For the past two years, companies have been racing to build AI agents. Most of that work has been focused inward: Embedding agents inside existing enterprise applications, workflows and teams. Now a more consequential shift is already underway. AI agents are beginning to operate beyond the boundaries of the enterprise, interacting with external systems, coordinating with partner platforms and, increasingly, engaging with other agents owned by different organizations. This is where the architecture changes.
The next wave of AI is not about what happens inside your company. It’s about what happens between companies. Consider what this enables:
These are not future scenarios. The underlying capabilities already exist. What’s changing is the expectation that these interactions will happen continuously, autonomously and across organizational boundaries.
That shift exposes a problem most enterprises have not yet designed for: Agents must be able to communicate, coordinate and establish trust outside the systems they were built in. Today’s enterprise stack was not built for that. Every company is developing agents on different frameworks, with different data structures and behind different security models.
When those agents need to interact across companies, complications arise as there is no shared identity, agreed upon standard messaging and no way to understand or build trust with external agents. Without a shared identity model, agents can’t reliably authenticate each other or verify permissions. Every interaction has to be explicitly defined: Who can call what, under which conditions and with what level of access. That turns even simple cross-enterprise workflows into a web of point-to-point integrations. The result is predictable: Most “agent-to-agent” workflows today are brittle, hard-coded and manually maintained. They work in isolated use cases, but they don’t scale well.
This is exactly why a new layer of infrastructure is emerging. Efforts like AGNTCY are trying to solve a very specific problem: How do agents from different companies find, verify and communicate with each other securely? AGNTCY was initially open-sourced by Cisco in March 2025 and has since grown to include more than 75 supporting companies, with Cisco, Dell Technologies, Google Cloud, Oracle and Red Hat joining as formative members under Linux Foundation governance.
This is already moving from concept to implementation. A recent Cisco Outshift and ServiceNow example shows AGNTCY being used to enable governed, multi-agent workflows across enterprise platforms; in this case, connecting Cisco’s agentic network intelligence with ServiceNow’s workflow and governance layer.
“We launched the internet of agents in early 2025, and subsequently built AGNTCY to solve a real coordination problem: How agents from different vendors and companies can find, verify and collaborate openly with each other,” said Vijoy Pandey, SVP and GM, Outshift by Cisco. “We’ve put this into practice with many partners, like this example from ServiceNow — using AGNTCY to enable secure, multi-agent workflows that connect platforms that wouldn’t otherwise talk to each other. By creating a shared layer for discovery, identity, communication and observability, we’re moving past brittle, one-off integrations toward an interoperable ecosystem where agents can actually work together to deliver results as the world has envisioned.”
The ServiceNow example is not yet the full cross-enterprise version of the internet of agents. It is an early proof point inside the enterprise stack: Agents from different platforms coordinating through a shared layer rather than through brittle, custom integrations. The next step is applying the same standards and governance patterns across company boundaries, where agents owned by different organizations can discover, verify and work with one another safely.
AGNTCY provides foundational components: Discovery (so agents can find each other and understand their capabilities), identity (cryptographically verifiable credentials and access control), messaging (structured, secure, safe communication) and observability (end-to-end visibility into what agents are actually doing). The ambition is bigger than a framework: AGNTCY is trying to become part of the shared infrastructure that lets agents operate safely across company boundaries.
AGNTCY is not alone. It’s part of a broader, fast-forming ecosystem tackling different layers of the same problem. Emerging agent-to-agent (A2A) approaches are beginning to define how agents exchange messages and coordinate tasks across systems. The Model Context Protocol (MCP) is helping standardize how agents access tools, APIs and external context. At the same time, a range of academic and open efforts are exploring federated identity, negotiation and decentralized orchestration.
As agents become more autonomous, ad hoc integrations quickly become difficult to scale, secure and govern across environments, driving the need for standardized communication layers. In other words, we’re watching the early formation of a protocol stack for agent-to-agent interaction. The real test comes when these protocols move from internal workflows to external business ecosystems: Supply chains, financial networks, healthcare systems, partner platforms and customer journeys no single company controls.
If this were just about sending messages, we’d already be done. The real challenge is whether one company can trust another company’s agent to act correctly. That’s why AGNTCY and similar efforts emphasize verifiable identity, access control and observability. Without these, cross-enterprise agent collaboration becomes a security nightmare. And the threat landscape is already real. Today, enterprise AI agents face a distinct and expanding set of attack vectors like prompt injection, token compromise, model poisoning, identity spoofing and data exfiltration via agent queries that traditional security tools were not designed to detect.
