--- title: "Issue 18" canonical: "https://current.tinyfish.ai/issue/18" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/18" issue: 18 description: "Eight billion dollars just bought five different definitions of the same word." authors: ["Sable Whitford","Rina Takahashi","Nora Kaplan"] published: 2026-03-02 updated: 2026-11-05 articles: 85 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 18 Eight billion dollars just bought five different definitions of the same word. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The $8 Billion Word Problem]() — By [Rina Takahashi]() · Published 2026-02-25 · Format: The Definitional Gap In February 2026, five companies raised a combined $8 billion for agent infrastructure. Every single one pitched "reliability." Temporal meant something specific by that word. Daytona meant something different. Databricks, something else entirely. Astelia, yet another thing. Four layers of the stack, four theories of where agents actually break. Somewhere in procurement offices right now, teams are choosing between these theories, locking into a definition the market hasn't finished writing. - **Temporal Raises $300M for Durable Agent Execution** — [Source]() — Published 2026-02-25 Temporal's $300M Series D at a $5B valuation, led by a16z, funds infrastructure for long-running stateful agents that recover from failures without losing progress. Cloud processes 300K+ agent actions per second. OpenAI and Nordstrom are among the installed base. - **Daytona's $24M Bet on Agent-Native Sandboxes** — [Source]() — Published 2026-02-25 Daytona's Series A, led by FirstMark Capital, builds isolated execution environments where agents launch sandboxes in milliseconds, fork into parallel decision paths, and snapshot mid-execution. Hit $1M ARR in under three months, doubled it six weeks later. - **Databricks Closes $7B Round for Agent Data** — [Source]() — Published 2026-02-25 Databricks' $7B financing at a $134B valuation doubles down on Lakebase, a serverless Postgres database purpose-built for AI agents, and Genie, its conversational AI layer. Revenue run rate surpasses $5.4B with 65% year-over-year growth. - **Astelia Raises $35M to Find Real Vulnerabilities** — [Source]() — Published 2026-02-25 Astelia's combined seed and Series A, led by Index Ventures and Team8, deploys autonomous agents that map enterprise environments and surface which vulnerabilities are actually exploitable. In some deployments, roughly 30 out of nearly 3 million proved genuinely reachable. - **Basis Hits $1.15B Valuation Automating Accounting Work** — [Source]() — Published 2026-02-25 Basis raised $100M Series B led by Accel for long-horizon agents that autonomously complete complex accounting workflows, including the first AI-completed end-to-end 1065 tax return. Roughly 30% of the top 25 U.S. accounting firms now use the platform. - **Security Threat Modeling for Emerging AI-Agent Protocols: A Comparative Analysis of MCP, A2A, Agora, and ANP** — [Source]() — Published 2026-02-25 Applies structured threat analysis to four agent communication protocols and finds twelve distinct protocol-level risks with no shared security framework across them. "Security" carries quietly different meanings in each protocol's design assumptions. - **Autonomous Agents on Blockchains: Standards, Execution Models, and Trust Boundaries** — [Source]() — Published 2026-02-25 A systematic review of 317 works maps the agent-blockchain interface and finds current authorization frameworks insufficient for agents executing financial transactions. Proposes a five-tier taxonomy by agent authority level, flagging multi-agent collusion as a distinct, underexplored risk. - **Agent2Agent Threats in Safety-Critical LLM Assistants: A Human-Centric Taxonomy** — [Source]() — Published 2026-02-25 Examines A2A's structural trust gap: the protocol draws no distinction between human-originated and agent-originated instructions. Both enter a receiving agent's context window with equivalent privilege, collapsing a trust boundary that governance frameworks quietly assume exists. - **A Survey of Agent Interoperability Protocols: MCP, ACP, A2A, and ANP** — [Source]() — Published 2026-02-25 Surveys the agent interoperability landscape and confirms a familiar pattern: protocols were built for capability first, security second. Fragmented practices across frameworks make integration, security, and scaling of LLM-driven agent communication genuinely difficult. - [Basis Raises $100M at $1.15B Valuation, Betting That Accounting Is Where Agents Can Actually Be Correct]() — Published 2026-02-26 Basis just closed a $100 million Series B led by Accel, with GV and Khosla Ventures participating, at a $1.15 billion valuation. The interesting thing here is the domain, not the check size. - **AI Agent Reliability Startup Temporal Raises $300M in Funding** — [Source]() — Published 2026-02-26 Temporal's CEO pitches failure recovery over capability. The a16z quote on "demo vs. production system" distills the investor thesis cleanly. - **Databricks