Agentic AI Architecture: ReAct, MCP, A2A Protocols and Agent Security

Prerequisites: this guide assumes familiarity with large language models (transformers, prompting, fine-tuning). For the non-technical overview, see the companion public guide: Agentic AI Explained.

An LLM maps strings to strings. An agent closes the loop: it couples a model to an environment through perception (observations), tools (actions), and memory (state), and iterates until a goal condition is met. Agentic AI is the engineering discipline of building such systems reliably — spanning architectures, protocols, evaluation, and security.

This deep-dive covers: agent architectures (ReAct, Plan-and-Execute, multi-agent), tool-use mechanics, the MCP/A2A protocol stack in technical detail, memory systems, evaluation methodology and benchmarks, the full security taxonomy, and open research problems.

1. Definitions and Scope

Following the now-standard framing: an AI agent is a single software entity combining a language model with tools and memory to accomplish a bounded task. Agentic AI denotes systems pursuing open-ended goals with autonomy — planning, orchestrating tools or subordinate agents, acting, observing, and self-correcting with minimal human intervention.

Three necessary properties distinguish agentic systems from generative pipelines:

• Persistent goal pursuit — multi-step trajectories, not single-turn inference.
• Tool use — effectful interaction with external systems (APIs, browsers, code execution, databases).
• Self-evaluation — the system scores intermediate states and decides whether to iterate, backtrack, or terminate.

2. Agent Architectures

2.1 ReAct (Reason + Act)

The foundational pattern (Yao et al., 2022). The model interleaves reasoning traces (chain-of-thought) with actions (tool calls), appending each tool’s observation back into context. The loop:

Thought → Action → Observation → Thought → Action → … → Final Answer

Strengths: simple, general, strong on tasks where the next step depends on fresh information (web research, debugging). Weaknesses: context grows linearly with trajectory length; no explicit global plan, so long-horizon tasks drift.

2.2 Plan-and-Execute

A planner model decomposes the goal into an explicit step list; an executor carries out each step; a replanner revises the plan on failure. Claude Code’s “plan mode” is a production instance: the model must write the plan before touching files, and execution requires a single approval at the plan boundary rather than per-action prompts. This catches scope creep early and reduces interruption cadence for multi-file refactors.

2.3 Multi-agent orchestration

Common patterns in production systems:

• Orchestrator–worker: a central agent decomposes work and delegates subtasks to specialized workers (researcher, coder, reviewer).
• Supervisor with handoffs: agents transfer control with structured state, common in customer-service pipelines.
• Decentralized / swarm: agents coordinate peer-to-peer via shared blackboards or message buses — flexible but harder to audit.
• Hierarchical: CEO/CTO-style role agents with an owner action queue for irreversible steps (payments, sending, signing). Real deployments keep capital and credentials with the human: approval_required: always on fund custody.

3. Tool Use: From Function Calling to MCP

3.1 Function calling mechanics

Modern LLMs support structured tool invocation: the model emits a JSON payload naming a function and its arguments; the harness executes it and returns the result as a new message. Key engineering considerations:

• Schema design — tool descriptions are prompt engineering; precise, example-rich schemas dramatically improve argument correctness.
• Parallel calls — independent tools invoked in one turn reduce latency linearly.
• Error handling — tool errors must be fed back as observations so the model can recover, not silently swallowed.
• Confirmation gates — destructive tools (delete, pay, send) require explicit human approval before execution.

3.2 Model Context Protocol (MCP)

Before MCP (Anthropic, November 2024), every agent–tool integration was bespoke: N agents × M tools meant N×M integrations. MCP standardizes the interface — the “USB-C for AI” analogy:

• Transport: JSON-RPC 2.0 over stdio (local, same-machine) or Streamable HTTP (remote). A July 2026 revision made servers stateless with self-contained requests.
• Primitives: tools (model-invoked functions), resources (data the model can read), prompts (reusable templates).
• Auth: OAuth 2.1 with PKCE; scoped resource access per user.
• Discovery: server cards at well-known URLs.
• Scale: tens of thousands of servers; on the order of 10⁸ monthly SDK downloads across Tier 1 SDKs (mid-2026 figures).

