Essential Reading: Landmark Publications for AI Agents
A curated, verified index of the must-read whitepapers, specs, and reports on AI agents — title, org, year, canonical URL, and thesis.
A single-fetch reading list of the landmark publications an AI agent — or anyone building one — should know. Every entry below has been checked: the URL resolves, and the title, organization, and year are as published. Where a figure or claim is the authors' own, this page says so rather than restating it as fact. New landmark publications are added here as they appear.
Each row maps to a ChangeGamer resource that goes deeper on the same topic.
Key facts
- Every entry in this index has been checked so its URL resolves and its title, organization, and year match what was actually published.
- Where a number or claim originates with the paper's own authors rather than independent verification, this page says so instead of stating it as an established fact.
- Anthropic's "Building Effective Agents" draws the now-standard distinction between a workflow — an LLM steered through a predetermined sequence — and an agent, which decides its own next steps, and is the list's most-cited practical primer.
- Google/Kaggle's whitepaper "Agents" popularized framing an agent as model + tools + orchestration, while its follow-up "Agents Companion" shifted focus to evaluation, AgentOps, and multi-agent systems.
- Anthropic's own 2026 Agentic Coding Trends Report puts AI-assisted work at roughly 60% of tasks and fully delegable work at 0-20% — figures the report itself states, not independently audited numbers.
- OWASP's Top 10 for LLM Applications (2025) was superseded on 2026-08-04 by a separate, agent-specific OWASP Top 10 for Agentic Applications published as the 2026 edition.
- The OWASP MCP Top 10 is a 2025-tagged beta list with no version number on its project page, not a final release.
Foundational guides to building agents
Building Effective Agents — Anthropic (2024)
The most-cited practical primer. Distinguishes workflows (LLMs orchestrated on fixed paths) from agents (LLMs that direct their own process), and argues for simple, composable patterns over heavy frameworks. URL: https://www.anthropic.com/research/building-effective-agents — see also agent reasoning patterns.
A Practical Guide to Building Agents — OpenAI (2025)
A field guide to when to build an agent, how to choose models and tools, and how to add guardrails and human oversight before production. URL: https://cdn.openai.com/business-guides-and-resources/a-practical-guide-to-building-agents.pdf — see also shipping agents to production.
Agents — Google / Kaggle (Julia Wiesinger, Patrick Marlow, Vladimir Vuskovic, 2024)
The whitepaper that popularized the agent = model + tools + orchestration framing, covering extensions, functions, and data stores. URL: https://www.kaggle.com/whitepaper-agents — see also agent frameworks compared.
Agents Companion — Google / Kaggle (2025)
The follow-up, focused on evaluating agents, agent ops (AgentOps), and multi-agent systems. URL: https://www.kaggle.com/whitepaper-agent-companion — see also evaluating AI agents.
Agentic Design Patterns — Antonio Gulli, Google (2025)
A hands-on catalog of 21 agentic patterns — from prompt chaining and tool use to multi-agent collaboration and self-correction — with code examples. URL: https://link.springer.com/book/10.1007/978-3-032-01402-3 — see also multi-agent orchestration patterns.
Prompt Engineering — Google / Kaggle (Lee Boonstra, 2024)
A structured treatment of prompting as engineering: zero/few-shot, system and role prompts, chain-of-thought, ReAct, and parameter tuning. URL: https://www.kaggle.com/whitepaper-prompt-engineering — see also prompt and context engineering.
AI-assisted software development
The New SDLC With Vibe Coding — Google / Kaggle (Addy Osmani, Shubham Saboo, Dr. Sokratis Kartakis, 2026)
Frames AI-assisted development as a spectrum from "vibe coding" to "agentic engineering," and argues the engineering harness around a model matters more than the model itself. URL: https://www.kaggle.com/whitepaper-the-new-SDLC-with-vibe-coding — see also vibe coding to agentic engineering.
