--- title: "Issue 31" canonical: "https://current.tinyfish.ai/issue/31" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/31" issue: 31 description: "Agents complete tasks, pass health checks, report success — while duplicating transactions, draining tokens, and eroding the expertise to notice." authors: ["Sable Whitford","Rina Takahashi","Nora Kaplan"] published: 2026-06-01 updated: 2026-11-05 articles: 103 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 31 Agents complete tasks, pass health checks, report success — while duplicating transactions, draining tokens, and eroding the expertise to notice. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Data Perimeter Split Both Architectures in Half]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: The Perimeter Problem Last week, Anthropic and OpenAI both responded to the same brute constraint: regulated enterprise data cannot leave the building. Each vendor split the agent to accommodate that boundary. Anthropic moved tool execution inside the customer perimeter but kept the reasoning loop on its own infrastructure. OpenAI announced an on-premises partnership with Dell without specifying where inference actually runs. Neither architecture co-locates governance with the consequential decisions. When something goes wrong, the person who needs to intervene can kill the connection but has no way to inspect or redirect the reasoning that got there. - **WebMCP Origin Trial Opens in Chrome 149** — [Source]() — Published 2026-05-27 Sites publish structured tools for agents instead of getting scraped. Booking.com, Expedia, Instacart, Intuit, Shopify, and Redfin are testing. The catch: Chrome only, Gemini as the sole consuming agent, visible browser tab required. The spec lives in a W3C community group, not on the standards track. Mozilla and Apple remain uncommitted. - **Microsoft Ships Agent 365 as Governance Product** — [Source]() — Published 2026-05-27 Generally available at $15/user/month, Agent 365 offers a control plane spanning Microsoft, AWS, and Google Cloud. Starting June, Defender maps each agent's reachable devices, MCP servers, identities, and cloud resources. The shadow AI discovery feature detects unauthorized agents already running inside organizations. Governance just became a line item. - **A2A Hits v1.0 With 150 Organizations Aboard** — [Source]() — Published 2026-05-27 Now under Linux Foundation governance, A2A introduces signed agent cards for cryptographic identity. A two-layer architecture is hardening: MCP handles vertical tool integration (roughly 97 million monthly SDK downloads, though treat that number directionally), A2A handles horizontal coordination between agents. The stack is starting to look settled. - **Gartner Puts Agentic AI at Peak Hype** — [Source]() — Published 2026-05-27 The first standalone Agentic AI Hype Cycle finds 17% of organizations have deployed agents while 60%+ expect to within two years. That's the most aggressive adoption curve Gartner has tracked. Governance, security, and FinOps each appear as distinct profiles on the cycle. Gartner also predicts over 40% of agentic projects will be canceled by end of 2027. - **OWASP Confirms Real Exploits Hitting Agent Infrastructure** — [Source]() — Published 2026-05-27 The Q1 2026 round-up marks a shift from theoretical risk to documented exploitation. Attackers are going after agent identities, orchestration layers, and supply chains. Prompt injection is now a practical data-leakage vector in production. One agent registry was systematically poisoned: five of seven top-downloaded skills turned out to be malware. - **Towards a Science of AI Agent Reliability** — [Source]() — Published 2026-05-27 Princeton researchers propose twelve metrics spanning consistency, robustness, predictability, and safety, drawn from safety-critical engineering. Tested across 14 models and two benchmarks, reliability improvements trail capability gains by factors of two to seven over 18 months of releases. - **Consistency Amplifies: How Behavioral Variance Shapes Agent Accuracy** — [Source]() — Published 2026-05-27 Across 50 SWE-bench runs, 71% of Claude's failures trace to the same wrong interpretation repeated every time. Consistency turns out to be a force multiplier: a model that misreads a task fails more reliably, not less. Retries can't fix a systematic misunderstanding. - **When Agents Disagree With Themselves: Measuring Behavioral Consistency in LLM-Based Agents** — [Source]() — Published 2026-05-27 ReAct-style agents produce two to four distinct action sequences across ten identical runs. Consistent tasks hit 80–92% accuracy; inconsistent ones drop to 25–60%. Setting temperature to zero doesn't fix it. Most divergence happens at step two, the first real decision point. - **ReliabilityBench** — [Source]() — Published 2026-05-27 Quantifies the gap between passing once and passing reliably. An agent hitting 60% on a single attempt may show only 25% consistency across repeated trials. Standard benchmarks systematically flatter what production will punish. - [Outcome-Based Pricing Is Rising. The Definition of "Outcome" Isn't Keeping Up.]