--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/26/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/26/foundations" issue: 26 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Rina Takahashi"] published: 2026-04-27 updated: 2026-04-23 articles: 18 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 26 — Foundations Conceptual clarity earned from building at scale ### The Conceptual Anchor - [Why Agent Infrastructure Starts Empty]() — By [Rina Takahashi]() · Published 2026-04-22 · Format: The Conceptual Anchor In a single week this April, Google, AWS, Cloudflare, and CIS independently shipped agent infrastructure built around the same architectural choice. None coordinated. All converged. At the same time, roughly 200,000 MCP servers sat exposed to arbitrary code execution — and the protocol's creator called it "expected behavior." Cloud infrastructure has followed the same sequence for nearly two decades: provision compute, then figure out security. Agent workloads appear to have broken that sequence. What replaced it is a different starting point entirely. ### The Practical Lens - [What Happens When the Sandbox Costs More Than the Work Inside It]() — By [Rina Takahashi]() · Published 2026-04-22 · Format: The Practical Lens A container takes hundreds of milliseconds to start and hundreds of megabytes to hold. For a web service that runs for weeks, nobody notices. But Cloudflare's rough math puts the near-term agent future at 24 million simultaneous sessions, each spawning streams of isolated tasks that live for a few milliseconds and die. At that cadence, spinning up the execution environment takes longer than the work inside it. ### Further Reading - **Cloudflare Ships Dynamic Workers with Deny-by-Default Capability Model** — [Source]() — Published 2026-04-22 Agents start with zero authority and earn capabilities through explicit grants. The permission inversion, explained. - **Google Brings gVisor Kernel Isolation to Agent Workloads via GKE Agent Sandbox** — [Source]() — Published 2026-04-22 The same isolation layer securing Gemini, now generally available. Containment reframed as a throughput problem. - **CIS Publishes First Security Controls Framework for MCP Deployments** — [Source]() — Published 2026-04-22 Maps CIS Controls v8.1 to agent protocol surfaces. The first governance framework treating sandboxing as a named requirement. - **OX Security Finds Architecture-Level RCE Across the MCP Supply Chain** — [Source]() — Published 2026-04-22 Critical vulnerability spanning 150M+ downloads. Anthropic called it "expected behavior." The recommended fix: sandbox everything. - **AWS AgentCore Browser Adds OS-Level Interaction Inside Firecracker MicroVM Boundaries** — [Source]() — Published 2026-04-22 Mouse, keyboard, and screenshot access beyond CDP. Tighter isolation enabling broader capability, not restricting it. ### Isolation Landscape Three major cloud providers shipped agent sandboxing within weeks of each other, and they arrived at remarkably different answers. Cloudflare went light and fast with V8 isolates. Google intercepted system calls with gVisor. AWS went heavy, pairing Firecracker microVMs with persistent filesystems. Google also hedged by adding a protocol-layer gateway that contains behavior instead of compute. Each approach encodes a different bet about where the actual risk lives. These cards map the five positions in play today, from the lightest isolation to the sobering default: no containment at all. - **Cloudflare's Isolates Trade Depth for Raw Speed** — [Source]() — Published 2026-04-22 Tag: V8 Isolates Dynamic Workers spin up V8 isolates in milliseconds with megabyte-scale memory footprints. A second-layer sandbox adds hardware memory protection keys against escape. Extremely fast, extremely cheap. But if your agent needs shell access or compiled binaries, you're shopping for a different product. - **Google gVisor Catches System Calls Before the OS** — [Source]() — Published 2026-04-22 Tag: Kernel Intercept GKE Agent Sandbox runs gVisor's user-space kernel, intercepting every system call before it touches the host. Pre-warmed pools provision 300 sandboxes per second. Strong isolation, real speed. The blind spot: a prompt-injected agent holding valid IAM permissions walks right through. - **AWS AgentCore Gives Agents a Filesystem That Persists** — [Source]() — Published 