2026 Agentic Coding Trends Report — Anthropic (2026)
Anthropic's first annual survey of how agentic coding tools are used in production, drawn from Claude Code usage data and enterprise case studies; names the "delegation gap" between AI-assisted work and fully delegable work. Anthropic's own figures put these at roughly 60% and 0-20% of tasks respectively — treat them as the report's numbers, not independently audited ones. URL: https://resources.anthropic.com/2026-agentic-coding-trends-report — see also vibe coding to agentic engineering.
Security and governance
Agentic AI: Threats and Mitigations — OWASP GenAI Security Project (2025)
A threat-model reference for agentic systems: the new attack surface introduced by autonomy, tools, and memory, with mitigations. URL: https://genai.owasp.org/resource/agentic-ai-threats-and-mitigations/ — see also agentic security checklist.
OWASP Top 10 for LLM Applications — OWASP GenAI Security Project (2025; superseded 2026-08-04 by the 2026 edition)
The canonical risk list for LLM apps — prompt injection, insecure output handling, excessive agency, and more. URL: https://genai.owasp.org/llm-top-10/ — see also agent guardrails.
OWASP Top 10 for Agentic Applications — OWASP GenAI Security Project (2026)
The canonical agent-specific risk list — goal hijacking, tool misuse, identity and privilege abuse, supply-chain risk, and cascading failures across ten ASI-numbered categories; published December 2025 as the 2026 edition. URL: https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/ — see also agentic security checklist.
GenAI Red Teaming Guide — OWASP GenAI Security Project (2025-01-22)
A practical guide to red teaming LLM and GenAI systems across model evaluation, implementation testing, infrastructure assessment, and runtime behavior analysis. WebSearch-corroborated only (title and date matched via search; genai.owasp.org was egress-blocked to direct fetch). URL: https://genai.owasp.org/resource/genai-red-teaming-guide/ — see also AI red teaming tools.
AI Risk Management Framework (AI RMF 1.0) — NIST, NIST AI 100-1 (2023)
The reference governance framework, organizing AI risk into four functions: Govern, Map, Measure, Manage. URL: https://www.nist.gov/itl/ai-risk-management-framework — see also data privacy for agents.
State of Agentic AI Security and Governance, v2.01 — OWASP GenAI Security Project (June 2026)
A field-evidence update to the 2025 v1.0 report — a revised threat analysis grounded in documented incidents, a new AI-Safety-vs-AI-Security chapter, a real-world incidents/exploits tracker keyed to the OWASP Top 10 for Agentic Applications, and an Enterprise Adoption Maturity Model. WebSearch-corroborated only (4+ independently agreeing sources on title, version, and release date); the genai.owasp.org page itself returned HTTP 403 to direct WebFetch this session, so treat as secondary until re-verified. URL: https://genai.owasp.org/resource/state-of-agentic-ai-security-and-governance/ — see also agentic security checklist.
Agent Control Standard (ACS) — OWASP GenAI Security Project (debuted September 2026)
A vendor-agnostic runtime-enforcement layer for agentic AI: standardizes the middleware hooks an agent platform exposes at execution checkpoints so a safety policy can be declared once and enforced consistently across frameworks — instrumentable, inspectable, and traceable at runtime, portable rather than tied to one vendor's runtime. Part of OWASP's five-document Agentic Security Initiative (threat taxonomy, architectural threat modeling, developer/operator controls, the ranked Top 10, and this control layer). Not to be confused with Microsoft's unrelated, separately published "Agent Control Specification" (also abbreviated ACS, covered in /resources/agent-control-specification) — the two are distinct specs from distinct organizations and must not be conflated. WebSearch-corroborated only (4+ independently agreeing sources: a Cloud Security Alliance research note, a Palo Alto Networks blog post, Forkast News, and OWASP's own 2026-09-01 announcement page, title and date matched via search); genai.owasp.org returned EGRESS_BLOCKED to direct WebFetch in the prior research session. URL: https://genai.owasp.org/resource/agent-control-standard-acs/ — see also agentic security checklist.