Raises $7 Billion for AI Agent Database** — [Source]() — Published 2026-02-26 The investor roster tells the story here. JPMorgan's participation through its "Security and Resiliency Initiative" signals that database-layer reliability has become a financial infrastructure concern. - **NIST Announces AI Agent Standards Initiative for Interoperable and Secure Innovation** — [Source]() — Published 2026-02-26 The primary source on NIST's three-pillar framework. Worth noting the open comment deadlines (March 9, April 2) and the politically loaded rebranding away from "AI Safety Institute." - **Daytona Raises $24M for AI Agent Computing Infrastructure** — [Source]() — Published 2026-02-26 A different slice of the reliability problem: sandboxed execution environments for AI-generated code. The disclosure about hardware constraints limiting customer onboarding is an unusually candid signal of real demand. - **Multi-Agent Systems Move Business AI From Chatbot to Operations** — [Source]() — Published 2026-02-26 Good context on why infrastructure capital is arriving now. The shift from single-prompt assistants to coordinated multi-agent workflows creates reliability requirements that didn't exist a year ago. - **NIST Agentic AI Initiative Looks to Get Handle on Security** — [Source]() — Published 2026-02-26 Essential political context behind the NIST announcement. The safety-to-standards rebranding reflects a broader contest over how federal AI governance gets framed, and who gets to frame it. ### [Foundations]() Conceptual clarity earned from building at scale - [The Workforce Nobody Manages]() — By [Nora Kaplan]() · Published 2026-02-25 · Format: The Workforce Problem Three million AI agents operate inside corporations. Walmart employs 2.1 million people across twenty countries and can account for every one of them. Recent surveys found nearly a quarter of organizations can't produce a list of their agents. Another quarter track them on spreadsheets. No inventory, no ownership records, no offboarding process. Everyone files these as security findings. But read that list of failures again, slowly. They sound like a workforce-management audit where every line item is red. Workforce-management failures call for workforce-management fixes. - [NIST Is Running a Design Review on Agent Identity. The First Window Closes in Twelve Days.]() — By [Rina Takahashi]() · Published 2026-02-25 · Format: Standards as Practice Roughly one in five organizations treats AI agents as entities that deserve their own identity credentials. The rest use shared service accounts or hardcoded keys. While practitioners figure this out in production, two teams inside NIST are writing the federal definitions of "agent identity," "authorization scope," and "agent security." Those definitions will harden into compliance language, procurement requirements, tooling categories. The vocabulary is still soft. The first comment window closes March 9. And the process is asking questions that sound a lot like a design review. - **State of AI Agent Security 2026** — [Source]() — Published 2026-02-25 The primary data source behind the workforce-scale numbers cited in this issue. Full survey methodology across 919 respondents, with the finding that over half of deployed agents run without monitoring or security oversight. - **Announcing the AI Agent Standards Initiative** — [Source]() — Published 2026-02-25 NIST's official announcement with links to both RFIs and March/April submission deadlines. Essential reading if you want to understand what the U.S. government thinks it can standardize about agent identity and security, and where the open questions still live. - **AI Agents Behave Like Users, But Don't Follow the Same Rules** — [Source]() — Published 2026-02-25 Help Net Security's coverage of the Cloud Security Alliance report on autonomous agent credentialing. The core argument: applying human-identity rigor to agent systems sounds reasonable until you examine where the analogy breaks down. - **The State of AI & Browser Automation in 2026** — [Source]() — Published 2026-02-25 Browserless.io's survey of the infrastructure layer beneath browser agents, including a useful "muscle vs. mind" taxonomy that separates execution platforms from AI reasoning logic. Good orientation for anyone trying to understand where browser agent tooling actually sits in the stack. - **OpenClaw Is Riddled With Security Concerns** — [Source]() — Published 2026-02-25 The New Stack reports on 21,000+ exposed instances and malware discovered in the OpenClaw skills marketplace. If you want to see what agent supply-chain risk looks like in practice, this is the npm left-pad moment for the agent ecosystem. - **Three Million Agents, Half Running Without Oversight** — [Source]() — Published 2026-02-25 Over 3 million AI agents now operate inside US and UK corporations. 