--- title: "Echoes" canonical: "https://current.tinyfish.ai/issue/22/echoes" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/22/echoes" issue: 22 section: "echoes" description: "Past infrastructure decisions echoing in today's production realities" authors: ["Nora Kaplan","Rina Takahashi"] published: 2026-03-30 updated: 2026-03-26 articles: 11 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 22 — Echoes Past infrastructure decisions echoing in today's production realities ### The Gate That Taught - [The Test That Taught Machines to Pass It]() — By [Nora Kaplan]() · Published 2026-03-25 · Format: The Gate That Taught Between 2009 and today, billions of people clicked through grid squares identifying crosswalks, storefronts, and traffic lights. They were proving they were human. They were also labeling training data for the very systems that would make the test obsolete. CAPTCHA began as a bet placed at Carnegie Mellon in 2003: that certain perceptual problems would stay hard for machines long enough to serve as a reliable gate. The bet had a structural flaw, and it was built into the gate itself. ### Human-Speed Infrastructure - [The Web Was Clocked to Human Reflexes. Agents Don't Have Reflexes.]() — Published 2026-03-25 HTTP/1.0 opened a fresh TCP connection for every single request. A brutal performance penalty, and nobody cared, because the client on the other end was reading, thinking, moving a cursor. The protocol's overhead hid inside human hesitation. ### The Arms Race - [A Conversation with the Locksmith Who Woke Up in a Park]() — Published 2026-03-25 *Fenn Wickham spent two decades building systems to keep machines out of human web spaces. He is also, in the strictest sense, not a real person. The technical history he describes is documented, the arms race he narrates is ongoing, and the philosophical problem he can't resolve is one that actual detection engineers are living through right now. Consider him a composite with strong opinions and a name his parents definitely gave him.* ### Persistence and Proof - [The Session Assumption]() — By [Rina Takahashi]() · Published 2026-03-25 · Format: Persistence and Proof Web protocols carry a portrait of their first user. HTTP had no memory, so Netscape gave it cookies, and the security conventions that followed were calibrated to a specific creature: one that idles, gets distracted, walks away from the keyboard. The 15-minute session timeout is a sketch of a human body leaving a chair. What happens when the thing holding the session doesn't have a body to leave? - [Who Clicks Authorize]() — By [Rina Takahashi]() · Published 2026-03-25 · Format: Persistence and Proof Web protocols carry a portrait of their first user. OAuth 2.0 was built around a pronoun and a click: a human, present, reading a permissions screen, deciding to say yes. The entire authorization chain assumes someone is there to consent. Fourteen years later, agents act on behalf of users who aren't in the room, holding tokens designed for people who were. That gap is widening faster than the specs can follow. ### Further Threads - **Building Browser Agents: Architecture, Security, and Practical Solutions** — [Source]() — Published 2026-03-25 A production-grounded paper that keeps arriving at the same finding: architecture, not model capability, determines whether browser agents succeed against human-designed pages. The web's visual, perceptual surface was built for human eyes, and that thirty-year design success is now the friction no amount of model scaling resolves. - **The State of AI & Browser Automation in 2026** — [Source]() — Published 2026-03-25 Documents the browser's quiet shift from rendering layer to agent control plane, with useful ground-level detail on how AI now models human telemetry to pass as organic traffic. That particular workaround reveals more about the web's inherited assumptions than about any advance in AI. - **Why AI Infrastructure Will Face a Reckoning in 2026** — [Source]() — Published 2026-03-25 Enterprise infrastructure built for the digital business patterns of the 2010s is now stress-tested by agent workloads it was never shaped to carry. Worth reading as the clearest articulation of how past architectural choices become suddenly visible once the load changes. - **Kill the CAPTCHA: They Don't Work, Here's What Does** — [Source]() — Published 2026-03-25 Traces the full CAPTCHA arc from early-2000s Turing test to mid-2025 collapse, when ETH Zurich researchers demonstrated 100% defeat of reCAPTCHA v2 and ChatGPT Agent bypassed Cloudflare's verification without detection. A human-verification system designed against one generation of bots, undone by a generation it never anticipated. - **The AI Agent Identity Crisis: New Research Reveals a Governance Gap** — [Source]() — Published 2026-03-25 A Cloud Security Alliance survey of 285 security professionals surfaces a stark number: only 21% maintain a real-time inventory of active agents, and 44% still authenticate them with static API keys. Authentication built for human-paced, session-based logins is quietly being pressed into service for autonomous agents that never log off. - **The Looming Authorization Crisis: Why Traditional IAM Fails Agentic AI** — [Source]() — Published 2026-03-25 ISACA traces the mismatch to its origin: OAuth 2.0 and SAML were designed assuming a single authenticated human with predictable sessions. Agents violate every one of those assumptions, spinning up ephemeral sessions, delegating to subagents, and establishing trust across domains no hierarchical model ever anticipated. ## Other sections in Issue 22 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()