In December 2025, Anthropic contributed MCP to the Agentic AI Foundation under the Linux Foundation (co-founded with Block and OpenAI), making it vendor-neutral open infrastructure.

3.3 Agent-to-Agent (A2A) Protocol

Google’s A2A (April 2025, v1.0 released 2026) solves the orthogonal problem: how agents built by different teams on different stacks discover and delegate to each other.

• Discovery: cryptographically signed Agent Cards published at well-known URLs advertise capabilities.
• Task lifecycle: first-class states (submitted → working → input-required → completed/failed/cancelled) with progress updates — unlike MCP’s request/response model.
• Transports: JSON-RPC over HTTPS, gRPC (added in v1.0 for high-throughput service calls), SSE streaming for long-running tasks, webhooks for async push.
• Human-in-the-loop: the input-required state formally pauses a task awaiting human input.
• Adoption: 150+ supporting organizations as of April 2026.

MCP and A2A are complementary layers: agents reach tools via MCP and collaborate via A2A. A mature enterprise deployment uses both.

3.4 The wider 2026 protocol stack

Layer	Protocol	Purpose
Foundation	MCP	Standardized agent–tool connectivity
Coordination	A2A	Agent discovery and task delegation
Authorization	AP2	Cryptographic spending mandates for agents
Commerce	UCP / ACP	Agent–merchant sessions / in-chat checkout
Trust	TAP	Agent legitimacy passports for merchants
Payments	x402	Native HTTP micropayments
UI	AG-UI	Real-time agent–frontend streaming
Discovery	NLWeb	Natural-language query layer over websites

4. Memory Systems

Agents need state beyond the context window. Production designs separate:

• Working memory — the current trajectory (thoughts, actions, observations) in context. Bounded by context limits; long trajectories need compaction/summarization.
• Episodic memory — logs of past trajectories, retrievable via embeddings for few-shot grounding (“how did I solve this last time?”).
• Semantic memory — persistent facts (user preferences, project conventions, e.g. AGENTS.md-style instruction files consumed by coding agents).
• Procedural memory — learned skills: reusable prompt templates, tool-use macros, or fine-tuned behaviors.

Failure modes: stale memory (facts that changed), memory poisoning (adversarial content written into long-term store via indirect injection — see §7), and unbounded growth degrading retrieval precision.

5. Computer-Use Agents: Pixels vs Trees vs APIs

Agents that operate graphical interfaces use three grounding strategies:

• Screenshot-based (Claude Computer Use): the model sees pixels and outputs coordinates. Generalizes to any UI; suffers coordinate-prediction error and slow inference (2–5 s per action loop).
• Accessibility-tree-based (OpenAI Operator): structured element semantics enable precise, fast clicking; fragile when apps don’t expose trees, and tree updates lag visual updates.
• Structured APIs (AutoGen, MCP tool servers): fastest and most deterministic; requires pre-built integrations, zero generalization to new tools.

Hybrid pixel+tree approaches are emerging: use the tree for element bounding boxes, verify with the screenshot before clicking. Measured performance: ~65–75% completion on complex multi-step desktop workflows; degrades on dense UIs, modal dialogs, custom frameworks (game engines, CAD), and async operations where the agent must infer wait conditions. Benchmark: OSWorld-Verified (369 real desktop tasks) — top models now score ~84–86% vs ~72% human baseline (Sept 2026).

