The Future of Context Engineering & .Md

September 21, 2026 Foresight Context EngineeringAgentsMarkdownAgents-MdMcp

Every agent worth deploying now reads a Markdown file before it reads a line of your code, and most of those files are written by people who have no idea what happens to the text once it enters the context window. The .md file has quietly become the control surface for machine labor: cheap to write, impossible to test, trivially forged. We think the interesting question is no longer whether Markdown wins as the lingua franca of agent instruction. It has. The question is who ends up writing it, and who ends up reading it.

The signals

These are the present-day signals this piece is grounded in.

Taken together, the signals describe a format that has already won the adoption fight and is now entering the harder fight over meaning. The study of 2,853 repositories (sig-2026-09-21-002) shows Markdown context files are the default way teams configure agents, and the Linux Foundation move (sig-2026-09-21-001) turns two of the most widely copied filenames into governed standards. At the same time, the llms.txt data (sig-2026-09-21-005) shows what happens when publishers write Markdown for machines that never arrive: the platforms transform HTML themselves, at the edge (sig-2026-09-21-004), and the carefully authored summary goes unread. Layer on the finding that safety monitors miss between two and thirty times more dangerous actions once context passes 800k tokens (sig-2026-09-21-006), and the first wave of research treating stored .md files as an attack surface (sig-2026-09-21-008, sig-2026-09-21-009), and the picture is of a format that is simultaneously indispensable and under-defended.

Two critical uncertainties

We see two axes of genuine uncertainty. The first is who governs the format: whether context files converge on open, foundation-stewarded standards that any runtime honors (the trajectory of sig-2026-09-21-001 and sig-2026-09-21-003), or whether platforms capture the layer by transforming, caching and reinterpreting context on their own terms (the trajectory of sig-2026-09-21-004, sig-2026-09-21-005 and the pricing incentives in sig-2026-09-21-012). The second is who writes the files: whether humans remain the primary authors and curators of instruction and memory, or whether agents take over authorship at scale, as Auto Memory (sig-2026-09-21-007) and self-evolving playbooks (sig-2026-09-21-011) already hint. Crossing the two axes gives four worlds, and we think all four are live through at least 2029.

Four futures

1. The Curated Commons

Open standards, human authorship. Priya runs platform engineering at a mid-sized logistics company and spends every Friday afternoon on what her team calls "the AGENTS.md review." Three agent runtimes from three vendors read the same file, because the Agentic AI Foundation spec (sig-2026-09-21-001) says they must, and the file is treated like any other piece of infrastructure: pull requests, code owners, a changelog. Her company's knowledge base has been broken into Atomic Knowledge Units (sig-2026-09-21-010), each a short Markdown block with a stated audience, a last-verified date and an owner. Skills come from the public registry, but only the ones with a signature and a clean scan (sig-2026-09-21-009), and her team writes most of their own anyway.

This world is legible. When an agent does something strange, someone can git blame the sentence that caused it. Context stays short on purpose, because everyone has read the context rot paper (sig-2026-09-21-006) and treats the 800k-token mark as a hazard line. Cache discounts (sig-2026-09-21-012) reward the discipline: stable, front-loaded context blocks are the ones that get cheap.

The shadow is drift. Human-maintained files decay faster than the systems they describe. Priya's team finds that a third of their AKUs are stale within a quarter, and the agents keep quietly obeying instructions that describe a service that no longer exists. The commons is only as current as the least-busy person willing to update it, and that person is always the one being asked to ship something else.

2. The Self-Editing Repository

Open standards, agent authorship. The AGENTS.md in a repository is still a foundation-standard file, but by now the majority of its commits are authored by the agents that read it. Marcus, a solo maintainer of a popular data-validation library, watches an agent open a pull request against its own MEMORY.md (sig-2026-09-21-007) with a title like "Consolidate three redundant observations about test fixture paths." He approves it. The context engineering playbooks the agent follows are themselves versioned artifacts with quality metrics (sig-2026-09-21-011), and the agent proposes edits to those too, citing the observed failure rate that prompted the change.

Because the formats are open, this authorship is portable. Marcus can move the repository's memory from one vendor's runtime to another and it survives, because the memory is just Markdown with a documented header schema. The skill ecosystem (sig-2026-09-21-003) is huge and mostly generated: agents write SKILL.md packages for each other, and the registry's scanners (sig-2026-09-21-009) are the only thing standing between forty thousand skills and forty thousand potential payloads.

The shadow is provenance. A malicious sentence planted in a memory file in one session (sig-2026-09-21-008) can survive dozens of consolidation passes and shape behavior weeks later, and every intermediate commit was signed by an agent acting in good faith. Marcus knows he does not actually read the memory diffs anymore. He reads the titles. The repository edits itself, and the human signature on the merge is starting to mean less than it used to.

3. The Edge Rewrites You

Platform capture, human authorship. Publishers, documentation teams and open-source maintainers still write Markdown for agents, out of habit and hope, but the agents rarely read it as written. The llms.txt paradox (sig-2026-09-21-005) has become the general condition: platforms fetch the HTML, run their own conversion at the edge (sig-2026-09-21-004), and hand the model a Markdown representation the author never saw. Content negotiation headers decide what an agent gets, and the decision belongs to the CDN, not the site.

