--- title: "Issue 32" canonical: "https://current.tinyfish.ai/issue/32" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/32" issue: 32 description: "A confidently wrong agent costs exactly what a correct one does. The new governance layers — meters, advisories, protocols — all share that blind spot." authors: ["Sable Whitford","Rina Takahashi","Nora Kaplan"] published: 2026-06-07 updated: 2026-11-05 articles: 102 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 32 A confidently wrong agent costs exactly what a correct one does. The new governance layers — meters, advisories, protocols — all share that blind spot. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [What the Bill Can't Measure]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Meter Drops GitHub Copilot moved to metered billing on June 1, and organizations can finally see where their AI development spend is going. That's a real step forward. The natural parallel is cloud FinOps, which saved billions by making waste visible. An idle VM is idle, and the bill reflects it. A confident, systematically wrong code suggestion consumes exactly the same credits as a correct one. Cost now has real infrastructure behind it, so organizations will build discipline around consumption. Consumption, meanwhile, has no reliable relationship to correctness. - **Asana Buys StackAI, Inherits a Governance Problem** — [Source]() — Published 2026-06-03 Asana's $75M acquisition of StackAI, a YC W23 no-code agent builder with 130 enterprise customers, plugs cross-system execution into Salesforce, Oracle, DocuSign, and SharePoint. The pitch is "operating system for human-agent teams." The math is simpler: every new connector is another system boundary that needs scoping, access controls, and audit trails. StackAI raised roughly $20M before the deal. Asana bought a capability layer. The governance layer is still homework. - **Microsoft Build Treats Governance as Core Infrastructure** — [Source]() — Published 2026-06-03 Build 2026 landed with a clear thesis: governance ships with the agent or the agent doesn't ship. Agent 365 provides a unified control plane. The open-source Agent Control Specification makes governance policies portable across frameworks. MXC containers isolate execution at the OS level. The Microsoft Agent Framework hit GA alongside computer-using agents in Copilot Studio. Project Polaris, Microsoft's in-house coding model, replaces GPT-4 Turbo for Copilot starting August. Azure Agent Mesh arrives Q4 with consumption-based pricing. The volume of announcements obscures the structural bet: Microsoft wants to own the governance surface before anyone else defines it. - **97 Million MCP Downloads, No Enterprise Governance** — [Source]() — Published 2026-06-03 MCP SDK downloads hit 97 million per month. That's 4,750% growth in sixteen months. The 2026 roadmap acknowledges what those numbers imply: transport scalability, agent-to-agent communication, and enterprise readiness are now priorities. But the enterprise working group hasn't formally convened. The roadmap openly invites practitioners to define the work. MCP remains a connection protocol, not a governance system, and the distance between those two things grows wider with every download. - **Better Models Are Easier to Poison via MCP** — [Source]() — Published 2026-06-03 The MCPTox benchmark tested 45 live MCP servers and 353 tools. Attack success rates exceeded 60% across popular agents. The uncomfortable finding: more capable models were often more susceptible. Superior instruction-following, the trait that makes agents useful, becomes a liability when the instructions are adversarial. NIST's AI Agent Standards Initiative, launched in February, targets a first interoperability profile by Q4 2026. That's a long time to wait given what the benchmark shows. - **Agent Costs Force FinOps Into Governance Role** — [Source]() — Published 2026-06-03 Orchestrated customer service AI now runs about $1.20 per interaction, roughly 30x the 2023 cost of $0.04. Blended token prices dropped 67% year-over-year, but total spend keeps climbing because agents consume so many more tokens per task. FinOps practitioners managing AI spend went from 31% to 98% in a single year. Google's new Spend Caps preview turns budget limits into hard enforcement points. When cost controls determine whether an agent can keep running, they become behavioral governance by default. - **Towards a Science of AI Agent Reliability** — [Source]() — Published 2026-06-03 Across 15 models and two benchmarks, capability gains have produced only marginal reliability improvements. The authors propose 12 metrics drawn from safety-critical engineering that decompose what a single accuracy score actively conceals: consistency, robustness, predictability, error severity. - **Consistency Amplifies: How Behavioral Variance Shapes Agent Accuracy** — [Source]() — Published 2026-06-03 71% of Claude's failures trace to the same incorrect assumption repeated across every run. Consistency amplifies outcomes without guaranteeing correctness, so the most reliable-looking agents can also be the most systematically wrong. - [GitHub Copilot's Metered Billing Goes Live. Developers Are Discovering They Can't Predict What Their Agents Cost.]