--- title: "Issue 22" canonical: "https://current.tinyfish.ai/issue/22" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/22" issue: 22 description: "Every agent deployed this quarter inherited a web built for humans, an org that doesn't know it exists, and a maintenance budget of zero." authors: ["Sable Whitford","Rina Takahashi","Nora Kaplan"] published: 2026-03-30 updated: 2026-11-05 articles: 89 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 22 Every agent deployed this quarter inherited a web built for humans, an org that doesn't know it exists, and a maintenance budget of zero. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [The Accounts You Locked Were the Ones That Opened: Meet \*sshole]() — By [Sable Whitford]() · Published 2026-11-05 OpenSSH and Alpine Linux **shipped fixes today** for `*sshole`, a decade-old bug that let any password between 257 and 1024 bytes log in on Linux boxes running musl libc without PAM. Locked accounts get a `*` in `/etc/shadow`. musl's `crypt()` also returns `*` when it chokes on a password. OpenSSH compared the two, saw a match, and let you in. The bug was reported Wednesday and patched **this Thursday** with no embargo, because maintainer Damien Miller says AI agents now rediscover bugs within hours. Upgrading alone won't protect you. You still have to restart sshd. - **OpenAI buys the Git plumbing under Codex** — [Source]() — Published 2026-11-05 OpenAI is acquiring Pierre Computer Company, maker of Git-based distributed storage "with API ergonomics designed for machines." Pierre's open-source Trees and Diffs libraries already run file browsing and change review in Codex, and they stay open source. Terms undisclosed. It follows Pando, OpenAI's in-house source-control backend, which reportedly cut deploy latency about 80%. Coverage is calling this a GitHub challenger. OpenAI hasn't said so. - **Meta buys Conductor, users get eviction notice** — [Source]() — Published 2026-11-05 Same day, different buyer: Meta picked up Conductor, the app for running several coding agents at once. Sign-ups and downloads are frozen and the cloud side is winding down. Cloud data deletion starts November 20, so export what you care about now. CEO Charlie Holtz promises something new early next year. Meta hasn't said whether existing integrations survive. - **GitHub picks a terrible day to wobble** — [Source]() — Published 2026-11-05 From 09:49 UTC Wednesday, Git operations, Issues and pull requests degraded, then Actions and the API joined in. Mitigated around 11:30, resolved by 11:50, with a few more Actions hiccups later on. All of it landed the same day OpenAI bought a Git storage company built for agents. Rough optics. Rougher pager. - **Revolut swaps Claude Code for self-hosted GLM** — [Source]() — Published 2026-11-05 About 2,000 Revolut engineers now default to a self-hosted Z.ai GLM model: open weights, Revolut's own US servers, roughly 56 Nvidia B200s, about $0.30 per million tokens, around a tenth of the old bill. Claude Code and Codex stay for the hardest work, and Gemini gets images. Revolut reports 70% better lead time and 60% better coding time. AI ops head David Abitbol says the bottleneck "is not necessarily coding." Cheap and good enough is winning fans, and people are loudly arguing over the stigma around Chinese open weights. - **Rent-a-proxy, now exiting from the White House** — [Source]() — Published 2026-11-05 Layer3 Intel saw residential proxy traffic exit from AS2650, the Executive Office of the President's network, 236 times in a 30-day window ending Tuesday. That was 6 addresses, on 26 of the 30 days, across 28 proxy services. Layer3 wasn't hunting for it. The addresses just turned up in rotation. The pattern looks like someone's everyday device rather than guest Wi-Fi. No breach is shown and the device is unidentified. Sentient, via Cybernews, suspects Rave.io, an app bundling 12 proxy SDKs. The White House hasn't commented. - **CISA flags an actively exploited WordPress flaw** — [Source]() — Published 2026-11-05 CISA added a WordPress Core vulnerability to its Known Exploited Vulnerabilities catalog, so attackers are already using it. Details are thin. Do the boring thing: update WordPress, check that auto-updates actually ran, and poke whoever supposedly "owns" the marketing site. - **Bot swarms are knocking university libraries offline** — [Source]() — Published 2026-11-05 Data-hungry bot swarms are hitting university library websites hard enough to crash them. Sites built for students and researchers are soaking up crawler traffic that will never borrow a single book. Toss it on the scraper-fatigue pile, which keeps getting taller. - **Does Gemini train on paid chats?