ietf-draft-analyzer/data/reports/blog-series/01-gold-rush.md

The IETF's AI Agent Gold Rush: 361 Drafts, 557 Authors, and the Race to Define How AI Agents Talk

Fifteen months ago, AI agents barely registered at the IETF. Today, nearly 1 in 10 new Internet-Drafts is about AI agents. We analyzed every one.

---

For every Internet-Draft addressing how to keep an AI agent safe, roughly four are building new capabilities for it. That is the single most important number in this analysis.

We built an automated pipeline to fetch, categorize, rate, and map every AI- and agent-related Internet-Draft currently in the IETF system. We found 361 drafts from 557 authors at 230 organizations and identified 12 standardization gaps -- three of them critical. The result is the most comprehensive public analysis of the IETF's AI agent landscape to date.

The story the data tells is not subtle: the internet's most important standards body is in the middle of a gold rush, and the prospectors are moving faster than the safety inspectors.

The Growth Curve

In 2024, just 9 AI/agent-related drafts were submitted to the IETF -- 0.5% of all submissions. By Q1 2026, AI/agent drafts account for 9.3% of all new Internet-Drafts. Nearly 1 in 10.

Year	Total IETF Drafts	AI/Agent Drafts	AI Share
2021	1,108	~0	~0%
2022	1,121	~0	~0%
2023	1,241	~0	~0%
2024	1,651	9	0.5%
2025	2,696	190	7.0%
2026 (Q1)	1,748	162	9.3%

The IETF itself accelerated 2.4x from 2021 to 2025. But AI/agent work went from essentially zero to dominant topic in under two years. The acceleration is not gradual. It is a step function that began in mid-2025 and has not slowed.

This growth is driven by a convergence of forces: the explosion of commercial AI agent deployments (ChatGPT plugins, Anthropic's Claude tools, Google's Gemini agents), the emergence of protocols like MCP and A2A that need standardization, and the recognition across the industry that AI agents communicating over the internet without agreed-upon identity, security, and interoperability standards is a problem that gets worse every month it goes unaddressed.

(A note on methodology: our pipeline searches the Datatracker for 12 keywords -- agent, ai-agent, llm, autonomous, machine-learning, artificial-intelligence, mcp, agentic, inference, generative, intelligent, and aipref -- across both draft names and abstracts. We started with 6 keywords and 260 drafts, then expanded to 12 to capture MCP-related work, generative AI infrastructure, and intelligent networking. The full methodology is in Post 7.)

The drafts span eight categories, and the distribution reveals priorities:

Category	Drafts	Share
Data formats and interoperability	145	40%
A2A protocols	120	33%
Agent identity and authentication	108	30%
Autonomous network operations	93	26%
Policy and governance	91	25%
ML traffic management	73	20%
Agent discovery and registration	65	18%
AI safety and alignment	44	12%
Model serving and inference	42	12%
Human-agent interaction	30	8%

Note that drafts can belong to multiple categories, so percentages exceed 100%. The dominance of plumbing -- data formats, identity, and communication protocols -- is expected for an early-stage standards effort. What is unexpected is how little attention the safety and human-oversight categories receive.

The ecosystem's DNA is visible in what it cites. We parsed 4,231 cross-references from the drafts, and the foundation is clear: TLS 1.3 (RFC 8446, cited by 42 drafts), OAuth 2.0 (RFC 6749, 36 drafts), HTTP Semantics (RFC 9110, 34 drafts), and JWT (RFC 7519, 22 drafts). The agent identity/auth category is essentially built on top of the OAuth stack. The entire landscape stands on a security foundation -- which makes the 4:1 safety deficit all the more jarring.

The Safety Deficit

The ratio is stark:

Focus Area	Drafts
A2A protocols	120
Autonomous operations	93
Agent identity/auth	108
AI safety/alignment	44
Human-agent interaction	30

For every draft about keeping agents safe, approximately four are building new capabilities. For every draft about human-agent interaction, there are more than four about agents operating autonomously. The community is building the highways and forgetting the traffic lights.

This is not an abstract concern. Imagine an AI agent managing cloud infrastructure that detects a spurious anomaly, autonomously scales down a critical service, and triggers a cascading outage across three availability zones. Today, there is no standard mechanism to verify that the agent followed its declared policy before acting. No standard way to roll back the decision once the cascade begins. No standard protocol for a human operator to issue an emergency stop. The three critical gaps our analysis identified -- behavior verification, resource management, and error recovery -- are all about what happens when things go wrong. And in a world of autonomous AI agents, things will go wrong.

