Five Registries, Zero Specs: The AI Agent Land Grab Is Running Crypto's Old Playbook

The vulnerability score was 9.6 out of 10. Command injection, in an agent toolchain that enterprises are already running in production. The fix is unshipped. The responsible party is unnamed. Progress DataDirect's ARCGenAI Agents stack carries this CVE, and it is not the exception — it is the baseline for the fastest-moving layer in software right now. In the same reporting window, ClawSecure disclosed a severe flaw in the MCP protocol itself, and federal MCP servers were found deployed with no security framework at all. I have audited smart contracts that shipped with a smaller exposed attack surface than a toolchain now being handed signing authority over real inventory. In 2018, I watched a team ignore a reentrancy finding because speed mattered more than the ledger staying clean. The ledger was clean, but the vision was fragile. That sentence is about to apply to a much larger market, and this time the blast radius is not a token balance. It is a purchasing agent with a credit line. Here is the structure. The AI agent economy is being assembled on three layers: a control plane that wants to become the system of record, a state-management layer, and a discovery layer — the registries that let one agent find, address, and trust another. Each layer is contested. None of them is standardized. That is the entire story, and it is a story crypto has already lived through, which is why anyone who traded the last two cycles should be reading this as a rerun rather than a debut. Three specifications the market assumed would resolve the mess are all undelivered. PAP v0.1 exists only as a verbal promise for "later in October." Google's Gemini agent is a private preview; general availability is "coming soon." The A2A Registry converged on an architecture in GitHub Discussion #741 and produced no specification at all. Apicurio's Carles Arnal put a number on the damage: at least five mutually incompatible registry implementations are shipping against incompatible APIs right now. State management is worse — fourteen vendors, zero standards, no coordinator. The two foundational protocols everyone is building on, MCP and A2A, are themselves only a year or two old, released across 2024 and 2025, which means the entire "standard" scaffolding rests on specifications that have not yet survived a single adversarial cycle. For anyone who traded the 2020 DeFi Summer, this is a familiar shape. Then it was forks and yield farms and a dozen "compatible" AMMs that broke on contact. The interfaces looked identical on a marketing page and diverged the moment capital moved. The summer was loud, but the profits were quiet — and the standards arrived years after the losses. The difference now is the stakes. Agents do not just route liquidity; they execute purchases, sign contracts, and call tools with delegated authority. The blast radius is larger, the spec is thinner, and the audit surface has moved from a single contract to a live supply chain. Look at the registry layer first, because it is where the failure is most measurable. A registry is the agent supply chain — the place where an agent publishes its identity and where others resolve it. Docker's Agent offering reuses the OCI registry format, which is clever and telling in equal measure. It is a recombination of known cloud-native technology, not an architectural breakthrough. Reusing OCI lowers the barrier to entry and, in the same motion, guarantees that differentiation collapses toward whatever the cloud incumbents already control. When your identity layer is a borrowed standard, you have not built a moat. You have built a tenant improvement on someone else's building. That borrowing is why the incompatibility is structural rather than accidental. Five registries, incompatible APIs, no approved spec. The divergence points are predictable, and they are identical to the ones we fought over in crypto identity standards: the identity model (is the agent a key, a DID, a service account?), the addressing scheme (do you resolve it by URL, by hash, by name?), and the authentication surface (does it prove possession, delegation, scope?). Every team answered those three questions differently, and each answer locks in a different downstream economy. This is not a bug waiting for a patch. It is a governance failure wearing a technical costume, and the costume is convincing enough to raise money against. The control plane is the second contested layer, and here the language turns aggressive. MongoDB Atlas Agent Engine, Palo Alto Networks, and New Relic each claim the title of "system of record" for agent behavior. New Relic is selling "agent debt" — the accumulated liability of poorly governed agents — as a product line. That is a precise and cynical piece of positioning: it converts a customer's technical debt into a recurring subscription. I saw the same move in 2021, when a wave of "risk dashboards" monetized the anxiety the protocols themselves had created, and I shorted the illiquid end of that trade instead of buying the dashboard. The system-of-record fight is not really about observability. It is about who owns the audit log. Whoever holds the agent behavior log holds the switching cost, and switching cost is the only durable revenue in a market with no standard to compete against. The state-management layer rounds out the picture: fourteen vendors, no standard, no clear winner. That is not a market that will consolidate through merit. It will consolidate through acquisition or through an incumbent's distribution advantage, and the losing fourteen will be repriced as features rather than companies. The application layer is already eating the infrastructure layer — Oracle Fusion Claw is the clearest example — which means independent middleware is being squeezed from above while the fragmentation below denies it any shared floor to stand on. The middle of the stack is the