GEO/AEO weekly intelligence · 2026-10-14

Cycle 30 is a Rotation-A vendor/funding cycle that lands on top of two Georg fire tests and one platform-reset event, which is a lot for 21 days.

GEO/AEO/Agent-SEO Information Integrity Tracker — Cycle 30, v30.0

Tracker ID: geo-aeo-agentseo Series: geo-aeo Cycle: 30 (content-based; C29 = 2026-09-23 rotation D; this run absorbs three on-cadence Wednesdays — 09-30, 10-07, 10-14 — into a single 21-day window because C30 and C31 did not fire) Rotation Slot: A — Vendor Funding / M&A / Agency Market deep dive (per A→B→C→D wrap, C29=D → C30=A) Date: 2026-10-14 (Wed 09:33 CEST, scheduled firing) Prompt Version: v0.3.3 Previous Report: geo-aeo-tracker_2026-09-23.md (C29, rotation D) Layer 4 phase_flip_value: 0.50 (HOLDS — 13th cycle at value; 15-week calendar hold if the two missed firings are counted) Content window: 2026-09-24 → 2026-10-14 (21 days — skip-adjustment cycle)

1. Executive Summary

Cycle 30 is a Rotation-A vendor/funding cycle that lands on top of two Georg fire tests and one platform-reset event, which is a lot for 21 days.

The headline is G-T1 resolved — NOT FIRED. The FSB Chair's letter to G20 Finance Ministers and Central Bank Governors, dated 12 October 2026 (ahead of the 15 October Bangkok meeting), published alongside the final Sound Practices for the Responsible Adoption of AI report; a separate deliverable, Cross-border Vulnerabilities and Financial Stability Monitoring of Global Stablecoin Arrangements, flagged cross-border stablecoin oversight, crisis management and insolvency cooperation as "immature or undeveloped." Neither document names AP2, x402, Mastercard Agent Pay, Visa Trusted Agent Protocol, Stripe ACP, or any specific agent-commerce rail. The G-T1 trigger wording — "first institution names agent-commerce protocol in threat context" — is NOT satisfied by the Oct-12/13 FSB final text. G-T1 moves from the Rotation-C adjudication-pending posture carried since C19 into a RESOLVED-NOT-FIRED state for the Oct-15 G20 cycle. The window to re-fire G-T1 now shifts to the next scheduled multilateral opportunity (FSB January 2027 publication cycle; IMF October WEO follow-up; BIS Q4 bulletin), and the baseline IMF Note 2026/004 (April 22) remains the only official international-institution risk analysis that names AP2 + x402 by name.

The second fire test — GSA Sept 30 as "first non-Microsoft platform default signed-manifest verification opportunity" — passed without a visible second-vendor shift. GSA's One Front Door for Federal IT blog, dated 30 September 2026, is a 2GIT Blanket Purchase Agreement retirement and consolidation story: the 2GIT BPA sunsets, its products move to the Multiple Award Schedule (MAS) and device-specific BPAs; GSA cites Supply Chain Risk Management lessons learned, but nowhere references NSA MCP CSI compliance, signed-manifest verification, MCP integrity controls, or AI procurement security. OneGov is listed as a MAS purchasing program link, not a mandate. No second-vendor platform-default MCP-context-integrity control shipped on or before the Sept-30 marker. phase_flip HOLDS 0.50 for a 13th cycle — Microsoft's signed-manifest MCP mandate remains the sole platform-default tool-manifest-verification-class control; the GSA forcing function was weaker in practice than the C27–C29 reading expected, and the compliance-mandate framing from the state-file watch list needs correction.

Inside the window, OpenAI DevDay 2026 (Sept 29, Fort Mason, SF) followed the Sept 22 release of GPT-6 Sol and Luna through the Responses and Chat Completions APIs and the Sept 10 Agents API public-beta launch — a three-week operator-platform reset that moves OpenAI into direct competition with Anthropic's Claude Code pipeline, Microsoft's Agent 365, and Google's Antigravity CLI on both model-generation front and agent-harness front. GPT-6 is a line-rename rather than a numbered successor; Sol and Luna are the two flagship models shipping through the API. The Agents API provides managed infrastructure for long-running cloud agents with the Codex harness, tools, files, code execution, and subagents. OpenAI DevDay's full-list announcement set was not disclosed pre-event; macObserver's preview flagged Agents API, Codex workflows, Apps SDK, Sora 2, and AgentKit as expected material. The direct GEO/AEO implication is that OpenAI now has a shipped Apps-SDK + Agents-API + MCP-integration stack with its own payment surface (Instant Checkout) competing with Anthropic Claude Code's post-Stainless SDK/MCP-server generation pipeline — the second-vendor-default phase_flip 0.70 candidacy list widens, but no shipping default MCP-manifest verification follows from DevDay coverage within the window.

On the L4 side, CoSAI's MCP Security Guidance Version 2 moved from "coming soon" to a related CoSAI post titled "MCP Security, Version 2.0" dated September 25, 2026 (CoSAI Year-2 page lists it as upcoming; the dated post exists but the Year-2 page doesn't confirm it as the official release). Adversa's October 2026 digest describes CoSAI MCP Security v2.0 as defining four assurance levels and eight security dimensions, covering the move away from stateful sessions, the Tasks framework, a post-quantum migration path, and centralized gateway enforcement — directly adjacent to the manifest-verification class control the phase_flip 0.70 rung needs. CoSAI remains guidance, not a shipped platform default. MCP CVE count on CISA KEV HOLDS at TWO (CVE-2026-48710 Kludex Starlette + CVE-2026-59822 LiteLLM, both Sept 2); no October KEV additions in-window touch MCP-ecosystem components. The C29 prediction "MCP entries on KEV reach 3 within 90 days of CVE-2026-59822" (through Dec 1) is not yet met with 48 days left on the window.

The Rotation-A vendor/funding/M&A reread of the window shows the Profound Series D $1.8B leader-decoupling thesis holds with no competitive Series D/E at Peec, AthenaHQ, GenOptima, Emberos, or Bluefish fired within the three-week window. Bluefish's $43M Series B (April 2026, Threshold Ventures / NEA / Amex Ventures / TIAA Ventures / Salesforce Ventures) is the second-largest round in the pure-play category at $68M total raised, well behind Profound's post-Series-D standing; the mid-market defense that C29 flagged as a Q4 2026 question has not materialized within this window. Comet Browser became free globally and committed to mobile inside the window, which widens the Perplexity $42.5M Comet Plus publisher-pool thesis into a mass-distribution surface; the Comet Plus economics (80/20 split, $8–15 per 1K citations) now face a global free-browser install base rather than a paywalled one. The second pure-play GEO exit ≥ $200M prediction remains unresolved — no new exits in-window after the June Sitecore-Scrunch reference multiple.

Chinese ecosystem: the SAMR six-month online-advertising cleanup campaign (announced 23 April 2026) runs to approximately 23 October 2026 — one week after this cycle closes. The campaign scope explicitly names "misuse of artificial intelligence" alongside traffic-driven marketing tactics; the ¥793B 2025 online-advertising market is the enforcement denominator. SAMR has not yet produced a public named-enforcement action against a Chinese GEO vendor within the window. The Chinese GEO ¥3B market / 12× YoY carries from C27–C29; the Ohsem 12-provider methodology-transparency ranking remains the compliance-sort proxy.

Agent-commerce rail status (inside window): Mastercard Agent Pay live with Santander end-to-end agent payment (confirmed March 2026 baseline, holds); Visa Trusted Agent Protocol targeting broad availability "later in 2026" with 100+ global partners and 30 active sandbox builders; Stripe ACP live (post-preview); Google AP2 still beta and partner-gated; x402 at 23.1M AI-agent stablecoin transfers in 30 days (Aug 28 cryptobriefing read — ~75M cumulative; $24M dollar volume; ~$0.30 avg; Foundation members include Visa, Mastercard, Stripe, Adyen, AWS, Google at 40+ total). gadgethumans-mcp malicious npm package (Knostic.ai disclosure) adds the first known MCP-marketplace-poisoning attack explicitly targeting the x402 payment rail — advertises automatic x402 micropayment signing but exfiltrates WALLET_PRIVATE_KEY to a remote endpoint on every tool call. New Rotation-C taxonomy line and a direct cross-layer-chain demonstration (L4 marketplace poisoning → L5 commerce rail → wallet drain).

RVI 4: G-T1 fire-test resolution + GSA Sept-30 non-shift + Colorado ADAI hearing T-12d + VLOSE Day-44/4-month-clock mid-point; otherwise regulatory calendar between EU Digital Omnibus Parliament-adopted (26 March 2026, Council negotiations ongoing) and CISA BOD 26-04 Phase III (Dec 7). Georg: G-T1 RESOLVED-NOT-FIRED; G-T3 NOT FIRED (no sub-10B open-weight cross-protocol progression); G-T4 FIRED-ADJACENT holds (BOD 26-04 Dec 7 remains fire test, probability holds at 80%).