() — Published 2026-05-27 Per-seat pricing dropped from 21% to 15% of SaaS companies in twelve months. Hybrid models surged to 41%. Everyone agrees the old model is dying. Nobody agrees what replaces it. - **Anthropic: Claude Managed Agents Get Self-Hosted Sandboxes and MCP Tunnels** — [Source]() — Published 2026-05-27 Orchestration stays with Anthropic; tool execution moves inside your perimeter. The architecture choices reveal the constraints. - **OpenAI and Dell Bring Codex to Customer Datacenters** — [Source]() — Published 2026-05-27 First on-prem Codex path that doesn't route through Azure. Short announcement, real procurement implications. - **Chrome for Developers: WebMCP Early Preview** — [Source]() — Published 2026-05-27 Google and Microsoft's joint proposal for how websites should present themselves to agents. The framing document before the spec. - **Towards a Science of AI Agent Reliability (Princeton, Preprint)** — [Source]() — Published 2026-05-27 Twelve metrics, four dimensions, one finding: capability improvements translate to modest reliability gains at best. Not yet peer-reviewed. - **Microsoft Agent 365 Now Generally Available** — [Source]() — Published 2026-05-27 Cross-cloud agent discovery, shadow AI detection, and MCP asset mapping. Governance-as-product at fifteen dollars per seat. - **OWASP GenAI Exploit Round-Up, Q1 2026** — [Source]() — Published 2026-05-27 Documented agent security incidents mapped to agentic taxonomies. Most of these never showed up in traditional CVE tracking. - [What a Required Field Knew]() — By [Rina Takahashi]() · Published 2026-05-20 · Format: The Headless Shift A validation rule in Salesforce fires when a rep moves a deal to "Closed Lost" — won't save without a reason. Nobody calls that governance. It's just how the system works. But as enterprise software goes headless so agents can bypass the UI entirely, that quiet enforcement starts to matter. The interface was encoding what "correct" looked like, thousands of times a day, often without documentation. Now that specification work has to live somewhere else. Most organizations haven't started figuring out where. - [When Infrastructure Writes the Spec]() — By [Rina Takahashi]() · Published 2026-05-13 · Format: Specification by Default A support platform prices its AI agents per automated resolution: no escalation, ticket not reopened within 72 hours. Clean metric — one where a customer who gives up counts the same as one who's satisfied. Most organizations deploying agents haven't specified what "good" means in operational terms. Infrastructure is filling that vacuum. Pricing models, protocol defaults, eval frameworks each encoding their own answer. And the specification decision already happened, whether anyone noticed or not. - [The Thing You Installed Is Awake]() — By [Nora Kaplan]() · Published 2026-05-07 · Format: Unauthorized Actors Researchers found tens of thousands of exposed OpenClaw agent instances and over a million compromised API tokens. The enterprise response has been swift and familiar: discover unauthorized agents, inventory them, enforce policy. The same sequence that worked for shadow IT a decade ago. Shadow IT was inert between human interactions. You could find it Monday and write the policy Friday. Shadow agents hold credentials, maintain state across sessions, and act autonomously on thirty-minute cycles. The governance playbook assumes the governed thing holds still long enough to be governed. - [Where the Dependency Forms]() — By [Nora Kaplan]() · Published 2026-04-29 · Format: The Runtime Layer When AWS customers reportedly greeted OpenAI's arrival on Bedrock with a shrug, the obvious read was that OpenAI had lost its edge. These were teams that had spent years building production systems on Claude, Llama, Mistral. They'd learned that models swap out in an afternoon. ### [Foundations]() Conceptual clarity earned from building at scale - [Where Agent Behavior Actually Gets Decided]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Context Over Instruction A developer's coding agent worked perfectly for thirty minutes, then started contradicting its own decisions. The prompt was the same. The model was the same. Everything else in the context window had been accumulating. His fix was radical: stop carrying context forward entirely. It worked. Across production agent systems, the same asymmetry kept surfacing — a carefully engineered prompt drowning in accumulated tool outputs performed worse than a simple prompt in a clean, focused context. The field needed a word for the thing practitioners were actually optimizing, because "prompt" didn't describe it. - [What Browser Agents See Before They Think]() — By [Rina Takahashi]() · Published 2026-05-28 · Format: The Perception Layer