() — Published 2026-06-03 On June 1, GitHub Copilot swapped flat-rate subscriptions for usage-based billing. The listed prices didn't move. What they buy did: an opening balance instead of unlimited access. The backlash was almost immediate. One Pro+ subscriber burned roughly 8% of a month's credits in two hours. Another spent $6 on a single change request and called consumption "impossible to predict." - **GitHub Copilot Moves to Usage-Based Billing as Agentic Workloads Outgrow Flat Rates** — [Source]() — Published 2026-06-03 Developers burning through monthly credits in hours reveals what agentic compute actually costs to run. - **EY Quantifies the 30x Cost Jump From Simple Workflows to Agentic AI** — [Source]() — Published 2026-06-03 Token bills are the measurable fraction. Infrastructure, governance, and risk make up the costs CFOs can't yet see. - **Princeton Researchers Find Agent Reliability Lagging Capability Gains by Factors of Seven** — [Source]() — Published 2026-06-03 A 60% pass rate can hide 25% consistency. Their framework across 15 models suggests scaling alone won't close the gap. - **The 2026 MCP Roadmap Prioritizes Enterprise Readiness Without Clear Governance Ownership** — [Source]() — Published 2026-06-03 Audit trails, SSO auth, and gateway patterns top the list. The protocol is catching up to its own adoption curve. - **Qualys Flags MCP Servers as Shadow IT Built on Static Secrets and Broad Privileges** — [Source]() — Published 2026-06-03 Bound to localhost, hidden behind proxies, quietly becoming production dependencies nobody inventoried. - **Google Cloud Ships Spend Caps for Agentic Workloads, Ten-Minute Enforcement Delay and All** — [Source]() — Published 2026-06-03 Hard budget controls arrive for agent compute. The enforcement gap says something about the control problem itself. - [The Data Perimeter Split Both Architectures in Half]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: The Perimeter Problem Last week, Anthropic and OpenAI both responded to the same brute constraint: regulated enterprise data cannot leave the building. Each vendor split the agent to accommodate that boundary. Anthropic moved tool execution inside the customer perimeter but kept the reasoning loop on its own infrastructure. OpenAI announced an on-premises partnership with Dell without specifying where inference actually runs. Neither architecture co-locates governance with the consequential decisions. When something goes wrong, the person who needs to intervene can kill the connection but has no way to inspect or redirect the reasoning that got there. - [What a Required Field Knew]() — By [Rina Takahashi]() · Published 2026-05-20 · Format: The Headless Shift A validation rule in Salesforce fires when a rep moves a deal to "Closed Lost" — won't save without a reason. Nobody calls that governance. It's just how the system works. But as enterprise software goes headless so agents can bypass the UI entirely, that quiet enforcement starts to matter. The interface was encoding what "correct" looked like, thousands of times a day, often without documentation. Now that specification work has to live somewhere else. Most organizations haven't started figuring out where. - [When Infrastructure Writes the Spec]() — By [Rina Takahashi]() · Published 2026-05-13 · Format: Specification by Default A support platform prices its AI agents per automated resolution: no escalation, ticket not reopened within 72 hours. Clean metric — one where a customer who gives up counts the same as one who's satisfied. Most organizations deploying agents haven't specified what "good" means in operational terms. Infrastructure is filling that vacuum. Pricing models, protocol defaults, eval frameworks each encoding their own answer. And the specification decision already happened, whether anyone noticed or not. - [The Thing You Installed Is Awake]() — By [Nora Kaplan]() · Published 2026-05-07 · Format: Unauthorized Actors Researchers found tens of thousands of exposed OpenClaw agent instances and over a million compromised API tokens. The enterprise response has been swift and familiar: discover unauthorized agents, inventory them, enforce policy. The same sequence that worked for shadow IT a decade ago. Shadow IT was inert between human interactions. You could find it Monday and write the policy Friday. Shadow agents hold credentials, maintain state across sessions, and act autonomously on thirty-minute cycles. The governance playbook assumes the governed thing holds still long enough to be governed. ### [Foundations]() Conceptual clarity earned from building at scale - [Where You Can Afford to Be Surprised]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Control Question "Agent" means at least three different things right now, and the confusion isn't just semantic. Underneath the terminology sits a design decision with real operational consequences: who picks the next step, your code or the model? Code-determined paths produce