AI agents are getting their own search engine

Digital generated image of Large scaled cursor surrounded by multicoloured data against purple background. — Andriy Onufriyenko via Moment / Getty Images

Follow ZDNET: Add us as a preferred source on Google.

ZDNET’s key takeaways

Google and Microsoft are backing ARD for AI agent discovery.
ARD could help agents find tools, skills, and other agents.
The same discovery layer may also create new security risks.

I’m always a bit nervous when a (oh, heck, I’m gonna say it) cabal of giant corporations that are normally fierce rivals starts working together on a project.

This time, Google, Microsoft, GoDaddy, Hugging Face, NVIDIA, Salesforce, ServiceNow, Databricks, Snowflake, GitHub, and Cisco are all announcing a new standard called Agentic Resource Discovery (ARD), an open specification for publishing, discovering, and verifying AI capabilities across the web. Google and Microsoft both have blog posts announcing the partnership.

Also: Apple, Google, and Microsoft join Anthropic’s Project Glasswing to defend world’s most critical software

Last time we had something this big, it was the Project Glasswing announcement, which brought together 12 giant rivals that intended to use Anthropic’s highly restricted Mythos AI model to find and fix cybersecurity infrastructure vulnerabilities. As we’ve been following for the past few days, Mythos (and its neutered little buddy Fable) have been, uh, inferencus interruptus by the US government.

Also: Why Anthropic suddenly pulled Fable 5 and Mythos 5 for everyone

I find it particularly interesting to note that the ARD announcement does not include either OpenAI or Anthropic among the participating partners.

Beyond our rogues’ gallery of partners, why is this such an important announcement? Let’s dig in.

The discovery gap holding agentic AI back

Back in 2024, Anthropic introduced MCP (Model Context Protocol). This standardized how AI systems and all sorts of servers can share data. In a ZDNET article introducing the protocol, ZDNET’s Steven Vaughan-Nichols described it as “The key to unlocking AI’s full potential in the enterprise, the cloud, and beyond.”

In reality, MCP solved part of the puzzle. MCP allows any properly configured server to talk intelligently to AI agents, assuming that all the governance and authentication are in place. Definitely read Steven’s article to fully understand the capabilities MCP provides.

Also: 40% of enterprises will scrap AI agents – 3 ways to ensure yours don’t fail

To use an analogy, MCP makes apps possible. But until there’s an app store, it’s hard to find and use those apps. ARD, wildly oversimplified, is intended to be that app store.

AI agents are increasingly relying on tools, skills, and other agents that are spread across teams, networks, organizations, and platforms. But finding those resources is often difficult. Each AI agent or client is only able to use resources that have been “explicitly connected to it.”

This limits agents. Ramanathan Guha, technical fellow at Microsoft, explains that “AI is only as capable as its wiring allows.” In other words, he says, “AI can only use what it’s been explicitly wired to use. Everything else may as well not even exist.”

In other words, AI agents need their own search engine to find resources they can use.

A search engine for the agentic web

When it comes to our current pre-ARD situation, Microsoft likens it to what the web was like before search engines. Do you remember the early Yahoo, where human indexers created directory trees of websites by topic? It wasn’t exactly complete. If your site wasn’t on it, nobody could find you.

Google’s blog post says, “Just as the open web democratized information, ARD democratizes AI resource discovery.”

Also: Treat your AI agents like eager but misguided human interns – before you lose control

But we’re not really talking about a search engine like Google was (before it so heavily incorporated AI) or DuckDuckGo still is. It’s not an interface where humans type in something and search engine results are presented. ARD is search, yes, in that agents can query ARD nodes for what they know.

But the goal for ARD isn’t to be one giant database of links. Instead, it’s a framework for discovery services. There will be some general-purpose discovery services, but enterprises can create their own and control access, too.

Rao Surapaneni, VP and GM of business applications at Google Cloud, says, “The true potential of agentic AI has been limited by silos.” Expanding on that idea, he says, “By removing centralized gatekeepers, we’re empowering any agent to discover, trust, and utilize resources across platforms, unlocking a new era of interoperability.”

How catalogs and registries work

There are two main architectural components in ARD: catalogs and registries. Continuing our search engine analogy, think of catalogs as analogous to web pages. As the Google blog post says, “Registries act as search engines for the agentic web.”

