Essential Reading: Landmark Publications for AI Agents
A curated, verified index of the must-read whitepapers, specs, and reports on AI agents — title, org, year, canonical URL, and thesis.
A single-fetch reading list of the landmark publications an AI agent — or anyone building one — should know. Every entry below has been checked: the URL resolves, and the title, organization, and year are as published. Where a figure or claim is the authors' own, this page says so rather than restating it as fact. New landmark publications are added here as they appear.
Each row maps to a ChangeGamer resource that goes deeper on the same topic.
Foundational guides to building agents
Building Effective Agents — Anthropic (2024)
The most-cited practical primer. Distinguishes workflows (LLMs orchestrated on fixed paths) from agents (LLMs that direct their own process), and argues for simple, composable patterns over heavy frameworks. URL: https://www.anthropic.com/research/building-effective-agents — see also agent reasoning patterns.
A Practical Guide to Building Agents — OpenAI (2025)
A field guide to when to build an agent, how to choose models and tools, and how to add guardrails and human oversight before production. URL: https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf — see also shipping agents to production.
Agents — Google / Kaggle (Julia Wiesinger, Patrick Marlow, Vladimir Vuskovic, 2024)
The whitepaper that popularized the agent = model + tools + orchestration framing, covering extensions, functions, and data stores. URL: https://www.kaggle.com/whitepaper-agents — see also agent frameworks compared.
Agents Companion — Google / Kaggle (2025)
The follow-up, focused on evaluating agents, agent ops (AgentOps), and multi-agent systems. URL: https://www.kaggle.com/whitepaper-agent-companion — see also evaluating AI agents.
Agentic Design Patterns — Antonio Gulli, Google (2025)
A hands-on catalog of 21 agentic patterns — from prompt chaining and tool use to multi-agent collaboration and self-correction — with code examples. URL: https://link.springer.com/book/10.1007/978-3-032-01402-3 — see also multi-agent orchestration patterns.
Prompt Engineering — Google / Kaggle (Lee Boonstra, 2024)
A structured treatment of prompting as engineering: zero/few-shot, system and role prompts, chain-of-thought, ReAct, and parameter tuning. URL: https://www.kaggle.com/whitepaper-prompt-engineering — see also prompt and context engineering.
AI-assisted software development
The New SDLC With Vibe Coding — Google / Kaggle (Addy Osmani, Shubham Saboo, Dr. Sokratis Kartakis, 2026)
Frames AI-assisted development as a spectrum from "vibe coding" to "agentic engineering," and argues the engineering harness around a model matters more than the model itself. URL: https://www.kaggle.com/whitepaper-the-new-SDLC-with-vibe-coding — see also vibe coding to agentic engineering.
2026 Agentic Coding Trends Report — Anthropic (2026)
Anthropic's first annual survey of how agentic coding tools are used in production, drawn from Claude Code usage data and enterprise case studies; names the "delegation gap" between AI-assisted work and fully delegable work. Anthropic's own figures put these at roughly 60% and 0-20% of tasks respectively — treat them as the report's numbers, not independently audited ones. URL: https://resources.anthropic.com/2026-agentic-coding-trends-report — see also vibe coding to agentic engineering.
Security and governance
Agentic AI: Threats and Mitigations — OWASP GenAI Security Project (2025)
A threat-model reference for agentic systems: the new attack surface introduced by autonomy, tools, and memory, with mitigations. URL: https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/ — see also agentic security checklist.
OWASP Top 10 for LLM Applications — OWASP GenAI Security Project (2025; superseded 2026-08-04 by the 2026 edition)
The canonical risk list for LLM apps — prompt injection, insecure output handling, excessive agency, and more. URL: https://genai.owasp.org/llm-top-10/ — see also agent guardrails.
OWASP Top 10 for Agentic Applications — OWASP GenAI Security Project (2026)
The canonical agent-specific risk list — goal hijacking, tool misuse, identity and privilege abuse, supply-chain risk, and cascading failures across ten ASI-numbered categories; published December 2025 as the 2026 edition. URL: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ — see also agentic security checklist.