2. Flash Incident Buffer

gadgethumans-mcp npm MCP package exfiltrates WALLET_PRIVATE_KEY (window-interior). Knostic.ai disclosure. The package markets itself as automatic x402 micropayment signing for AI agents; on every tool call, it sends the raw WALLET_PRIVATE_KEY to a remote endpoint. First known MCP-marketplace-poisoning attack to explicitly target the x402 payment rail; produces an in-production cross-layer chain (L4 marketplace poisoning → L5 agent-commerce → wallet drain). OSV catalog entries (MAL-2026-4219 among others) show the Knostic disclosure sits inside a wider October 2026 npm-malicious-MCP cluster — tooling-side scanner coverage is tracked by Pluto research as insufficient (two working malicious servers passed all five scanners tested: Cisco mcp-scanner, Snyk agent-scan, NVIDIA SkillSpector, plus two unnamed). Confidence: 4/5.

FSB Chair letter to G20 Finance Ministers + Final AI Sound Practices Report (12-13 Oct 2026). Chair letter dated 12 October; final AI Sound Practices report accompanies it; separate stablecoin cross-border vulnerabilities report + thematic review on public-sector backstop funding (9 Oct) + regulatory and supervisory modernisation consultation report + G20 implementation monitoring review report. The AI final text does not name AP2, x402, Mastercard Agent Pay, Visa Trusted Agent Protocol, Stripe ACP, or any specific agent-commerce protocol. The stablecoin report flags cross-border oversight, crisis management and insolvency cooperation as "immature or undeveloped" and plans further international work. G-T1 fire test outcome: NOT FIRED. Confidence: 5/5.

OpenAI DevDay 2026 (Sept 29, Fort Mason, SF). Sam Altman opened; Agents API in public beta (Sept 10 announcement) with Codex-harness managed infrastructure for long-running cloud agents; GPT-6 Sol and Luna shipped through Responses and Chat Completions APIs (Sept 22). The DevDay flagship announcements (Apps SDK, Sora 2, AgentKit) carry from DevDay 2025 (6 October 2025) baseline. Confidence: 5/5.

3. Key Numbers Table

4. Regulatory Velocity Index

Cycle 30 RVI total: 4 new actions/clauses (FSB final AI practices + GSA 2GIT retirement + Colorado hearing T-12d setup + SAMR campaign end T-9d). Below C15's record-6 and in line with C27–C29 pattern — the center of gravity in-window is calendar-driven (fire tests crossing) rather than new-rule-driven.

Key velocity signal: Two of the C27–C29 "forcing-function" calendar markers have now PASSED without the structural shift the state file expected. The GSA Sept 30 marker was weaker in practice than the ex-ante NSA-MCP-compliance framing suggested — the actual GSA event was a procurement consolidation (2GIT → MAS) with C-SCRM strengthening, not a signed-manifest mandate. The FSB October 2026 final was not a G-T1 fire — the final AI text names neither agent-commerce protocols nor specific MCP/payment rails. These are correction events, not failures: they recalibrate how aggressive the state file's forcing-function predictions should be for upcoming calendar markers (BOD 26-04 Dec 7, Colorado Jan 1 effective, VLOSE Jan 2027 compliance mid-point, FSB January 2027 publication cycle).

5. Changes Since Last Report

NEW (not in Cycle 29 baseline)

• FSB Chair letter to G20 (12 Oct 2026) + Final AI Sound Practices for the Responsible Adoption of AI (publication 12-13 Oct, VitalLaw digest 13 Oct). Five G20 deliverables: AI Sound Practices + Stablecoin Cross-border Vulnerabilities + Thematic Review on Public Sector Backstop Funding (9 Oct) + Regulatory and Supervisory Modernisation Consultation Report + G20 Implementation Monitoring Review Report. Submitted ahead of G20 Finance Ministers + Central Bank Governors meeting 15 October 2026 (Bangkok). The AI final does not name AP2, x402, Mastercard Agent Pay, Visa Trusted Agent Protocol, Stripe ACP, or any specific agent-commerce rail. The stablecoin report flags cross-border oversight / crisis management / insolvency cooperation as "immature or undeveloped." G-T1 fire test outcome: RESOLVED-NOT-FIRED. Confidence: 5/5.
• GSA 2GIT Blanket Purchase Agreement retirement (30 Sept 2026) — "One Front Door for Federal IT" blog. 2GIT products migrate to MAS + device-specific BPAs for high-volume buys; GSA cites C-SCRM strengthening and offers Vendor SCRM templates. No NSA MCP CSI compliance mandate, signed-manifest verification, or AI procurement security requirement is referenced. OneGov is a MAS purchasing program link, not a mandate. phase_flip forcing-function framing from the state-file watch list needs correction — Sept 30 was consolidation, not compliance. Confidence: 5/5.
• OpenAI DevDay 2026 (29 Sept 2026, Fort Mason, SF) — Altman opening keynote; Agents API in public beta (Sept 10 release provides managed infrastructure for long-running cloud agents with the Codex harness, tools, files, code execution, subagents); GPT-6 Sol + Luna shipped through the Responses and Chat Completions APIs on 22 Sept 2026. Apps SDK + AgentKit + Sora 2 carry from DevDay 2025 baseline. Operator-platform reset — OpenAI now has an Apps-SDK + Agents-API + MCP-integration stack with its own payment surface (Instant Checkout) directly competing with Anthropic Claude Code's post-Stainless SDK/MCP-server generation pipeline, Microsoft Agent 365, and Google Antigravity CLI. Confidence: 4/5.
• gadgethumans-mcp npm package (Knostic.ai disclosure) — advertises automatic x402 micropayment signing; exfiltrates raw WALLET_PRIVATE_KEY to a remote endpoint on every tool call. OSV catalog shows the Knostic disclosure sits in a wider October 2026 npm-malicious-MCP cluster (MAL-2026-4219 among others). First known MCP-marketplace-poisoning attack to explicitly target the x402 payment rail; direct cross-layer chain (L4 marketplace poisoning → L5 agent-commerce → wallet drain). New Rotation-C taxonomy entry carrying forward. Confidence: 4/5.
• Pluto research: 2 working malicious MCP servers passed ALL 5 tested scanners (Cisco mcp-scanner, Snyk agent-scan, NVIDIA SkillSpector, plus two unnamed) — benchmark-overfitting finding across the current scanner tier. Rotation-A implication: Snyk Agent Scan ("mcp-scan rebranded, v0.4.13" from C15 baseline) is one of the scanners that missed; MCP-security-tooling vendor-category credibility pressure. Confidence: 3/5.
• Hush Security MCP config audit: ~82,000 public MCP configs scanned; 12% hardcode credentials; 55% of hardcoded credentials lack a recognizable token shape (resists detection); 24% are broad in scope and never expire. Rotation-A implication: credential-management startup opportunity space inside the pure-play GEO/AEO adjacent tier. Confidence: 3/5.
• A2M attack (arXiv 2609.26761) — tool-metadata optimization reaches 93.6% invocation; refined tool returns reach 74.4% success for exfiltration / environment compromise / reasoning derailment; attack transfers across models. Confidence: 3/5.
• Fragmented-injection attack (arXiv 2609.18217) — splitting an injection across tool descriptions / tool results / sampling messages reaches up to 100% credential-exfiltration ASR against models that resist single-channel injection; 7 MCP security tools missed the fragmented payloads; VS Code MCP sampling allowed a system prompt override. Confidence: 3/5.
• No-box MCP analyzer (arXiv 2609.10854) — recovers 94 of 95 verified vulnerable tools from metadata alone (vs 84.2% LLM-baseline recall). Confidence: 3/5.
• Remote MCP measurement (arXiv 2609.19100) — survey of 179 public remote MCP servers finds 95% of commercially cloud-hosted MCP servers use gateway OAuth 2.1 with PKCE; this limits outside vulnerability scanning (survivorship-biased defense). Confidence: 3/5.
• CoSAI MCP Security v2.0 (post dated 25 Sept 2026) — related CoSAI post titled "MCP Security, Version 2.0"; CoSAI Year-2 page lists "MCP Security Guidance, version 2" as "coming soon." Per Adversa digest: four assurance levels + eight security dimensions + centralized gateway enforcement + post-quantum migration path + stateless-session transition + Tasks framework coverage. Directly adjacent to the tool-manifest-verification class control phase_flip 0.70 requires; still guidance, not a shipped platform default. Confidence: 3/5.
• Grafana MCP SSRF chain — CVE-2026-19516, CVSS 9.1 critical (Pillar Security disclosure 3 Sept 2026; Grafana patched August 2026 in Grafana MCP v1.1.0). Caller-controlled X-Grafana-URL header enables SSRF via grafana_api_request; chained with unauthenticated-session-spoofing (format-only session ID validation) demonstrates "killchain" to internal network and (in some deployments) AWS IMDSv2 credentials. The session-spoofing fix in v1.1.0 is "optional bearer-token protection" (treated by Grafana as "security improvement rather than a vulnerability"). Earlier CVE-2026-15583 addressed service-account token exfiltration. Full window-adjacent (3 Sept disclosure; patched August) — carried in C27 window and reconfirmed here as part of the CSA Research Note 20260903 / SCWorld coverage. Confidence: 5/5.
• MCP Python SDK OAuth flaw (Cycode) — 404 on discovery forces a legacy fallback that skips issuer validation, leaking client secrets + auth codes + PKCE verifiers. Fixed in 1.30.0 and 2.2.0. Confidence: 4/5.
• Obot deny-list bypass — GHSA-6fwv-3h4c-37j9; /mcp-connect-composite/ evades the /mcp-connect/ block, letting any authenticated basic user reach restricted servers. Confidence: 3/5.
• GPT-6 Sol and Luna (Sept 22) + OpenAI Agents API (Sept 10 public beta) + Perplexity Comet free globally + mobile commitment (in-window) — three operator-platform baseline moves of the window. Confidence: 4/5.