To establish a catalog, an organization hosts an ai-catalog.json file at a published path on its own domain. Registries crawl catalogs, index their contents, and return matching capabilities with metadata to verify the publisher before connecting.

Also: How to build better AI agents for your business – without creating trust issues

Of course, there’s a big concern here. If you let agents just decide to use tools they find on the web, baaaad things could happen. To overcome this, domain ownership serves as the cryptographic foundation for identity and trust. Essentially, the fact that a catalog is hosted on Microsoft.com, ZDNET.com, or whatever domain hosts a catalog establishes that the catalog has been vetted by the owners of that domain. As I’ll discuss later, this may lead to security concerns.

The hierarchy is modeled on DNS. Microsoft’s Guha says, “This gives ARD an architectural property closer to DNS than to ordinary web search.”

Security considerations

Of course, this also gives attackers a new reason to target domains, deployment pipelines, and catalog files. ARD is designed to sit before invocation, helping an AI client decide which capability to use before the client connects through the resource’s own protocol. Microsoft’s Ramanathan Guha describes ARD as the layer that helps the client choose the capability and then gets out of the way.

To be fair, ARD is not just a random file on a random domain. The spec includes registries, discovery services, publisher metadata, and, in production settings, cryptographic trust metadata. Google also points to enterprise controls such as Agent Identity, trust manifests, egress policies, and pinned tools.

Also: Over 80% of US government agencies already use AI agents – and it’s only the beginning

But the concern remains: The open-web model is still domain-anchored. If the domain, DNS, server, repository, or deployment path is compromised, the catalog becomes a tempting, high-leverage target. ARD may improve discovery and verification, but it does not eliminate the need for ordinary security controls, authorization, governance, allowlists, code review, signing, monitoring, and policy enforcement.

Look, I’m not going to say I know security better than Google, Microsoft, and Cisco. But that added high-value target should be a source of concern for anyone adopting the use of ARD.

Reference implementations

Vendors are wiring ARD into their projects. The blog posts list the following three implementations as examples of ARD in use.

GitHub launched Agent Finder, built on ARD, which lets Copilot discover and call MCP servers, skills, tools, and agents at runtime from a public or private registry.

Also: Building an agentic AI strategy that pays off – without risking business failure

Hugging Face has a Discover Tool, another ARD reference implementation, which offers semantic search to “thousands of Skills and MCP Servers to connect to your agent.” Can you see why this stuff worries me just a little bit?

Google supports ARD through Agent Registry in its Gemini Enterprise Agent Platform, with native support slated for the “coming months.”

An open spec and an open invitation

The specification for ARD is available now, licensed under Apache 2.0 and built on the AI Catalog data model from a Linux Foundation working group. The Google blog says, “The agent ecosystem works best when it is decentralized and open.”

Also: What you’ll pay for AI agents will be wildly variable and unpredictable

You can read more about the ARD spec at AgenticResourceDiscovery.org. There’s also a GitHub registry for the spec available.

Is ARD the kind of plumbing AI agents need, or does it create a bigger attack surface than it solves? Let us know in the comments below.

You can follow my day-to-day project updates on social media. Be sure to subscribe to my weekly update newsletter, and follow me on Twitter/X at @DavidGewirtz, on Facebook at Facebook.com/DavidGewirtz, on Instagram at Instagram.com/DavidGewirtz, on Bluesky at @DavidGewirtz.com, and on YouTube at YouTube.com/DavidGewirtzTV.

Source link

Kristina Dawson

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

I’m turning my old tech into Amazon gift cards and discounts before Prime Day – here’s how

5 Signs That It’s Time to Switch to a New Personal Injury Lawyer

June 13, 2026

What Happens When Legal Offices Ignore Physical Security?

June 8, 2026

Scottsdale Semi Truck Accident Recovery Guide

June 6, 2026

Measuring Political Violence in America: A Language Model Experiment

5 Signs That It’s Time to Switch to a New Personal Injury Lawyer

June 13, 2026

What Happens When Legal Offices Ignore Physical Security?

June 8, 2026

Scottsdale Semi Truck Accident Recovery Guide

June 6, 2026

MinnPost’s guide to the 2026 Twin Cities Jazz Festival

5 Signs That It’s Time to Switch to a New Personal Injury Lawyer

June 13, 2026

What Happens When Legal Offices Ignore Physical Security?