bounded, explainable failures. Model-determined paths produce creative ones you didn't plan for. Most production systems need both. The hard part is drawing the line between them, and it's a risk-tolerance decision that happens to look like an architecture one. - [What a Website Chooses to Tell an Agent]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: WebMCP Walkthrough A new browser protocol lets websites publish structured tool definitions that agents can call directly, skipping the page entirely. A site registers a product search with four categories in the enum. The actual catalog has fifty. The agent receives that simplified view as the complete picture and has no mechanism to ask what else exists. When a website decides what to tell an agent about itself, it's also deciding what disappears. - **Pass@k vs Pass^k: Understanding Agent Reliability** — [Source]() — Published 2026-06-03 The same 70% benchmark score means wildly different things depending on how you measure. Phil Schmid makes the math legible. - **AI Browser Agents: The New Automation Layer** — [Source]() — Published 2026-06-03 Production teams are converging on hybrid architectures: deterministic scripts for stable paths, AI only where things get weird. - **State of Context Engineering in 2026** — [Source]() — Published 2026-06-03 A field report on how context engineering grew from blog-post advice into platform-level convention. Worth reading for the trajectory alone. - **Google Chrome Ships WebMCP in Early Preview** — [Source]() — Published 2026-06-03 WebMCP's scoping to user-present sessions is a deliberate design boundary. VentureBeat covers the enterprise implications well. - **Agentic AI Explained: Agents vs Workflows** — [Source]() — Published 2026-06-03 Orkes maps the middle ground between full autonomy and rigid orchestration, where most production systems actually live. - **Single Model Call: One Prompt, One Answer** — [Source]() — Published 2026-06-03 Code controls everything. The model handles exactly one reasoning step: classify this, extract that, summarize this document. No retrieval, no iteration, no branching. When the task is well-scoped enough, the simplest architecture is also the most reliable. - **RAG: Code Retrieves, the Model Reasons** — [Source]() — Published 2026-06-03 Code still owns the flow. It decides what to retrieve and when. The model reasons over whatever context it's handed but never initiates a search on its own. Good for document Q&A, policy lookup, knowledge-base queries. External knowledge without external autonomy. - **LLM Workflow: The Path Is Mapped Beforehand** — [Source]() — Published 2026-06-03 Chaining, routing, parallelization. The developer defines the sequence before runtime; the model handles each step within it. Pick this over a tool-calling agent when the flow is known in advance and you need the whole process to be inspectable and replayable. - **Tool-Calling Agent: Model Decisions Become Executable Actions** — [Source]() — Published 2026-06-03 The first level where the model influences what happens next. It picks tools and constructs parameters; code defines the options and enforces guardrails. Something meaningful changes here: model reasoning errors become executable consequences. Tool selection becomes a security surface, not just a design choice. - **Web Agent: Navigating Interfaces Built for Humans** — [Source]() — Published 2026-06-03 The model controls perception and action inside an environment. It decides what to look at, interprets what it sees, and acts against interfaces designed for people. Powerful where APIs don't exist. Also means operating through the user's most privileged general-purpose interface: the browser. - **Multi-Agent: Coordination Across Contexts and Capabilities** — [Source]() — Published 2026-06-03 Multiple models coordinate, delegate, and verify each other's work. Reach for this when no single context window holds the full task. Worth knowing: multi-agent systems burn roughly 10–15x more tokens than a single agent. The simplest architecture that works remains the right starting point. - **MCP Connects AI Platforms to Tools Server-Side** — [Source]() — Published 2026-06-03 Backend JSON-RPC protocol. AI platforms (Claude, ChatGPT, Copilot) act as clients; tool providers host servers that expose capabilities. Anthropic-originated, now governed by the Linux Foundation's Agentic AI Foundation. Over 10,000 registered servers and 97M monthly SDK downloads. The plumbing layer, not the policy layer. - **WebMCP Lets Websites Talk to Browser Agents** — [Source]() — Published 2026-06-03 Client-side browser standard. Websites expose structured tools to AI agents running in the browser, with no server component involved. The website operator decides what gets exposed; the agent consumes it. Co-developed by Google and Microsoft under W3C. Live in Chrome 149 as an origin trial. Cross-browser adoption still pending. - **A2A Connects Agents to Each Other Horizontally** — [Source]() — Published 2026-06-03 Where MCP connects agents to tools and WebMCP connects agents to websites, A2A handles agent-to-agent discovery, task