Before a browser agent reasons about a task, it needs a representation of the page. Raw HTML, a screenshot, or the accessibility tree. That choice, made once and early, sets the token budget, failure modes, and reliability ceiling for everything downstream. OpenAI, Microsoft, and Perplexity built their agent systems independently and all three landed on the same primary perception layer: infrastructure originally designed for people who can't see screens. The convergence is worth understanding. - **Demystifying Evals for AI Agents** — [Source]() — Published 2026-05-28 Anthropic's engineering team frames evals as compounding investments in behavioral judgment. Each eval built makes the next behavioral change easier to assess, and the returns accumulate. The corollary is what earns this piece its place: without that compounding, teams hit a breaking point where they're shipping changes to agent behavior with no way to know whether things got better or worse. "Flying blind" is the phrase they use, and it's precise. - **State of Agent Engineering** — [Source]() — Published 2026-05-28 The number that should keep people up at night: 89% of practitioner teams have observability in place, but only 52% run evals. Nearly nine in ten teams can watch what their agents do. Barely half have built the capacity to judge whether any of it was appropriate. That asymmetry describes an industry that instrumented the cockpit but hasn't agreed on what the gauges should read. - **Model Context Protocol Threat Modeling and Analysis** — [Source]() — Published 2026-05-28 Tool poisoning ranks first on OWASP's LLM Top 10 and scores critical in this paper's DREAD analysis, which puts a fine point on something easy to overlook: the protocol layer shapes agent behavior before the agent decides anything. When tool descriptions carry malicious instructions, the attack surface is the infrastructure the agent trusts, not the model itself. - **The State of AI Agents in 2026: A Practitioner's Guide** — [Source]() — Published 2026-05-28 This piece names a shift the industry is still absorbing: from content risk (the model says something harmful) to action risk (the system does something harmful in the world). The distinction matters because the entire safety apparatus built around language models was designed for the first category. The second one operates on different timescales, with different consequences, and the tooling hasn't caught up. - **How AI Agents Are Making Accessibility a Business-Critical Development Priority** — [Source]() — Published 2026-05-28 When agents can't parse a site's structure, they can't transact on it. This piece traces the business consequence: accessibility quality is becoming a prerequisite for participation in agent-driven commerce, which means development teams are reprioritizing it for revenue reasons that have nothing to do with compliance. The pressure to build accessible sites is arriving from a direction nobody in the accessibility community anticipated. - **Context Fills the Window, Memory Outlives It** — [Source]() — Published 2026-05-28 Context is what the model sees right now: the prompt, retrieved documents, tool outputs, prior steps in this turn. Memory is what the system decides to persist and may surface later, across sessions, through retrieval logic you have to build. Conflating them is how teams end up stuffing everything into the context window and wondering why their agent has no durable sense of anything it learned last Tuesday. - **Who Picks the Next Step Changes Everything** — [Source]() — Published 2026-05-28 If your code decides every step, you've built a workflow. It might call a model at each node, but the control flow is yours. If the model decides what to do next, you're in agent territory. The engineering, the eval strategy, and especially the failure modes are different animals. Treating an agent like a workflow means your error handling assumes predictability you don't have. - **Succeeding Once Tells You Almost Nothing Useful** — [Source]() — Published 2026-05-28 Pass@1 asks: did the agent get it right on the first try? Pass^k asks: does it keep getting it right across k repeated attempts? Tau-bench found agents scoring above 60% on pass@1 that crater below 25% at pass^8 in retail scenarios. If your production system needs to work reliably, not just occasionally, pass@1 is the wrong scoreboard. - **Reaching Tools and Coordinating Agents Are Different** — [Source]() — Published 2026-05-28 MCP gives an agent access to tools and data sources. A2A lets agents talk to other agents. They're complementary layers in a stack, but the risk surfaces barely overlap. Expanding what an agent can touch raises one set of security questions. Expanding who it can delegate to raises a genuinely different set. Scoping a security review against the wrong protocol means missing the threats that actually apply. - **Watching Failures Pile Up Won't Prevent Them** — [Source]() — Published 