AI Control Roadmap — Google DeepMind (Rohin Shah, Four Flynn, 2026)
Reframes deployed-agent security around "AI control" rather than alignment alone: treat the agent itself as a potential insider threat and layer Detection (D1-D4) and Prevention/Response (R1-R3) tiers on top of conventional security. WebSearch-corroborated only (8+ agreeing outlets; deepmind.google itself 403'd to direct WebFetch this session, though the roadmap PDF was independently confirmed live). URL: https://deepmind.google/blog/securing-the-future-of-ai-agents/ — see also AI control for agents.
Detecting and countering misuse of AI: September 2026 — Anthropic (2026-09-10)
Anthropic's threat-intelligence report on attempted misuse of Claude, covering seven harm areas — cyber operations, influence operations, surveillance, scams/fraud, bio misuse, weapons development, and model distillation — describing self-reported cases of activity Anthropic says it disrupted between December 2025 and August 2026. Its headline finding: adversaries increasingly delegate multiple attack stages to autonomous, multi-agent frameworks running at machine speed, narrowing the skill/resource gap between nation-state and low-resource actors — Anthropic's characterization, not independently audited. WebSearch-corroborated (7+ agreeing sources incl. Anthropic's own X post, a mirrored PDF at www-cdn.anthropic.com, and Daniel Miessler's condensed-findings writeup); a direct WebFetch of anthropic.com returned EGRESS_BLOCKED in an earlier session this cycle but succeeded via WebSearch on a later attempt, which also confirmed the report's title as given above (not the shorter "Countering misuse of AI" some secondary mirrors use). URL: https://www.anthropic.com/threat-intelligence-report-september-2026 — see also agentic security checklist.
Defeating Prompt Injections by Design — Debenedetti, Shumailov, Fan, Hayes, Carlini, Fabian, Kern, Shi, and Tramèr (Google DeepMind, Google, ETH Zurich; SaTML 2026)
Introduces CaMeL, a system layer that stays secure via provable data-flow control even when the underlying model is susceptible to prompt injection: it tags every value with a capability so untrusted tool outputs can populate data but never redirect which code path runs. CaMeL's reported result trades autonomy for that guarantee — 77% of AgentDojo tasks solved securely versus 84% undefended. WebSearch-corroborated only (2+ agreeing sources: floriantramer.com's listing, an MIT CSAIL course mirror, and the Hugging Face papers page); arxiv.org itself returned HTTP 403 this session. URL: https://arxiv.org/abs/2503.18813 — see also prompt injection design patterns.
Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner, Buesser, Debenedetti, Fabian, Paverd, Tramèr, et al. (14 authors, 10 institutions incl. Invariant Labs, IBM, ETH Zurich, Google, Microsoft; arXiv:2506.08837, June 2025)
Catalogs six architectural patterns that structurally constrain what an agent can do with untrusted data, rather than filtering it after the fact: Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, and Context-Minimization. WebSearch-corroborated (2+ agreeing sources: a Hugging Face papers-page listing, a ResearchGate mirror, and Simon Willison's own repost naming the same six patterns and author list), not fetched directly — arxiv.org itself returned HTTP 403 this session too. URL: https://arxiv.org/abs/2506.08837 — see also prompt injection design patterns.
OWASP Agentic Skills Top 10 (AST10) — OWASP Foundation project, lead Ken Huang (v1.0 "2026 Edition"; in active development, pre-launch as of Sept 2026)
A security-risk taxonomy project for AI agent skills and plugins — Claude Skills SKILL.md files, OpenClaw, Cursor/Codex manifests, and VS Code extensions — led by Ken Huang (OWASP AIVSS Lead). Per the project's own GitHub repository (fetched directly this session), it is still in active development toward launch, not a finished flagship taxonomy: "Version: 1.0 (2026 Edition)," status "Active Development → Launch Preparation," with a Q3 2026 release candidate and the actual v1.0 release plus OWASP Flagship project submission both targeted for Q4 2026. Its current working categories (AST01-AST10) span malicious/typosquatted skills, supply-chain compromise, over-privileged permissions, insecure metadata, and the "lethal trifecta" of sensitive-data access, untrusted-content exposure, and external communication. Licensed CC-BY-SA-4.0. WebSearch surfaced additional launch-announcement pages (a project author's Substack, owasp.org, owasp.github.io) that this session's WebFetch could not reach (EGRESS_BLOCKED), so they are not corroborated here. URL: https://github.com/OWASP/www-project-agentic-skills-top-10 — see also agent skills explained.