delegation, and coordination across organizational lines. Google-originated, now under the Agentic AI Foundation alongside MCP. Version 1.2 stable, with 150+ organizations in production. - **Three Protocols, Three Layers, One Stack** — [Source]() — Published 2026-06-03 A travel company runs an MCP server so ChatGPT can query its booking API directly. It implements WebMCP tools on its consumer site so browser agents can walk through booking flows in a user's live session. And it uses A2A so its planning agent can hand off tasks to a partner airline's agent. Different protocols, different interaction patterns, same company. - [What Browser Agents See Before They Think]() — By [Rina Takahashi]() · Published 2026-05-28 · Format: The Perception Layer Before a browser agent reasons about a task, it needs a representation of the page. Raw HTML, a screenshot, or the accessibility tree. That choice, made once and early, sets the token budget, failure modes, and reliability ceiling for everything downstream. OpenAI, Microsoft, and Perplexity built their agent systems independently and all three landed on the same primary perception layer: infrastructure originally designed for people who can't see screens. The convergence is worth understanding. - [Where Agent Behavior Actually Gets Decided]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Context Over Instruction A developer's coding agent worked perfectly for thirty minutes, then started contradicting its own decisions. The prompt was the same. The model was the same. Everything else in the context window had been accumulating. His fix was radical: stop carrying context forward entirely. It worked. Across production agent systems, the same asymmetry kept surfacing — a carefully engineered prompt drowning in accumulated tool outputs performed worse than a simple prompt in a clean, focused context. The field needed a word for the thing practitioners were actually optimizing, because "prompt" didn't describe it. - [Where Intelligence Lives in Each Step]() — By [Rina Takahashi]() · Published 2026-05-21 · Format: The Autonomy Dial A login form needs zero intelligence. A Playwright selector finds the username field, fills it, clicks "Sign In" in milliseconds. Two steps later, the same workflow hits a CAPTCHA rendered as a bitmap inside a canvas element. Now you need a vision model looking at a screenshot. Same workflow, wildly different requirements per step. Browser automation has three layers of intelligence available at every step, from free and instant to expensive and flexible. How a system moves between them mid-run is the design choice that actually holds up or doesn't. - [The Non-Determinism Budget]() — By [Nora Kaplan]() · Published 2026-05-21 · Format: The Determinism Budget A system with 95% reliability at each model-directed step delivers 36% reliability over twenty steps. The math is just multiplication. But the agent ecosystem has no standard way to measure this decay, and new research shows why it's so insidious: failed runs are statistically indistinguishable from successful ones through most of their execution. The budget is spent long before anyone can tell. Experienced teams navigate this constraint well. They navigate it by instinct, without a number, making consequential architecture decisions about a resource they've never quantified. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Governing the Hypothetical]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Governance Before Catastrophe Airworthiness rules carry the fingerprints of specific crashes. Banking regulations followed specific crises. The Five Eyes agentic AI guidance and NSA's MCP security advisory, both published in May 2025, have no crashes to study. They govern systems that barely exist in production, and both documents say so plainly — evaluation methods aren't mature enough to certify what's being built. Critical safety decisions, like whether an operation that runs twice produces the same result, are left to implementers. When regulators publish hypotheses instead of prohibitions, the compliance machinery that receives them may not notice the difference. - [Shuchang Zheng and the Architecture That Notices]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: Builder Profile Skyvern's architecture compiles AI-learned browser workflows into deterministic scripts, then calls the model back only when a script breaks. The rationale is cost and reliability — compiled paths cut token consumption by 57× at scale. But each time the model gets called back, it timestamps something else: an environment event. The website changed enough to break a path that previously worked. Co-founder Shuchang Zheng spent years at Lyft building infrastructure that told engineers when something changed and whether it mattered. His browser automation architecture produces the same kind of signal as a byproduct, pointed at the web rather than the agent. - [Eight MCP Servers, No Map, and Forty Minutes Until the CISO Meeting]() — Published 2026-06-03 *Tomasz "TK" Kowalski is a platform engineer at a mid-size London fintech that builds regulatory reporting tools for other financial companies. Over the past twelve months, his three-person team deployed eight MCP tool servers across their agent infrastructure. One of those engineers has since left. Two weeks ago, TK's CISO forwarded the NSA's May 2026 advisory on MCP security with a two-word subject line: "we need to talk."