--- title: "Market Pulse" canonical: "https://current.tinyfish.ai/issue/31/market-pulse" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/31/market-pulse" issue: 31 section: "market-pulse" description: "Reading the agent ecosystem through a practitioner's lens" authors: ["Rina Takahashi","Nora Kaplan"] published: 2026-06-01 updated: 2026-05-28 articles: 21 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 31 — Market Pulse Reading the agent ecosystem through a practitioner's lens ### The Perimeter Problem - [The Data Perimeter Split Both Architectures in Half]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: The Perimeter Problem Last week, Anthropic and OpenAI both responded to the same brute constraint: regulated enterprise data cannot leave the building. Each vendor split the agent to accommodate that boundary. Anthropic moved tool execution inside the customer perimeter but kept the reasoning loop on its own infrastructure. OpenAI announced an on-premises partnership with Dell without specifying where inference actually runs. Neither architecture co-locates governance with the consequential decisions. When something goes wrong, the person who needs to intervene can kill the connection but has no way to inspect or redirect the reasoning that got there. ### Ecosystem Signals While most of the industry took the long weekend off, the agent ecosystem kept doing what it's done all quarter: building walls and drawing maps. Standards for what sites expose to agents. Governance planes that catalog what's already running. Coordination protocols for establishing trust across organizational boundaries. Security reports documenting what happens when those boundaries fail. These efforts look parallel. They aren't. They're all converging on the same structural problem: where does the perimeter sit when the thing inside it is autonomous, distributed, and increasingly worth attacking? The answer is arriving from every direction at once, faster than most organizations can absorb it. - **WebMCP Origin Trial Opens in Chrome 149** — [Source]() — Published 2026-05-27 Tag: Web Standards Sites publish structured tools for agents instead of getting scraped. Booking.com, Expedia, Instacart, Intuit, Shopify, and Redfin are testing. The catch: Chrome only, Gemini as the sole consuming agent, visible browser tab required. The spec lives in a W3C community group, not on the standards track. Mozilla and Apple remain uncommitted. - **Microsoft Ships Agent 365 as Governance Product** — [Source]() — Published 2026-05-27 Tag: Enterprise Governance Generally available at $15/user/month, Agent 365 offers a control plane spanning Microsoft, AWS, and Google Cloud. Starting June, Defender maps each agent's reachable devices, MCP servers, identities, and cloud resources. The shadow AI discovery feature detects unauthorized agents already running inside organizations. Governance just became a line item. - **A2A Hits v1.0 With 150 Organizations Aboard** — [Source]() — Published 2026-05-27 Tag: Protocol Layer Now under Linux Foundation governance, A2A introduces signed agent cards for cryptographic identity. A two-layer architecture is hardening: MCP handles vertical tool integration (roughly 97 million monthly SDK downloads, though treat that number directionally), A2A handles horizontal coordination between agents. The stack is starting to look settled. - **Gartner Puts Agentic AI at Peak Hype** — [Source]() — Published 2026-05-27 Tag: Market Signal The first standalone Agentic AI Hype Cycle finds 17% of organizations have deployed agents while 60%+ expect to within two years. That's the most aggressive adoption curve Gartner has tracked. Governance, security, and FinOps each appear as distinct profiles on the cycle. Gartner also predicts over 40% of agentic projects will be canceled by end of 2027. - **OWASP Confirms Real Exploits Hitting Agent Infrastructure** — [Source]() — Published 2026-05-27 Tag: Threat Landscape The Q1 2026 round-up marks a shift from theoretical risk to documented exploitation. Attackers are going after agent identities, orchestration layers, and supply chains. Prompt injection is now a practical data-leakage vector in production. One agent registry was systematically poisoned: five of seven top-downloaded skills turned out to be malware. ### Research Spotlight - **Towards a Science of AI Agent Reliability** — [Source]() — Published 2026-05-27 Princeton researchers propose twelve metrics spanning consistency, robustness, predictability, and safety, drawn from safety-critical engineering. Tested across 14 models and two benchmarks, reliability improvements trail capability gains by factors of two to seven over 18 months of releases. Why does accuracy keep climbing while reliability stalls? Structured tasks show moderate gains; open-ended tasks show almost none. Single success metrics hide the gap. Who's behind this? The Princeton team running the Science of AI Agent Evaluation program, with a related paper accepted to ICLR 2026. - **Consistency Amplifies: How Behavioral Variance Shapes Agent Accuracy** — [Source]() — Published 2026-05-27 Across 50 SWE-bench runs, 71% of Claude's failures trace to the same wrong interpretation repeated every time. Consistency turns out to be a force multiplier: a model that misreads a task fails more reliably, not less. Retries can't fix a systematic misunderstanding. What breaks retry-based strategies? Interpretation accuracy matters more than execution consistency. Running it again won't help if the reading was wrong from the start. So consistency is good, right? Only if the underlying assumption is correct. Otherwise you've just automated the same mistake at higher confidence. - **When Agents Disagree With Themselves: Measuring Behavioral Consistency in LLM-Based Agents** — [Source]() — Published 2026-05-27 ReAct-style agents produce two to four distinct action sequences across ten identical runs. Consistent tasks hit 80–92% accuracy; inconsistent ones drop to 25–60%. Setting temperature to zero doesn't fix it. Most divergence happens at step two, the first real decision point. Where does variance actually start? 