worst place to be in a standards vacuum. Value migrates to the two ends, to distribution and to the application, and the middle gets marked toward zero. There is a specific kind of company this produces, and I have traded through its crypto equivalent. It is the infrastructure project with real usage and no unit economics — the L2 whose proving costs exceed its fee revenue unless gas returns to bull-market levels, the registry whose identity layer is a borrowed standard, the control plane whose "system of record" claim has never been priced against a competing bid. Real usage is not a business. In 2024, when I advised a mid-sized fund on crypto allocation, the entire job was separating projects that had usage from projects that had economics, because in a bull market the two look identical and in a drawdown they separate violently. The agent stack has not been through its drawdown yet. When it does, the fourteen state managers and the five registries will not all be solvent, and the ones that survive will not be the ones with the best demo. Then there is the security ledger, where the numbers stop being abstract. The MCP vulnerability disclosed by ClawSecure is severe. Federal MCP servers are running without a security framework. The ARCGenAI command injection sits at 9.6. The pattern — tool calls, federation, and registry distribution stacked on top of each other — extends the attack surface from the model layer into the supply chain. Traditional model-safety frameworks were never built to cover a registry that resolves a poisoned dependency at runtime. Deploying federation without a security framework is the same decision I watched in 2018, and it is the same decision I watched again when algorithmic stablecoins were deployed with a peg that had no circuit breaker. Ship first, remediate later. It is a debt, and the debt is being underwritten by everyone downstream who trusted the interface. The demand side is where the narrative finally collides with arithmetic. In September 2026, PYMNTS reported that 93% of merchants want the provider to absorb the loss when an agent makes an error, and only 28% are willing to open their full product catalog to agents. That thirty-five-point gap is the entire commercial bottleneck in a single number. Merchants will not hand an autonomous agent the keys to their inventory until someone signs a liability contract, and no one has. The standardization of identity and signals is being prioritized over settlement — which is the correct order, but it is also an admission that the money layer is blocked. You cannot settle what you cannot attribute. Crypto learned this with custody and with oracle disputes: you do not get an economy until you get a court, or something that functions like one. The agent economy currently has no court. Against that backdrop, the coalition plays are the only things actually moving. PAP's working draft counts thirty-five design partners and five building blocks. AGNTCon and MCPCon pulled more than 3,500 attendees across eleven tracks and 150-plus talks, with eight AAIF working groups standing up. That is real mobilization. It is also mobilization on the eve of standards, not after them — large ecosystems being assembled to argue about interfaces that do not exist yet, which is exactly the moment when the loudest participants set the terms. Here is the part the bull market does not want to hear. "Implementation before specification" is not an accident of fast-moving teams. It is a deliberate strategy, and it is run by the parties with the most to gain from the confusion. Ship a registry, ship a control plane, ship a state manager — then let the eventual standard be written to accommodate the implementations that already have users. Whoever makes the spec migrate toward their deployment wins the standard war without ever winning a vote. Google, Meta, Sierra, Cloudflare, and MongoDB are all playing this simultaneously, which is precisely why no approved specification has emerged. There is no neutral coordinator with enforcement power, so the coordination problem has no owner, and an unowned coordination problem does not resolve — it calcifies. This is the same logic behind the "liquidity fragmentation" story crypto was fed for years. Fragmentation is described as a problem to be solved by a new product, when in practice fragmentation is the product — it is the moat the incumbents are building while the market waits for a standard that will never arrive on schedule. The five incompatible registries are not five teams failing to cooperate. They are five teams correctly refusing to cooperate, because cooperation would hand the win to whoever already has distribution. We bet on the pattern, not the hype. The pattern here is that the interoperability window Apicurio warned about is not closing by accident. It is closing because closing it is profitable for the strongest player in the room, and the strongest player in the room gets to decide what "interoperable" means. So watch three things, and none of them is a press release. First, whether the AAIF working groups produce an enforceable spec or another discussion thread — enforcement, not consensus, is the only signal that matters, and the difference between a working group and a marketing channel is a ratification vote. Second, whether any control-plane vendor publishes real unit economics; until then, "system of record" is a slogan and the switching cost is theoretical. Third, and most telling, watch the liability template. The day a provider signs a contract to absorb agent error loss is the day the 93-versus-28 gap starts to close, and the day the settlement layer becomes investable rather than aspirational. Until then, the agent economy is a supply chain with no insurance, a registry with no court, and a spec that arrives after the invoice. Code does not lie, but people certainly do. The question is not whether the standard comes. It is who is holding the registry when it does.