2026-04-22 Tag: Durable MicroVMs Each session gets its own Firecracker microVM with KVM-level hardware isolation. The real differentiator: durable filesystem storage lets agents suspend mid-task and resume with files, packages, and git history intact. Sessions run up to eight hours with full shell access. You pay for the weight. - **Google Agent Gateway Polices Behavior, Not Infrastructure** — [Source]() — Published 2026-04-22 Tag: Protocol Gateway Agent Gateway inspects MCP and A2A interactions at the protocol layer, enforcing access rules before requests reach tools. It governs what agents do rather than where they run. Worth noting: attribute-based authorization currently covers MCP traffic only. Everything else passes uninspected. - **MCP's Default Transport Trusts Everything by Design** — [Source]() — Published 2026-04-22 Tag: No Containment The baseline when nobody adds sandboxing. OX Security audited 200,000 active MCP servers across 150 million downloads and surfaced ten-plus critical CVEs. Nine of eleven tested registries were compromised. Anthropic's response: the behavior is "expected." That's the floor you're building on. ### What Shipped Three cloud providers and a standards body shipped containment products in the same week. The pattern is worth noticing. Each release draws a perimeter around some slice of agent behavior: code execution, protocol traffic, browser actions, tool permissions. And each perimeter has a telling gap on the other side. What nobody shipped: anything that evaluates whether a sequence of individually-permitted actions adds up to something no one actually authorized. The walls are going up fast. What moves between them remains an open question. Here's what landed, what each release governs, and where its authority stops. - **Google Launches gVisor Sandboxes for Agent Code** — [Source]() — Published 2026-04-22 Tag: Agent Sandbox GKE Agent Sandbox spins up 300 isolated pods per second, each with its own kernel, network stack, and file system via gVisor. Per-task code execution gets a tight perimeter. Agent-to-agent communication, where orchestration risks actually compound, gets nothing. - **Google Agent Gateway Polices Protocol Traffic Between Agents** — [Source]() — Published 2026-04-22 Tag: Agent Gateway Agent Gateway sits between agents and tools, mediating MCP, A2A, REST, and gRPC with centralized access policies, mTLS, and Model Armor for prompt-injection defense. Fine-grained policy conditions only work for MCP today. What an agent reasons about or remembers? Still ungoverned territory. - **Cloudflare Dynamic Workers Execute Agent Code Instantly** — [Source]() — Published 2026-04-22 Tag: Dynamic Workers V8 isolates let Dynamic Workers run AI-generated code in milliseconds with minimal memory overhead, roughly 100x faster than containers. The trade-off is architectural: isolates are stateless by design. Per-task execution gets a boundary. Persistent state across sessions lives somewhere else entirely. - **Cloudflare Browser Run Adds Real-Time Human Oversight** — [Source]() — Published 2026-04-22 Tag: Browser Run Browser Rendering gets a new name and new capabilities: Live View, Human in the Loop handoff, and 120 concurrent sessions. A human can watch and intervene while an agent operates a browser. Everything the agent does before opening or after closing that tab falls completely outside the boundary. - **AWS AgentCore Policy Enforces Per-Call Tool Rules** — [Source]() — Published 2026-04-22 Tag: AgentCore Policy Natural-language rules get compiled into Cedar policies and enforced at the gateway, independent of agent code or model. Identity-aware, per-call tool permissions are real progress. The structural gap: each action is evaluated alone. A sequence of five permitted actions that collectively cause harm goes undetected. - **CIS Publishes First Cross-Industry MCP Security Guide** — [Source]() — Published 2026-04-22 Tag: Security Guidance The CIS MCP Companion Guide maps Critical Security Controls onto MCP deployments, recommending sandboxed services and treating external configuration as untrusted input. Solid operational hardening for practitioners. But it can only advise around protocol-level defaults that Anthropic has explicitly declined to change. ## Other sections in Issue 26 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()