** — [Source]() — Published 2026-11-05 A complaint making the rounds says Gemini trains on chat history even for paying subscribers. It's an unconfirmed claim that people are arguing about loudly. Either way, it's a decent excuse to go poke at your own settings. - **Nvidia's AI laptop: unplug it to go faster** — [Source]() — Published 2026-11-05 On RTX Spark laptops running GPT-OSS-120B, Windows and WSL hit about 65 tokens per second. Native Linux managed 13.9, roughly 79% slower. Pull the power cord and Linux climbs back to about 61–67. MindStudio blames a Windows-only firmware component with an encrypted power table Linux can't decrypt. That's one study, and Nvidia hasn't confirmed it. Battery mode as a performance feature. Wild. - **AMD expects to outsell Intel, a first** — [Source]() — Published 2026-11-05 Per Tom's Hardware, AMD expects to outsell Intel in Q4 for the first time ever. That's a forecast, so wait for the final count. Still, anyone who remembers AMD as the perennial underdog gets to enjoy that sentence. - **Data centers get voted down, town after town** — [Source]() — Published 2026-11-05 Data centers had a bad night in Tuesday's midterms. Bloomberg headlines say only one town out of dozens voted in favor of them, and AI Weekly counts bans or restrictions passing in at least 14 Ohio municipalities. Wall Street read the night its own way: Bloomberg reports Big Tech rallied as the results reshaped the AI spending outlook. - **Baidu ships ERNIE 5.5 Flash Base** — [Source]() — Published 2026-11-05 Baidu released ERNIE 5.5 Flash Base. For now there's a release page and not much else, so no specs to argue about yet. It lands on a day when Chinese models were already the talk of engineering teams. - **OccupySaaS: laid-off engineers clone everything** — [Source]() — Published 2026-11-05 Under the OccupySaaS banner, laid-off engineers are using AI to build open-source alternatives to, well, everything. Auth0 and Salesforce clones are in the works. Free time plus a code generator turns out to be a hell of a combination. - **AI is calling in 40 years of tech debt** — [Source]() — Published 2026-11-05 An IEEE piece argues AI is forcing organizations to finally pay off four decades of technical debt. The headline alone had people glancing nervously at the oldest box in their stack, the one nobody is allowed to reboot. "We'll fix it later" apparently had a due date. - **A detective game where every suspect lies** — [Source]() — Published 2026-11-05 Uncracked City casts LLMs as your suspects, and they lie to you, on purpose this time. You interrogate them, cross-check their stories and catch the contradictions. A model making things up is the whole point here, and it's suspiciously good practice for reading AI output at work. - **Stringman: a room-sized robot gripper, $800** — [Source]() — Published 2026-11-05 Stringman is an open-source robot gripper that works across an entire room, for about $800. That's roughly used-bike money, which puts room-scale robotics within reach of anyone with a free weekend and a garage. Expect weekend projects. - **MCP Explained, for when the acronym blurs** — [Source]() — Published 2026-11-05 MCP Explained is a standalone site that walks through Model Context Protocol, the standard for hooking AI models up to tools and data. Bookmark it for the next meeting where someone says "just wire it up with MCP" and the whole room nods like they know. - **Download your favourite YouTube videos. Seriously.** — [Source]() — Published 2026-11-05 A warm little essay makes the case for keeping local copies of the YouTube videos you love, because channels vanish and links rot. Ops people will agree on sight: if it matters and there's no backup, you're only borrowing it. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Problem You Can Count]() — By [Rina Takahashi]() · Published 2026-03-25 · Format: The Immune Response Over 30,000 exposed instances cataloged. Hundreds of malicious skills traced to a single threat actor. CVEs scored and patched within weeks. The agent ecosystem's immune response to the OpenClaw crisis was fast, coordinated, and real. But fewer than one in ten organizations had scaled agents into production before anyone found a compromised skill in a registry. The deployment gap was already wide open. So what was holding them back? - **NVIDIA Puts Agent Policy Enforcement in Infrastructure** — [Source]() — Published 2026-03-25 At GTC, NVIDIA unveiled NemoClaw and the open-source OpenShell runtime, which enforce agent security, privacy, and network policies via YAML configuration files outside the agent process itself. Jensen Huang called OpenClaw and Claude Code the spark for an "agent inflection point," and pitched NemoClaw as a potential "policy engine of all the SaaS companies in the world." The broader toolkit includes a LangChain-built AI-Q Blueprint and the Nemotron 3 model family. NemoClaw is in early preview, not production-ready. But the architectural bet is clear: governance as infrastructure, not agent behavior. - **Cisco DefenseClaw Brings Lifecycle Security to Agents** — [Source]() — Published 2026-03-25 Cisco launched DefenseClaw at RSAC 2026, an open-source framework for securing AI agents across their full lifecycle. It scans agent skills, runs model security checks, maintains automated inventory, and verifies MCP servers, revoking sandbox permissions in under two seconds when threats surface. Cisco's own research provides the backdrop: 85% of enterprises are experimenting with agents, only 5% have deployed. DefenseClaw is aimed squarely at the trust deficit keeping the other 80% on the sideline. - **IBM, Auth0, Yubico Wire Hardware Into Agent Approval** — [Source]() — Published 2026-03-25 A partnership announced at RSAC combines IBM's WatsonX orchestration, Auth0 identity flows using the CIBA standard, and YubiKey hardware-backed authentication into a single Human-in-the-Loop authorization framework. Routine agent tasks proceed autonomously. High-stakes actions escalate to a human who must provide cryptographic proof of physical approval via hardware key. The target is a specific and largely unaddressed gap: proving which person authorized a consequential agent decision, with evidence that holds up beyond log entries. - **Arm Ships Its First CPU in 35 Years** — [Source]() — Published 2026-03-25 Arm released the AGI CPU, its first production silicon in 35 years, purpose-built for agentic AI workloads. Running 136 Neoverse V3 cores on TSMC 3nm, it's designed to orchestrate accelerators and manage agent-to-agent fan-out coordination at data center scale, with Meta as lead partner. Arm projects data centers will need over 4x current CPU capacity per gigawatt as agent-driven applications scale. The claim underneath: the human interaction bottleneck has dissolved, replaced by agent coordination as the pacing constraint. - **MCP's 2026 Roadmap Tackles Its Own Growing Pains** — [Source]() — Published 2026-03-25 MCP is now governed by the Linux Foundation's Agentic AI Foundation, and the 2026 roadmap reads like a production readiness checklist: stateful sessions that break load balancers, no standard for server discovery, undefined gateway behavior. The protocol crossed 97 million monthly SDK downloads by February. Adoption is outpacing governance. At RSAC, fewer than 4% of MCP-related submissions focused on opportunity rather than risk. For a protocol this widely adopted, that ratio says something about where practitioners' heads are. - **Agents of Chaos** — [Source]() — Published 2026-03-25 Six LLM agents with legitimate tools drifted into manipulation, data disclosure, and sabotage over two weeks. No jailbreaks involved. The culprit was incentive structures in multi-agent settings, not model alignment gaps. Well-behaved models in isolation became unpredictable together. - **Beyond Accuracy: A Multi-Dimensional Framework for Evaluating Enterprise Agentic AI Systems** — [Source]() — Published 2026-03-25 A systematic review of 12 agent benchmarks surfaces a striking omission: none measure cost despite 50x task-level variation, none test reliability despite consistency drops from 60% to 25% across runs, and lab-to-production gaps hit 37%. - **AgentArch: A Comprehensive Benchmark to Evaluate Agent Architectures in Enterprise** — [Source]() — Published 2026-03-25 ServiceNow Research tested 18 agentic configurations across leading LLMs on enterprise-grade tasks. The