--- title: "Practitioner's Corner" canonical: "https://current.tinyfish.ai/issue/27/practitioners-corner" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/27/practitioners-corner" issue: 27 section: "practitioners-corner" description: "Lessons from the field—what we see building at scale" authors: ["Rina Takahashi"] published: 2026-05-04 updated: 2026-04-30 articles: 10 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 27 — Practitioner's Corner Lessons from the field—what we see building at scale ### The Wrong Layer - [The Wrong Layer]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: The Wrong Layer A single-pixel font. An instruction buried in an HTML comment. CSS that hides a payload from every human eye but leaves it fully legible to any agent parsing the source. Google's latest scan of billions of crawled pages found these attacks growing 32% in three months. The manipulation happens before the model ever touches the input. ### Builder Profile - [The Web Wasn't Built for This]() — By [Rina Takahashi]() · Published 2026-04-29 · Format: Builder Profile Five days from prototype to Hacker News post. Eighty-one thousand GitHub stars and a $17M seed round followed. By every visible metric, Browser Use looks like a solved problem. Their own benchmark says otherwise: after purpose-built models and a compressed action vocabulary engineered against the live web, roughly one in six tasks still fails. That gap is the story. What happens when you try to build a negotiation layer between language models and a web that was never designed to be read by machines. ### The Wrong Number - [The Dropdown That Doesn't Exist Yet]() — Published 2026-04-29 *Paloma "Pally" Voss is a composite character. Her employer, her specific situation, and her fondness for weather metaphors are all fictional. The failure mode she describes is not.* ### Structured Admission - [WebMCP: A W3C Standard That Admits the Browser-Agent Model Is Broken]() — Published 2026-04-29 Google's WebMCP proposal replaces the screenshot-parse-click loop with structured tool contracts. Sites declare capabilities through the navigator.modelContext API, complete with schemas, parameters, and browser-enforced permissions. Agents stop guessing which button means "Buy Now" by squinting at raw HTML. ### This Week's Evidence - **Indirect Prompt Injection Is Taking Hold in the Wild** — [Source]() — Published 2026-04-29 Google and Forcepoint independently document IPI attacks with real fraud payloads and organized tooling. The shift from proof-of-concept to commodity exploit happened faster than most threat models assumed. - **Continuously Hardening ChatGPT Atlas Against Prompt Injection Attacks** — [Source]() — Published 2026-04-29 OpenAI's most candid admission that prompt injection resists model-level solutions. The RL attacker methodology is worth close reading: it reveals what "hardening" actually means when the vulnerability is structural. - **Gartner Says AI Projects in Infrastructure and Operations Stall Ahead of Meaningful ROI** — [Source]() — Published 2026-04-29 A 28% full-success rate across 782 I&O leaders, with failures clustering in autonomous workflow categories. The number that matters is the gap between "deployed" and "delivering value," which Gartner sizes but doesn't fully explain. - **Beyond pass@1: A Reliability Science Framework for Long-Horizon LLM Agents** — [Source]() — Published 2026-04-29 Proposes four metrics for what benchmarks systematically miss: how agent reliability degrades as task duration increases. If you've watched an agent succeed at step-level evals and fail at workflow-level execution, this paper names the mechanism. - **Mitigating the Risk of Prompt Injections in Browser Use** — [Source]() — Published 2026-04-29 Anthropic's multi-layer browser defense architecture is thorough and well-documented. The real takeaway lives in the residual 1.4% attack success rate, which quantifies the floor that layered defenses can reach but not break through. - **AI Is Hitting Operational Limits as Companies Rush to Scale** — [Source]() — Published 2026-04-29 Datadog's production instrumentation data finds 60% of AI failures trace to capacity and infrastructure limits, not model errors. Useful evidence for anyone arguing that the bottleneck has migrated below the model layer. ## Other sections in Issue 27 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()