--- title: "Issue 27" canonical: "https://current.tinyfish.ai/issue/27" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/27" issue: 27 description: "Agents are opening bank accounts, poisoning competitor pricing, and crawling twenty thousand pages per referral returned. We're defending the wrong layer." authors: ["Sable Whitford","Nora Kaplan","Rina Takahashi"] published: 2026-05-04 updated: 2026-11-05 articles: 84 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 27 Agents are opening bank accounts, poisoning competitor pricing, and crawling twenty thousand pages per referral returned. We're defending the wrong layer. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [Where the Dependency Forms]() — By [Nora Kaplan]() · Published 2026-04-29 · Format: The Runtime Layer When AWS customers reportedly greeted OpenAI's arrival on Bedrock with a shrug, the obvious read was that OpenAI had lost its edge. These were teams that had spent years building production systems on Claude, Llama, Mistral. They'd learned that models swap out in an afternoon. - **AWS Turns Its Contact Center Into Four Agent Suites** — [Source]() — Published 2026-04-29 Amazon Connect quietly grew from a single contact-center product into four agentic AI solutions covering supply chains, hiring, healthcare, and CX. AWS is now building first-party agent applications on its own runtime, drawing on Amazon's actual logistics, hiring, and clinical workflows. These aren't demos. They're operational lineage turned into product. - **Adobe Decomposes Its Platform Into Agent Infrastructure** — [Source]() — Published 2026-04-29 Adobe CX Enterprise replaces Experience Cloud with an agent-first architecture, exposing MCP servers and agentic skills to external orchestrators. Adobe's customer is now also any agent that needs its data and decisioning capabilities. Partnerships span AWS, Anthropic, Google Cloud, Microsoft, and OpenAI. Coherent strategy, though adoption timelines remain open. - **NTT DATA Deploys Multi-Agent Enterprise Infrastructure Management** — [Source]() — Published 2026-04-29 NTT DATA's SDI Services Agent orchestrates specialized agents across networking, data centers, cybersecurity, and workplace environments. The design choice worth noting: agents reason through live telemetry and policy guardrails to take deterministic action across multivendor estates. They act on problems, not just surface alerts for humans to triage. - **Kyndryl Names the Enterprise Agentic Infrastructure Gap** — [Source]() — Published 2026-04-29 The world's largest IT infrastructure services provider launched a maturity model and implementation blueprints built around a blunt admission: today's enterprise environments cannot reliably support agentic AI. Their own research finds nearly half of organizations investing heavily in AI struggle to achieve meaningful returns. The diagnostic is more interesting than the product. You cannot scale agentic workflows atop manual operating models. - **Cloudflare and GoDaddy Propose Open Agent Identity** — [Source]() — Published 2026-04-29 Two companies with enormous structural web coverage are jointly proposing identity standards for an agentic internet. Cloudflare proxies roughly 20% of websites; GoDaddy hosts millions more. Their Agent Name Service provides DNS-like verification for agents, while Web Bot Auth adds cryptographic signatures. The ambition goes well beyond blocking bots. They want agents to transact as verified participants. - **TrajAD: Trajectory Anomaly Detection for Trustworthy LLM Agents** — [Source]() — Published 2026-04-29 A fine-tuned Qwen3-4B verifier that detects and pinpoints procedural errors mid-trajectory, enabling surgical rollback-and-retry instead of restarting entire tasks. Includes TrajBench, the first dataset built specifically for trajectory anomaly localization. - **TriCEGAR: A Trace-Driven Abstraction Mechanism for Agentic AI** — [Source]() — Published 2026-04-29 Learns formal state abstractions directly from agent execution traces using predicate trees and counterexample-guided refinement. Constructs a behavioral MDP online for probabilistic model checking, removing the manual state definitions that have kept formal verification out of production. - **Benchmarking Agents in Insurance Underwriting Environments** — [Source]() — Published 2026-04-29 Snorkel AI and credentialed underwriters built a multi-turn benchmark testing 13 frontier models against real enterprise friction: noisy tools, proprietary domain knowledge, imperfect simulated users. Pass^k evaluation exposes up to 20% performance degradation from research scores to production conditions. - **Ontology-Constrained Neural Reasoning in Enterprise Agentic Systems** — [Source]() — Published 2026-04-29 Formal ontologies constrain LLM reasoning at the input level across role, domain, and interaction layers. Tested across 600 runs in five regulated industries, the architecture reveals an "inverse parametric