“The enterprise wasn’t built for a world where AI agents can make decisions and take action on their own, which is why trust has to be built in from the start,” says Srini Namineni, Chief Automation Officer at Cisco. “The goal isn’t full autonomy everywhere. It’s the right level of autonomy for the right task, with humans involved where judgment, accountability or risk demand it. The companies that succeed with agentic AI won’t simply be the ones that move fastest. They’ll be the ones that establish the right guardrails early and apply them consistently as agents begin working across systems, teams and organizations.”
A landmark example: Security researchers in early 2026 discovered a vulnerability in a major enterprise SaaS platform that demonstrated how an attacker could effectively exploit an enterprise AI agent through the systems and permissions it relied on. The research showed how agents can be tricked into recruiting more powerful agents to fulfill a malicious task, and the exposure was significant: The affected applications were in use across nearly half of the Fortune 100.
Early implementations of agent protocols have also exposed a more mundane but pervasive gap: The configuration files that connect language models to external tools are often being treated as setup plumbing rather than security-critical infrastructure. Researchers and security firms have found MCP and agent configuration files containing hardcoded secrets, overly broad permissions and risky defaults, including a 2026 scan of more than 34,000 repositories that found hardcoded secrets inside agent files. The pattern is familiar: Developers copy example configurations, wire agents into real systems and move faster than security governance can adapt. But in the agentic era, a sloppy config file does not just expose an API key; it can define what an AI agent is allowed to read, write, run or transmit.
Most organizations are still focused on deploying agents, improving model performance and scaling internal use cases. But the next challenge is operating architecture: Deciding how agents are identified, authorized, monitored, connected and governed across systems.
This is the starting point. If your agents cannot reliably authenticate external systems, verify permissions and operate within clear trust boundaries, cross-enterprise collaboration is not viable. Identity, authorization and traceability are the foundation for everything that follows and the hardest to retrofit once agents are already deployed. Without this layer, any attempt at external coordination introduces significant security and operational risk.
Trust and interoperability have to be designed together. Agents need to connect across systems without losing identity, context, authority or auditability. This means moving beyond closed, tool-specific architectures and designing for:
Getting this right early will avoid costly rework and position enterprise agents to operate safely across broader agent ecosystems.
This is where interoperability becomes more than a technical architecture issue. With identity, permissions and shared protocols in place, agents can begin to coordinate across organizational boundaries by connecting with partners, suppliers and external platforms to execute workflows that no single system controls end to end.
Procurement offers an early signal of what this could look like. MIT’s Center for Transportation & Logistics has described how AI is reshaping supplier negotiations, moving from copilots toward semi-autonomous and autonomous negotiation systems operating within guardrails. Walmart’s use of AI to negotiate replenishment terms with suppliers shows how agentic systems can move beyond internal task automation and into structured interaction with external parties. For an interoperability lens, the lesson is that cross-enterprise agent workflows require a common operating layer: Verified agent identity, clear authority boundaries, structured data exchange, auditable decisions and shared rules for when humans must approve or intervene.
Without that interoperability layer, agents remain trapped inside individual applications. With it, they can participate in broader business ecosystems where sourcing, negotiation, approval, contracting and fulfillment can be coordinated across company boundaries.
Data interoperability runs through all of this. Agents cannot coordinate across systems, tools or enterprises if the underlying data cannot be consistently understood, traced and exchanged. That requires standardized taxonomies, clear data lineage, shared definitions and alignment across functions.
Many organizations have deferred this work because humans have historically absorbed the ambiguity: Translating between systems, reconciling inconsistent labels and interpreting context that was never formally encoded. Agents will not have that same tolerance for messy handoffs. As they begin to interact across applications, business units and external partners, weak data foundations will become one of the biggest barriers to agent interoperability.
We’re at the same moment the internet faced in the early 1990s. The technology is advancing quickly, but the basic infrastructure for coordination is still being worked out. Companies have spent the last two years building agents inside their own walls. The next challenge is learning how those agents will work with everyone else’s.
That is the central question behind the internet of agents. It will not be enough for a company to have powerful agents. Those agents will need to safely identify, communicate and coordinate with agents outside the company. Otherwise, even the most sophisticated agents will fail to participate safely in broader business ecosystems.
**This article is published as part of the Foundry Expert Contributor Network.**Want to join?