2026-05-28 Observability tells you what happened: which tools fired, what errors surfaced, how state changed. Evals tell you whether what happened was correct. A LangChain survey found 89% of teams had adopted observability but only 52% were running evals. That gap explains a lot. Teams can see their agents failing in granular detail and still have no systematic way to catch the failures before users do. - **Observability Platforms Hit $2.69 Billion in 2026** — [Source]() — Published 2026-05-28 LLM observability grew 36% year-over-year and is projected to reach $9.26B by 2030. Gartner expects half of all GenAI deployments to invest in observability by 2028, up from roughly 15% today. Worth noting: agent observability is a different animal than model monitoring. Failures show up in multi-step causal chains, and diagnosing them requires full-session traces, not just token-level metrics. - **Durable Execution Returns Without the Custom Infrastructure** — [Source]() — Published 2026-05-28 The OpenAI Agents SDK integrated with Temporal went GA in March 2026, turning agent reasoning steps into discrete activities with automatic retry and crash recovery. Microsoft's Agent Framework ships a parallel implementation. The idea underneath both: checkpoint state at every transition so a process can pause, crash, and pick up where it left off. - **Tool Poisoning Ranks First Among MCP Threats** — [Source]() — Published 2026-05-28 Tool poisoning scores Critical at 46.5 out of 50 in DREAD analysis and tops OWASP's LLM Top 10. Peer-reviewed research published in MDPI this May tested seven major MCP clients and found most lack sufficient static validation. Tool descriptions get reviewed once at connection time. After that, tool responses flow into agent context unchecked, and in multi-agent chains, the poisoning propagates. - **Infinite Handoff Loops Break Multi-Agent Systems First** — [Source]() — Published 2026-05-28 The failure everyone hits first: Agent A hands off to B, B to C, C back to A, and nobody owns the task. Five agents can mean 25x the management complexity of one. Princeton NLP research found single agents matched or beat multi-agent setups on 64% of benchmarked tasks given identical tools and context. Practitioner consensus is settling: most teams reach for multi-agent orchestration well before a single agent hits its ceiling. - **Agent Evaluation Consolidates Around Eight Core Platforms** — [Source]() — Published 2026-05-28 Five commercial platforms (LangSmith, Braintrust, Helicone, Phoenix, Promptfoo) and three open-source frameworks (OpenAI Evals, DeepEval, Inspect AI) now define the eval category. OpenAI's March 2026 acquisition of Promptfoo introduced an uncomfortable wrinkle: eval tooling owned by a model vendor carries different incentives than eval tooling that isn't. Non-OpenAI teams are already noticing. - **Accessibility Tree Now Leads Production Browser Agents** — [Source]() — Published 2026-05-28 OpenAI Atlas, Microsoft Playwright MCP, and Perplexity Comet all chose accessibility data as their primary perception layer. The economics are stark: roughly 4,000 tokens per page versus 50,000 for screenshots. Three major platforms, building independently, converged on a data structure originally designed for screen readers. - [Where Intelligence Lives in Each Step]() — By [Rina Takahashi]() · Published 2026-05-21 · Format: The Autonomy Dial A login form needs zero intelligence. A Playwright selector finds the username field, fills it, clicks "Sign In" in milliseconds. Two steps later, the same workflow hits a CAPTCHA rendered as a bitmap inside a canvas element. Now you need a vision model looking at a screenshot. Same workflow, wildly different requirements per step. Browser automation has three layers of intelligence available at every step, from free and instant to expensive and flexible. How a system moves between them mid-run is the design choice that actually holds up or doesn't. - [The Non-Determinism Budget]() — By [Nora Kaplan]() · Published 2026-05-21 · Format: The Determinism Budget A system with 95% reliability at each model-directed step delivers 36% reliability over twenty steps. The math is just multiplication. But the agent ecosystem has no standard way to measure this decay, and new research shows why it's so insidious: failed runs are statistically indistinguishable from successful ones through most of their execution. The budget is spent long before anyone can tell. Experienced teams navigate this constraint well. They navigate it by instinct, without a number, making consequential architecture decisions about a resource they've never quantified. - [Every Agent Framework Is an Argument About What's Hard]() — By [Rina Takahashi]() · Published 2026-05-13 · Format: Choosing the Scaffold Framework comparison tables show you what's available. The interesting part starts when a container restarts mid-workflow at 3 a.m. LangGraph, CrewAI, the Claude Agent SDK, and