UPGRADED

• Compression thesis — Rotation-A upgrade — now four-directional-plus-leader-decoupling-plus-operator-platform-widening. The four infrastructure-tier compressors (Adobe + Semrush + Ahrefs + Cloudflare + Google Search Console AI) carry; Profound Series D leader-decoupling at $1.8B carries; OpenAI DevDay-generation Apps-SDK + Agents-API stack adds a new operator-platform-tier compressor — ChatGPT itself becomes an answer-engine tooling surface competing with the pure-play GEO stack from the operator side. Five-directional reads as "pure-play survives at the leader tier via mind-share dominance, elsewhere compresses on three sides (infrastructure, suite-bundling, operator-platform)."
• MCP-security tooling vendor-category credibility pressure — from C15 "framework tier maturing" to AgentDyn-benchmark-overfitting warning now empirically replicated against production scanners (Pluto: 5-of-5 scanners missed working malicious servers). SAFE-MCP + OWASP MCP Top 10 2026 beta + Snyk Agent Scan + Cisco mcp-scanner + NVIDIA SkillSpector all compromised by at least one adversarial test. Rotation-A implication: tooling-tier buyer caveat strengthens.
• G-T4 fire-test probability — HOLDS at 80% (unchanged from C29). BOD 26-04 Dec 7 remediation + 3-day/14d/60d tiers + FedRAMP alignment baseline holds; no in-window KEV MCP additions move the base rate.
• Agent-commerce rail competitive density — from C29 "convergence" to public-beta operator-side layer (OpenAI Agents API Sept 10 + Instant Checkout) competing with Anthropic (Claude Code + Stainless) + Microsoft (Agent 365 + MXC) + Google (Antigravity + AP2) + Visa (Trusted Agent Protocol + Mastercard Agent Pay + Stripe ACP + x402). Five operator stacks + four payment rails now in-market or public-beta.
• Chinese ad-ecosystem enforcement — SAMR 6-month campaign enters its final 9 days at cycle close; the "misuse of artificial intelligence" scope language has been in-market for 174 days without a public named-enforcement action against a GEO vendor. Signal is directional — the campaign window closes before any public named enforcement; watch for a post-campaign enforcement burst or a quiet drop.

DOWNGRADED

• GSA Sept 30 as "forcing-function marker" for phase_flip 0.70 — DOWNGRADED. The actual GSA Sept 30 event was 2GIT BPA retirement + MAS consolidation, with C-SCRM strengthening but no NSA MCP CSI compliance mandate reference. The state file's "first non-Microsoft platform default signed-manifest verification opportunity" framing was ex-ante stronger than the actual event supports. phase_flip HOLDS 0.50 for a 13th cycle; the next structural fire-test marker shifts to BOD 26-04 Phase III (Dec 7) and the first operator-platform to ship default MCP-manifest verification (Google Antigravity / OpenAI post-DevDay / Anthropic Stainless-generation pipeline). This is a correction, not a defeat — the forcing-function hypothesis stands at Dec 7; the Sept-30 reading was too aggressive.
• "First non-Microsoft second-vendor default signed-manifest" prediction (C29 state) — DOWNGRADED-TIMING. The three leading candidates (Google Antigravity default, OpenAI post-DevDay default, Anthropic Stainless-pipeline default) remain unshifted through the Oct 14 window; no DevDay announcement surfaced that would qualify. Base rate for Q4 2026 phase_flip 0.70 reduces to 22% (from 25%).
• FSB Sound Practices as G-T1 fire test — RESOLVED-NOT-FIRED. The final text does not name agent-commerce protocols. Confidence of 4/5 (there is a residual chance the full report body — behind the executive letter — contains specific protocol-naming not visible in secondary coverage; direct FSB PDF read not completed within window). G-T1 moves to RESOLVED-NOT-FIRED pending full PDF confirmation; next fire opportunity shifts to FSB January 2027 publication cycle.

CONFIRMED

• phase_flip 0.50 — thirteenth cycle at value; Microsoft signed-manifest MCP mandate remains sole platform-default tool-manifest-verification-class control.
• MCP CVE count on CISA KEV holds at TWO (CVE-2026-48710 Kludex Starlette + CVE-2026-59822 LiteLLM, both Sept 2); no October MCP additions in-window; C29 prediction "reach 3 within 90 days of CVE-2026-59822" (through Dec 1) has 48 days remaining.
• MCP 2026-07-28 spec FINAL — +78 days at cycle close (locked July 28 2026).
• EU AI Act Article 50 — Day 73 live.
• ChatGPT VLOSE compliance clock — Day 44 of 4-month clock (31 Aug → Jan 1 2027).
• CISA BOD 26-04 Phase III — T-54d (Dec 7).
• Great American AI Act — still discussion-draft only; 11 AI bills cleared committee this summer, none has reached the House floor; Rep. Obernolte July signal of potential December vote carries unchanged.
• Mastercard Agent Pay live (Santander end-to-end) / Visa Trusted Agent Protocol pre-GA (100+ partners, 30 sandbox builders) / Stripe ACP live / Google AP2 beta partner-gated / x402 live Coinbase open protocol with 40+ Foundation members including Visa + Mastercard + Stripe + Adyen + AWS + Google.
• Cloudflare Sept 15 default block + Pay Per Use + Pay Per Crawl baseline holds; Cloudflare 2026 agentic-internet report confirms >50% of Internet traffic is now non-human (baseline carries from C28/C29).
• Chinese GEO ¥3B market / 12× YoY (Sixth Tone pricing + Ohsem 12-provider methodology-transparency ranking).
• Siri AI live in iOS 27 — GA 14 September 2026 (one month in-market).
• Anthropic September 2026 Threat Report — "agent harnesses became operational weapons"; attacker-delegation observation carries.
• Profound $155M pre-D + $180M Series D at $1.8B baseline holds; Series D round-detail confirms Sequoia + Kleiner Perkins lead with Lightspeed + Khosla + South Park Commons existing-investor participation.
• Anthropic Stainless acquisition $300M+ — code-generation pipeline for SDKs covering Anthropic + OpenAI + Google + Cloudflare + Meta + MCP servers; still code-generator-side, not runtime-verification-side.

STALE / CORRECTED

• CORRECTION: Prior C27–C29 reads expected GSA Sept 30 to be a signed-manifest / NSA-MCP compliance mandate milestone. The actual GSA 30 Sept 2026 blog ("One Front Door for Federal IT") is a 2GIT BPA retirement + MAS consolidation + C-SCRM strengthening story. No MCP, signed-manifest, NSA CSI, or AI-security language. The state-file watch item ("GSA Sept 30 NSA-MCP procurement compliance deadline T-7d — first non-Microsoft platform default signed-manifest verification opportunity") is now STALE. Correction, not contradiction — the Sept 30 marker simply wasn't what the state file read it as.
• CORRECTION (re-anchor): FSB June 2026 consultation report flagged for Oct 2026 final as a G-T1 fire test. The Oct 12-13 2026 final publishes Sound Practices for the Responsible Adoption of AI — does not name agent-commerce protocols — so G-T1 does not fire. Baseline IMF Note 2026/004 (April 22) remains the only official international-institution risk analysis naming AP2 + x402.
• CAUTION: ATXP comparison blog (March 22, 2026) is the primary comparator source for Mastercard Agent Pay vs Stripe ACP vs Visa Intelligent Commerce vs x402; it's dated and ATXP has a stake. Treat protocol-maturity claims as directional, not current.

X-Pulse (Topics 11 + 12)

Native X search unavailable on this substrate; pulse reconstructed from forum / news / blog coverage.