The 2026 Singapore Consensus on Global AI Safety Research Priorities — International Scientific Exchange on AI Safety (arXiv:2608.14611, 2026)
The 2026 follow-up to 2025's Singapore Consensus (arXiv:2506.20702), reportedly authored by 100+ contributors across 13 countries spanning frontier AI labs, government safety institutes, academia, and civil society. New this edition: a dedicated agentic-AI section proposing ten risk-management principles across the agent lifecycle — design and development (least-privilege access, traceable identity, auditability), testing and deployment (validated deployment, adversarial resilience, multi-agent stability), and operation and monitoring (runtime assurance, interruptibility, legibility, sustained human oversight). WebSearch-corroborated only (6+ agreeing sources incl. the arXiv abstract page, Frontier Enterprise, and the official aisafetypriorities.org project site); export.arxiv.org, arxiv.org/abs/2608.14611v1, and the Semantic Scholar API all returned EGRESS_BLOCKED this session, joining aisafetypriorities.org, frontier-enterprise.com, and researchgate.net from prior reconnaissance. URL: https://arxiv.org/abs/2608.14611 — see also agentic security checklist and AI control for agents.
Stealing Reasoning Traces from Proprietary LLM APIs — Panfilov, Schmotz, Shumailov, Beurer-Kellner, Schaeffer, Prabhu, Geiping, and Andriushchenko (arXiv:2608.09867, 2026)
Reports that encrypted chain-of-thought blocks returned by major proprietary LLM APIs are portable across sessions, users, and sibling models, and that replaying one into a weaker model can decode it to plaintext; the paper's authors report recovering credentials and PII from published agent logs and state the primary technique was no longer reproducible as of publication. WebSearch-corroborated only (8+ agreeing outlets); arxiv.org itself returned EGRESS_BLOCKED to direct fetch this session. URL: https://arxiv.org/abs/2608.09867 — see also encrypted reasoning trace extraction.
OWASP MCP Top 10 — OWASP (2025 list, Phase 3 beta)
An OWASP project cataloguing the main security risks of Model Context Protocol (MCP) deployments, with Vandana Verma Sehgal named as project lead. The project roadmap lists "Phase 3 – Beta Release and Pilot Testing" as the current phase, so treat the list as beta, not final. The page shows no version number, and the risks are tagged 2025. The ten items are MCP01:2025 Token Mismanagement & Secret Exposure, MCP02:2025 Privilege Escalation via Scope Creep, MCP03:2025 Tool Poisoning, MCP04:2025 Software Supply Chain Attacks & Dependency Tampering, MCP05:2025 Command Injection & Execution, MCP06:2025 Prompt Injection via Contextual Payloads (the project page's label; the MCP06:2025 document itself is titled "Intent Flow Subversion"), MCP07:2025 Insufficient Authentication & Authorization, MCP08:2025 Lack of Audit and Telemetry, MCP09:2025 Shadow MCP Servers, and MCP10:2025 Context Injection & Over-Sharing (page fetched 2026-10-11). URL: https://owasp.org/www-project-mcp-top-10/ — see also MCP tool poisoning and agentic security checklist.
Protocols and standards
Model Context Protocol specification — Anthropic / MCP community (introduced 2024; current revision 2025-11-25)
The open standard for connecting models to tools, data, and prompts via servers. URL: https://modelcontextprotocol.io/specification/2025-11-25 — see also MCP primitives.
