method aims to improve efficiency and security, particularly for autonomous AI operations, by enabling client-side resolution of file paths within authorized boundaries, thus preventing unauthorized data access and ensuring the AI only processes necessary information.

The NSA's Artificial Intelligence Security Center has highlighted the rapid proliferation of the Model Context Protocol (MCP), emphasizing the security challenges that have emerged due to its flexible but underspecified design. This scenario is reminiscent of early web protocol deployments, where poor implementation by vendors led to the development of a standard execution layer to address security issues. The NSA's Cybersecurity Information Sheet outlines ten security concerns with MCP, including undefined access control, dangerous serialization, weak approval workflows, and minimal audit logging, which necessitate a new approach to securing MCP environments. Arcade.dev has responded by developing an "actions runtime" that provides secure authorization, reliable tool execution, and centralized governance for multi-user AI agents, addressing many of the NSA's identified gaps. The runtime offers just-in-time delegated OAuth, reliable tools, and a centralized control plane, ensuring that issues like misconfiguration, parameter injection, and audit logging are managed effectively. Arcade's approach aligns with the NSA's recommendations, providing a robust framework for enterprise-level security in AI-driven automation.

Anthropic's disabling of public access to its Claude Fable 5 and Mythos 5 models following a U.S. government directive highlights the inherent security challenges of relying on probabilistic AI models. A jailbreak incident underscored the limitations of model-based guardrails, which are non-deterministic and thus cannot guarantee consistent enforcement of security boundaries. This incident illustrates the need for a structural approach to security that goes beyond relying on models' built-in controls, which can be manipulated to bypass refusals and access sensitive data. The security community emphasizes that risks such as prompt injection are not mere bugs but fundamental properties of systems that mix trusted instructions with untrusted data. Effective security architecture should integrate deterministic controls at the action layer, tied to verified identities, ensuring that any unauthorized actions prompted by a manipulated model do not result in breaches. This approach requires treating AI models as inherently fallible, thereby necessitating robust system-wide controls to prevent unauthorized access and actions, regardless of model behavior.

Arcade.dev has secured $60 million in Series A funding led by SYN Ventures, with strategic investments from Morgan Stanley and Wipro, bringing its total financing to $72 million. The company addresses a critical issue in AI by ensuring that AI agents can perform actions securely and reliably in production environments, focusing on the "action layer" rather than just the reasoning capabilities of AI models. Arcade's solution enables enforcement, execution, and governance of agent actions, making it possible for agents to act within business systems with the same permissions as users, without overprivileged access or security risks. The company, led by a team with experience from major tech firms, has developed an MCP authorization specification adopted by key industry players, creating a neutral control layer that works across different AI models and clients. This funding aims to expand Arcade's tool offerings and enhance its governance capabilities, positioning Arcade as a leader in secure AI deployment within enterprises.

Arcade.dev highlights the evolving challenges of securing agentic AI systems, which are increasingly entrusted with sensitive business operations like managing emails, CRM updates, and financial workflows. The company addresses the vulnerabilities in OAuth-as-a-Service systems, particularly the COAT and COSF attack classes, which exploit the trust inherent in agentic infrastructure. These attacks involve sophisticated methods to hijack OAuth flows and access resources without traditional credential theft. Arcade has proactively redesigned its security architecture to mitigate these threats by binding authorization flows to verified user sessions and ensuring minimal data exposure in agent contexts. The company's efforts have been recognized in the security community, and they are collaborating with the Internet Engineering Task Force to standardize these protective measures across the industry. By prioritizing proactive vigilance and architectural integrity, Arcade aims to set a high security standard for enterprises deploying agentic AI, emphasizing that security must be integral to the system design rather than an afterthought.