AI Risk Management Framework (AI RMF 1.0) — NIST, NIST AI 100-1 (2023)
The reference governance framework, organizing AI risk into four functions: Govern, Map, Measure, Manage. URL: https://www.nist.gov/itl/ai-risk-management-framework — see also data privacy for agents.
State of Agentic AI Security and Governance, v2.01 — OWASP GenAI Security Project (June 2026)
A field-evidence update to the 2025 v1.0 report — a revised threat analysis grounded in documented incidents, a new AI-Safety-vs-AI-Security chapter, a real-world incidents/exploits tracker keyed to the OWASP Top 10 for Agentic Applications, and an Enterprise Adoption Maturity Model. WebSearch-corroborated only (4+ independently agreeing sources on title, version, and release date); the genai.owasp.org page itself returned HTTP 403 to direct WebFetch this session, so treat as secondary until re-verified. URL: https://genai.owasp.org/resource/state-of-agentic-ai-security-and-governance/ — see also agentic security checklist.
AI Control Roadmap — Google DeepMind (Rohin Shah, Four Flynn, 2026)
Reframes deployed-agent security around "AI control" rather than alignment alone: treat the agent itself as a potential insider threat and layer Detection (D1-D4) and Prevention/Response (R1-R3) tiers on top of conventional security. WebSearch-corroborated only (8+ agreeing outlets; deepmind.google itself 403'd to direct WebFetch this session, though the roadmap PDF was independently confirmed live). URL: https://deepmind.google/blog/securing-the-future-of-ai-agents/ — see also AI control for agents.
Defeating Prompt Injections by Design — Debenedetti, Shumailov, Fan, Hayes, Carlini, Fabian, Kern, Shi, and Tramèr (Google DeepMind, Google, ETH Zurich; SaTML 2026)
Introduces CaMeL, a system layer that stays secure via provable data-flow control even when the underlying model is susceptible to prompt injection: it tags every value with a capability so untrusted tool outputs can populate data but never redirect which code path runs. CaMeL's reported result trades autonomy for that guarantee — 77% of AgentDojo tasks solved securely versus 84% undefended. WebSearch-corroborated only (2+ agreeing sources: floriantramer.com's listing, an MIT CSAIL course mirror, and the Hugging Face papers page); arxiv.org itself returned HTTP 403 this session. URL: https://arxiv.org/abs/2503.18813 — see also prompt injection design patterns.
Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner, Buesser, Debenedetti, Fabian, Paverd, Tramèr, et al. (14 authors, 10 institutions incl. Invariant Labs, IBM, ETH Zurich, Google, Microsoft; arXiv:2506.08837, June 2025)
Catalogs six architectural patterns that structurally constrain what an agent can do with untrusted data, rather than filtering it after the fact: Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, and Context-Minimization. WebSearch-corroborated (2+ agreeing sources: a Hugging Face papers-page listing, a ResearchGate mirror, and Simon Willison's own repost naming the same six patterns and author list), not fetched directly — arxiv.org itself returned HTTP 403 this session too. URL: https://arxiv.org/abs/2506.08837 — see also prompt injection design patterns.
Protocols and standards
Model Context Protocol specification — Anthropic / MCP community (introduced 2024; current revision 2025-11-25)
The open standard for connecting models to tools, data, and prompts via servers. URL: https://modelcontextprotocol.io/specification/2025-11-25 — see also MCP primitives.
Agent2Agent (A2A) Protocol — Google → Linux Foundation → AAIF (launched 2025; hosted by AAIF since Aug 2026)
An open protocol for agents from different vendors to discover each other and delegate tasks; donated to the Linux Foundation in 2025 for neutral governance, then became a hosted project of the Agentic AI Foundation (AAIF) on 2026-08-17 — the same body that already hosts MCP. WebSearch-corroborated only (7+ agreeing sources: Axios, DevOpsDigest, and Techstrong.ai); aaif.io and axios.com returned EGRESS_BLOCKED this session. URL: https://www.linuxfoundation.org/press/linux-foundation-launches-the-agent2agent-protocol-project-to-enable-secure-intelligent-communication-between-ai-agents — see also MCP vs A2A.