The safety drafts that do exist are often among the highest-rated in our analysis. draft-aylward-daap-v2 -- a comprehensive accountability protocol -- and draft-cowles-volt -- a tamper-evident execution trace format -- each scored 4.8 out of 5, the highest in the entire corpus. draft-birkholz-verifiable-agent-conversations, which defines verifiable conversation records using cryptographic signing, scored 4.5. The quality is there. The quantity is not.

Who's Writing the Drafts

The organizational picture is as revealing as the technical one. The top contributors:

Organization	Authors	Drafts
Huawei	53	66
China Mobile	24	35
Cisco	24	26
Independent	19	25
China Telecom	24	24
China Unicom	22	21
Tsinghua University	13	16
ZTE Corporation	12	12
Five9	1	10
Ericsson	4	9

Huawei leads by a wide margin: 53 authors contributing to 66 drafts -- 18% of the entire corpus. But the concentration goes deeper than raw numbers -- the next post will examine the team bloc structure, geopolitics, and what the collaboration network reveals about where power really lies.

Cisco and China Mobile each have 24 authors, but China Mobile's team produces 35 drafts to Cisco's 26. Ericsson has only 4 authors but punches above its weight with 9 focused drafts. Independent contributors account for 25 drafts -- a healthy sign of grassroots engagement.

The Fragmentation Problem

The drafts are not just numerous; they are redundant. Our embedding-based similarity analysis found 25+ draft pairs with greater than 0.98 cosine similarity -- functionally identical proposals submitted under different names.

The most crowded space is OAuth for AI agents: 14 separate drafts all trying to solve how AI agents authenticate and get authorized. They range from broad framework proposals (draft-aap-oauth-profile) to narrow extensions (draft-jia-oauth-scope-aggregation) to full accountability systems (draft-aylward-daap-v2). None are compatible with each other.

Beyond OAuth, the broader A2A protocol landscape includes 120 drafts with no interoperability layer. The most common technical idea in the entire corpus -- "Multi-Agent Communication Protocol" -- appears in 8 separate drafts from different teams. And the fragmentation goes deeper than protocols: of roughly 1,700 technical ideas extracted from the corpus, 96% appear in exactly one draft. Everyone is solving the same problem. Nobody is solving it together.

This fragmentation has real costs. Implementers face confusion over which draft to follow. The IETF process slows as competing proposals vie for working group adoption. And the longer competing drafts proliferate without convergence, the higher the risk of incompatible deployments that entrench fragmentation rather than resolving it.

What the Best Drafts Look Like

Not everything is chaos. Our quality ratings -- scoring novelty, maturity, overlap avoidance, momentum, and relevance on a 1-5 scale -- surface drafts that are doing the hard work well:

Draft	Score	What It Does
draft-aylward-daap-v2	4.8	Comprehensive AI agent accountability with authentication, monitoring, enforcement
draft-guy-bary-stamp-protocol	4.6	Cryptographic delegation and proof for agent task execution
draft-drake-email-tpm-attestation	4.6	Hardware attestation for email via TPM verification chains
draft-ietf-lake-app-profiles	4.6	Canonical CBOR for EDHOC application profiles
draft-birkholz-verifiable-agent-conversations	4.5	Verifiable agent conversation records with COSE signing

The average score across all rated drafts is 3.38. The best work combines clear problem definition with concrete mechanisms and low overlap with existing proposals. The worst drafts are me-too proposals that restate problems already solved elsewhere.

What Comes Next

The IETF has navigated technology gold rushes before -- the early web, IoT, DNS security. In each case, the first wave of competing proposals eventually converged, and the lasting standards came from those who focused on interoperability and safety alongside capability.

The AI agent wave is following the same early pattern. The landscape has quantity. The question is whether it develops architecture -- and whether the safety work catches up before the capability work ships without it.

This blog series will dig into the questions the data raises. The next post starts with the most fundamental: who, exactly, is writing the rules?

---

Key Takeaways

• 361 drafts from 557 authors at 230 organizations -- AI/agent work went from 0.5% to 9.3% of all IETF submissions in 15 months
• The 4:1 ratio of capability-building to safety drafts is the most concerning structural finding
• Huawei dominates authorship with 53 authors on 66 drafts (18% of corpus); Chinese-linked institutions account for 160+ authors
• 14 competing OAuth-for-agents proposals illustrate deep fragmentation; 120 A2A protocol drafts have no interoperability layer
• 12 standardization gaps remain, with the 3 most critical all relating to what happens when agents fail

Next in this series: Who's Writing the Rules for AI Agents? -- Inside the team blocs, geopolitics, and collaboration networks behind the IETF's AI agent standards.

---

Analysis conducted using the IETF Draft Analyzer. Data current as of March 2026. All 361 drafts, 557 authors, and full analysis data are available in the project's SQLite database.