On May 27, 2026, Snowflake announced its intent to acquire Natoma, a move that highlights the importance of strict AI governance as a crucial enterprise requirement. This acquisition will integrate Natoma into Snowflake's governance and identity framework for AI agents, prompting engineering leaders to evaluate their multi-user agent infrastructure. The decision involves choosing between ecosystem-native gateways or independent MCP runtimes, with options such as Arcade.dev, AWS AgentCore, WorkOS, and Merge offering varied features like deployment flexibility, secure agent authorization, and identity management. While Natoma's integration into Snowflake could affect its standalone availability, it remains a suitable choice for enterprises deeply integrated into the Snowflake ecosystem, particularly those prioritizing role-based access control and native Cortex tool integration. For those needing cross-cloud portability and independent governance, Arcade offers a vendor-neutral action runtime with extensive agent-optimized tools and lifecycle governance. The acquisition necessitates that teams reassess whether their infrastructure can effectively combine authorization, tool reliability, and lifecycle governance, while maintaining flexibility across deployment environments.

Composio is a platform offering extensive toolkits and APIs for rapid prototyping of AI agents, but transitioning to production requires alternative architectures that address authorization, governance, and deployment challenges. The text discusses several production-ready alternatives to Composio, such as Arcade.dev, AWS AgentCore, Merge, and Natoma, each suited for different needs like secure multi-user production, AWS-native ecosystems, B2B data synchronization, and shadow AI discovery, respectively. Arcade is highlighted for its unified runtime with built-in governance and agent-optimized tools, providing centralized policies and robust audit capabilities. AWS AgentCore integrates deeply with AWS infrastructure, requiring extensive configuration but offering strong compliance benefits. Merge focuses on normalized data schemas for B2B data sync, and Natoma specializes in shadow AI discovery and governance. Recent security incidents involving Composio underline the importance of strong governance and authorization models for production readiness, driving home the need for production platforms that prioritize per-user delegated authorization and centralized governance to mitigate risks and ensure scalability.

Anthropic's release of Fable 5 marks a significant advancement in AI model capabilities, particularly in its ability to autonomously handle complex tasks over extended periods through the use of multiple layers of subagents. These subagents allow for the division of labor, enabling the main orchestrator to maintain focus and efficiency by offloading tasks to other agents, thus making long-running AI agents both practical and powerful. However, this increased capability brings about heightened security challenges for enterprise AI teams, as the authorization process becomes more complex with each subagent potentially inheriting credentials and permissions, leading to potential security vulnerabilities. The challenge lies in ensuring secure action at runtime without compromising the model's advanced reasoning capabilities, and bridging this gap is crucial for moving beyond prototypes to secure, production-ready deployments.

Arcade Labs is a public platform by Arcade's engineering team for sharing research, prototypes, and experimental tools that are under constant development but not officially supported or guaranteed to be stable. The platform allows innovations to be shared immediately, even without a commitment to future support or stability. One of its key offerings, Omni, is an MCP server that optimizes the use of over 500 SaaS productivity tools by allowing agents to dynamically discover and use tools as needed, improving efficiency and user experience by eliminating unnecessary overhead. Additionally, the Agent Library provides a local-first, MCP-native memory layer for AI agents, allowing for efficient text, code, PDF, and image searches. Arcade Labs projects are available at github.com/arcadeai-labs, with some being open source and others being hosted services, and users can provide feedback through GitHub issues, though there is no formal support provided for these projects.

Microsoft Build 2026 showcased a strategic shift in enterprise software, emphasizing agents as the primary unit of work and standardizing on the Model Context Protocol (MCP) for integration across its ecosystem. CEO Satya Nadella highlighted the need for a cohesive environment and common language, with MCP now central to platforms like Foundry, Agent 365, and Copilot. The conference unveiled several key initiatives, including Microsoft Foundry's tooling and runtime layer, Agent 365's control over agent identity and security, and Microsoft IQ's context grounding for agents. Notable announcements included the introduction of seven new in-house MAI models, Project Solara for secure agent-focused hardware, and a tiered execution model blending cloud and local agent compute. The adoption of MCP is widespread, with significant growth in server downloads and enterprise AI implementation. However, challenges remain in ensuring tool quality and governance, as highlighted in the Arcade's State of MCP Tools report, which emphasizes authorization, reliable execution, and the integration of robust identity management to enhance production safety across varied models and frameworks.