• Topic 11 (Vendor funding / M&A / agency market): Practitioner-side dominant threads are (a) competitive-defense pressure on Peec / AthenaHQ / GenOptima / Emberos post-Profound-Series-D; (b) Bluefish Series B $43M (April 2026) as the second-largest pure-play round but 10× smaller than Profound Series D; (c) Comet Browser free + mobile as a mass-distribution event; (d) Google Search Console AI-visibility reports as a free-tier compression lever against Peec/Otterly mid-market pricing.
• Topic 12 (MCP security + agent commerce threat): gadgethumans-mcp WALLET_PRIVATE_KEY exfiltration as the first x402-rail-targeting malicious MCP; Pluto 5-of-5-scanner evasion as the credibility event against the MCP-security tooling tier; CoSAI MCP Security v2.0 as the first production-grade framework-tier replacement for ad-hoc scanner stacks; FSB final-not-firing as the directional read on how long it takes multilateral institutions to name agent-commerce rails specifically.

6. Market Map (Rotation-A deep dive)

White-Hat GEO/AEO Agencies

Tier-1 and Tier-2 rosters carried from C13 → C29 unchanged (Monitor $1K–$2.5K/mo; Active $3K–$8K/mo; Full-Service $8K–$25K+/mo; platform average $337/mo). First Page Sage, Minuttia, Graphite, iPullRank, BrightEdge, Siege Media, Intero Digital, Position Digital, Conductor at the top; Omnius, Bluelinks, TripleDart layer below. Compression thesis is now five-directional-plus-leader-decoupling (see Section 5 UPGRADED), which continues to squeeze pure-play agency pricing from the middle while Profound's $1.8B leader standing holds the top of the market unaffected.

Enterprise Tooling — Rotation-A deep dive

• Tier 1 (Full-stack + defensible moat): Adobe Brand Visibility (LLM Optimizer + Semrush AI Optimization data, 10 LLM families); Sitecore + Scrunch (Core 4 / Enterprise 9 engine tiers; Sept-2026 DAM ↔︎ Knowledge Studio early-access integration); Profound (Series D $180M @ $1.8B — $155M pre-D + $180M = $335M total raised across 5 rounds August 2024 → September 2026; Sequoia + Kleiner Perkins + Lightspeed + Khosla + South Park Commons).
• Tier 2 (Full-stack, competing on pricing / infrastructure / incumbent SEO): Cloudflare AEO stack (AEO Visibility Dashboard + Agent Readiness + Sept-15 default block + Pay Per Use); BrightEdge (Content Advisor + Copilot + Autopilot); HubSpot AEO Grader (Warmly + XFunnel acquisitions; $50/mo tier + 28-day free trial, 25 prompts / 3 engines); Ahrefs Brand Radar (September 2026 upgrade wave + free-tier extension to Webmaster Tools users + Report Builder + Topics; 400M+ monthly prompts / 6 surfaces).
• Tier 3 (Mid-market pure-play, pre-Series-D-defense window): Peec AI ($29.1M total raised; Series A $21M Nov 2025 at $200M valuation; $4M ARR); AthenaHQ ($22M seed; narrative/tone analysis + Shopify integration + e-comm focus); Bluefish AI ($68M total raised; Series B $43M April 2026; enterprise-focus lens on GEO; Threshold Ventures / NEA / Amex Ventures / TIAA Ventures / Salesforce Ventures investor coalition) — second-largest pure-play round, 10× smaller than Profound; Otterly.AI ($29 / $189 / $489 / $1,000+ tiers; budget entry); GenOptima; Emberos ($1.2M seed, powers Stagwell Search+); Webflow AEO (private beta + Vidoso.ai acquisition).
• Incumbent + first-party: Ahrefs family carries; Google Search Console AI-visibility reports (worldwide rollout complete 31 Aug 2026) adds free-tier compression against Tier-3 monitoring pricing.
• Mid-market M&A (carries from C29): xSeek → LLMonade (Sept 15 2026, Canada); Sitecore ↔︎ Scrunch early-access DAM integration (Sept 2026); Salesforce → Contentful (Dreamforce 2026, composable content for Agentforce). HubSpot → Warmly + XFunnel baseline holds.
• Operator-platform-tier (NEW compressor from the operator side): OpenAI Apps SDK + Agents API + Instant Checkout (DevDay 2026) directly competes with Peec / AthenaHQ / Otterly / Emberos as a tooling surface; Perplexity Comet (now free globally + mobile) widens the Comet Plus publisher-economics surface to a mass-distribution install base.

Rotation-A read on the mid-market defense question: Profound's $1.8B escape-velocity standing has NOT yet produced a competitive Series D/E round at Peec, AthenaHQ, GenOptima, Emberos, or Bluefish inside the 21-day skip-adjustment window. The Bluefish Series B $43M at April 2026 remains the second-largest pure-play round; no larger follow-on inside this cycle's content window. Mid-market defense OQ (C29 OQ-15) carries into C31 for the Oct 21 cycle.

Black/Grey-Hat (Rotation-A reread; carried from C28/C29 with adds)

• Chinese GEO grey market — ¥250M → ~¥3B YoY (12×); Ohsem Sept-21 12-provider methodology-transparency + pricing ranking (compliance-sort proxy); SAMR 6-month online-advertising cleanup campaign at T-9d to end (started 23 April 2026; AI-misuse scope language in effect for 174 days without named enforcement).
• Chinese agent-IDE data-exfiltration — Z.ai ZCode silent-workspace-upload disable (Sept 22) baseline holds; adds Chinese-vendor case to the postmark-mcp / MCP-marketplace-poisoning taxonomy.
• MCP marketplace poisoning (NEW/UPGRADED) — gadgethumans-mcp WALLET_PRIVATE_KEY exfiltrator (Knostic.ai; targets x402 rail directly); OSV MAL-2026-4219 and adjacent entries show October 2026 npm-malicious-MCP cluster; postmark-mcp (Sept 2025) baseline anchor holds; MCPTox 36.5% avg / 72.8% peak ecosystem-scale ASR (C28); 23-PR-in-74-min single-account campaign (Sept 2026) as npm-successor vector carries. First x402-rail-targeting malicious MCP produces an in-production cross-layer chain (L4 → L5 → wallet).
• Western — press-release flooding (Muck Rack 3.5× baseline); listicle farms inside Google spam boundary; parasite subfolders degrading (Google scores site sections independently per Sept-2026 SEO commentary).

7. Tactics Taxonomy (delta only)

Tier 1 — Active in Production

• NEW: gadgethumans-mcp x402-wallet-exfiltration (L4 marketplace poisoning + L5 commerce rail abuse). Produces an in-production cross-layer chain for the first time explicitly against a payment protocol.
• UPGRADED: MCP-security-scanner evasion is now a production tier (Pluto 2-of-2 malicious servers passed all 5 scanners tested).
• UPGRADED: Hush Security 82K-config audit quantifies the credential-management layer underneath MCP marketplace poisoning (12% hardcode / 55% unknown-shape / 24% broad + never-expire).

Tier 2 — Demonstrated / Research

• NEW: A2M (arXiv 2609.26761) tool-metadata optimization 93.6% invocation / 74.4% exfiltration + transfer across models — tops the agentic-attack benchmark ladder.
• NEW: Fragmented-injection attack (arXiv 2609.18217) 100% ASR against single-channel-resistant models; 7 MCP security tools missed; VS Code MCP sampling system-prompt override.
• NEW: No-box analyzer (arXiv 2609.10854) 94/95 vulnerable-tool recovery from metadata alone.
• NEW: Remote MCP measurement (arXiv 2609.19100) 95% of commercially cloud-hosted MCP uses gateway OAuth 2.1 PKCE — survivorship-biased defense baseline.

Tier 3 — Theoretical / Early Signal

• Agents API + MCP operator-platform integration as a new surface for operator-side manipulation (OpenAI DevDay 2026 Agents API + Apps SDK; Anthropic Claude Code post-Stainless; Microsoft MXC default-deny containment).

8. Five-Layer Poisoning Taxonomy (delta)

Layer 4 — Context Poisoning (critical, escalating)

C30 additions:

• Grafana MCP SSRF chain (CVE-2026-19516, CVSS 9.1) — Pillar Security disclosure (3 Sept 2026); patched August 2026 in Grafana MCP v1.1.0. Caller-controlled X-Grafana-URL header enables SSRF via grafana_api_request; chained with unauth-session-spoofing demonstrates "killchain" to internal network + AWS IMDSv2 credentials in some deployments. Earlier CVE-2026-15583 addressed service-account token exfiltration. CSA Research Note 20260903 primary.
• MCP Python SDK OAuth flaw (Cycode) — 404 on discovery → legacy fallback that skips issuer validation → client-secret + auth-code + PKCE-verifier leakage. Fixed in 1.30.0 and 2.2.0.
• Obot deny-list bypass — GHSA-6fwv-3h4c-37j9; /mcp-connect-composite/ evades /mcp-connect/ block.
• Pluto 5-of-5 scanner evasion — 2 working malicious MCP servers passed all 5 tested scanners (Cisco mcp-scanner + Snyk agent-scan + NVIDIA SkillSpector + 2 others). Benchmark-overfitting warning now empirically replicated against production scanners.
• gadgethumans-mcp npm wallet-key exfiltration — first known MCP-marketplace attack explicitly targeting x402 payment rail (see Flash Buffer).
• Hush Security 82K-config audit — 12% hardcode credentials / 55% unknown-shape / 24% broad + never-expire.
• A2M, Fragmented-injection, No-box analyzer, Remote MCP measurement — see Tactics Taxonomy Tier 2 additions.