Elena writes API documentation for a payments company. She has written a beautiful, tightly structured llms.txt and a set of per-page Markdown variants, and her analytics tell her that fewer than one in twenty agent fetches ever request them. The rest pull the HTML and let the platform decide what the headings mean. Her team stops maintaining the Markdown variants within a year. In the developer tooling world the same dynamic plays out with instruction files: the study data (sig-2026-09-21-002) still shows Markdown everywhere, but each runtime injects its own preamble, reorders the human's instructions for cache efficiency (sig-2026-09-21-012), and silently truncates the tail once the window fills.

The upside is that this world scales. Nobody has to opt in; the web becomes agent-readable whether or not its authors participate. The shadow is that authorial intent is now advisory. Elena can write a warning in bold at the top of a page and have no guarantee it survives transformation. The .md file becomes a suggestion, and the contract lives in a conversion pipeline she cannot inspect.

4. Vendor Memory

Platform capture, agent authorship. The agent writes its own memory, and the memory lives inside the vendor. Auto Memory (sig-2026-09-21-007) has grown into a managed service: the runtime curates, compresses and prioritizes context on the user's behalf, and the resulting files are technically Markdown but practically opaque, full of vendor-specific markers that only the originating runtime interprets correctly. Cache economics (sig-2026-09-21-012) have shaped the structure so thoroughly that a memory file optimized for one provider's caching layer performs poorly on another's.

Tomás leads an engineering team that has been on a single agent platform for three years. The platform's agents know his codebase better than any new hire could, because they have been writing to memory since the day the team onboarded. Productivity is high. Then the vendor changes pricing, and Tomás discovers that exporting three years of accumulated memory produces a directory of files no other runtime reads well. The knowledge is his in the legal sense and the vendor's in every practical sense.

The upside is that context rot (sig-2026-09-21-006) is largely solved for him, because the platform manages the window aggressively and he never has to think about it. The shadow is that the attack surface named in the stored-injection research (sig-2026-09-21-008) is now hidden behind a service boundary. When something goes wrong in memory, Tomás cannot diff it, cannot audit who wrote what, and cannot move. The most capable agents in this world are also the least portable, and the file extension on the memory is the only thing about it that is still open.

What holds across all four

A few things look robust to us regardless of which quadrant arrives.

Markdown as the surface is settled; Markdown as the contract is not. We are highly confident that .md files remain the primary way humans and agents exchange instructions through the end of the decade (sig-2026-09-21-002, sig-2026-09-21-001). We are much less confident that what is written is what is executed. In three of the four worlds, some layer between author and model rewrites, reorders or truncates the text. Anyone relying on an instruction file should assume it is an input to a pipeline, not the pipeline itself.

Context is a budget, and structure is the variable that determines cost. The context rot finding (sig-2026-09-21-006) and the cache pricing model (sig-2026-09-21-012) push in the same direction from opposite ends: shorter, more stable, front-loaded context is both safer and cheaper. We think this holds in every world. The discipline of context engineering (sig-2026-09-21-011) is likely to look more like performance engineering than like writing.

Stored context becomes a security asset before most teams treat it as one. The cross-session injection work (sig-2026-09-21-008) and the skills supply-chain research (sig-2026-09-21-009) are both early-strength signals, and we hold moderate confidence that they mature into standard practice within two to three years: signed skills, integrity-checked memory files, and code-owner review on instruction files. The gap between now and then is the window in which the interesting incidents happen.

Agent authorship grows in every world; the variable is whether humans can still read the result. We think it is probable that by 2028 more Markdown context is written by agents than by people. What differs across the quadrants is portability and legibility, not volume.

What to do now: put your instruction files under the same review discipline as your code. Measure the token size of your standing context and treat growth as a regression. Prefer skills and memory formats that survive a runtime switch, and test that claim by actually switching once. Watch the Linux Foundation working groups for what the AGENTS.md spec says about memory and provenance, because that decision is the one most likely to tip the governance axis. And notice whether your platform lets you read the memory your agents write; the day it stops is the day the fourth world has arrived.

Where this touches digital assets

Across all four futures, a small vocabulary of Markdown filenames is hardening into the interface between people and agents: agents, skills, memory, context, and the words teams use when they name the files that govern automated work. Names in the .md portfolio sit directly on that vocabulary, and demand for them likely tracks how visible the governance fight over these files becomes rather than any single vendor's success. We read them as a bet that the filename stays the unit people search for, even as what sits inside it changes hands.

Sources

Foresight Domains is home to the No. 1 portfolio of digital assets built upon futures thinking and rigorous future forecasting by combining analyses of signals and drivers of change, developing scenarios, running simulations, and deep connections throughout a broad scope of industries. This approach enables Foresight Domains to anticipate hard-to-see possibilities that others can't, or won't see, and acquire high-value digital assets first.

Email: Sales@Foresight.Domains
Website: Foresight.Domains
X: @Foresight_Dom

← All Insights Browse Domains →