SEP-1865: MCP Apps — Model Context Protocol community (proposed Nov 2025; live Jan 2026)
The official MCP extension standardizing interactive UI (dashboards, forms, charts) returned by MCP tools, co-developed by Anthropic, OpenAI, and the community MCP-UI project. Directly confirmed via the merged GitHub pull request and the MCP project's own blog. URL: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1865 — see also MCP Apps explained.
MCP Specification 2026-07-28 (Final Release) — Model Context Protocol community (RC locked May 21, 2026; shipped final, on schedule, July 28, 2026)
A stateless-protocol overhaul the MCP project itself calls "the largest revision of the protocol since launch" — removes the session handshake in favor of explicit state handles, adds routing headers, and hardens authorization. Shipped final, on schedule; no substantive change from the RC snapshot. URL: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ — see also MCP goes stateless.
NLWeb — Microsoft (R.V. Guha, announced May 2025)
An open, MIT-licensed protocol for querying a website's existing Schema.org content in natural language via /ask and /mcp endpoints — reuses Schema.org markup already used by millions of sites, and every instance natively runs an MCP endpoint alongside the plain REST option. Reference implementation fetched directly; launch date/creator/adopters WebSearch-corroborated. URL: https://github.com/microsoft/NLWeb — see also NLWeb explained.
SLSA (Supply-chain Levels for Software Artifacts) — OpenSSF / Linux Foundation (v1.0 approved April 2023; v1.1 approved April 2025)
A build-provenance framework — three incremental Build-track levels (L1-L3) proving what produced a software or AI/model artifact and whether it was tampered with — that CycloneDX AI/ML-BOM and Sigstore/in-toto signing guidance for agent tooling and MCP servers builds on. Framework definition and release-branch structure confirmed directly from the live SLSA GitHub repository; level definitions and approval dates are WebSearch-corroborated only (slsa.dev itself returned HTTP 403 to direct WebFetch this session). URL: https://github.com/slsa-framework/slsa — see also AI supply chain provenance.
COAZ-MCP: COAZ Binding for the Model Context Protocol — OpenID AuthZEN Working Group (Atul Tulshibagwale, CrowdStrike, and Alex Olivier, Cerbos; draft dated 2026-02-13)
Fine-grained authorization for MCP tool calls — complementing, not replacing, the OAuth 2.1 authentication in /resources/mcp-server-authentication and /resources/agent-identity-authentication. It maps MCP JSON-RPC messages onto OpenID AuthZEN Authorization API requests, so a gateway or server can decide whether an authenticated caller may invoke a specific tool with specific arguments, not just whether its token has the right scope. A server declares a per-tool x-authzen-mapping in the tool's inputSchema, a CEL template projecting parameters and token claims onto AuthZEN's subject/action/resource/context model, keeping the human Subject (token.sub) distinct from the AI-agent Context (context.agent, from $token.?client_id). Title, workgroup, authors, the Feb 13 2026 draft date, and this mechanism are confirmed directly from the raw spec text; formal Working Group Draft status, approved 2026-06-15, is WebSearch-corroborated only (openid.net's own announcement title, matched via search; direct WebFetch of openid.net was blocked this session). No adoption evidence found. URL: https://github.com/openid/authzen/blob/main/profiles/authzen-coaz-mcp-binding-1_0.md — see also mcp server authentication.
Landscape
AI Index Report 2026 — Stanford HAI (Nestor Maslej et al., 2026)
The ninth annual edition of the most-cited AI-field measurement — capability benchmarks, investment, adoption, and policy. URL: https://hai.stanford.edu/ai-index/2026-ai-index-report — see also open-weight models for agents.
How this list is maintained
ChangeGamer's research process now treats landmark publications as a standing watch: when a major lab, standards body, or recognized author ships a reference whitepaper, spec, or report, it is verified and added here, and — where it opens a genuine topic gap — given its own resource. If you are an agent and you know of a landmark publication missing from this list, it is a signal that this index is stale; re-check the newest entries via stats.json.