Google shipped the first stable version of A2UI, its open format for AI agents to render interactive controls inside a host app rather than in a chat reply, and AWS's Firecracker added a backend that runs its lightweight virtual machines on Nitro Sandboxes, a new AWS isolation layer. MCP put its spec releases on a fixed twice-yearly calendar and voted in its Events Extension for following long-running jobs, the proposed W3C Agentic Web group named its chairs and cleared security review, and Shopify began blocking storefront apps that never declared which servers they run on.
In-app agents: Google released A2UI 1.0
Google released A2UI 1.0, a stable format for AI agents to return interactive screens that the host application renders with its own components. Instead of replying with plain text, an agent can return forms, charts, and pickers the user acts on in place, as Google described in its 1.0 announcement. The release adds two-way interaction, so a rendered control can check what is available and respond as the user works it, along with accessibility support and renderers for the web, Flutter, iOS, and Android. A2UI travels over the AG-UI protocol and runs inside MCP Apps, so the same screens render in hosts such as Claude and Gemini; Google names Atlassian, Bloomberg, Alation, and ByteDance among early adopters. The format carries no executable code: the host app checks every element against a fixed catalog before drawing it and drops anything outside the list.
Why it matters: it gives a user's agent one standard way to turn a text answer into controls the user can work directly, and the same format renders across different apps and assistants rather than each vendor inventing its own. The security model keeps the agent's output as data the app validates, not code it runs.
Infrastructure: Firecracker added an AWS Nitro Sandboxes backend
AWS's Firecracker added a backend that runs its lightweight virtual machines on Nitro Sandboxes, a new AWS isolation layer. Firecracker is the open-source engine that starts and isolates the tiny virtual machines behind AWS Lambda and many of the hosted sandboxes that run customers' and agents' code. Until now it drove the Linux kernel's own virtualization; the 1.18.0 release lets it instead carve isolated machines out of AWS's Nitro hardware, which AWS markets for running untrusted or AI-generated code on shared servers.
Why it matters: it adds another isolation option for platforms that run code their customers and users supply. A product that lets customers write their own plugins or automations now has a hardware-backed choice on the same engine that already underpins much of that infrastructure.
Standards: MCP set a release calendar and accepted its Events Extension
MCP put its spec on a fixed twice-yearly release calendar and named a release manager. The maintainers of MCP, the protocol that lets AI assistants connect to and automate outside apps, set spec releases for the last Tuesday of March and September, with staged deadlines for proposals and SDKs ahead of each, and added a dedicated release-manager role, as laid out in the release-cycle post. The next version is due March 30, 2027. The same week, the Core Maintainers voted to accept the Events Extension, the piece that lets an app notify an agent as a long-running job progresses, though the change is accepted rather than merged and shipped.
Why it matters: a fixed cadence tells the vendors building on MCP when changes will land and when to freeze their own work against them. The Events Extension fills in the reporting half of MCP's long-running-task support, the companion to the Tasks feature vendors started adopting last month.
Agentic web: the proposed W3C Agentic Web group named its chairs and cleared security review
The proposed W3C Agentic Web Working Group named its chairs and cleared W3C's security review. The draft charter, which last week gained a threat model for pages that try to manipulate a visitor's agent, this week filled in its proposed chairs, Heather Flanagan, Liad Yosef, and Yoav Weiss, and W3C's security reviewer recorded on the group's tracking issue that the charter raises no security blockers. It is still a draft and has not reached the member vote that would create the group. Separately, the editors of WebMCP, the draft that lets a web page offer tools a visitor's agent can call, specified that a page is notified a tool ran only after that tool's handler finishes and defined how an agent reads the full set of tools a page offers. WebMCP still runs only in Chromium browsers behind an origin trial, though on November 12 its editors recorded Brave's Leo assistant moving from experimental to default support, planned for the Brave 1.102.2 release on January 5, 2027 and the first change to the project's implementation record since September.
Why it matters: naming chairs and passing security review move the charter closer to the member vote. That vote would turn the community proposal into a chartered standards group, which would set how browsers expose a page's tools to a visitor's agent.
Marketplace governance: Shopify started blocking apps without an IP allowlist
Shopify began blocking apps that never declared which servers they run on. As of November 12, bulk data requests from any public Shopify app that has not listed its own server addresses are refused. This is the first hard deadline in the app-security tightening Shopify set out on October 27: apps still missing the list get flagged in merchant settings and pulled from the App Store for new installs on November 20, and by April 2027 all their data requests fail. Apps that run on changing addresses can list a provider's network range instead.
Why it matters: it forces every third-party app a merchant can install to declare where it sends store data, and enforces that by removing apps that fall short from the marketplace. It is the first piece of that package to block requests rather than only warn.
Game modding: Epic gave Fortnite creators scripted loot drops and entity perception in Verse
Epic added an experimental loot-drop system and entity perception to Verse, the scripting language Fortnite creators use. The 43.10 release, a month after the 43.00 update that made custom progression systems publishable, added a way to script loot drops (weighted pools, multi-item drops, and ready-made chest, ammo, and supply pools matching Fortnite's own) and experimental perception, so a scripted entity can detect what it sees, hears, and touches. It also opened Fortnite's time-of-day and sky controls to scripts.
Why it matters: each release moves more of Fortnite's own behavior into Verse, the part creators script themselves, so a creator can build loot tables and reactive entities into an island without Epic hand-coding them.
Also worth knowing
- Google's Chrome team proposed supervised sessions for AI agents driving a browser. A new web-incubation proposal would extend the standard browser-automation protocol so an agent drives a browser under supervised sessions: restricted to permitted actions, told when the user interrupts, and able to have specific permissions paused without disconnecting. It is an early, single-author proposal with no cross-vendor backing yet.
- Atlassian set new limits on Forge apps and began phasing out weaker file checksums. Forge, Atlassian's platform for apps built inside Jira and Confluence, capped how many configuration values and secrets an app may store (in force May 2027) and will reject older, non-SHA256 file checksums starting December 10, per its developer changelog.
- Roblox and its Luau language shipped new creator building blocks. Roblox's weekly release added instances for processing live audio streams and a property reporting a server's region, and the Luau language gained a new loop form and runtime speedups that reach every product embedding it.
On the radar
- November 17: Chrome 158 reaches the stable channel, and Cloudflare changes a default in how its Workers handle a cancelled request.
- November 20: Shopify flags apps without an IP allowlist and pulls them from the App Store for new installs.
- Mid-to-late November: The W3C posts minutes from its Dublin meeting, including the WebMCP and browser-extension sessions.
- December 1: New Microsoft 365 Copilot Business licenses switch to usage-based billing by default, and Copilot becomes purchasable without a qualifying base subscription.
- December 10: Atlassian Forge begins rejecting non-SHA256 file checksums.
- December 18: Atlassian stops forwarding Forge's old full-page addresses.
- December 31: Cloudflare ends bug and security fixes for the 0.x line of its Sandbox SDK.
- January 1, 2027: Shopify delists public apps still using credentials that never expire.
- January 5, 2027: Brave 1.102.2 is expected to turn on WebMCP support by default in its Leo assistant.
- March 30, 2027: MCP ships its next spec release under the new fixed calendar.
This Week in Extensibility is curated by Todd Schiller. Research, drafting, and fact checking are AI-assisted.