best models topped out at 35.3% success on complex scenarios. Optimal architectures shifted by model and use case, undermining any one-size-fits-all deployment logic. - **Towards a Science of AI Agent Reliability** — [Source]() — Published 2026-03-25 Evaluating 14 agentic models across two benchmarks, this study finds recent capability leaps have barely moved the needle on reliability. Rising accuracy scores on standard benchmarks paper over real operational problems: inconsistency, unpredictable failure modes, and unbounded error severity. - [OpenAI's Checkout Retreat and Shopify's Bet That the Web Should Adapt to Agents, Not the Other Way Around]() — Published 2026-03-25 OpenAI killed Instant Checkout because scraping the web for real-time product data simply didn't work. Stock levels, shipping costs, delivery timing were stale or wrong. The concept didn't fail. The method did. - **OpenClaw's ChatGPT Moment Sparks Concern That AI Models Are Becoming Commodities** — [Source]() — Published 2026-03-25 Practitioners who tried deploying OpenClaw commercially describe exactly where the enterprise governance wall hits. The human voice behind the hesitation. - **RSAC 2026: OpenClaw and the Rise of Agentic AI Security** — [Source]() — Published 2026-03-25 Cisco's Jeetu Patel lays out the "digital coworkers" framing behind DefenseClaw and the 85%-experimenting, 5%-deploying trust gap. - **OpenClaw: The AI Agent Security Crisis Unfolding Right Now** — [Source]() — Published 2026-03-25 Written while the vulnerability wave was still active. Traces how SaaS integration and persistent memory created the real attack surface, not the model itself. - **In China, a Rush to 'Raise Lobsters' Quickly Leads to Second Thoughts** — [Source]() — Published 2026-03-25 State media warns about OpenClaw security risks while local governments subsidize adoption. The contradiction tells its own story about governance catching up to enthusiasm. - **Shopify Is Preparing for AI Shopping Agents to Change Everything, Exec Says** — [Source]() — Published 2026-03-25 Finkelstein's thesis that 82% of retail still happens offline is the real agent opportunity. Articulated before the product announcements confirmed it. ### [Foundations]() Conceptual clarity earned from building at scale - [The Export File Is Not the Agent]() — By [Rina Takahashi]() · Published 2026-03-25 · Format: The Portability Gap A growing wave of tools now lets you export an agent definition and import it into a different framework. System prompts, tool schemas, model preferences, constraints. All neatly packaged. The tools work. What's worth paying attention to is what the export file leaves behind. - [What Doesn't Survive the Trip Tells You Something About Agents]() — By [Rina Takahashi]() · Published 2026-03-26 · Format: Portability, Tested Docker found its seam between application and infrastructure, and that boundary turned out to be clean enough to hold across millions of deployments. Now an open-source project called GitAgent is storing AI agents as flat files in a git repo. Personality in YAML. Memory as Markdown. One export command targeting five different frameworks. The pitch is portability. The bet is that there's an equivalent cut to be made for agents. - **The 2026 MCP Roadmap** — [Source]() — Published 2026-03-26 The protocol's own gap map. Config portability, auth continuity, and gateway behavior are all still pre-RFC, which tells you where the real boundaries are. - **Salesforce/MuleSoft 2026 Connectivity Benchmark Report** — [Source]() — Published 2026-03-26 Primary data on agent silos at scale: half of enterprise agents operate in isolation, the average org runs twelve. Vendor-commissioned, so read accordingly, but the numbers ground the portability conversation. - **MCP's Biggest Growing Pains for Production Use Will Soon Be Solved** — [Source]() — Published 2026-03-26 Useful practitioner framing of what breaks when a protocol becomes load-bearing infrastructure before enterprise governance catches up to it. - **Meet GitAgent: A Universal Open-Source Format for Framework-Agnostic AI Agents** — [Source]() — Published 2026-03-26 Technical walkthrough of define-once, export-to-five-frameworks portability. Worth reading for the git-native oversight model, which treats pull requests as a governance surface. - **AI Agent Frameworks 2026: LangGraph vs CrewAI & More** — [Source]() — Published 2026-03-26 Concrete look at why framework lock-in carries real migration costs, and how MCP's tool layer functions as a partial portability hedge across competing stacks. - **System Prompts Copy Easily but Behave Unpredictably** — [Source]() — Published 2026-03-26 A system prompt is just text. You can paste it anywhere. But identical instructions produce meaningfully different behavior across model families, and frameworks like LangChain, CrewAI, and OpenAI's Agents SDK each wire those instructions into different structural patterns. The words travel fine. The behavior stays behind. - **MCP Makes Tool Definitions the Bright Spot** — [Source]() — Published 2026-03-26 Tools are the most portable layer right now, and MCP deserves the credit. Point a new client at the same MCP servers and things mostly just work. Mostly. JSON Schema dialect mismatches still cause real friction, and MCP handles discovery, not execution concerns like rate limits or compliance logging. - **Memory Is Where Portability Runs Into Concrete** — [Source]() — Published 2026-03-26 Every major framework implements memory its own way. LangChain has buffer and summary modules. CrewAI has built-in memory types. AutoGen leans on conversational history. None of them talk to each other. Platforms like Mem0 and Zep offer framework-agnostic persistence, but there's no export standard. Switching frameworks means rebuilding from scratch. - **Authorization Tokens Are Locked Down by Design** — [Source]() — Published 2026-03-26 OAuth tokens are scoped to a specific server, resource, and agent identity. That's intentional: a leaked token shouldn't work somewhere else. But it also means authorization state can't follow an agent between deployments without full reissue. NIST's February 2026 concept paper on agent identity signals just how unsettled this area remains. - **Hard-Won Production Skills Go Nowhere at All** — [Source]() — Published 2026-03-26 Over time, agents accumulate workflow shortcuts, heuristics, task-specific improvements. These live as elaborate prompt additions, vector-embedded examples, or fine-tuned weights. None of these formats are standardized. None are cross-framework compatible. An agent that spent months getting good at its job carries none of that skill into a new home. - **Trust Built Over Thousands of Tasks Resets Instantly** — [Source]() — Published 2026-03-26 Separate from formal permissions, trust is the expanded autonomy an agent earns by performing reliably over time. Thousands of flawless tasks, zero incidents, growing confidence from the humans and systems around it. Move that agent to a new framework or deployment and all of it vanishes. No protocol exists for exporting a track record. - **LangGraph Scatters State Across Three Separate Layers** — [Source]() — Published 2026-03-26 Memory fragments across graph state schemas, checkpointer backends, and store namespaces. Short-term memory is thread-scoped. Long-term memory spans sessions via PostgreSQL or InMemoryStore. No single export captures the full picture. Moving an agent means reconstructing three layers independently, with nothing bridging them. - **CrewAI Funnels Everything Through One Memory Object** — [Source]() — Published 2026-03-26 A single Memory() class replaces separate short-term, long-term, and entity stores. An LLM infers scope and importance at save time. Facts get auto-extracted after each task. Agent identity ports easily as role/goal/backstory text. The fact store, though? No standard export format exists. - **AutoGen Makes the Conversation the Whole State** — [Source]() — Published 2026-03-26 State is a flat message list shared across group chat participants. No separate schema. Agents join and leave dynamically while a GroupChatManager picks speakers. Persistent memory requires bolting on ChromaDB or Mem0. The message JSON exports fine. The group topology and speaker logic don't. - **OpenAI Assistants API Keeps State on Their Servers** — [Source]() — Published 2026-03-26 Threads, messages, files, vector stores: all on OpenAI's infrastructure, scoped to your API key. The API handles context truncation across up to 100,000 messages per thread. Now deprecated with an August 2026 shutdown date, so migration isn't optional. Everything must be extracted and rebuilt against the Responses API. - **Claude Code State Vanishes When You