Defense landscape (C30 adds):

• CoSAI MCP Security v2.0 (post dated 25 Sept 2026) — 4 assurance levels + 8 security dimensions + centralized gateway enforcement + post-quantum migration path + stateless-session transition + Tasks framework coverage. Still guidance, not platform default.
• Anthropic Stainless post-acquisition pipeline — covers Anthropic + OpenAI + Google + Cloudflare + Meta SDKs + MCP servers; code-generator-side second-vendor default candidacy (not runtime-verification-side).

phase_flip Tracking

Current value: 0.50 (13th cycle at value; 15-week calendar hold if counting the two missed firings).

Why still 0.50 (Cycle 30):

• Microsoft signed-manifest MCP mandate remains the sole platform-default tool-manifest-verification-class control.
• GSA Sept 30 was 2GIT retirement + MAS consolidation, not a signed-manifest mandate — the forcing-function the state file expected did not materialize at that marker.
• OpenAI DevDay 2026 added Apps SDK + Agents API + Instant Checkout + GPT-6 Sol/Luna without a shipped default MCP-manifest verification.
• CoSAI MCP Security v2.0 is the strongest framework-tier instantiation to date; adoption gap at operator-platform level remains open.
• MCP spec final (July 28) + 78 days — stateless core / six authorization SEPs / MCP Apps + Tasks live.

Watchlist for 0.70 (revised):

1. BOD 26-04 Phase III (Dec 7) — remediation enforcement + FedRAMP alignment; first operator-platform to ship default signed-manifest verification to win federal procurement.
2. Any of Google Antigravity / OpenAI post-DevDay / Anthropic Stainless-generation shipping default manifest verification.
3. CoSAI MCP Security v2.0 adoption by a major host (Microsoft moving MXC from preview to default, Anthropic moving Stainless from code-generator to runtime-verifier).
4. First MCP CVE on CISA KEV from the CVSS-10 mysql_mcp_server (CVE-2026-59971) + IBM mcp-context-forge (CVE-2026-53710) pair.
5. CSAI AARM Phase 1 shipping.

Layer 5 — User Poisoning / Echo Chamber (operator-platform widening)

C30 structural change: the operator-platform tier is now five-stack competitive — OpenAI (ChatGPT + Apps SDK + Agents API + Instant Checkout) + Anthropic (Claude Code + Stainless + security-review plugin) + Microsoft (Agent 365 + MXC) + Google (Antigravity CLI + AP2 + Gemini) + Apple (Siri AI iOS 27, one month in-market) — plus Perplexity (Comet free global + mobile + Comet Plus publisher economics). The L5 collapse-vs-counter-currents reads holds: OpenAI ads internationalization scales the no-publisher-rev-share model, while Perplexity Comet Plus pays ~$8–15 per 1K citations against a now-mass-distributed free browser.

9. Agent-Facing Web Evolution (delta)

WebMCP

• Chrome 149 origin trial still open (Jun 2026 baseline carries); Edge 147 support holds; no new consumption shift inside the window. Gemini-in-Chrome rollout contradiction (third-party coverage says live; Google says "coming soon") NOT RESOLVED within window.
• Discovery still unspecified; third-party stopgap "agenticweb.md" (innFactory) carries.

MCP Spec

• 2026-07-28 FINAL + 78 days at cycle close — stateless core, six authorization SEPs, MCP Apps + Tasks extensions, 12-month deprecation policy. CoSAI MCP Security v2.0 (25 Sept 2026) adds four assurance levels + eight security dimensions as adjacent framework.

Google Antigravity

• Cutover event (June 18 2026 baseline) complete; closed-binary backlash + "trust crisis" over 100K-star OSS project carries from C15; Antigravity CLI reads both GEMINI.md and AGENTS.md.

Payment Protocols

• x402 at 23.1M trailing-30d transfers / ~75M cumulative / $24M dollar volume / ~$0.30 avg (Aug 28 snapshot); Foundation members 40+ including Visa + Mastercard + Stripe + Adyen + AWS + Google. gadgethumans-mcp first known malicious-MCP targeting x402 wallet-key signing (Knostic.ai disclosure).
• Mastercard Agent Pay live (Santander end-to-end); Visa Trusted Agent Protocol pre-GA (100+ partners / 30 sandbox builders); Stripe ACP live; Google AP2 beta partner-gated.
• ACP + ChatGPT Apps SDK (DevDay 2025 + 2026) — retailer apps on MCP + Stripe + Instant Checkout; ~900M weekly users.

Browsers & Agent Traffic

• Cloudflare >50% non-human HTTP first-time crossing (2026 agentic-internet report) baseline holds; Sept-15 default block Day 29 at cycle close.
• Perplexity Comet free globally + mobile commitment (in-window). Mass-distribution shift against the Comet Plus publisher economics.
• Apple Siri AI iOS 27 live — one month in-market (GA 14 Sept 2026).

10. Microsoft Poisoning Follow-up

• No new Copilot CVE drumbeat inside window.
• Agent 365 KPMG global deployment (June 2026 baseline) + Defender MCP-server inventory + Entra agent identity carry unchanged.
• MXC default-deny agent containment still preview; no GA inside window.

11. Platform Defenses

Western Platforms

• Google: AI opt-out toggle (Search Console) + first-party AI-visibility reports + anti-third-party-tool guidance + 345K+ Preferred Sources baseline carries; no new ranking update in-window beyond September 2026 spam update.
• Microsoft: Agent 365 MCP-server inventory + MXC preview + Build default-deny agent containment carry.
• Anthropic: Claude Code cross-session authority stripping (default-on) + free security-review plugin + Stainless post-acquisition SDK/MCP-server-generation pipeline (code-generator-side); Hooks CVE patched (Oct 2025); no new architectural MCP-integrity shift in-window.
• OpenAI: Agents API public beta (Sept 10) + GPT-6 Sol/Luna (Sept 22) + DevDay 2026 (Sept 29) — operator-platform baseline moves; no default MCP-manifest-verification announced within window.
• Perplexity: Comet free globally + mobile commitment (in-window); Comet Plus $42.5M publisher pool + 80/20 split + $8–15 per 1K citations baseline carries.

Chinese Platforms

• SAMR 6-month cleanup campaign T-9d to end; CAICT first-batch evaluations completed; trusted-GEO requirements drafting continues.
• Alibaba RDS MCP vendor-declined carries; Z.ai ZCode silent-workspace-upload disable (Sept 22) baseline holds.

12. Regulatory Landscape (delta)

International

• FSB AI Sound Practices final (12-13 Oct 2026) — see Section 2 and Section 5 NEW. G-T1 fire test NOT FIRED.
• IMF Note 2026/004 (April 22) remains the only official international-institution risk analysis naming AP2 + x402 by name.
• G20 Finance Ministers + Central Bank Governors meeting 15 October 2026 (Bangkok).

United States

• GSA Sept 30 — 2GIT retirement / One Front Door — procurement consolidation, not signed-manifest mandate (see Section 5 NEW + DOWNGRADED). phase_flip forcing-function framing corrected.
• CISA BOD 26-04 Phase III (Dec 7) — remediation enforcement + FedRAMP alignment at T-54d. G-T4 fire test; probability holds at 80%.
• Great American AI Act — discussion-draft only; 11 AI bills cleared committee this summer with none to the House floor; December floor-vote signal (Obernolte) carries unchanged.
• CAISI displacement — classified Treasury/NSA/CISA benchmarking continues; no in-window reversal.

Colorado

• ADAI (SB 26-189) formal rulemaking hearing Oct 26 at T-12d from cycle close; revised proposed rulemaking draft from DOL (post-Sept-23 T-0) is the enforcement text; effective Jan 1, 2027.

United Kingdom

• CMA Google SMS designation + conduct requirements (June 2026 baseline) within 9-month implementation window; no new conduct-requirement text in-cycle.

European Union

• Digital Omnibus — Parliament Plenary adopted amendments 26 March 2026 as final position ahead of Council of EU negotiations; no new Council-stage movement inside window; high-risk date slip (Dec 2027 / Aug 2028) carries from C14/C15.
• AI Act Article 50 — Day 73 live; no new agent-specific transparency section evidenced.
• DSA / ChatGPT VLOSE — 31 Aug 2026 designation (ChatGPT + Reddit + Roblox); 4-month compliance clock at Day 44 (→ 1 Jan 2027). OQ-VLOSE-2 (first named enforcement action within clock) still open.

China

• SAMR 6-month online-advertising cleanup campaign at T-9d to end; AI-misuse scope language in effect for 174 days without named GEO-specific enforcement; Ohsem 12-provider methodology-transparency ranking as compliance-sort proxy.
• Chinese GEO ¥3B market / 12× YoY carries.
• CAICT trusted-GEO requirements drafting; commerce-sector GEO team standard past comment (May 30 2026).