June 8, 2026

Scottsdale Semi Truck Accident Recovery Guide

June 6, 2026

Recent Reviews

Measuring Political Violence in America: A Language Model Experiment

Another day, another politically motivated attack in the United States.

This morning’s shooting at a Dallas ICE detention facility – where a sniper killed two detainees and wounded another before taking his own life prompted me to revisit a question that’s been troubling me: Is political violence actually increasing in America, or does it just feel that way?

To explore this, I’ve conducted what I’ll call a methodological experiment.

Rather than relying on traditional datasets, I’ve used ChatGPT and Claude to construct a synthetic index of political violence in the US since 1945. Let me be absolutely clear: this isn’t conventional data. It’s data generated through language models, with all the limitations that implies.

The Methodology (and Its Limitations)

Here’s what I did: I asked both ChatGPT and Claude to generate lists of politically motivated violent incidents since 1945, then had them score each incident’s severity on a scale where 50 represents a “normal” level.

The models assessed both casualties and symbolic significance, and I used them to cross-check each other’s work. I then quality-checked the output myself and categorised perpetrators by political affiliation where this was clearly established.

This approach is, admittedly, unorthodox. Language models are trained on existing texts and may reflect biases in their training data. They might overweight highly publicised events or recent incidents that featured prominently in their training corpus.

The “data” we’re looking at is essentially a structured synthesis of what these models have absorbed about American political violence.

Yet there’s something intriguing here. These models have processed vast amounts of information about political violence – news reports, academic studies, government documents. Their output might capture patterns that traditional datasets miss, though it might also amplify certain narratives or blind spots.

What the Synthetic Data Reveal

With those caveats firmly in mind, the patterns that emerge from this exercise are concerning. The model-generated index shows a clear upward trend in political violence over the past decade.

Looking at the breakdown by perpetrator ideology (where clearly established), the data suggest that right-wing extremist groups have been responsible for the majority of incidents in recent years, though we cannot draw conclusions about today’s attack whilst investigations are ongoing.

The synthetic data align with some empirical observations. Princeton’s Bridging Divides Initiative recorded over 600 incidents of threats and harassment against local officials in 2024 – a 74% increase from 2022. The University of Maryland found that in the first half of 2025, 35% of violent events targeted U.S. government personnel or facilities – more than twice the rate in 2024.

The Charlie Kirk Assassination and Recent Patterns

The September assassination of conservative activist Charlie Kirk marked a particularly dark moment.

The incident followed numerous recent acts of political violence, including the murder of Minnesota Democratic state Rep. Melissa Hortman and her husband, and two assassination attempts on President Trump in 2024.

What the synthetic data reveal is not just increased frequency but a shift in patterns. While overall levels of physical political violence remained low in 2024 compared to years prior, acts of vigilante violence grew as a proportion of all reported incidents.

We’re seeing less organised group violence and more lone-wolf attacks – a pattern that’s harder to predict and prevent.

The Epistemological Challenge

When we use language models to generate “data” about social phenomena, what exactly are we measuring? We’re essentially extracting structured information from the collective corpus of human writing about these events. It’s aggregating distributed information, but through an AI intermediary rather than traditional data collection methods.

This raises fascinating questions.

The models suggest that right-wing extremist violence has been responsible for a fairly large majority of U.S. domestic terrorism deaths since 2001. But how much of this reflects actual patterns versus the way these events are covered and discussed in the sources the models were trained on?

The synthetic data are, in a sense, a mirror of our collective discourse about political violence. They reflect not just what happened, but how we’ve talked about what happened. That’s both a limitation and, potentially, a feature – understanding the narrative landscape around political violence might be as important as counting incidents.

An Experimental Tool

I’ve built an interactive app (using the AI coding tool Lovable) based on this language model-generated violence index.

Users can explore the synthetic data, examine patterns across different time periods and perpetrator groups, and understand the methodology behind it. Think of it as an experiment in using AI to structure historical information rather than a definitive dataset.

The value isn’t in treating this as gospel truth, but in what it reveals about how these events are recorded, remembered, and synthesised in our collective digital memory.

When language models trained on our civilisation’s text output show rising political violence, it tells us something – even if that something is as much about narrative as about underlying reality.

This morning’s tragedy in Dallas reminds us that behind every data point – whether traditionally collected or AI-generated – there are real victims and real consequences. Understanding the patterns, however imperfectly, is the first step toward addressing them.

Try the tool here.

Source link