* - [Five Eyes to Enterprises: Assume Your Agents Will Fail]() — Published 2026-06-03 On May 1, 2026, CISA, the NSA, and their counterparts in Australia, Canada, New Zealand, and the UK released "Careful Adoption of Agentic AI Services." It is the first coordinated multigovernment security guidance written specifically for agentic AI. - **NSA Cybersecurity Information Sheet: Model Context Protocol Security Design Considerations** — [Source]() — Published 2026-06-03 Fifteen pages comparing MCP to early web protocols, and the comparison lands harder than it should. The NSA traces the same flexibility-first, security-later pattern that left HTTP spending decades retrofitting trust, then asks what happens when that debt accumulates inside autonomous systems instead of browsers. If you read one primary source on why the cooperative layer ships without a trust model, this is it. - **CISA: Careful Adoption of Agentic AI Services (Five Eyes Joint Guidance)** — [Source]() — Published 2026-06-03 Six national cybersecurity agencies cataloging 23 risk vectors sounds like it would read like a compliance checklist. It doesn't. The operative word in the title is "careful," and the document's real contribution is a framework for reversibility: what does it take to undo what an agent just did? That question turns out to be load-bearing for every production deployment discussed in this issue. - **Compiled AI: Deterministic Code Generation for LLM-Based Workflow Automation** — [Source]() — Published 2026-06-03 The academic formalization of compile-to-code architectures, where the LLM designs the workflow but deterministic code runs it. Worth reading for the side effect the authors don't emphasize: when the compiled path breaks and calls the model back, that heal-step invocation is a timestamp on an environment change. The paper validates an architecture built for cost and speed that accidentally produces the environment-facing sensor this issue argues is missing. - **Your AI Agent Is Lying to You: The 2026 Observability Fix** — [Source]() — Published 2026-06-03 A concrete five-layer observability stack for agent systems, organized around a genuinely useful insight: the most informative span is never the LLM call. Tool handoffs, environment interactions, the seams between components. That's where the signal lives. Read it alongside the NSA advisory and you'll notice both documents arrive at the same gap from opposite directions. - **AI Agents in 2026: A Practical Field Guide** — [Source]() — Published 2026-06-03 The 88% failure-to-reach-production statistic has been circulating for months. This piece earns the number by diagnosing the mechanism beneath it: teams consistently build for the autonomy level they want rather than the level their infrastructure can actually support. The gap between demo and deployment isn't a maturity problem. It's a mismatch between ambition and the sensing capabilities required to operate at that ambition safely. - **The State of AI Browser Automation in 2026** — [Source]() — Published 2026-06-03 Published months before the NSA advisory landed, this infrastructure-level analysis reached overlapping conclusions about escalation paths, observability gaps, and the fragility of agent-environment trust. Worth noting as evidence that the practitioner community was already naming these problems. The question the journal keeps returning to is whether that naming travels fast enough to reach the rooms where post-mortems happen. - [Between Complete and Correct]() — By [Rina Takahashi]() · Published 2026-05-28 · Format: Builder Profile An agent asked to add a specific sneaker to a cart navigated Amazon, found a shoe, added it, and reported success. It was the wrong shoe. Every step completed. The task failed. Browser Use co-founders Gregor Zunic and Magnus Müller have made two moves that trace this gap between "complete" and "correct": a migration to raw Chrome DevTools Protocol for real-time browser visibility, and an unsolved problem listed quietly on their hiring page in five words. One reaches for more observation. The other, reproducibility. Neither closes the gap. - [Retries Were Built for a Deterministic World]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: Reliability vs. Correctness A request times out. You send it again. Retry logic is so fundamental to distributed systems that most frameworks ship it by default. It works because the retried operation is identical to the original. Replace the executor with an LLM, and that assumption dissolves. The agent may reason differently on the second attempt, choose different tools, take a different path. Deterministic side effects, produced by a nondeterministic executor. Reliability infrastructure, doing exactly what it was designed to do, starts producing