53% are neither monitored nor secured. For scale: that's an unsupervised workforce exceeding Walmart's entire global headcount. (Gravitee, n=750 CTOs and tech VPs) - **Most Teams Ship Agents Before Security Signs Off** — [Source]() — Published 2026-02-25 81% of teams have moved past planning into active testing or production. Only 14.4% of agents go live with full security approval. The remaining 85.6% launch with partial oversight or none whatsoever. (Gravitee, n=919) - **Nearly Half of Organizations Can't Locate Their Agents** — [Source]() — Published 2026-02-25 22.5% of organizations have no formal catalog of their agents or MCP servers. Another 25.4% track them on spreadsheets, which go stale the moment someone hits save. Together, that's nearly half with no reliable real-time inventory. (Gravitee, n=919) - **Agents Rarely Get Their Own Identity in Security** — [Source]() — Published 2026-02-25 Just 21.9% of organizations treat AI agents as independent, identity-bearing entities in their security model. The rest still lump them in with human users or generic service accounts, which quietly guts auditability and access control. (Gravitee, n=919) - **Gartner: Half of AI Initiatives Will Stall Out** — [Source]() — Published 2026-02-25 "Through 2028, over 50% of AI initiatives will halt, becoming unmanageable, because of unresolved agentic identity challenges." Note: this is a separate prediction from Gartner's earlier cost-focused cancellation forecast. The culprit here is identity governance specifically. (Gartner, via Veza) - **88% Report Confirmed or Suspected Agent Security Incidents** — [Source]() — Published 2026-02-25 88% of organizations confirmed or suspected an agent-related security or data privacy incident in the past year. Documented cases include agents leaking confidential data, acting on stale information, and deleting databases nobody asked them to touch. (Gravitee, 2026) - **NIST Opens First Federal Push on Agent Standards** — [Source]() — Published 2026-02-25 NIST's new AI Agent Standards Initiative targets security and identity for autonomous systems through parallel tracks. An RFI on agent security closes March 9; a concept paper on agent identity and authorization accepts comments through April 2, with listening sessions to follow. - **Veza Ships Identity Control Plane for AI Agents** — [Source]() — Published 2026-02-25 Veza Access Agents, launched today, automate identity governance spanning humans, non-human identities, and AI agents. A new Suggested Owner Agent maps agents to human owners, tackling the attribution problem directly. Early access is live now; GA is targeted for end of Q2 2026. - **MCP Joins Linux Foundation, Apps Extension Goes Official** — [Source]() — Published 2026-02-25 Anthropic donated MCP to the Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI. Separately, MCP Apps went official, letting tools return interactive UI components like dashboards and forms directly inside agent conversations. - **OpenClaw Exposure Reveals Agent Security at Breaking Point** — [Source]() — Published 2026-02-25 Censys found over 21,000 publicly exposed OpenClaw instances. Researchers flagged roughly 12% of ClawHub skills as malicious, distributing infostealers through professional-looking plugins. The npm and PyPI "claw" package ecosystem has exploded from near-zero to over 1,000 packages, with an estimated 900 now malicious. - **Microsoft Unifies AutoGen and Semantic Kernel Into One** — [Source]() — Published 2026-02-25 The Microsoft Agent Framework, now in public preview, merges AutoGen's agent abstractions with Semantic Kernel's enterprise plumbing. Both predecessors enter maintenance mode. The consolidated framework targets 1.0 GA by end of Q1 2026, with MCP and A2A interoperability baked in. - **Gong Launches MCP Support to Bridge AI Silos** — [Source]() — Published 2026-02-25 Gong shipped MCP support today under its Mission Andromeda initiative, connecting to Salesforce, HubSpot, and Microsoft Dynamics 365. The company positioned the move as a response to AI fragmentation, where siloed agents can't orchestrate across the full customer journey. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Reading an Architecture as an Argument About Failure]() — By [Rina Takahashi]() · Published 2026-02-25 · Format: Designing for Distrust During their January 2026 Launch Week, Skyvern shipped a feature that lets users upload a PDF of a human standard operating procedure and have an AI agent build a workflow from it. A procedure manual written for people, fed directly to a machine. It's a revealing choice, and what it compensates for runs through the rest of the architecture. - [The Math That Quietly Decides Which Agent Workflows Survive]() — By [Rina Takahashi]() · Published 2026-02-25 · Format: The Binding Constraint A single step succeeds 95% of the time. Chain twenty of those steps together and the workflow completes 36% of the time. No individual component failed. Multiplication just compounded what looked, at each decision point, like a rounding error. - [The SRE Whose Dashboards Were Green While Everything Was Wrong]() — Published 2026-02-25 *Dag Failover is, by his own admission, a name that has caused problems at every company he's ever worked for. "My first week at Google, three people asked if it was a handle," he says. It is not. It is, apparently, a corruption of a Norwegian surname that his great-grandfather decided not to correct at Ellis Island because he thought it sounded "more American."