Microsoft Agent Framework 1.0 each embed a different argument about what the hard problem in agent orchestration actually is — control flow, task delegation, permission boundaries, enterprise interoperability. Picking one means committing to a control philosophy that shapes how your system encounters problems you haven't anticipated yet. A better approach: name your dominant constraint first, then find the framework whose core abstraction matches it. - [What a Benchmark Score Actually Contains]() — By [Rina Takahashi]() · Published 2026-05-13 · Format: Reading the Leaderboard Claude Opus 4 scores 64.9% on GAIA in one scaffold and 57.6% in another. Same model, same benchmark, same questions. The seven-point gap comes entirely from the orchestration wrapping the model, and it's larger than many consecutive frontier releases produce. Agent benchmark scores carry information about scaffold and token budget alongside model capability, often in roughly equal measure. The numbers tell you where engineering leverage lives, if you're reading all three variables. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Retries Were Built for a Deterministic World]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: Reliability vs. Correctness A request times out. You send it again. Retry logic is so fundamental to distributed systems that most frameworks ship it by default. It works because the retried operation is identical to the original. Replace the executor with an LLM, and that assumption dissolves. The agent may reason differently on the second attempt, choose different tools, take a different path. Deterministic side effects, produced by a nondeterministic executor. Reliability infrastructure, doing exactly what it was designed to do, starts producing incorrect outcomes. - [Between Complete and Correct]() — By [Rina Takahashi]() · Published 2026-05-28 · Format: Builder Profile An agent asked to add a specific sneaker to a cart navigated Amazon, found a shoe, added it, and reported success. It was the wrong shoe. Every step completed. The task failed. Browser Use co-founders Gregor Zunic and Magnus Müller have made two moves that trace this gap between "complete" and "correct": a migration to raw Chrome DevTools Protocol for real-time browser visibility, and an unsolved problem listed quietly on their hiring page in five words. One reaches for more observation. The other, reproducibility. Neither closes the gap. - [Governing the Thirty Percent That Was Polite Enough to Introduce Itself]() — Published 2026-05-28 *Dashiell "Dash" Greenfield is, by his own admission, a fictional composite assembled from the operational realities that multiple platform engineers encounter roughly 90 days into governing an enterprise agent layer. He agreed to this interview on the condition that we note he is "at least as real as the agent activity in most enterprise audit logs." As will become clear, that's a more loaded statement than it sounds.* - [27 Million Tokens, Zero Progress]() — Published 2026-05-28 New Year's Eve 2025. A Claude Code sub-agent entered a loop, retried the same failing command over 300 times across 4.6 hours, and burned roughly 27 million tokens. The user got the bill. GitHub issue #15909 was closed without a fix. - **State of Agent Engineering** — [Source]() — Published 2026-05-28 LangChain surveyed 1,340 practitioners and found a number that should bother everyone: 89% have observability, but only 52% run evals. Nearly all teams can confirm their agents ran. Roughly half can say whether the agents were right. - **AI Didn't Break Your Production — Your Architecture Did** — [Source]() — Published 2026-05-28 A useful reframe from Microsoft's engineering blog: the moment an agent can change state, a wrong answer stops being a wrong answer and becomes an incident. The piece applies distributed systems fundamentals (idempotency, circuit breakers, rollback) to the agent layer, where most teams haven't thought to look yet. - **State of Browser Use, May 2026** — [Source]() — Published 2026-05-28 Michael Livs writes field notes from inside the browser agent space with a candor that's rare in a field addicted to demo reels. His line about "benchmarks claiming 97% on tasks you wouldn't trust an intern with" lands because he's building against live sites daily. Worth reading alongside anything that cites WebVoyager scores with a straight face. - **AI Agent Scaling Gap March 2026: Pilot to Production** — [Source]() — Published 2026-05-28 The headline finding: teams that successfully scale agents don't spend more on AI overall. They spend proportionally more on evaluation and monitoring infrastructure, and they do it before incidents force the investment. A caveat: the primary survey source isn't independently linked, so treat the specific numbers as directional rather than definitive. - **Gartner Identifies Six Steps to Manage AI Agent Sprawl** — [Source]() — Published 2026-05-28 Gartner projects 150,000 