knowledge effect": ontological grounding helps most where model knowledge is thinnest. - [Visa's Intelligent Commerce Connect Positions the Payment Rail as Persistent Agent Infrastructure]() — Published 2026-04-29 Visa's Intelligent Commerce Connect, announced April 8, supports four agent payment protocols through a single integration point and accepts non-Visa cards. The openness is genuine. But the structural parallel to cloud runtimes is worth sitting with. Both layers advertise protocol agnosticism while quietly accumulating state that agents depend on: tokenized credentials and spend controls for Visa, task context and governance logs for cloud providers. - **An Interview with OpenAI CEO Sam Altman and AWS CEO Matt Garman About Bedrock Managed Agents** — [Source]() — Published 2026-04-29 Altman and Garman on record together, and the most revealing thread is how naturally both frame the model as table stakes and the harness as the product. - **OpenAI Models, Codex, and Managed Agents Come to AWS** — [Source]() — Published 2026-04-29 OpenAI's own announcement is worth reading for what it emphasizes: deployment, orchestration, and governance get top billing, while model capabilities barely register. - **Introducing Gemini Enterprise Agent Platform** — [Source]() — Published 2026-04-29 Google's full architectural blueprint for the rebrand, laying out Studio, Gateway, Registry, Identity, and Observability as a unified stack that quietly retires standalone Vertex AI. - **OpenAI Jumps Out of Microsoft's Bed, into Amazon's Bedrock** — [Source]() — Published 2026-04-29 The Register makes a persuasive case that the revised Microsoft exclusivity terms turn this into a repeatable playbook, not a one-time defection. - **Inside the AI Index: 12 Takeaways from the 2026 Report** — [Source]() — Published 2026-04-29 Stanford's own summary of the 2026 AI Index, where the China parity finding (U.S. leads by just 2.7%) and the consumer trust collapse data land hardest. - **Cloudflare and GoDaddy Partner to Help Enable an Open Agentic Web** — [Source]() — Published 2026-04-29 The primary source on the ANS standard, which goes well beyond bot-blocking into cryptographic identity and payment signaling for agent-to-site interactions. ### [Foundations]() Conceptual clarity earned from building at scale - [The Routing Decision Nobody Governs]() — By [Nora Kaplan]() · Published 2026-04-29 · Format: The Governance Gap Every major agent tracing framework records four identity attributes: description, ID, name, version. None of them include which model is actually reasoning. In production architectures where a planning step runs on one model and execution routes to another, the trace can tell you what happened. It cannot tell you who decided. - [Who Decides Which Model Handles What]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: Routing In Practice When a multi-model agent workflow fires off a request, something picks which model handles it. A developer binding a provider in code. A gateway applying fallback rules. A default nobody remembers setting. Most teams treat this as plumbing and move on. - **Stanford HAI 2026 AI Index: Technical Performance** — [Source]() — Published 2026-04-29 The primary-source benchmark data showing why no single model dominates across tasks, and why the gaps between capabilities are widening, not narrowing. - **New LLM Releases: April 2026** — [Source]() — Published 2026-04-29 The most complete record of what actually shipped this month. The 50x price spread within a single provider's catalog tells you more about the multi-model future than any strategy deck. - **2026 MCP Roadmap** — [Source]() — Published 2026-04-29 Auth, audit trails, gateway behavior: MCP's own roadmap names the enterprise gaps that compound every time you route a request through a different model. - **Work Moved Into the Browser. Security Didn't Follow.** — [Source]() — Published 2026-04-29 The core insight here applies well beyond browsers: when attribution no longer implies agency, session identity in multi-model pipelines becomes structurally ambiguous. - **Best Multi-Agent Frameworks in 2026** — [Source]() — Published 2026-04-29 A useful survey of which frameworks actually let you swap models at the agent level versus which ones quietly lock you to a single provider's SDK. - **Agent Observability 2026: Evals, Traces, and Cost Attribution** — [Source]() — Published 2026-04-29 Traces fragment at model boundaries. This piece compares the tooling options for cost and latency analysis when a single request touches multiple providers. - **Claude Opus 4.7 Sets the Coding Ceiling** — [Source]() — Published 2026-04-29 87.6% on SWE-bench Verified, up from 80.8% on its predecessor. At $5/$25 per million tokens, it's priced as a premium specialist. One wrinkle worth budgeting for: a tokenizer change inflates input token counts by up to 35%. - **Ten Million Tokens Rewrites the Retrieval Math** — [Source]() — Published 