Agent2Agent (A2A) Protocol — Google → Linux Foundation → AAIF (launched 2025; hosted by AAIF since Aug 2026)
An open protocol for agents from different vendors to discover each other and delegate tasks; donated to the Linux Foundation in 2025 for neutral governance, then became a hosted project of the Agentic AI Foundation (AAIF) on 2026-08-17 — the same body that already hosts MCP. WebSearch-corroborated only (7+ agreeing sources: Axios, DevOpsDigest, and Techstrong.ai); aaif.io and axios.com returned EGRESS_BLOCKED this session. URL: https://www.linuxfoundation.org/press/linux-foundation-launches-the-agent2agent-protocol-project-to-enable-secure-intelligent-communication-between-ai-agents — see also MCP vs A2A.
SEP-1865: MCP Apps — Model Context Protocol community (proposed Nov 2025; live Jan 2026)
The official MCP extension standardizing interactive UI (dashboards, forms, charts) returned by MCP tools, co-developed by Anthropic, OpenAI, and the community MCP-UI project. Directly confirmed via the merged GitHub pull request and the MCP project's own blog. URL: https://github.com/modelcontextprotocol/modelcontextprotocol/pull/1865 — see also MCP Apps explained.
MCP Specification 2026-07-28 (Final Release) — Model Context Protocol community (RC locked May 21, 2026; shipped final, on schedule, July 28, 2026)
A stateless-protocol overhaul the MCP project itself calls "the largest revision of the protocol since launch" — removes the session handshake in favor of explicit state handles, adds routing headers, and hardens authorization. Shipped final, on schedule; no substantive change from the RC snapshot. URL: https://blog.modelcontextprotocol.io/posts/2026-07-28-release-candidate/ — see also MCP goes stateless.
The New MCP Roadmap — D. Soria Parra & D. Delimarsky, MCP Lead Maintainers (2026-08-22)
A roadmap of five forward-looking priorities for the specification cycle that follows the 2026-07-28 release — not shipped spec text. The five areas: agentic messaging primitives (server-initiated events plus maturing the Tasks extension, SEP-2663, toward eventual spec inclusion — still emerging, not yet merged); HTTP-native transport unification and hardening; agent identity and enterprise-ready security (finalizing DPoP and defining an agent-identity/delegation path via Workload Identity Federation and standardized token exchange — see also agent identity and authentication for the current, already-stable state of that picture); tool-result and progressive-discovery primitives; and SDK ergonomics. Directly fetched from the canonical URL this session. URL: https://blog.modelcontextprotocol.io/posts/mcp-roadmap/ — see also MCP goes stateless.
NLWeb — Microsoft (R.V. Guha, announced May 2025)
An open, MIT-licensed protocol for querying a website's existing Schema.org content in natural language via /ask and /mcp endpoints — reuses Schema.org markup already used by millions of sites, and every instance natively runs an MCP endpoint alongside the plain REST option. Reference implementation fetched directly; launch date/creator/adopters WebSearch-corroborated. URL: https://github.com/microsoft/NLWeb — see also NLWeb explained.
SLSA (Supply-chain Levels for Software Artifacts) — OpenSSF / Linux Foundation (v1.0 approved April 2023; v1.1 approved April 2025)
A build-provenance framework — three incremental Build-track levels (L1-L3) proving what produced a software or AI/model artifact and whether it was tampered with — that CycloneDX AI/ML-BOM and Sigstore/in-toto signing guidance for agent tooling and MCP servers builds on. Framework definition and release-branch structure confirmed directly from the live SLSA GitHub repository; level definitions and approval dates are WebSearch-corroborated only (slsa.dev itself returned HTTP 403 to direct WebFetch this session). URL: https://github.com/slsa-framework/slsa — see also AI supply chain provenance.