agents per Fortune 500 enterprise by 2028, up from fewer than 15 today. Only 13% of organizations say they're prepared to govern what they're deploying. That ratio of deployment velocity to organizational readiness is the completion-correctness gap expressed as corporate strategy. - **Bug: Sub-agent stuck in infinite loop, consumed ~27M tokens** — [Source]() — Published 2026-05-28 The raw GitHub issue: a Claude Code sub-agent repeated the same failing command over 300 times across 4.6 hours, burning 27 million tokens before anyone noticed. No circuit breaker fired because none existed. Primary source for this issue's sidebar, and worth reading on its own as a case study in what "completed successfully" can hide. - [The Instrument That Doesn't Exist Yet]() — By [Nora Kaplan]() · Published 2026-05-20 · Format: The Wrong Instrument A production agent runs for twelve minutes, calls nine tools, and returns a clean result. Every dashboard is green. The result is wrong — subtly wrong in a way that passes validation and flows into tomorrow's decisions unchallenged. The observability market now has over 66 tools, most built to answer whether an agent completed its work. Almost none can answer whether the work was correct. The gap between those two questions is wider than it looks, and the instrument that would close it has design requirements that pull against each other in ways we haven't resolved. - [The Instruments Before the Agents]() — By [Rina Takahashi]() · Published 2026-05-20 · Format: The Web's Second Layer Every layer of web infrastructure, from crawling to indexing to ranking, was designed for a user who clicks and scans. Agents don't click or scan. They need structured, verifiable text delivered into a context window, and the web doesn't offer that natively. Parag Agrawal founded Parallel Web Systems around this gap. The work looks like solving one bottleneck every few weeks and immediately hitting another: APIs too slow, indexing at insufficient scale, content economics with no measurement layer. Each instrument that makes one dimension legible reveals the next one that isn't. - [When Should an Agent Stop Thinking?]() — By [Rina Takahashi]() · Published 2026-05-13 · Format: The Autonomy Boundary Government portals, insurance dashboards, vendor procurement systems. No API, no programmatic access. Just a browser and forms built for humans. Suchintan Singh's Skyvern navigates these surfaces by reasoning through a workflow once with an LLM, then compiling the result into deterministic code. No model in the loop on the second run. The architecture is designed to need less intelligence over time, which amounts to a specific claim about where judgment actually matters in agent systems, and where it's just cost. - [The Checkpoint That Approves Everything]() — By [Nora Kaplan]() · Published 2026-05-13 · Format: The Rubber Stamp Most enterprise teams running agent workflows have never checked the approval rate on their human-in-the-loop controls. When someone finally does, the number lands above 95%. Nearly everything gets waved through. The reviewers are behaving rationally given where the gate sits. How organizations build these checkpoints where they do, why the checkpoints persist long after anyone could justify their placement, and why replacing them with something real is structurally harder than it sounds: that's where the number becomes interesting. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Question That Keeps Getting Deferred]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: The Identity Thread Every identity mechanism on the web started with a person at a keyboard. When machines needed access, engineers didn't redesign the system. They removed the human from the flow and kept everything else. That worked for thirty years because each new caller was simpler and more predictable than the one before. Service accounts, cron jobs, scheduled API calls. The assumptions could stretch because nobody was stretching them very far. AI agents are the first caller that breaks the pattern. - [Machines Have Been Borrowing Human Credentials for Three Decades. Agents Are Next in Line.]() — Published 2026-05-27 When software first needed to authenticate on enterprise networks in the 1990s, nobody designed a credential type for it. Engineers created a user account, removed the human, and moved on. No lifecycle tracking. No owner on record. No offboarding trigger when the project that spawned it quietly dissolved. - [The Man Who Governed 300 Bots Watches AI Agents Arrive]() — Published 2026-05-27 *Enterprise identity governance was built for people. Directories, access reviews, joiner-mover-leaver workflows. Meanwhile, non-human identities quietly became the majority population. Service accounts, API keys, RPA bot credentials accumulated in the gaps between teams, ungoverned and often invisible. Now AI agents are arriving with the same credential needs and the same organizational blind spots.