2026-04-29 Llama 4 Scout offers a 10M-token window starting at $0.08 per million input tokens. Gemini 2.5 Pro hits 91.5% on long-context comprehension at 128K. Both shrink the need for chunked retrieval, though "lost in the middle" problems grow with the window. - **Qwen 3 Stretches to 119 Languages Natively** — [Source]() — Published 2026-04-29 Expanded from 29 to 119 languages (Qwen 3.6 reaches 201). Its thinking-budget control lets agents vary reasoning depth per subtask, handy when deep translation precedes structured extraction. Open-weighted under Apache 2.0, so you can actually inspect what you're deploying. - **Mistral Medium 3 Makes Agent Loops Affordable** — [Source]() — Published 2026-04-29 $0.40 input, $2.00 output per million tokens. Roughly a quarter of what Opus 4.7 costs. Mistral claims performance within 90% of Sonnet 3.7, though independent verification is still catching up. Treat that number as directional, not settled. - **Local Models Cross the Agent-Ready Latency Threshold** — [Source]() — Published 2026-04-29 Ollama crossed 52 million monthly downloads in Q1 2026. Sparse models like Qwen3-Coder-Next activate 3B of 80B parameters, hitting 40–60 tokens/second on a 16GB laptop. Gemma 4 adds native function calling. The practical play is hybrid: local for speed, API for ceiling. - **Strength in One Category Predicts Nothing Elsewhere** — [Source]() — Published 2026-04-29 Opus 4.7 scores 87.6% on SWE-bench Verified but drops to 64.3% on SWE-bench Pro. Gemini leads long-context benchmarks and trails on coding. April 2026 has enough model density to route across specialists. The landscape rewards orchestration over allegiance. - **Microsoft's Six Providers Hide Behind One Preview Tool** — [Source]() — Published 2026-04-29 Version 1.0 connects Azure OpenAI, OpenAI, Anthropic, Bedrock, Gemini, and Ollama. Mixing providers across agents in a single workflow takes one line of config. Seeing what actually happened requires DevUI, still in preview. Full cost attribution needs Azure infrastructure underneath. The on-ramp is wide open; the rearview mirror is fogged. - **LangGraph Locks Model Choices Into Compiled Paths** — [Source]() — Published 2026-04-29 Any Python function becomes a node, any provider can power it, and conditional edges route execution based on state. Once compiled, though, the graph is frozen. LangSmith traces surface provider metadata per run, which is genuinely useful. Cross-model cost attribution? That's your problem. Manual instrumentation, operator by operator. - **CrewAI Exposes Model Choice, Keeps Delegation Opaque** — [Source]() — Published 2026-04-29 Each agent takes an explicit llm parameter. Hierarchical crews get a separate manager_llm setting. Clean so far. But how that manager actually delegates work is framework-internal, not operator-configurable. Cross-model tracing in open-source requires bolting on separate instrumentation per provider. Unified visibility lives behind the Enterprise paywall. - **Google Shows Everything, Lets You Configure Less** — [Source]() — Published 2026-04-29 The Gemini Enterprise Agent Platform ships the richest native observability of the group: DAG traces, topology graphs, OTel-compliant telemetry, live evaluation scoring, and access to 200+ models via Model Garden. Impressive instrumentation. Yet Agent Memory Bank documentation is silent on what happens when different models write entries to the same identity-scoped store. The platform can tell you what occurred. Whether the memory is coherent is a question it doesn't surface. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [The Wrong Layer]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: The Wrong Layer A single-pixel font. An instruction buried in an HTML comment. CSS that hides a payload from every human eye but leaves it fully legible to any agent parsing the source. Google's latest scan of billions of crawled pages found these attacks growing 32% in three months. The manipulation happens before the model ever touches the input. - [The Web Wasn't Built for This]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: Builder Profile Five days from prototype to Hacker News post. Eighty-one thousand GitHub stars and a $17M seed round followed. By every visible metric, Browser Use looks like a solved problem. Their own benchmark says otherwise: after purpose-built models and a compressed action vocabulary engineered against the live web, roughly one in six tasks still fails. That gap is the story. What happens when you try to build a negotiation layer between language models and a web that was never designed to be read by machines. - [The Dropdown That Doesn't Exist Yet]() — Published 2026-04-29 *Paloma "Pally" Voss is a composite character. Her employer, her specific situation, and her fondness for weather metaphors are all fictional. The failure mode she describes is not.