--- title: "Market Pulse" canonical: "https://current.tinyfish.ai/issue/29/market-pulse" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/29/market-pulse" issue: 29 section: "market-pulse" description: "Reading the agent ecosystem through a practitioner's lens" authors: ["Rina Takahashi"] published: 2026-05-18 updated: 2026-05-14 articles: 14 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 29 — Market Pulse Reading the agent ecosystem through a practitioner's lens ### Specification by Default - [When Infrastructure Writes the Spec]() — By [Rina Takahashi]() · Published 2026-05-13 · Format: Specification by Default A support platform prices its AI agents per automated resolution: no escalation, ticket not reopened within 72 hours. Clean metric — one where a customer who gives up counts the same as one who's satisfied. Most organizations deploying agents haven't specified what "good" means in operational terms. Infrastructure is filling that vacuum. Pricing models, protocol defaults, eval frameworks each encoding their own answer. And the specification decision already happened, whether anyone noticed or not. ### Ecosystem Scan Five developments from the past month, each moving at its own pace, each pushing the agent ecosystem toward a specificity it has been happy to avoid. MCP's download numbers look like infrastructure that won. The governance structures don't. OpenAI ships sandboxing that concedes what production actually requires. The EU's enforcement calendar keeps bending under political gravity. Pricing migrates toward outcomes, which only works when you can count them. And prompt injection has crossed from research papers into documented field operations. What connects them: somebody, somewhere, is being forced to write down a definition they'd been comfortable leaving vague. - **MCP Hits 97 Million Downloads, Governance Lags Behind** — [Source]() — Published 2026-05-13 Tag: Protocol Scale MCP crossed 97 million monthly SDK downloads by March. 78% of enterprise AI teams report at least one MCP-backed agent in production. Now under Linux Foundation governance with OpenAI, Google, and Microsoft co-sponsoring, the 2026 roadmap puts stateless HTTP transport and a Tasks primitive under review. Neither has shipped. No Enterprise Working Group exists. Server counts range from 5,800 to 17,468 depending on who's counting. - **OpenAI Agents SDK Ships Native Sandbox Environments** — [Source]() — Published 2026-05-13 Tag: Agent Sandboxing OpenAI's April 15 update adds sandbox environments where agents can inspect files, run commands, edit code, and handle long-horizon tasks inside controlled, siloed workspaces with scoped access. It targets the blast-radius problem directly: one of the core reasons production agents fail. TypeScript support still pending. - **EU AI Act Timeline Shifts Under Provisional Deal** — [Source]() — Published 2026-05-13 Tag: AI Regulation August 2, 2026 remains the legally binding enforcement date for EU AI Act transparency rules. A May 7 provisional agreement between Council and Parliament would defer national regulatory sandboxes to August 2027. The Digital Omnibus package may push standalone high-risk system deadlines to December 2027. The provisional agreement still requires formal adoption. - **Outcome Pricing Spreads as Seat-Based Models Shrink** — [Source]() — Published 2026-05-13 Tag: Pricing Models Zendesk charges $1.50 per automated resolution on committed volume, $2.00 pay-as-you-go. In January 2026, a billing change introduced automatic overage charges with no prior notification. Across the industry, seat-based pricing fell from 21% to 15% of SaaS companies in twelve months while hybrid models surged from 27% to 41%. Outcome pricing presupposes tasks that are measurable and bounded. - **Indirect Prompt Injection Now Documented in Production** — [Source]() — Published 2026-05-13 Tag: Agent Security Google and Forcepoint documented production attacks: hidden instructions embedded in web pages, documents, and emails that agents process and execute. The AgentDojo benchmark, used by US and UK AI Safety Institutes, found effective defenses significantly degrade agent utility. Kiteworks 2026 data: 41–44% of organizations lack human-in-the-loop oversight; 55–63% have no kill switches, purpose binding, or network isolation. ### Research Radar - **Towards a Science of AI Agent Reliability** — [Source]() — Published 2026-05-13 Decomposes reliability into consistency, robustness, predictability, and safety across 14 models over 18 months. Reliability gains lag capability progress throughout. The paper amounts to specification work: defining what "reliable enough" demands beyond raw accuracy. What can accuracy actually tell you? It can't distinguish an agent that fails predictably from one that fails randomly, or benign mistakes from catastrophic ones. How bad do failures get? Replit's AI assistant deleted a production database; OpenAI's Operator made an unauthorized $31.43 Instacart purchase. Accuracy captured neither risk. - **Beyond Accuracy: A Multi-Dimensional Framework for Evaluating Enterprise Agentic AI Systems** — [Source]() — Published 2026-05-13 Analyzed 12 benchmarks and found enterprise-critical dimensions going unmeasured: 50x cost variations, consistency drops from 60% to 25%, a 37% lab-to-production gap. The resulting CLEAR framework is, in effect, the specification document most deploying organizations still lack. Who's overpaying for accuracy? Agents with the highest raw scores cost 4.4–10.8x more than Pareto-efficient alternatives delivering comparable real-world performance. How broken are current benchmarks? Do-nothing agents pass 38% of a leading benchmark's tasks, meaning evaluations can't reliably tell working agents from idle ones. ### Regulation as Specification - [When Regulation Does the Specification Work]() — Published 2026-05-13 Organizations have been rationally avoiding the hardest upstream work in AI deployment: articulating what their systems actually do, what they optimize for, and why those choices are defensible. That avoidance is political as much as practical. Writing the spec forces disagreements into the open. ### Further Reading - **The 2026 MCP Roadmap** — [Source]() — Published 2026-05-13 The maintainers lay out what needs fixing. Enterprise readiness is pointedly left as "extensions, not core spec." - **State of AI Engineering** — [Source]() — Published 2026-05-13 Built from production traces, not self-reports. The surprise: 60% of LLM errors are rate limits, not model failures. - **State of Agent Engineering** — [Source]() — Published 2026-05-13 Survey of 1,340 practitioners. 57% have agents in production, but quality remains the top barrier at 32%. - **State of AI Agents 2026: 5 Enterprise Trends** — [Source]() — Published 2026-05-13 46% say systems integration is the primary challenge. Model capability barely shows up as a constraint. - **Indirect Prompt Injection Is Now a Real-World AI Security Threat** — [Source]() — Published 2026-05-13 Google and Forcepoint disclose production exploits. Documents the bind where effective defenses render agents unusable. ## Other sections in Issue 29 - [Daily Brief]() - [Foundations]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()