69% of trajectory divergence occurs at step two. Early commitments cascade through the rest of execution. Can't you just set temperature to zero? No. Behavioral variance persists regardless, suggesting the instability runs deeper than sampling randomness. - **ReliabilityBench** — [Source]() — Published 2026-05-27 Quantifies the gap between passing once and passing reliably. An agent hitting 60% on a single attempt may show only 25% consistency across repeated trials. Standard benchmarks systematically flatter what production will punish. How much do benchmarks overstate readiness? Pass-at-one scores can run more than double the actual multi-trial consistency rate. What does this mean for procurement? A demo that works is not evidence of a system that works repeatedly. The gap is measurable and large. ### Pricing Shift - [Outcome-Based Pricing Is Rising. The Definition of "Outcome" Isn't Keeping Up.]() — Published 2026-05-27 Per-seat pricing dropped from 21% to 15% of SaaS companies in twelve months. Hybrid models surged to 41%. Everyone agrees the old model is dying. Nobody agrees what replaces it. ### Further Reading - **Anthropic: Claude Managed Agents Get Self-Hosted Sandboxes and MCP Tunnels** — [Source]() — Published 2026-05-27 Orchestration stays with Anthropic; tool execution moves inside your perimeter. The architecture choices reveal the constraints. - **OpenAI and Dell Bring Codex to Customer Datacenters** — [Source]() — Published 2026-05-27 First on-prem Codex path that doesn't route through Azure. Short announcement, real procurement implications. - **Chrome for Developers: WebMCP Early Preview** — [Source]() — Published 2026-05-27 Google and Microsoft's joint proposal for how websites should present themselves to agents. The framing document before the spec. - **Towards a Science of AI Agent Reliability (Princeton, Preprint)** — [Source]() — Published 2026-05-27 Twelve metrics, four dimensions, one finding: capability improvements translate to modest reliability gains at best. Not yet peer-reviewed. - **Microsoft Agent 365 Now Generally Available** — [Source]() — Published 2026-05-27 Cross-cloud agent discovery, shadow AI detection, and MCP asset mapping. Governance-as-product at fifteen dollars per seat. - **OWASP GenAI Exploit Round-Up, Q1 2026** — [Source]() — Published 2026-05-27 Documented agent security incidents mapped to agentic taxonomies. Most of these never showed up in traditional CVE tracking. ### Past Articles - [What a Required Field Knew]() — By [Rina Takahashi]() · Published 2026-05-20 · Format: The Headless Shift A validation rule in Salesforce fires when a rep moves a deal to "Closed Lost" — won't save without a reason. Nobody calls that governance. It's just how the system works. But as enterprise software goes headless so agents can bypass the UI entirely, that quiet enforcement starts to matter. The interface was encoding what "correct" looked like, thousands of times a day, often without documentation. Now that specification work has to live somewhere else. Most organizations haven't started figuring out where. - [When Infrastructure Writes the Spec]() — By [Rina Takahashi]() · Published 2026-05-13 · Format: Specification by Default A support platform prices its AI agents per automated resolution: no escalation, ticket not reopened within 72 hours. Clean metric — one where a customer who gives up counts the same as one who's satisfied. Most organizations deploying agents haven't specified what "good" means in operational terms. Infrastructure is filling that vacuum. Pricing models, protocol defaults, eval frameworks each encoding their own answer. And the specification decision already happened, whether anyone noticed or not. - [The Thing You Installed Is Awake]() — By [Nora Kaplan]() · Published 2026-05-07 · Format: Unauthorized Actors Researchers found tens of thousands of exposed OpenClaw agent instances and over a million compromised API tokens. The enterprise response has been swift and familiar: discover unauthorized agents, inventory them, enforce policy. The same sequence that worked for shadow IT a decade ago. Shadow IT was inert between human interactions. You could find it Monday and write the policy Friday. Shadow agents hold credentials, maintain state across sessions, and act autonomously on thirty-minute cycles. The governance playbook assumes the governed thing holds still long enough to be governed. - [Where the Dependency Forms]() — By [Nora Kaplan]() · Published 2026-04-29 · Format: The Runtime Layer When AWS customers reportedly greeted OpenAI's arrival on Bedrock with a shrug, the obvious read was that OpenAI had lost its edge. These were teams that had spent years building production systems on Claude, Llama, Mistral. They'd learned that models swap out in an afternoon. ## Other sections in Issue 31 - [Daily Brief]() - [Foundations]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()