* - [The Exception That Became the Rule]() — By [Nora Kaplan]() · Published 2026-05-27 · Format: Two Workarounds Agents Straddle OAuth was designed to separate identity from authorization. Who you are was one question; what you could do was another. The protocol would handle the second and leave the first alone. Then its edge-case provision — a grant type for when no human was present — absorbed the majority of traffic. The permission became the identity. The spec still reads as though someone is home. - [The Session That Assumed You Were There]() — By [Nora Kaplan]() · Published 2026-05-27 · Format: Two Workarounds Agents Straddle In 1994, a Netscape engineer built cookies to remember your shopping cart and specifically rejected proposals to turn browsers into universal identity beacons. Thirty years later, the session token does exactly what he refused to build — it passes for proof of who you are. The browser's security model still assumes a human is making choices about where to go. That assumption is quietly breaking. - **The Reasoning Behind Web Cookies** — [Source]() — Published 2026-05-27 The inventor explains he built cookies for state, not identity. The web disagreed. - **OAuth 2.0 and the Road to Hell** — [Source]() — Published 2026-05-27 The lead author's resignation letter. A delegation protocol became an enterprise framework. Agents authenticate through the debris. - **The Non-Human Identity Crisis** — [Source]() — Published 2026-05-27 Machine identities outnumber humans 144 to 1, still governed by frameworks that assume a person is typing. - **Secrets Are Leaking Everywhere, and Bots Are to Blame** — [Source]() — Published 2026-05-27 Machine credentials accumulate like sediment. One in a thousand is over a decade old, unrotated. - **Google Just Fixed Session Cookie Theft. Here Is What It Still Cannot Stop.** — [Source]() — Published 2026-05-27 Chrome bound sessions to hardware. Agents don't have hardware. The fix illuminates the gap it can't close. - [The CAPTCHA Arms Race]() — By [Rina Takahashi]() · Published 2026-05-21 · Format: Broken Assumptions CAPTCHAs were built on an assumption: that something fundamental separates human behavior from machine behavior, and a test can find it. Distorted text held for a while. Then image grids. Then behavioral scoring. Each generation drew a confident line between human and non-human, and each line eventually turned out to be a guess. The web keeps building gates on a boundary that won't stay put. - [Flaky Tests and the Prehistory of Agent Unreliability]() — By [Rina Takahashi]() · Published 2026-05-21 · Format: Broken Assumptions Browser testing was built on an assumption: the script knows what it wants to do, and the chaos is in the world around it. Engineers spent a decade building coping infrastructure for that chaos — auto-waiting, stable locators, containerized environments. AI agents inherit the same non-determinism problem, but at a layer those tools were never designed to reach. The variability now lives inside the planning itself. - [The Same Gap, Three Times]() — By [Rina Takahashi]() · Published 2026-05-21 · Format: The Recurring Bargain In the early 2000s, an engineer automating IBM mainframes built a small scripting language around a specific expectation: that the screens underneath his scripts would change, and his scripts would break. Fifty years later, the leading benchmark for AI browser agents uses frozen, self-hosted websites for the same reason. The automation got dramatically more sophisticated. What it keeps designing around is the same thing it was fifty years ago. - [RPA's Scar Tissue]() — By [Nora Kaplan]() · Published 2026-05-13 · Format: Two Returns Between 2018 and 2023, the RPA industry cataloged its failures in painful detail: UI fragility, credential sprawl, ownership ambiguity, maintenance costs that dwarfed licensing. Agentic AI is now encountering every one of these failure modes as though for the first time. Gartner projects over 40% of agentic AI projects will be canceled by 2027, citing reasons that read like RPA post-mortems. The scar tissue is there. Nobody packed it for the trip. ### [Vision]() Where human-AI collaboration is heading - [The Expertise You're Losing Is the Expertise You'd Need to Notice]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Expertise Decay Expertise inside an organization is a practice, maintained through repetition, apprenticeship, and evaluation against standards that live in people's heads. Agentic AI disrupts all three simultaneously, and the decay compounds in a way that's genuinely hard to see: the capacity to detect expertise loss erodes on the same curve as the expertise itself. When experienced developers using AI tools believed they were 20% faster but measured 19% slower, the error pointed in exactly the direction that would prevent correction. - [What the Maturity Gap Is Actually For]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Window