* - [Agent Observability Has a 37-Point Blind Spot Between "Did It Run?" and "Did It Work?"]() — Published 2026-02-25 Among organizations running agents in production, 89% have observability in place. Only 52% run evaluations of any kind. That 37-point spread is a confidence gap masquerading as coverage. - **State of Agent Engineering** — [Source]() — Published 2026-02-25 Primary survey of 1,340 practitioners surfaces a striking disconnect in production agent systems. - **The Agentic AI Infrastructure Landscape in 2025–2026** — [Source]() — Published 2026-02-25 The "march of nines" framing sharpens why compound reliability degrades faster than model capabilities improve. - **State of AI Agents 2026: 5 Trends Shaping Enterprise Adoption** — [Source]() — Published 2026-02-25 Anthropic-sourced data on where multi-step agent workflows actually stall in enterprise settings. - **AI Deployments Gone Wrong: The Fallout and Lessons Learned** — [Source]() — Published 2026-02-25 A catalog of high-profile AI failures that reveals how governance gaps compound into system-level breakdowns. - **Web Scraping Proxies in 2026: Higher Demand, Higher Spend** — [Source]() — Published 2026-02-25 Primary survey data on the anti-bot arms race and its rising, often unmodeled, operational costs. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Cookie That Couldn't Be Killed]() — By [Rina Takahashi]() · Published 2026-02-25 · Format: The Persistent State In 1994, a Netscape engineer needed websites to remember shopping carts. He made three small design choices: cookies would set silently, persist across sessions, and be readable across sites. Practical, almost obvious. Those same three properties turned out to be the exact foundation that behavioral advertising would later require at scale. By the time anyone tried to undo them, the cookie was load-bearing for an industry worth hundreds of billions of dollars. Google spent five years trying. The story of what happened is also the story of why it couldn't. - [Google's Privacy Sandbox Asked an Industry to Volunteer for Worse Outcomes. The Industry Declined.]() — Published 2026-02-25 Google spent six years engineering a replacement for third-party cookies. The Privacy Sandbox moved ad targeting onto the device through Topics API, Protected Audience, and Attribution Reporting. Technically functional. Also, by every independent measure, significantly less capable than what it replaced. - [We Solved a Shopping Cart Problem — A Fictional Interview About the Birth of the Cookie]() — Published 2026-02-25 *Dex Pokorny is not a real person. He is, however, a plausible one — a composite drawn from documented accounts of Netscape's engineering team in 1994, built to carry a true story in a voice that belongs to no one in particular and could belong to several people who were actually there. The technical history is real. The opinions are invented. The bewilderment is probably accurate.* - [The Consent Layer That Can't Keep Up]() — By [Rina Takahashi]() · Published 2026-02-25 · Format: Compounding Consequences A session-state mechanism from 1994 sits beneath a $900 million compliance industry. Cookie consent banners interrupt every site visit in Europe, powered by platforms that largely fail at what they promise. Each regulatory layer was built to manage the consequences of the one before it. The regulation meant to finally clean up the whole structure was recently withdrawn. What remains is a stack of workarounds, still compounding. - [The Split Web]() — By [Rina Takahashi]() · Published 2026-02-25 · Format: Compounding Consequences The same mechanism also fractured the web along a seam most people never notice. Safari and Firefox block third-party cookies by default. Chrome does not. Which privacy architecture governs your browsing depends on which browser icon you tap. Advertisers now maintain parallel infrastructure for both regimes. The split exists because the original cookie was never replaced. Half the web removed it. The other half kept going. - **The Reasoning Behind Web Cookies** — [Source]() — Published 2026-02-25 Montulli's own account of what cookies were designed to prevent, not enable. - **To Understand Where the Cookie Is Headed, Let's Look at Its History** — [Source]() — Published 2026-02-25 The IETF flagged the surveillance risk by 1997. Browsers made different choices. - **Google Ends Third-Party Cookie Phaseout Plans** — [Source]() — Published 2026-02-25 The institutional account of why antitrust pressure, not privacy strategy, ended the phaseout. - **Google's Privacy Sandbox Is Officially No Longer** — [Source]() — Published 2026-02-25 A sharp postmortem on why Sandbox satisfied neither privacy advocates nor advertisers. - **Cookie Compliance in 2026: Where GDPR Enforcement Stands Now** — [Source]() — Published 