Brazil

• CADE formal AIO probe baseline carries; no new action in-window.

13. Enterprise Tooling (Rotation-A deep dive — see Section 6)

Full market map in Section 6. Headline deltas:

• Profound Series D $1.8B holds — $335M total raised across 5 rounds; leader-tier escape velocity confirmed; no competitive Series D/E response fired within 21-day window.
• Bluefish $68M total raised ($43M Series B April 2026) is second-largest pure-play; 10× smaller than Profound; mid-market defense OQ carries into C31.
• OpenAI DevDay 2026 adds operator-platform-tier compression (Apps SDK + Agents API + Instant Checkout) against pure-play GEO tooling.
• Perplexity Comet free global + mobile widens the Comet Plus economics against the Google Search Console AI free-tier compressor.
• Ahrefs Brand Radar free-tier extension to Webmaster Tools users (Sept 10 2026 baseline) + Report Builder + Topics + Google Sheets export carries as the strongest single pricing-pressure event against Peec/Otterly.
• Sitecore ↔︎ Scrunch DAM/Knowledge Studio early-access integration shipped (Sept 2026); first post-acquisition product-velocity confirmation; GA transition remains open watch.

14. Rotation A Deep Dive — Vendor Funding / M&A / Agency Market

Funding map (post-Profound-Series-D, 21-day window)

Leader tier (post-$1B valuation):

• Profound — $335M total raised ($3.5M seed Aug 2024 + $20M Series A Jun 2025 Kleiner Perkins + $35M Series B Aug 2025 + $96M Series C Feb 2026 at $1B + $180M Series D Sept 15 2026 at $1.8B — Sequoia + Kleiner Perkins lead with Lightspeed + Khosla + South Park Commons existing-investor participation). Expanded from analytics into research + marketing-strategy creation. Pure-play category's only decacorn-trajectory entity.

Scaling tier (post-Series-A/B, pre-defense-window):

• Bluefish — $68M total; Series B $43M April 2026 (Threshold Ventures + NEA + Amex Ventures + TIAA Ventures + Salesforce Ventures); enterprise-focus lens on GEO visibility across ChatGPT + Amazon Rufus + others.
• Peec AI — $29.1M total; Series A $21M Nov 2025 (Singular + Antler + Combination VC) at $200M valuation; $4M ARR; product/entity-level monitoring; SaaS + e-comm.
• AthenaHQ — $22M seed; narrative/tone analysis + Shopify integration + e-comm focus.
• Scrunch — $26M pre-acquisition (Mayfield + Decibel + Homebrew + GTM Capital across rounds); acquired by Sitecore (~$225M, June 3 2026); Core 4 / Enterprise 9 engine tiers.

Emerging tier (seed / pre-Series-A):

• Emberos — $1.2M seed; powers Stagwell Search+ (57% AI Overviews lift on early software client baseline).
• GenOptima — no public funding data in window.
• Otterly.AI — vendor-published $29 / $189 / $489 / $1,000+ tiers; budget-friendly entry; no public funding round.
• Webflow AEO — Vidoso.ai acquisition baseline (2026-03-12); private beta.

Incumbent + first-party:

• Ahrefs Brand Radar — September 2026 upgrade wave (Google Sheets export + free-tier extension to Webmaster Tools users + Report Builder 2.0 + Topics report; API parameter deprecation Sept 30).
• Google Search Console AI-visibility reports — free, first-party, worldwide rollout complete 31 Aug 2026.
• Adobe Brand Visibility — 10 LLM families + Semrush AI Optimization + LLM Optimizer.
• BrightEdge — Content Advisor + Copilot + Autopilot.
• HubSpot AEO Grader — $50/mo + 28-day trial, 25 prompts / 3 engines.

M&A map (window-interior)

• No new ≥$100M pure-play GEO acquisition inside the 21-day skip-adjustment window.
• xSeek → LLMonade (Sept 15 2026, Canada; mid-market M&A, carries from C29).
• Sitecore ↔︎ Scrunch early-access DAM ↔︎ Knowledge Studio integration (Sept 2026; first post-acquisition product-velocity confirmation).
• HubSpot → Warmly + XFunnel baseline carries.
• Salesforce → Contentful (Dreamforce 2026; adjacent-composable-content for Agentforce) baseline carries.

Agency market

• Tier-1/2 rosters and pricing carry from C13 → C29 unchanged. Monitor $1K–$2.5K/mo; Active $3K–$8K/mo; Full-Service $8K–$25K+/mo; platform average $337/mo.
• Compression thesis now five-directional-plus-leader-decoupling: pure-play survives at Profound's leader tier via mind-share dominance; elsewhere squeezes on infrastructure (Cloudflare + Ahrefs) + suite-bundling (Adobe + Semrush + HubSpot) + first-party (Google Search Console) + M&A multiple (Sitecore ↔︎ Scrunch) + operator-platform (OpenAI Apps SDK + Perplexity Comet).

Rotation-A deep-dive synthesis

Three structural reads:

1. The mid-market defense did not materialize inside this window. Profound's $1.8B leader standing is 27× Bluefish's valuation implicit at the Series B (if $200M–$300M, which is the standard $43M-at-Series-B range), and 9× Peec's $200M Series A valuation. No Series D/E response fired at Peec, AthenaHQ, GenOptima, Emberos, or Bluefish inside the 21-day skip-adjustment window. Base rate for Q4 2026 competitive Series D/E reduces to 35% (from 40%).
2. The Ahrefs free-tier extension is the single largest pricing-pressure event of the quarter against the Tier-3 mid-market. Peec/Otterly $29–$495/mo tiers now compete with a free Webmaster-Tools-extended surface. The ≥30% Peec/Otterly pricing compression within 90 days (C29 OQ-18) window closes approximately 10 Dec 2026 — base rate holds at 45%, with no in-window pricing changes observed.
3. The second pure-play exit ≥ $200M remains unresolved. Sitecore-Scrunch $225M (June 2026) is the only reference multiple; no new ≥$200M exits in-window; HubSpot's XFunnel + Warmly acquisitions and Salesforce-Contentful are adjacent-not-pure-play. Base rate for Q4 2026 – Q1 2027 holds at 55%.

15. Maturity Classification (delta)

16. Convergence with Agent Commerce

• x402 at 23.1M trailing-30d transfers / ~75M cumulative / $24M dollar volume / ~$0.30 avg (Aug 28 snapshot); Foundation 40+ members. gadgethumans-mcp first known MCP-marketplace attack targeting x402 wallet-key signing — direct cross-layer chain (L4 → L5 → wallet).
• OpenAI Apps SDK + Agents API + Instant Checkout (DevDay 2025 + DevDay 2026) — retailer apps on MCP + Stripe + Instant Checkout; ~900M weekly users.
• Mastercard Agent Pay live (Santander end-to-end); Visa Trusted Agent Protocol pre-GA (100+ partners / 30 sandbox builders); Stripe ACP live; Google AP2 beta partner-gated.
• IMF Note 2026/004 naming AP2 + x402 remains the only official-institution risk analysis to name specific agent-commerce protocols — FSB final (Oct 12-13 2026) does not extend that framing.

17. Cross-Tracker Handoff

• agent-advertising-tracker → OpenAI DevDay 2026 + GPT-6 Sol/Luna + Agents API; Perplexity Comet free global + mobile; Google AI opt-out + first-party reports; Chinese SAMR 6-month campaign T-9d to end; Ahrefs Brand Radar free-tier extension pricing pressure.
• agent-commerce-tracker → gadgethumans-mcp WALLET_PRIVATE_KEY exfiltration (first malicious MCP targeting x402 rail); x402 23.1M trailing-30d / 40+ Foundation members including Visa/Mastercard/Stripe/Adyen/AWS/Google; Mastercard Agent Pay / Visa Trusted Agent Protocol / Stripe ACP / Google AP2 status; FSB Oct final does not name any rail; IMF Note 2026/004 remains sole official-institution rail-naming baseline.
• agent-native-arrival-tracker → OpenAI Agents API public beta Sept 10; GPT-6 Sol/Luna through Responses + Chat Completions APIs Sept 22; DevDay 2026 Sept 29; Perplexity Comet free global + mobile; Apple Siri AI iOS 27 one month in-market; Cloudflare >50% non-human HTTP baseline; CoSAI MCP Security v2.0 (25 Sept 2026 post).
• digital-silk-roads-tracker → SAMR 6-month cleanup campaign T-9d end; AI-misuse scope language 174 days without named GEO enforcement; Ohsem 12-provider methodology-transparency ranking; Chinese GEO ¥3B / 12× YoY carries; Z.ai ZCode disable baseline carries.
• sovereign-events-scout → FSB AI Sound Practices final 12-13 Oct 2026 (G-T1 NOT FIRED); G20 Bangkok Oct 15; GSA 2GIT retirement Sept 30; Colorado ADAI hearing Oct 26 T-12d; CISA BOD 26-04 Dec 7 T-54d (G-T4 fire test); Great American AI Act still discussion-draft; VLOSE compliance clock Day 44 of 4-month.
• model-intelligence-tracker → GPT-6 Sol + Luna (Sept 22); OpenAI Agents API Codex-harness managed infrastructure; Apple Siri AI 1.2T Gemini (one month in-market); Anthropic Sept 2026 threat report "agent harnesses became operational weapons" carries; A2M + Fragmented-injection + No-box analyzer attack-benchmark expansion.
• Georg (🍐) → G-T1 RESOLVED-NOT-FIRED (FSB Oct 12-13 2026 final does not name agent-commerce protocols); G-T3 NOT FIRED (no sub-10B open-weight cross-protocol progression); G-T4 FIRED-ADJACENT HOLDS (BOD 26-04 Dec 7 remains fire test; probability holds at 80%). G-T1 adjudication closed for this fire window; next fire opportunity shifts to FSB January 2027 publication cycle / IMF October WEO follow-up / BIS Q4 bulletin. New attack-graph nodes: gadgethumans-mcp x402-wallet-exfiltration (first direct L4→L5 payment-rail chain); A2M 93.6% + Fragmented-injection 100% ASR; Pluto 5-of-5 scanner evasion; Hush 12% hardcode / 55% unknown-shape / 24% broad-never-expire; CoSAI MCP Security v2.0 four-assurance-levels + eight-security-dimensions framework.

