The week's activity clustered on the agentic web. OpenAI pulled six web-platform companies into a hackathon to get sites exposing tools to AI agents, its ChatGPT desktop app became the first non-browser client documented to use that interface, and the Model Context Protocol published a roadmap for its next cycle. In the isolation layer below, two open-source projects tightened how sandboxes fence off the network, while an essay questioned whether sandboxes are the right tool for AI agents at all.
Agentic web: OpenAI rallies vendors behind WebMCP
OpenAI opened a ten-day WebMCP Challenge backed by six web-platform companies. The challenge, which OpenAI is running with Google Chrome, Cloudflare, Shopify, Vercel, Render, and Netlify, asks developers to either build a new agent-native web app or add WebMCP support to a site they already run, with $35,000 in cash prizes. WebMCP lets a website expose in-page actions that a user's own agent can call directly instead of scraping the page. It remains an experimental Web Machine Learning Community Group draft, available in browsers only behind an origin trial. Submissions opened August 25 and close September 3, with winners named September 23.
OpenAI's ChatGPT desktop app became the first non-browser client documented to support WebMCP. An update merged August 26 adds ChatGPT's desktop application to the specification's cross-browser implementation-status list, next to the existing origin trials in Chrome and Edge and experimental support in Brave. Until now the interface had been documented only in Chromium browsers.
Why it matters: WebMCP's momentum has run almost entirely through one browser engine family. A major model provider organizing a cross-company hackathon, and wiring the interface into its own desktop client, broadens who is testing the draft beyond browsers. The interface is still experimental everywhere it appears, so this is adoption of a draft, not cross-vendor agreement or a stable capability. Neither Apple's WebKit nor Mozilla's Gecko has implemented it.
Standards: MCP maps its next spec cycle
The Model Context Protocol published a roadmap naming five priorities for its next specification cycle. The August 22 roadmap is forward-looking. It describes work the maintainers intend to do, not capabilities that have shipped. Two priorities target how agents act: server-initiated messaging so clients stop polling for results, and an identity-and-delegation path so an agent can act as itself or on a named user's behalf rather than through a shared key. A third, progressive tool discovery, lets a server present a small entry point and reveal more of its catalog as a task narrows. A fourth continues to unify how servers connect. One piece is already in place: a July release unified how remote servers connect over the web.
Why it matters: MCP is the dominant way agents connect to outside tools and data, so the direction it sets shapes what a user's agent can safely do across the services it reaches. Identity and delegation in particular govern whether an agent acts with its own, auditable identity instead of a borrowed credential. The roadmap is a statement of intent, and none of these are settled specification text yet.
Idea: govern AI agents with rules, not just containment
Steve Yegge argued that technical sandboxes are the wrong primary defense for AI agents, and that rules and governance should carry more of the load. In "Fences, Not Sandboxes", published August 24, Yegge contends that a determined agent can find its way around hard containment. The more durable control, he argues, is a layer that defines what an agent may do, checks its decisions, and records where its actions came from, not an attempt to wall it off completely. He frames this as a complement to sandboxes, not a replacement.
Why it matters: most extensibility safety assumes untrusted code can be contained, the assumption the infrastructure items below reinforce. Yegge names a real tension: as user-facing extensions become AI agents that act with judgment, the question shifts from what code can touch to what an actor is allowed to decide.
Infrastructure: OS-level sandboxes tighten the network boundary
Two open-source isolation projects shipped releases that harden how sandboxed code reaches the network. go-landlock 0.10.0, released August 24, adds support for the tenth version of Landlock, a Linux kernel feature that lets a program restrict what its own code is allowed to do. The new version can restrict outbound UDP network traffic, closing a gap where earlier versions could limit files but not that class of network access. Kata Containers 4.1.0, released August 21, runs containers inside lightweight virtual machines for stronger isolation. It added a rootless mode that drops the shared-filesystem component entirely and gained support for additional hypervisors.
Why it matters: these are the layers products build on to run a customer's or an agent's code in isolation, and the network boundary is where that isolation most often leaks. When the kernel and the virtual machine can limit which connections contained code opens, a product gets tighter control over untrusted code without building that control itself.
Also worth knowing
WebMCP's draft gained early proposals for agent identity and saved automations. Two discussion items opened this week: one proposing a way for a site to recognize a returning agent and remember per-agent permissions, and another proposing that a completed multi-step agent task be saved as a reusable, reviewable workflow. Both are early Community Group discussion, not specified capabilities.
Chrome added an extension interface for finding the public suffix of a web address. The extensions release notes describe a built-in way to ask where a domain's registrable part ends, for example telling example.co.uk apart from a subdomain, a piece extensions previously had to bundle themselves.
On the radar
- September 1: Atlassian's cloud-app reliability targets for Forge apps take effect.
- September 3: Submissions close for the OpenAI WebMCP Challenge.
- September 23: OpenAI names the WebMCP Challenge winners.
- October 1: Atlassian Forge revenue-share rate changes take effect.
This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.