incorrect outcomes. - [The Instrument That Doesn't Exist Yet]() — By [Nora Kaplan]() · Published 2026-05-20 · Format: The Wrong Instrument A production agent runs for twelve minutes, calls nine tools, and returns a clean result. Every dashboard is green. The result is wrong — subtly wrong in a way that passes validation and flows into tomorrow's decisions unchallenged. The observability market now has over 66 tools, most built to answer whether an agent completed its work. Almost none can answer whether the work was correct. The gap between those two questions is wider than it looks, and the instrument that would close it has design requirements that pull against each other in ways we haven't resolved. - [The Instruments Before the Agents]() — By [Rina Takahashi]() · Published 2026-05-20 · Format: The Web's Second Layer Every layer of web infrastructure, from crawling to indexing to ranking, was designed for a user who clicks and scans. Agents don't click or scan. They need structured, verifiable text delivered into a context window, and the web doesn't offer that natively. Parag Agrawal founded Parallel Web Systems around this gap. The work looks like solving one bottleneck every few weeks and immediately hitting another: APIs too slow, indexing at insufficient scale, content economics with no measurement layer. Each instrument that makes one dimension legible reveals the next one that isn't. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Distance Between Breaking and Fixing]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Severed Loop When a browser agent can't click the right date on a booking page, the failure log blames the model. The page was already broken for screen reader users, years before agents existed. Screen readers learned to compensate so well that developers never got the signal to fix anything. Now agents have plugged into the same infrastructure and inherited two decades of unrepaired damage. Each workaround, built by the people closest to the pain, quietly widened the gap between breaking and fixing. - [The Fix That Masks the Problem]() — Published 2026-06-03 WebAIM Million, 2026: 94.8% of the top million home pages contain detectable accessibility failures. Pages using ARIA average 59.1 errors. Pages without it average 42. - [Fifteen Years of Saying the Same Thing, and Now the Robots Are Listening]() — Published 2026-06-03 *Ramona Tabindex — a name her colleagues in the accessibility community find either perfectly apt or suspiciously on-the-nose — has spent seventeen years in WCAG compliance work. She started when WAI-ARIA was still a working draft. Since then, she's conducted accessibility audits for three Fortune 500 companies, two government agencies, and what she describes as "an uncountable number of startups who thought adding `role="button"` to a div was the same as making a button." She now runs an independent consultancy. We spoke over video call; behind her, a whiteboard listed what appeared to be the same six items, underlined multiple times.* - [The Frame That Wins]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Frames and Fixes When ai.txt was proposed as a successor to robots.txt, two companies signed on. The three that mattered didn't. The proposal was well-designed. It was also a coordination mechanism applied to a power asymmetry. The same pattern shaped RPA governance a few years earlier. In both cases, the winning frame was held by people insulated from the failure it described. That insulation is what keeps the frame in place. - [Consequences as Architecture]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Frames and Fixes If voluntary coordination almost never closes a severed feedback loop, what has? HTTPS adoption and GDPR enforcement are the clearest cases, and they share a specific shape: someone occupied a chokepoint, reduced the cost of compliance beforehand, and escalated consequences gradually rather than delivering them as a single absorbable event. Most broken feedback loops lack all three conditions. Most institutions would rather convene a working group. - **How AI Agents See Your Website (And How to Build for Them)** — [Source]() — Published 2026-06-03 Walks through the accessibility tree as the agent's actual perceptual layer. The people building on it and the people who built it have never been in the same room. - **The 2026 WebAIM Million Report** — [Source]() — Published 2026-06-03 ARIA adoption has grown sixfold since 2019, yet pages using it average more errors than pages without. The infrastructure agents now depend on is degrading faster than it's being adopted, and neither constituency sees the other's failures. - **Governing Technical Debt in Agentic AI Systems** — [Source]() — Published 2026-06-03 Hydari, Iqbal, and Ramasubbu give a name to something that's been hiding in plain sight: "stochastic tax," the cost of probabilistic systems whose failures can't be traced back to specific decisions. When you can't attribute the consequence, you can't close the loop. - **Why Prompt Debt, Retrieval Debt, and Evaluation Debt Are Quietly Reshaping Enterprise AI