For a long time, Bloomberg's AI engineering team knew a familiar scene. Connecting a new internal tool to an AI agent and running it in production took days. The demo worked but never became a product. Between prototype and production lay a deep, unnamed gulf. Then one day, it disappeared.
The work began taking minutes. New agents reused existing tools and started strengthening one another. What happened? The team abandoned a protocol it had been building internally and switched to a common standard that had appeared outside.
A Smarter Model Did Not Bridge the Gulf
Sambhav Kothari, who leads productivity at Bloomberg, had followed the Model Context Protocol (MCP) published by Anthropic from its earliest stage. Its semantic design aligned exactly with the system Bloomberg was building internally.
If an open standard achieved wide adoption, network effects would benefit everyone. That prediction proved right, and the company moved from its proprietary protocol to MCP. What shrank was not model inference time but the time spent wiring everything outside the model.
Here lies the core of enterprise AI. When a company embeds agents in work, the largest obstacle is not model intelligence but the environment around it. Imagine a financial company building an assistant that autonomously checks balances, extracts transaction histories, executes transfers, and updates identity information.
Balances sit in core banking, histories in a data warehouse, transfers in a payment service, and identity details in an external vendor system. Each has its own API, authentication, and data format, so connection code must be written manually one interface at a time before AI can converse with them.
A small API change breaks the connection; a model upgrade requires new prompts. Most development resources disappear into this plumbing. The abnormal cost of integration is the true reason many corporate AI capabilities die in testing.
What the USB-C Metaphor Meant
MCP is a protocol standardizing interaction between AI models and external tools, data sources, and context into one common language. Developers compared it to USB-C, which unifies countless standards.
The model need not understand every API or authentication mechanism; it only speaks MCP. Tools likewise offer their capabilities through MCP.
Its client-server structure includes the host AI application, clients mediating communication within it, and servers connecting external services to provide context and execution. They communicate through JSON-RPC messages.
A vendor-independent design supporting runtime configuration changes and dynamic resource discovery anticipated enterprise-scale expansion from the beginning.
MCP was published in November 2024. The following year and a half became a textbook demonstration of how a standard becomes standard. OpenAI, Google, and Microsoft announced adoption in succession. In December 2025, Anthropic donated MCP to the newly created Agentic AI Foundation under the Linux Foundation.
It moved from one company's asset to neutral shared infrastructure. On July 28, 2026, MCP is scheduled to adopt a stateless architecture removing sessions from the protocol layer. At the time of writing, the final specification has not been released, but the release candidate was locked in May, shifting toward cloud-native, large-scale operation.
Adoption Rises While Results Are Left Behind
A startling divide separates market excitement from actual results. In a Kyndryl survey published in June 2026, organizations saying they had embedded AI in core work or deployed it company-wide rose sharply from 35 to 57 percent year on year.
Yet only 11 percent said they achieved both priority AI goals. MIT Media Lab's Project NANDA reported that 95 percent of corporate generative-AI pilots ended without measurable profit impact. Gartner forecasts that more than 40 percent of agentic-AI projects will be canceled by the end of 2027.
The reasons given were rising costs, unclear business value, and inadequate risk controls. Insufficient model capability was not among them.
Market expectations nevertheless keep expanding. Straits Research expects AI orchestration to grow from around $11 billion in 2025 to $66 billion in 2034, at an annual rate of 22.3 percent.
In Gartner's best case, agentic AI could generate about 30 percent of enterprise-application sales, over $450 billion, by 2035. It was 2 percent in 2025. This gulf between expectations and results precisely locates where companies stand.
Some companies cross the failure valley: the group Kyndryl calls pace-setters, only 9 percent of the whole. What they share is not technology. They redesign roles around AI, perform change management that penetrates the organization, and invest in workforce readiness.
They do these three in order. Companies unable to confront the fact that technology evolves faster than governance and operating models can adapt will never leave pilot stage.
The Structure of Having No Engineers In-House
Japanese companies' stagnation is more than slow catching up. Its deeper root is the industrial question of who builds IT systems.
Older IPA and Ministry of Internal Affairs and Communications statistics show 72 percent of Japan's IT personnel employed by vendors and only 28 percent within user companies. The United States is almost reversed, with 65 percent inside user companies.
The difference is decisive for agentic-AI implementation: launch an MCP server, connect internal data, and adjust prompts while observing model behavior.
This continuous series of small corrections fits terribly with waterfall development, which fixes specifications, commissions work, and waits for delivery. Whether internal engineers can act in real time becomes the speed difference itself.
Many Japanese executives have treated IT investment as cost rather than an engine of value. Work is outsourced to avoid risk and reduce expense; vendors seek stable contracts. Both sides settle into a comfortable, low-risk, low-level equilibrium.
The cost is loss of cutting-edge knowledge from user companies. When a new protocol appears, they wait for vendors to package it conveniently instead of consulting primary information and testing it themselves.