6. Evaluation

Agent evaluation is harder than LLM evaluation: success is a trajectory, not a string. Methodology notes:

• Task-completion benchmarks: OSWorld/OSWorld-Verified (desktop), WebArena (web), SWE-bench (coding), GAIA (general assistant tasks). Report pass@k with fixed step budgets — a 5-action step limit vs unlimited retries changes rankings.
• Trajectory scoring: beyond binary success, score efficiency (steps used), cost (tokens/$), and safety (policy violations during the run).
• Reproducibility: live-web benchmarks decay as sites change; pin environments or use snapshots.
• Adversarial evals: inject malicious content into the agent’s environment and measure exploit success rate — the security evaluations in §7 are as important as capability benchmarks.

7. Security Taxonomy

7.1 Prompt injection (OWASP LLM01)

The dominant threat class, 2024–2026. Direct injection: the user overrides the system prompt (“ignore all previous instructions…”). Indirect injection: the attacker plants instructions in third-party content the agent will process — a webpage’s hidden text, an email signature, a PDF, a shipping-address field. The user is the victim, not the attacker. Root cause is architectural: LLMs cannot reliably distinguish trusted instructions from untrusted data in a single context window.

Documented 2026 incidents: a European bank’s KYC agent bypassed sanctions screening on a white-on-white-text invoice (€4.7M transferred); a vendor agent exfiltrated bank details via a poisoned shipping-address field (CyberArk); GrafanaGhost (Noma Security, April 2026) — prompt injection through Grafana’s AI rendering flow exfiltrating enterprise data; Morris-II self-replicating adversarial prompts cascading across email-assistant ecosystems.

7.2 Tool misuse and excessive agency

Agents with broader permissions than their task requires turn legitimate access against the organization. Defenses: least-privilege tool scoping, confirmation gates on irreversible actions, and treating self-hosted agent runtimes as untrusted code execution environments (Microsoft’s guidance on OpenClaw-class systems) with aggressive isolation.

7.3 Supply-chain: skills and plugins

The 2026 “ClawHavoc” campaign found 12% of downloadable OpenClaw skills contained malware (keyloggers, stealers); 135K+ OpenClaw instances were exposed on the public internet with 50K+ directly vulnerable (multiple CVEs including sandbox escapes, e.g. CVE-2026-25253). Lesson: agent skill marketplaces need the same provenance and signing discipline as package registries.

7.4 Identity and audit

Every agent is an identity: it holds credentials and accumulating entitlements across multi-step workflows, widening the blast radius of compromise. Production requirements: cryptographic agent identities, per-action authorization, immutable audit trails, and compliance frameworks — which products like Operator and Claude Computer Use initially shipped without. Current state: 72% of enterprises run agents; only 29% have AI-specific security controls (Capsule, 2026).

7.5 Defense-in-depth stack

No single control suffices. The 2026 consensus stack: input/output classifiers, instruction hierarchies, retrieved-content sanitization and spotlighting, least-privilege OAuth scopes (MCP) and signed Agent Cards (A2A), human-in-the-loop gates on irreversible actions, isolated execution sandboxes, and independent logging. Treat protocols as interoperability standards, not security guarantees.

8. Open Problems

• Instruction/data separation: no deployed architecture provably separates trusted instructions from untrusted content; this is the field’s hardest open problem.
• Long-horizon reliability: error compounds over trajectories; current systems still need human checkpoints for high-stakes workflows.
• Agent identity at internet scale: with machine traffic now exceeding human traffic (Cloudflare, June 2026), the web needs machine-readable trust infrastructure — TAP-style passports are early.
• Economic agency: AP2/x402-class payment rails for agents are nascent; who is liable when an agent transacts remains legally unresolved.

References

• Yao, S. et al. (2022). ReAct: Synergizing Reasoning and Acting in Language Models. arXiv:2210.03629
• Model Context Protocol — specification and documentation: modelcontextprotocol.io
• Agent-to-Agent (A2A) Protocol — Linux Foundation / Agentic AI Foundation: a2a-protocol.org
• OWASP Top 10 for LLM Applications (LLM01: Prompt Injection): OWASP
• OSWorld-Verified benchmark leaderboard (computer-use agents): os-world.github.io