* - [WebMCP: A W3C Standard That Admits the Browser-Agent Model Is Broken]() — Published 2026-04-29 Google's WebMCP proposal replaces the screenshot-parse-click loop with structured tool contracts. Sites declare capabilities through the navigator.modelContext API, complete with schemas, parameters, and browser-enforced permissions. Agents stop guessing which button means "Buy Now" by squinting at raw HTML. - **Indirect Prompt Injection Is Taking Hold in the Wild** — [Source]() — Published 2026-04-29 Google and Forcepoint independently document IPI attacks with real fraud payloads and organized tooling. The shift from proof-of-concept to commodity exploit happened faster than most threat models assumed. - **Continuously Hardening ChatGPT Atlas Against Prompt Injection Attacks** — [Source]() — Published 2026-04-29 OpenAI's most candid admission that prompt injection resists model-level solutions. The RL attacker methodology is worth close reading: it reveals what "hardening" actually means when the vulnerability is structural. - **Gartner Says AI Projects in Infrastructure and Operations Stall Ahead of Meaningful ROI** — [Source]() — Published 2026-04-29 A 28% full-success rate across 782 I&O leaders, with failures clustering in autonomous workflow categories. The number that matters is the gap between "deployed" and "delivering value," which Gartner sizes but doesn't fully explain. - **Beyond pass@1: A Reliability Science Framework for Long-Horizon LLM Agents** — [Source]() — Published 2026-04-29 Proposes four metrics for what benchmarks systematically miss: how agent reliability degrades as task duration increases. If you've watched an agent succeed at step-level evals and fail at workflow-level execution, this paper names the mechanism. - **Mitigating the Risk of Prompt Injections in Browser Use** — [Source]() — Published 2026-04-29 Anthropic's multi-layer browser defense architecture is thorough and well-documented. The real takeaway lives in the residual 1.4% attack success rate, which quantifies the floor that layered defenses can reach but not break through. - **AI Is Hitting Operational Limits as Companies Rush to Scale** — [Source]() — Published 2026-04-29 Datadog's production instrumentation data finds 60% of AI failures trace to capacity and infrastructure limits, not model errors. Useful evidence for anyone arguing that the bottleneck has migrated below the model layer. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Bargain That Held for Thirty Years]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: The Sign in the Forest In 1994, a science fiction novelist's web crawler kept crashing someone's server. The fix was a plain text file asking automated visitors to stay off certain pages. That file, robots.txt, held for thirty years, because obeying it paid. - [20,583 Pages Per Referral: What the Crawl-to-Click Ratio Actually Looks Like Now]() — Published 2026-04-29 Googlebot crawls roughly five pages for every visitor it sends back. That ratio held for two decades. It was the deal. - [The Man Who Put a Sign on the Internet]() — Published 2026-04-29 *This conversation is imagined. Martijn Koster is very real — a Dutch software engineer who created robots.txt in 1994 and, by most accounts, the internet's first search engine. His actual words, where they exist in the public record, are cited. Everything else is constructed from what's known about his perspective, his temperament, and the dry pragmatism that runs through three decades of his public writing. He did not participate in this interview, has not endorsed it, and would probably find the whole exercise slightly odd.* - [The Invisible Agent]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: Blind Spots and Inherited Frames Robots.txt governs web crawling through one mechanism: matching a text label that automated visitors voluntarily attach to themselves. For thirty years, crawlers wore that label because they needed to. The AI agents arriving now don't crawl. They open real browsers, render pages, click through interfaces. They carry the same user-agent string as the person who launched them. The protocol that governs automated access to the web literally cannot see what's visiting. - [The Successor Trap]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: Blind Spots and Inherited Frames When robots.txt stopped working, replacements arrived fast. Llms.txt, ai.txt, Google's WebMCP — each citing robots.txt as ancestor, each proposing better signals and finer permissions. But the companies building browser-based agents benefit commercially from accessing content freely. The sites trying to restrict access are the ones whose content feeds those agents. That's a conflict of interest. And the new standards may have inherited exactly the framing that keeps it invisible. - **Cloudflare Radar Data Reveals the Real Economics of AI Crawling** — [Source]() — Published 2026-04-29 The numbers behind the broken bargain. - **Rethinking robots.txt: Why Successor Standards Haven't Arrived Yet** — [Source]() — Published 