The report
The Linux Foundation announced four additions to the Agentic AI Foundation on October 22, 2026: Agent Skills from Anthropic, Open Responses from OpenAI, OpenEnv from Hugging Face and OpenSandbox from Alibaba. The foundation says its hosted portfolio now contains 10 projects. These contributions cover different interfaces, rather than four implementations of the same security safeguard.
| Project | Interface it aims to make portable | Security question the format does not settle |
|---|---|---|
| Agent Skills | Reusable instructions, scripts and resources available to coding or workflow agents | Who may install a skill and what its scripts may change |
| Open Responses | Model responses, tool-call items and streaming state | Whether a tool result corresponds to a completed authorized effect |
| OpenEnv | Environment reset, step and state during training or evaluation | Whether the same named tool in production carries different credentials or side effects |
| OpenSandbox | Sandbox creation, filesystem and command operations across supported backends | Which isolation backend is actually selected and whether indirect network or credential access is constrained |
The OpenEnv repository describes stateful episodes that can be reset and stepped. A production MCP tool, in contrast, may modify a live account or external system. An identical schema response is not proof of equivalent authority. The OpenSandbox repository supports multiple runtime configurations, including technologies with different isolation properties; optional microVM support must not be reported as universal microVM deployment.
The relevant failure mode has a concrete example in OpenAI's containment red-team investigation. Source-level compatibility does not answer whether a workload is isolated from its host, whether a side effect can be attributed to one invocation or whether a permitted intermediary can reach an otherwise blocked destination. Those properties must be checked in the deployed environment, not inferred from foundation membership.
A meaningful interoperability test would replay one agent plan against two conforming implementations, while preserving the same caller identity and allowed actions. It would record cancellation, tool result, actual external effect, and whether any credential escaped the intended scope. This is an engineering implication of the announced interface boundaries, not a claim that AAIF already supplies such a cross-implementation certification. Evaluation containment and policy-attested execution address separate parts of that test.