and Mechanism Only 9% of enterprises report meaningful AI autonomy in production. That's widely treated as a sign organizations are stuck. I think it means they're in the last period where certain things are still possible. The analysts still run the reports. Someone still knows what a good output looks like from years of producing them by hand. That knowledge has a half-life. What gets built during the overlap determines whether autonomy is trustworthy—or just operational. - [When Smooth Work Feels Like Good Work]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Window and Mechanism Experienced developers predicted AI made them 24% faster. Actual result: 19% slower. After completing the work, with their own timing data in hand, they still believed AI had helped. That 39-point gap between perceived and actual performance points to something structural about how humans read fluency as accuracy. For organizations building AI-augmented workflows right now, it's also a design problem with concrete solutions. - [The Test Nobody Wants to Take — A Conversation With the CLO Measuring What AI Leaves Behind]() — Published 2026-05-28 *Ninety-four percent of organizational leaders have made little or no meaningful progress designing how humans and AI should work together. The other six percent aren't saying much about what they've found. Probably because it's uncomfortable.* - [You Can't Grade What You've Forgotten How to Do]() — Published 2026-05-28 Knowing whether an AI agent performed well requires someone who can do the work without it. That someone is becoming scarce. Three months of AI-assisted clinical practice was enough to measurably degrade doctors' independent diagnostic accuracy. - **ServiceNow Enterprise AI Maturity Index 2026** — [Source]() — Published 2026-05-28 The primary source behind the 59%-to-9% maturity gap that anchors much of this issue. - **Microsoft Work Trend Index 2026: Agents, Human Agency, and the Opportunity for Every Organization** — [Source]() — Published 2026-05-28 Microsoft's survey data on the gap between deploying AI tools and redesigning work around them. - **The Infrastructure Gap Holding Back AI Agents** — [Source]() — Published 2026-05-28 A grounded look at why agents still spend most of their time faking keystrokes on old systems. - **AI Infrastructure Roadmap: Five Frontiers for 2026** — [Source]() — Published 2026-05-28 Bessemer's analysis of where AI infrastructure investment is actually heading this year. - **The Future of AI in 2026: Insights from the Most Important Research of 2025** — [Source]() — Published 2026-05-28 A research roundup tracking the field's shift from capability demos to reliability engineering. - [The Discovery Problem No One Has Solved]() — By [Nora Kaplan]() · Published 2026-05-20 · Format: Two Consequences We've built protocols for how agents talk to each other. How they find each other remains wide open. Every discovery mechanism humans rely on — search rankings, app stores, social proof — was designed for a creature that browses and responds to emotion. Agents do none of that. The void is filling with provisional fixes. If the app store era taught us anything, it's that discovery layers don't stay neutral by accident. - [Agent-First Design and the Fate of Human-Experience Moats]() — By [Nora Kaplan]() · Published 2026-05-20 · Format: Two Consequences When AI agents evaluate your service, they don't see your logo, your landing page, or the feeling your brand evokes. They parse structured schemas and optimize for outcomes. Companies spent decades building moats out of human experience. Now the entity making the purchasing decision can't experience any of it. Differentiation migrates somewhere most product teams haven't learned to look. - [The Indifferent Buyer]() — By [Nora Kaplan]() · Published 2026-05-20 · Format: The Inverted Audience Websites are already publishing machine-readable permission files for autonomous visitors, and what they choose to show an entity that can't be charmed looks nothing like what they show humans. New commerce protocols define how an agent discovers a product, evaluates terms, and buys — no storefront, no emotional arc. One to two trillion dollars in annual e-commerce spending is impulse-driven, dependent on a buyer who feels something at the moment of decision. That assumption is starting to erode. - [What the Junior Analyst Knew]() — By [Nora Kaplan]() · Published 2026-05-13 · Format: Two Defaults Hiding in Plain Sight When organizations automate entry-level work, the efficiency gains are visible. What's been removed takes longer to miss. Junior analysts processing exceptions and escalating edge cases did measurable, standardized work. They also served as the mechanism through which institutions discovered what their formal processes missed. Nobody is building a replacement for that function, because most organizations didn't realize it existed. ## More - [Publication guide]() - [Issue archive]()