2026-04-29 A clear map of what's been proposed and what hasn't stuck. - **Internet Governance in 2026: When Authority Moves Upstream of Consensus** — [Source]() — Published 2026-04-29 The macro context for why voluntary norms are losing ground. - **Is Chrome the New Internet Explorer? The Chokepoint Mechanism That's Harder to Reverse** — [Source]() — Published 2026-04-29 Same structural concentration, opposite mechanism, harder to contest. - **Cloudflare Acknowledges the Symbiosis Is Over** — [Source]() — Published 2026-04-29 The infrastructure layer confirms what publishers already knew. ### [Vision]() Where human-AI collaboration is heading - [The Scaffolding Nobody Voted On]() — By [Nora Kaplan]() · Published 2026-04-29 · Format: The Core Reframe Somewhere in Cloudflare's infrastructure, an AI agent now carries a $100 monthly credit limit. It can open accounts, start paid subscriptions, deploy code. No human signs off on the individual purchase. - [The Liability Vacuum]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: What Breaks Next AI agents can browse stores, compare prices, and complete purchases on behalf of users. A federal court just ruled they may have no legal right to do any of it. The infrastructure for agent commerce is deploying now; the accountability framework that should govern it is still a draft. Legal systems have absorbed strange new economic actors before. The absorptions tend to be ugly, and the gap before they arrive is where the exposure lives. - [The Platform Without an Audience]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: What Breaks Next Agents are becoming commercial actors, but the platforms where they spend money were built for a different kind of customer. One with eyes, attention, and a susceptibility to advertising. Agentic browser traffic is growing at rates that make the shift feel abstract until you look at what it breaks: loyalty programs, recommendation engines, ad placements, the entire logic of the commercial web. What does a platform sell when nobody's watching the storefront? - [Running a Hotel Where Most of the Guests Are Thermostats]() — Published 2026-04-29 *Bex Halyard is a fictional character, a composite built from real operational patterns emerging at cloud infrastructure companies navigating the shift to agent customers. She does not exist, has never existed, and would like you to know she's fine with that, since most of her customers don't exist in the traditional sense either. Her title is VP of Customer Operations at a mid-size cloud infrastructure provider she'd prefer we not name.* - [ERC-8004 Went Live in January. The Identity Layer for Non-Human Actors Is Being Built on Public Rails.]() — Published 2026-04-29 In January, Google, Coinbase, MetaMask, and the Ethereum Foundation shipped a shared answer to a question that enterprise infrastructure has been circling for years: how does an autonomous agent prove who it is to a stranger? ERC-8004 provides three on-chain registries for agent identity, reputation, and validation. No payments, no execution logic. Just the minimum viable layer so non-human actors can discover and evaluate each other without a pre-existing trust relationship. - **The Agentic Web: AI Agents Will Redefine the Internet** — [Source]() — Published 2026-04-29 Berkeley's Dawn Song identifies the two protocol primitives still missing: agent payments and agent identity. The clearest articulation of what "infrastructure gap" actually means here. - **The Agentic Web: Inside the Protocol Race for Machine-to-Machine Payments** — [Source]() — Published 2026-04-29 The most granular map available of who's building the payment rails agents will transact on. Useful for understanding how many competing bets are live simultaneously. - **On the Institutional Origins of the Agentic Web** — [Source]() — Published 2026-04-29 Harvard Law frames the foundational fork: will agent identity run on open protocols or default to platform gatekeepers? Worth reading alongside the payment pieces for the governance layer they mostly skip. - **Amazon Injunction Could Change the Future of Agentic Commerce** — [Source]() — Published 2026-04-29 Surfaces the real stakes of the Amazon-Perplexity fight: who captures economic surplus when agents route around ads and storefronts. The litigation is a proxy war for the whole commerce layer. - **AI Agents Will Transform the Online Economy** — [Source]() — Published 2026-04-29 Introduces "agentic PageRank," where agents rank other agents by reliability. A counterintuitive idea: reputation systems built for machines, by machines, with humans mostly watching. - **Agents Can Now Create Cloudflare Accounts, Buy Domains, and Deploy** — [Source]() — Published 2026-04-29 A cloud provider redesigns onboarding so agents, not humans, are the contracting party. The abstract shift made concrete: infrastructure treating software as a customer. ## More - [Publication guide]() - [Issue archive]()