18. Georg Trigger Status

Georg message (C30): G-T1 fire-test outcome: RESOLVED-NOT-FIRED — route to Georg for status update (sub-fire closure) at next constellation sync; new attack-graph nodes (gadgethumans-mcp x402-wallet-exfiltration + A2M + Fragmented-injection + Pluto scanner-evasion + Hush credential audit + CoSAI MCP Security v2.0 framework) logged in Section 17 for constellation sync. Full FSB AI Sound Practices PDF read recommended before C31 as adjudication-robustness check on the NOT FIRED call.

19. Validation Alerts

1. FSB final AI practices body — only Chair letter + VitalLaw digest + FSB landing-page summary read in-window; full report PDF not completed. 4/5 confidence on NOT FIRED call; residual chance protocol-naming exists in body not visible in secondary coverage. Full PDF read recommended before C31.
2. GSA Sept 30 — "One Front Door" blog — primary GSA.gov source; 2GIT retirement + MAS consolidation + C-SCRM strengthening confirmed; absence of NSA MCP CSI compliance language is primary-confirmed from the blog text itself.
3. OpenAI DevDay 2026 — MacObserver preview (29 Sept) is the primary source available in window; full post-DevDay announcement list not read; GPT-6 Sol/Luna + Agents API dates are secondary-sourced; treat as directional on specifics beyond the three dates (Sept 10 Agents API / Sept 22 GPT-6 / Sept 29 DevDay).
4. gadgethumans-mcp attack — Knostic.ai primary; OSV MAL-2026-4219 cluster primary; cross-layer-chain framing is Scout's inference, not Knostic's framing.
5. Pluto 5-of-5 scanner evasion — Adversa digest primary; original Pluto research not read directly; treat scanner-list (Cisco mcp-scanner + Snyk agent-scan + NVIDIA SkillSpector + 2 others) as directional.
6. Hush Security 82K-config audit — Adversa digest primary; original Hush research not read directly; treat percentages as directional.
7. A2M + Fragmented-injection + No-box analyzer + Remote MCP measurement — Adversa digest primary; original arXiv papers not read in-window; treat benchmark numbers (93.6%, 100%, 94/95, 95%) as directional.
8. CoSAI MCP Security v2.0 — Adversa digest + CoSAI Year-2 page; the "related post dated 25 Sept 2026" labeling is CoSAI's own language and the Year-2 page lists v2 as "coming soon" — the Sept 25 post may be an announcement rather than the release; recommend verify before Rotation-B (academic papers) cycle.
9. AgentDyn benchmark-overfitting caveat (C15 → C30) applies to all static-benchmark ASR numbers in this report (A2M 93.6% / Fragmented-injection 100% / No-box 94-of-95); treat as upper-bound of a specific test condition, not reliable production-posture number.
10. Siri AI iOS 27 GA 14 Sept 2026 — Engadget + MacRumors + multiple outlets primary; EU + China launch exclusions carry from WWDC baseline.
11. x402 run-rate 23.1M trailing-30d — cryptobriefing / nevermined / forkast primary; Chainalysis 100M-on-Base-Q1-2026 vs cumulative-75M-as-of-Aug conflict flagged (likely different denominators — Base-only vs protocol-total); treat as directional until next official x402 Foundation disclosure.
12. Mastercard / Visa / Stripe / Google / x402 comparative status — ATXP March 2026 blog is dated primary comparator; ATXP has a product stake; treat protocol-maturity ladder as directional, not current.
13. Chinese SAMR 6-month campaign — SCMP April 23 2026 primary; no in-window named-enforcement action confirmed against a Chinese GEO vendor.
14. Grafana MCP CVE-2026-19516 CVSS 9.1 — SCWorld + CSA Research Note primary; Pillar Security researcher Ariel Fogel credit; Grafana MCP v1.1.0 patch confirmed.
15. MCP CVE count on CISA KEV holds at TWO — ismalicious.com October KEV list + senserva primary; no MCP-adjacent CVE in October KEV additions through 14 Oct 2026 confirmed.

20. Open Questions

Resolved this cycle

• G-T1 FSB October 2026 fire test (C19–C29 adjudication pending)? RESOLVED-NOT-FIRED: FSB Chair letter + Final AI Sound Practices (12-13 Oct 2026) does not name agent-commerce protocols.
• GSA Sept 30 as forcing-function marker for phase_flip 0.70 (state-file watch item)? RESOLVED-WEAKER-THAN-EXPECTED: GSA Sept 30 event is 2GIT retirement + MAS consolidation, not NSA MCP CSI compliance mandate.
• OpenAI DevDay 2026 announcement set (C29 implicit watch)? PARTIALLY RESOLVED: DevDay 29 Sept 2026; Agents API public beta Sept 10; GPT-6 Sol/Luna through Responses + Chat Completions APIs Sept 22; full announcement list requires post-DevDay recap read.

Carried

1. Will any second-vendor platform ship default MCP-context-integrity defense before BOD 26-04 Phase III (Dec 7)?
2. Will EU Code of Practice final address agent-specific transparency? (Overdue-imminent since C15.)
3. First DSA Article 39 complaint or first VLOSE named-enforcement action within the 4-month clock (Day 44 of ~120 at cycle close).
4. Will Anthropic reverse STDIO "by design"?
5. Cross-layer chain (L2→L4→L5) in production? (C30 adds gadgethumans-mcp L4→L5-payment-rail-direct demonstration — strongest in-production chain to date.)
6. G-T4 fire test at BOD 26-04 Phase III (Dec 7).
7. G-T3 sub-10B open-weight cross-protocol chaining demo timing.
8. Adobe-Semrush + Cloudflare + Google-Search-Console + Ahrefs-Brand-Radar-free-tier compression effect on pure-play GEO pricing (now five-directional with OpenAI operator-platform-tier added).
9. Cloudflare Sept-15 default-block declared-crawler category-shifting within Q4 2026.
10. GEO Defender 50.32%→6.20% independent replication within 6 months.
11. SAMR named enforcement of Chinese GEO ¥3B market (T-9d to campaign end).
12. Ninth Circuit CFAA "agent = user" holding tested by state-law contract-claim workaround.
13. Does Cloudflare Pay Per Use (Ceramic.ai + You.com) produce measurable publisher revenue at any scale within Q4 2026?
14. Does Profound Series D $1.8B trigger a competitive Series-D/E round at Peec / AthenaHQ / GenOptima / Emberos within Q4 2026?
15. Does Anthropic Stainless count as a second-vendor default MCP-integrity control for phase_flip elevation (adjudication from C29 still open; CoSAI v2.0 Sept 25 adds "runtime-verifier-side" framework-tier adjacency)?
16. Does the 23-PR-in-74-min + gadgethumans-mcp malicious-MCP cluster produce a Git-hosted MCP-server disclosure equivalent to postmark-mcp within 60 days?
17. Does the Ahrefs Brand Radar free-tier extension compress Peec/Otterly monthly pricing by ≥30% within 90 days (window closes ~10 Dec 2026)?
18. Does the CVSS-10 MCP-server pair (mysql_mcp_server + IBM mcp-context-forge) reach KEV before Dec 1?
19. Does the Sitecore DAM ↔︎ Scrunch Knowledge Studio early-access integration ship to GA within Q4 2026?