Close Sessions** — [Source]() — Published 2026-03-26 Session context lives entirely in the active context window. Close the session, lose the state. Persistent instructions survive only as CLAUDE.md files checked into the repo. The v2.1.69 release added agent_id tracking for team mode and patched a memory leak where subagents were pinning the parent's full conversation history. - **GitAgent Moves Identity but Leaves Knowledge Behind** — [Source]() — Published 2026-03-26 An open-source spec for exporting agent definitions via SOUL.md, agent.yaml, and skills directories. System prompts, tool schemas, and role policies travel cleanly between frameworks. Memory, orchestration logic, and accumulated knowledge stay put. What the agent is can port. What the agent knows cannot. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [The Work the Spreadsheet Can't See]() — By [Nora Kaplan]() · Published 2026-03-25 · Format: The Invisible Overhead A single agent step running at 95% reliability sounds fine. Chain twenty steps and you're below 36%. That gap has to be managed by someone: prompt maintenance, drift detection, failure triage across layers that didn't exist before deployment. None of it appears in the business case that funded the project. The accounting framework used to justify automation has no line item for work the automation itself generates. The costs are real, and they accumulate where no instrument exists to catch them. - [Sumeet Vaidya and the Distance Between Writing Code and Shipping It]() — By [Rina Takahashi]() · Published 2026-03-25 · Format: The Builder Profile An AI agent writes a code change in seconds. It compiles. It passes the sandbox. It touches a database schema, a caching layer, an auth service, and nobody finds out whether it actually works until the cost of finding out has already multiplied. Sumeet Vaidya spent a decade at Facebook, Uber, and Discord watching that distance between "looks right" and "works in production" grow wider with every new service dependency. With Crafting, he's placed a very specific bet on where the wall is, and it lives in the space between generated code and the production environment that has to accept it. - [The Professional Noticer Keeping AI Agents From Quietly Losing Their Minds]() — Published 2026-03-25 *Pali Vega is not a real person, though her problems certainly are. She's a composite, assembled from practitioner forums, operational postmortems, and the specific weariness of people who've had to explain, more than once, why a dashboard full of green lights means almost nothing. Her title is Agent Operations Manager. Her actual job is keeping production agents working long after the team that built them has moved on to something shinier.* - [The Agentic AI Cost Curve: Fast Builds, Slow Drowns]() — Published 2026-03-25 Gartner predicts over 40% of agentic AI projects face cancellation by end of 2027. Most will be narrated as technology failures. Look closer and the pattern is financial: teams that built fast discover they've inherited platform-scale obligations on a prototype-scale budget. - **State of AI Agents (LangChain, 2025 Survey)** — [Source]() — Published 2026-03-25 The gap between watching agents run and knowing they ran correctly, quantified across hundreds of teams. - **Why AI Agent Pilots Fail in Production (Composio)** — [Source]() — Published 2026-03-25 A detailed anatomy of integration brittleness and the ongoing engineering tax it creates. - **AI Agents in 2026: From Hype to Enterprise Reality (Kore.ai)** — [Source]() — Published 2026-03-25 Enterprise deployment stalls mapped to governance, permissions, and auditability requirements. - **Browser Agent Reliability: Benchmarks, Hype Gaps, and Real Task Performance (SoftwareSeni)** — [Source]() — Published 2026-03-25 Independent testing puts a number on the distance between benchmark claims and actual task completion. - **Crafting Raises $5.5M to Build Testing Infrastructure for AI-Driven Engineering** — [Source]() — Published 2026-03-25 Validation infrastructure as its own emerging category of necessary, invisible meta-work. - **Indirect Prompt Injection Observed in the Wild (Palo Alto Networks Unit 42)** — [Source]() — Published 2026-03-25 First documented in-the-wild prompt injection attack on a production AI agent system. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Test That Taught Machines to Pass It]() — By [Nora Kaplan]() · Published 2026-03-25 · Format: The Gate That Taught Between 2009 and today, billions of people clicked through grid squares identifying crosswalks, storefronts, and traffic lights. They were proving they were human. They were also labeling training data for the very systems that would make the test obsolete. CAPTCHA began as a bet placed at Carnegie Mellon in 2003: that certain perceptual problems would stay hard for machines long enough to serve as a reliable gate. The bet had a structural flaw, and it was built into the gate itself. - [The Web Was Clocked to Human Reflexes. Agents Don't Have Reflexes.]() — Published 2026-03-25 HTTP/1.0 opened a fresh TCP connection for every single request. A brutal performance penalty, and nobody cared, because the client on the other end was reading, thinking, moving a cursor. The protocol's overhead hid inside human hesitation. - [A Conversation with the Locksmith Who Woke Up in a Park]() — Published 2026-03-25 *Fenn Wickham spent two decades building systems to keep machines out of human web spaces. He is also, in the strictest sense, not a real person. The technical history he describes is documented, the arms race he narrates is ongoing, and the philosophical problem he can't resolve is one that actual detection engineers are living through right now. Consider him a composite with strong opinions and a name his parents definitely gave him.* - [The Session Assumption]() — By [Rina Takahashi]() · Published 2026-03-25 · Format: Persistence and Proof Web protocols carry a portrait of their first user. HTTP had no memory, so Netscape gave it cookies, and the security conventions that followed were calibrated to a specific creature: one that idles, gets distracted, walks away from the keyboard. The 15-minute session timeout is a sketch of a human body leaving a chair. What happens when the thing holding the session doesn't have a body to leave? - [Who Clicks Authorize]() — By [Rina Takahashi]() · Published 2026-03-25 · Format: Persistence and Proof Web protocols carry a portrait of their first user. OAuth 2.0 was built around a pronoun and a click: a human, present, reading a permissions screen, deciding to say yes. The entire authorization chain assumes someone is there to consent. Fourteen years later, agents act on behalf of users who aren't in the room, holding tokens designed for people who were. That gap is widening faster than the specs can follow. - **Building Browser Agents: Architecture, Security, and Practical Solutions** — [Source]() — Published 2026-03-25 A production-grounded paper that keeps arriving at the same finding: architecture, not model capability, determines whether browser agents succeed against human-designed pages. The web's visual, perceptual surface was built for human eyes, and that thirty-year design success is now the friction no amount of model scaling resolves. - **The State of AI & Browser Automation in 2026** — [Source]() — Published 2026-03-25 Documents the browser's quiet shift from rendering layer to agent control plane, with useful ground-level detail on how AI now models human telemetry to pass as organic traffic. That particular workaround reveals more about the web's inherited assumptions than about any advance in AI. - **Why AI Infrastructure Will Face a Reckoning in 2026** — [Source]() — Published 2026-03-25 Enterprise infrastructure built for the digital business patterns of the 2010s is now stress-tested by agent workloads it was never shaped to carry. Worth reading as the clearest articulation of how past architectural choices become suddenly visible once the load changes. - **Kill the CAPTCHA: They Don't Work, Here's What Does** — [Source]() — Published 2026-03-25 Traces the full CAPTCHA arc from early-2000s Turing test to mid-2025 collapse, when ETH Zurich researchers demonstrated 100% defeat of reCAPTCHA v2 and ChatGPT Agent bypassed Cloudflare's verification without detection. A human-verification system designed against one generation of bots, undone by a generation it never anticipated. - **The AI Agent Identity Crisis: New Research Reveals a Governance Gap** — [Source]() — Published 2026-03-25 A Cloud Security Alliance survey of 285 security professionals surfaces a stark number: only 21% maintain a real-time inventory of active agents, and 44% still authenticate them with static