2026-02-25 Independent legal analysis of the widening gap between regulation and actual implementation. - **How Browsers Handle First and Third-Party Cookies** — [Source]() — Published 2026-02-25 Technical breakdown of the three-way browser split advertisers actually navigate today. ### [Vision]() Where human-AI collaboration is heading - [The Honest Version We Built for Machines]() — By [Nora Kaplan]() · Published 2026-02-25 · Format: The Mirror A hotel booking site, talking to an AI agent, can't show a countdown timer. It can't bury fees on page three of checkout. Under a new W3C draft specification called WebMCP, websites must declare their capabilities as typed functions with honest descriptions of what those functions return. The requirement sounds like plumbing. But when a site has to produce a clean, structured version of itself for machines, it also produces something else: a document that sits next to the human-facing version and makes the distance between them measurable. - [The Honest Interface]() — By [Nora Kaplan]() · Published 2026-02-25 · Format: Two Doors A cancel button in eight-point gray on a white background is technically a cancel button. The FTC would disagree about what it communicates. Dark patterns work because visual interfaces have texture: color, size, placement, language that shames you for choosing wrong. When a site must declare its capabilities to an agent through a structured protocol, there is no font size. No fold. Some manipulations have no mechanism to survive that translation. Others find new places to hide. - [The Human Door]() — By [Nora Kaplan]() · Published 2026-02-25 · Format: Two Doors If the machine-readable interface is more honest than the human one, an uncomfortable question follows: what happens to the human-facing web it leaves behind? Secondary interfaces have a history. Desktop after mobile-first. Admin panels behind consumer apps. They get enough investment to function, never enough to thrive. But the human web might break this pattern in an unexpected direction. It might become the door people stop choosing to walk through. - [Mino on the Hostile Web, the Machine Door, and Why Dark Patterns Work Better on Agents Than Humans]() — Published 2026-02-25 *In December 2025, researchers published a paper called DECEPTICON that measured something nobody had thought to measure: how effectively the web's dark patterns manipulate AI agents. Hidden cancel buttons, fake urgency timers, shame-laced opt-outs. The finding was jarring. Dark patterns successfully steered agents toward unintended outcomes in over 70% of tested tasks. The human rate? Thirty-one percent.* - [The Nudge Economy Meets a User That Doesn't Flinch]() — Published 2026-02-25 Drip pricing lifted StubHub's revenue by 20%. Confirmshaming, false urgency, roach-motel cancellation flows. A meaningful slice of digital commerce runs on the gap between what consumers actually want and what they can be pressured into accepting. - **Google Previews WebMCP: A Protocol for How AI Agents Interact With Websites** — [Source]() — Published 2026-02-25 The news that prompted this issue. Google's first browser-native protocol for agent-site interaction is framed as a developer convenience, but the governance implications run much deeper than the announcement lets on. - **The Agentic Web Explained: AGENTS.md, MCP, A2A, and the Architecture Taking Shape** — [Source]() — Published 2026-02-25 The clearest technical map of how backend agent protocols and browser-facing ones fit together. Worth reading to understand why "the machine door" isn't one door but several, built by different parties with different incentives. - **Is Your Workplace Set Up for AI Agents?** — [Source]() — Published 2026-02-25 HBR's electricity-in-factories analogy holds up well here: bolting agents onto existing structures captures almost nothing. The piece is about organizational design, but the logic applies just as cleanly to web architecture. - **FTC Staff Report: Bringing Dark Patterns to Light** — [Source]() — Published 2026-02-25 Before asking whether agents will navigate the web better than humans do, it helps to remember what the human-facing web actually looks like. The FTC's catalog of deceptive design is the regulatory baseline for a web already built to manipulate. - **How to Save the Internet From Enshittification: Cory Doctorow on Platform Decay** — [Source]() — Published 2026-02-25 Doctorow's framework for how platforms turn extractive is the sharpest lens for a question this issue raises: does agent-facing infrastructure escape the cycle, or is it just early enough in the cycle to still feel helpful? - **Subprime Attention Crisis by Tim Hwang** — [Source]() — Published 2026-02-25 The economic substrate beneath everything we're discussing. Hwang's argument that the ad-funded web is a bubble built on manipulable human attention raises an uncomfortable corollary: what happens to that economy when the attention being manipulated belongs to machines? ## More - [Publication guide]() - [Issue archive]()