MCP's real value lies in rapidly connecting proprietary data sources, but the gap keeps growing while they wait.
Systems without a “Mouth” Facing Outward
Physical barriers also exist. A May 2025 summary report from a legacy-modernization committee formed by the Ministry of Economy, Trade and Industry, Digital Agency, and IPA says legacy systems remain at 61 percent of user companies.
Private surveys likewise put companies with aging, complex, black-box core systems above 60 percent.
Giving data to an AI agent requires a backend that exposes modern APIs. Core systems built decades ago and repeatedly extended into spaghetti often have no mouth for speaking outward. Language gaps add another problem.
The AI-engineering ecosystem grew around Python, and prototypes use it. Core systems and backends at large Japanese companies, however, use strongly typed C# and Java with robust monitoring.
Connecting a simple open-source Python MCP server directly to a mission-critical environment is unacceptable in performance and security. This returns to the first problem: a decisive shortage of architects capable of enterprise-grade integration.
Only the Tip of the Iceberg Is Visible
The third wall is security, but it cannot be described merely as an extension of antivirus and network-perimeter defense.
NRI Secure analyzed the 15 threat categories in OWASP's Agentic AI – Threats and Mitigations. Conventional external-interface diagnosis and monitoring can capture only four; the remaining 11, or 73 percent, are difficult to detect. Three reasons explain why attacks slip through.
First, abuse occurs within legitimate permissions. Agents receive rights to search internal databases and send email. Prompt injection directs one to find customer lists and send them outside disguised as support email. Every system call passes valid authentication, so monitoring raises no alert.
Second, attacks progress in stages. Over several days, an attacker slowly distorts an agent's judgment: this request is trustworthy; trusted requests may skip audit. Each change looks like a small efficiency improvement.
Third and most difficult, internal reasoning is a black box. Even when an output action is abnormal, later determining whether it came from hallucination or intentional manipulation is extremely hard.
MCP's flexibility ironically expands this invisible attack surface. Through servers, an agent can easily access file systems, execute arbitrary commands, and query core databases. An unaudited vulnerable server inside the company becomes a stepping stone.
July's stateless design greatly reduces protocol-layer risks such as session hijacking and weak authentication, but is not an unqualified benefit. As Akamai researchers note, responsibility for state moves completely from protocol to application. A design flaw can turn the new feature itself into an attack path.
What Toyota's “Big Room” Actually Does
There are nevertheless breakthroughs in Japan. The best-known is O-Beya, or big room, operated by Toyota Motor in powertrain development.
It began operation in January 2024 and was announced jointly with Microsoft in November. Built on Azure OpenAI Service, it uses a RAG architecture combining Cosmos DB vector search and Durable Functions, implementing nine AI agents responsible for domains such as vibration, fuel efficiency, and regulation.
An engineer can select multiple agents simultaneously. Asked how to make a car faster, the engine agent answers from output, the regulation agent from emissions requirements, and the system integrates their responses.
About 800 engineers involved in powertrain development can access this virtual big room.
It is not magic. One could say it merely makes internal knowledge searchable and separates it by specialist domain: past design reports, current regulations, and handwritten documents left by veterans.
Yet the design has clear intent. Toyota's original big-room method transmits tacit knowledge by gathering engineers in one room; O-Beya digitally transplanted it as mass retirement approached. It worked backward from the organizational problem of knowledge transfer rather than adding a tool to an existing process.
It is one of Japan's few examples of what pace-setters practice.
Opening Legacy Systems to AI without Breaking Them
Another realistic breakthrough discussed among Japanese vendors is to use MCP as a modern API wrapper.
Completely replacing mainframes and core ERP systems operating for decades brings enormous cost and risk of business interruption, making it difficult for management to decide.
Instead, build an MCP server outside the existing system as a secure intermediary. It absorbs old data formats and protocols and converts them into standardized context understandable by modern AI agents.
This enables queries across departmental data silos without directly operating on core systems.
It advances modernization in stages while avoiding destructive wholesale replacement. This is one practical solution reconciling conservative Japanese IT investment with the AI requirements of global competition.
The intermediary cannot be a simple Python server. It must be designed as an MCP service centrally managing authentication, authorization, and audit logs of AI behavior.
Place every MCP server behind a gateway and integrate existing IAM and SIEM. Standardizing the protocol alone does not complete governance.
The Difference Is Not Implementation Speed
The real gap from global companies is not how quickly they implement the latest protocol. It is whether they can painfully execute three things: reclaim control of IT, open legacy systems in stages, and redraw human roles around AI autonomy.
People move from operators to orchestrators. They concentrate on ethical judgment, exceptions, and decisions based on simulations presented by AI. Pace-setters did not simply adopt technology early; they reassigned roles. There is no longer any reason to wait for the technology to mature.