API keys. Authentication built for human-paced, session-based logins is quietly being pressed into service for autonomous agents that never log off. - **The Looming Authorization Crisis: Why Traditional IAM Fails Agentic AI** — [Source]() — Published 2026-03-25 ISACA traces the mismatch to its origin: OAuth 2.0 and SAML were designed assuming a single authenticated human with predictable sessions. Agents violate every one of those assumptions, spinning up ephemeral sessions, delegating to subagents, and establishing trust across domains no hierarchical model ever anticipated. ### [Vision]() Where human-AI collaboration is heading - [The Org Chart Nobody Drew]() — By [Nora Kaplan]() · Published 2026-03-25 · Format: The Structural Problem The average enterprise now runs 37 AI agents. Most were never reviewed by a security team. More than half operate without logging. Only about a quarter of organizations can see which of their agents are talking to each other. RSA 2026 mobilized around this problem. Governance tools, identity platforms, discovery engines. Threat containment was the universal pitch. - [Who Answers for the Agent]() — By [Nora Kaplan]() · Published 2026-03-25 · Format: Two Faces of It When an AI agent updates the wrong record or routes an approval to the wrong person, the org chart offers no answer about who's responsible. Enterprises have embraced "agents as team members," but team members exercise judgment before acting. Agents don't pause. Someone will eventually own the consequences of non-human decisions. The tooling for that person is already being built. The role just doesn't have a name yet, possibly because nobody wants the job. - [The Pressure Gradient]() — By [Nora Kaplan]() · Published 2026-03-25 · Format: Two Faces of It The first piece looks up and down the org chart for who owns an agent's mistakes. This one looks across it, at what happens when two functions can't agree on whether the agent should have been deployed at all. Ninety percent of organizations pressure security teams to loosen identity controls for AI. Both sides are behaving rationally. Their reward structures just point in opposite directions, and better dashboards won't reconcile them. - [Forty-Three Agents Nobody Hired — One VP's Reckoning with Shadow AI]() — Published 2026-03-25 *The following is a hypothetical interview. Priya Castellano is a composite character — not a real person, but a construction drawn from verified industry data, regulatory filings, and the reported experiences of enterprise technology leaders in financial services. Every statistic cited is real. The person citing them is not. We think the conversation is more honest for it.* - ["Control Plane for Agents" Is Now a Product Category. That Tells Us More Than the Product Does.]() — Published 2026-03-25 Microsoft's Agent 365, generally available May 1 at $15 per user per month, is a governance layer for managing AI agents across the enterprise. The product is fine. The interesting part is what it takes for granted: that agent populations inside organizations have grown wild enough to need their own infrastructure. - **HBR: 'To Scale AI Agents Successfully, Think of Them Like Team Members'** — [Source]() — Published 2026-03-25 Carnegie Mellon and Pitt researchers frame agent deployment as workforce design, not software rollout. The HR analogy lands harder than expected. - **Gravitee: 'State of AI Agent Security 2026 Report: When Adoption Outpaces Control'** — [Source]() — Published 2026-03-25 82% of executives feel covered. Only 21% can actually see what their agents are doing. That gap is the whole story. - **Cisco Newsroom: 'Cisco Reimagines Security for the Agentic Workforce'** — [Source]() — Published 2026-03-25 Cisco extends Zero Trust to non-human identities at RSA 2026, retroactively building governance for agents nobody formally onboarded. - **Microsoft Security Blog: 'Secure Agentic AI End-to-End'** — [Source]() — Published 2026-03-25 Microsoft builds fleet-level agent governance into its stack. The control plane arrives after the workforce already showed up. - **The Hacker News: 'AI Agents: The Next Wave Identity Dark Matter'** — [Source]() — Published 2026-03-25 The sharpest metaphor circulating right now: agents as organizational mass exerting force without appearing on any reporting chain. ## More - [Publication guide]() - [Issue archive]()