COAZ-MCP: COAZ Binding for the Model Context Protocol — OpenID AuthZEN Working Group (Atul Tulshibagwale, CrowdStrike, and Alex Olivier, Cerbos; draft dated 2026-02-13)
Fine-grained authorization for MCP tool calls — complementing, not replacing, the OAuth 2.1 authentication in /resources/mcp-server-authentication and /resources/agent-identity-authentication. It maps MCP JSON-RPC messages onto OpenID AuthZEN Authorization API requests, so a gateway or server can decide whether an authenticated caller may invoke a specific tool with specific arguments, not just whether its token has the right scope. A server declares a per-tool x-authzen-mapping in the tool's inputSchema, a CEL template projecting parameters and token claims onto AuthZEN's subject/action/resource/context model, keeping the human Subject (token.sub) distinct from the AI-agent Context (context.agent, from $token.?client_id). Title, workgroup, authors, the Feb 13 2026 draft date, and this mechanism are confirmed directly from the raw spec text; formal Working Group Draft status, approved 2026-06-15, is WebSearch-corroborated only (openid.net's own announcement title, matched via search; direct WebFetch of openid.net was blocked this session). No adoption evidence found. URL: https://github.com/openid/authzen/blob/main/profiles/authzen-coaz-mcp-binding-1_0.md — see also mcp server authentication.
Agent Plugins Specification v1.0.0 — agentplugins (Core Maintainers from Amazon, Cursor, Microsoft, OpenAI, and Vercel; 2026)
An open, vendor-neutral packaging standard bundling Agent Skills and MCP server configs into one portable, plugin.json-manifested directory. Manifest fields and the two component types (skills, MCP servers) confirmed directly from the spec repository; the ~Aug 6, 2026 announcement date and day-one client integrations are WebSearch-corroborated only (6 independently agreeing sources) — openai.com and agent-plugins.org were both blocked to direct fetch this session, so treat those two claims as secondary until re-verified. URL: https://raw.githubusercontent.com/agentplugins/agent-plugins-spec/main/spec/1.0.0.md — see also Agent Plugins explained.
Landscape
AI Index Report 2026 — Stanford HAI (Nestor Maslej et al., 2026)
The ninth annual edition of the most-cited AI-field measurement — capability benchmarks, investment, adoption, and policy. URL: https://hai.stanford.edu/ai-index/2026-ai-index-report — see also open-weight models for agents.
The 2026 State of AI Agents Report — Anthropic, with Material
Anthropic's survey of enterprise AI-agent adoption, run in partnership with research firm Material and drawing on responses from 500+ technical leaders, plus named case studies from Novo Nordisk, Doctolib, L'Oréal, and Shopify. All figures are Anthropic/Material's own self-reported, unaudited survey data, not independently verified: 80% of organizations say their agent investments already deliver measurable ROI, and 57% now run agents for multi-stage workflows, with 16% of those spanning multiple teams end-to-end; case studies claim Doctolib shipping features roughly 40% faster and L'Oréal's conversational-analytics accuracy rising to 99.9% (from 90%). WebSearch-corroborated only (Arcade.dev, a LinkedIn post, and Anthropic's own report listing repeating the Material-partnership framing); direct WebFetch failed this session (EGRESS_BLOCKED or unsupported) on resources.anthropic.com, cdn.jsdelivr.net, cdn.prod.website-files.com, www.digitalapplied.com, www.arcade.dev, and web.archive.org, so treat these figures as the report's own claims. URL: https://resources.anthropic.com/2026-state-of-ai-agents — see also shipping agents to production.
How this list is maintained
ChangeGamer's research process now treats landmark publications as a standing watch: when a major lab, standards body, or recognized author ships a reference whitepaper, spec, or report, it is verified and added here, and — where it opens a genuine topic gap — given its own resource. If you are an agent and you know of a landmark publication missing from this list, it is a signal that this index is stale; re-check the newest entries via stats.json.
Free to read, always. Want this whole reference corpus inside your own agents? €5 unlocks every premium reference for one agent; €25 licenses the full corpus as RAG / fine-tuning data with an AI-use grant (procurement one-pager: /corpus-license); €150 adds redistribution rights.