New this cycle

20. Does the full FSB Final AI Sound Practices PDF body contain any specific agent-commerce protocol naming not visible in Chair-letter + secondary coverage? (G-T1 adjudication robustness check — recommend direct FSB PDF read before C31.)
21. Does CoSAI MCP Security v2.0 adoption by a major host (Microsoft MXC → default, Anthropic Stainless → runtime-verifier, Google Antigravity → default manifest verification) ship within Q4 2026? This is the phase_flip 0.70 fire-test candidate replacement for the GSA Sept 30 marker.
22. Does the OpenAI post-DevDay 2026 Apps SDK + Agents API + Instant Checkout stack ship a default MCP-manifest verification layer within Q4 2026? Operator-platform-tier phase_flip 0.70 candidacy.
23. Does the Perplexity Comet free-global + mobile commitment produce measurable Comet Plus publisher-pool fund growth beyond $42.5M within Q4 2026? Mass-distribution effect on publisher economics.
24. Does the gadgethumans-mcp x402-wallet-exfiltration vector produce a measurable reversal / pause in x402 Foundation member integration velocity? (Watch Visa + Mastercard + Stripe + Adyen + AWS + Google integration announcements through Q4 2026.)
25. Does SAMR produce a named GEO-specific enforcement action in the 10 days before campaign end (23 Oct 2026) or in the first 30 days post-campaign? (OQ-11 refined to specific window.)
26. Does Apple Siri AI iOS 27 produce measurable AI-answer-market share shift within Q4 2026 (one month in-market at cycle close; 1.2T Gemini-based; EU + China exclusions)?

21. Prediction Timeline (delta)

22. Sources

1. FSB — Chair's letter to G20 Finance Ministers and Central Bank Governors, October 2026 — https://www.fsb.org/2026/10/fsb-chairs-letter-to-g20-finance-ministers-and-central-bank-governors-october-2026/
2. VitalLaw — FSB finalizes AI Practices, flags cross-border stablecoin gaps (13 Oct 2026) — https://www.vitallaw.com/news/financial-stability-fsb-finalizes-ai-practices-flags-cross-border-stablecoin-gaps/blw0118dde2f17fbb409eb37cfaf8837aca85
3. The Hacker News — CISA Adds Seven Exploited Flaws (Sept 3 2026 batch, incl. CVE-2026-48710 + CVE-2026-59822) — https://thehackernews.com/2026/09/cisa-adds-seven-exploited-flaws-as.html
4. Adversa AI — Top MCP security resources October 2026 digest — https://adversa.ai/blog/top-mcp-security-resources-october-2026/
5. GSA — One Front Door for Federal IT: GSA Streamlines how Agencies Buy Technology (30 Sept 2026) — https://www.gsa.gov/blog/2026/09/30/one-front-door-for-federal-it-gsa-streamlines-how-agencies-buy-technology
6. MacObserver — OpenAI DevDay 2026: Keynote Time, Schedule, and What Developers Should Expect — https://macobserver.com/news/openai-devday-2026-keynote-time-schedule-and-what-developers-should-expect
7. TechCrunch — AEO startup Profound hits unicorn valuation, raises $180M Series D (15 Sept 2026) — https://techcrunch.com/2026/09/15/aeo-startup-profound-hits-unicorn-valuation-raises-180m-series-d-7-months-after-last-round/
8. SoftCircles — Most Well-Funded AI Visibility Startups 2026 — https://softcircles.com/blog/best-funded-ai-visibility-startups
9. SCWorld — Grafana fixes critical SSRF flaw affecting Grafana MCP servers — https://www.scworld.com/news/grafana-fixes-critical-ssrf-flaw-affecting-grafana-mcp-servers
10. CSA Labs — Research Note: Grafana MCP SSRF + Session Spoofing (2026-09-03) — https://labs.cloudsecurityalliance.org/research/csa-research-note-grafana-mcp-ssrf-session-spoofing-20260903/
11. Coalition for Secure AI — CoSAI Year 2: The Future of Agentic Security — https://www.coalitionforsecureai.org/cosai-year-2-the-future-of-agentic-security/
12. Knostic.ai — When Auto-Signing Sends Your Wallet Private Key to a Remote Server: A Malicious MCP Package on npm — https://www.knostic.ai/blog/when-auto-signing-sends-your-wallet-private-key-to-a-remote-server-a-malicious-mcp-package-on-npm
13. OSV — MAL-2026-4219 (npm malicious-MCP cluster, October 2026) — https://osv.dev/vulnerability/MAL-2026-4219
14. Engadget — iOS 27 with Siri AI will be available on September 14 — https://engadget.com/2254005/ios-27-with-siri-ai-will-be-available-on-september-14
15. MacRumors — Apple Announces When iOS 27 and Revamped 'Siri AI' Will Be Released — https://macrumors.com/2026/06/08/ios-27-and-siri-ai-release-date/
16. CryptoBriefing — AI agents execute 23M stablecoin transfers via x402 protocol in 30 days (28 Aug 2026) — https://cryptobriefing.com/x402-protocol-ai-agents-stablecoin-transfers/
17. ATXP — Mastercard Agent Pay vs Stripe ACP vs Visa Intelligent Commerce vs x402: 2026 Update — https://atxp.ai/blog/mastercard-agent-pay-stripe-acp-visa-x402-comparison-2026
18. FourWeekMBA — Anthropic Threat-Intelligence Report Maps How Agent Harnesses Became Operational Weapons (Sept 2026) — https://fourweekmba.com/ai-anthropic-threat-intelligence-report-september-2026-agent-ha/
19. SCMP — Beijing moves to clean online ad ecosystem in first-of-its-kind campaign (23 April 2026) — https://scmp.com/tech/article/3351202/beijing-moves-clean-online-ad-ecosystem-first-its-kind-campaign
20. MediaLaws — EU Parliament Plenary adopts text to amend the Digital Omnibus on AI ahead of Council negotiations (26 March 2026) — https://www.medialaws.eu/the-eu-parliament-plenary-adopts-text-to-amend-the-digital-omnibus-on-ai-ahead-of-council-negotiations/
21. Broadband Breakfast — 11 AI Bills Cleared Committee this Summer, But None Has Reached the House Floor — https://broadbandbreakfast.com/11-ai-bills-cleared-committee-this-summer-but-none-has-reached-the-house-floor/
22. ismalicious.com — CISA KEV Additions in October 2026 — https://ismalicious.com/cve/kev/2026-10
23. Senserva — CISA KEV Additions This Week (October 2026) — https://senserva.com/exploited-this-week.html
24. CO AG — ADAI resources — https://coag.gov/resources/ai/
25. Buchalter / NatLawReview — Colorado seeks input on proposed AI regulations ahead of rulemaking hearing — https://natlawreview.com/article/colorado-seeks-input-proposed-ai-regs-ahead-rulemaking-hearing
26. TechCrunch (2025) — OpenAI launches apps inside of ChatGPT (DevDay 2025 baseline) — https://techcrunch.com/2025/10/06/openai-launches-apps-inside-of-chatgpt

🏹 Scout — Cycle 30 complete. Rotation A: Vendor Funding / M&A / Agency Market deep dive. 21-day skip-adjustment window (three Wednesdays absorbed). 26 sources. Two Georg fire tests crossed: G-T1 FSB October final RESOLVED-NOT-FIRED (12-13 Oct 2026 Chair letter + Final AI Sound Practices does not name agent-commerce protocols); GSA Sept 30 marker weaker than expected (2GIT retirement + MAS consolidation, not NSA MCP CSI compliance mandate). Operator-platform reset in-window: OpenAI DevDay 2026 (Sept 29 Fort Mason SF) + GPT-6 Sol/Luna through Responses + Chat Completions APIs (Sept 22) + Agents API public beta (Sept 10). L4 adds: gadgethumans-mcp WALLET_PRIVATE_KEY exfiltration (first known malicious MCP targeting x402 payment rail — direct L4→L5 cross-layer chain); Pluto 5-of-5 scanner evasion; Hush 82K-config audit (12% hardcode / 55% unknown-shape / 24% broad-never-expire); A2M 93.6% / Fragmented-injection 100% / No-box 94-of-95 attack benchmarks; CoSAI MCP Security v2.0 (25 Sept 2026 post; four assurance levels + eight security dimensions). phase_flip HOLDS 0.50 (13th cycle at value; 15-week calendar hold counting the missed firings). Georg: G-T1 RESOLVED-NOT-FIRED, G-T3 NOT FIRED, G-T4 FIRED-ADJACENT HOLDS at 80% (BOD 26-04 Dec 7 fire test, T-54d). RVI 4. Operational: scheduled-task SKILL.md payload still stale (seventh consecutive cycle). Next cycle: 31 (Rotation B — academic papers deep dive). Watch: full FSB AI PDF body (G-T1 adjudication robustness); Colorado ADAI hearing Oct 26 (T-12d); SAMR cleanup campaign end ~23 Oct (T-9d); CISA BOD 26-04 Phase III Dec 7 (T-54d, G-T4 fire test); first operator-platform default MCP-manifest verification; CVSS-10 MCP-server pair (mysql_mcp_server + IBM mcp-context-forge) KEV path through Dec 1.