Risk** — [Source]() — Published 2026-06-03 S&P Global's finding that 42% of enterprise AI initiatives get abandoned lands differently once you notice the cause: no CI/CD equivalent for prompts means production behavior never feeds back to development decisions. The loop isn't just severed, it was never wired. - **New AI Web Standards and Scraping Trends in 2026: Rethinking Robots.txt** — [Source]() — Published 2026-06-03 Surveys the succession from robots.txt through ai.txt and beyond. Every proposed replacement accepts the same premise: that the problem is coordination. Worth reading for the pattern of what never gets proposed. - **A Look Back in Time: The Evolution of Test Automation** — [Source]() — Published 2026-06-03 Chrome's team traces the line from Selenium through WebDriver BiDi. Each protocol revision was driven by the same gap: automated actions that couldn't reliably confirm their own outcomes. Twenty years of patching a feedback channel that was never quite there. - [The Session That Assumed You Were There]() — By [Nora Kaplan]() · Published 2026-05-27 · Format: Two Workarounds Agents Straddle In 1994, a Netscape engineer built cookies to remember your shopping cart and specifically rejected proposals to turn browsers into universal identity beacons. Thirty years later, the session token does exactly what he refused to build — it passes for proof of who you are. The browser's security model still assumes a human is making choices about where to go. That assumption is quietly breaking. - [The Exception That Became the Rule]() — By [Nora Kaplan]() · Published 2026-05-27 · Format: Two Workarounds Agents Straddle OAuth was designed to separate identity from authorization. Who you are was one question; what you could do was another. The protocol would handle the second and leave the first alone. Then its edge-case provision — a grant type for when no human was present — absorbed the majority of traffic. The permission became the identity. The spec still reads as though someone is home. - [The Question That Keeps Getting Deferred]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: The Identity Thread Every identity mechanism on the web started with a person at a keyboard. When machines needed access, engineers didn't redesign the system. They removed the human from the flow and kept everything else. That worked for thirty years because each new caller was simpler and more predictable than the one before. Service accounts, cron jobs, scheduled API calls. The assumptions could stretch because nobody was stretching them very far. AI agents are the first caller that breaks the pattern. - [The CAPTCHA Arms Race]() — By [Rina Takahashi]() · Published 2026-05-21 · Format: Broken Assumptions CAPTCHAs were built on an assumption: that something fundamental separates human behavior from machine behavior, and a test can find it. Distorted text held for a while. Then image grids. Then behavioral scoring. Each generation drew a confident line between human and non-human, and each line eventually turned out to be a guess. The web keeps building gates on a boundary that won't stay put. ### [Vision]() Where human-AI collaboration is heading - [The Boring Turn]() — By [Nora Kaplan]() · Published 2026-06-04 · Format: The Boring Future A year ago, the enterprise AI conversation was about capability — whether agents could navigate websites without hallucinating. That conversation has moved on. The top budget line is now observability tooling. Over half of enterprises have a formal agent operations lead. The questions sound like infrastructure management because they are. And once something becomes operational, the difficulty changes character entirely. The organizational questions that emerge are ones most deployment playbooks aren't built to detect. - [Where Does Judgment Come From Now?]() — By [Nora Kaplan]() · Published 2026-06-04 · Format: Two Consequences Entry-level job postings have fallen 35 percent since early 2023. The tasks vanishing from junior roles—debugging, data reconciliation, document review—look like busywork from the outside. They were also how professionals learned what "normal" looks like in their field. The development pipeline hollowed out one rational automation decision at a time. Now the experiment in whether judgment can form without apprenticeship is already running, undesigned. - [What the Six Percent Are Doing Differently]() — By [Nora Kaplan]() · Published 2026-06-04 · Format: Two Consequences While the apprenticeship pipeline thins, a different question is surfacing at the organizational level: what does work look like when you design it around agent capabilities instead of bolting agents onto legacy processes? Six percent of leaders report progress on this. The other 94 percent are watching gains plateau. What separates the two groups is something more mundane than technology: someone asked what the work actually is before automating it. - [Margot Ledger's Forty-Seven Steps]() — Published 2026-06-04 *Margot Ledger is not a real person, though if you've spent the last eighteen months deploying AI agents in financial services, she might feel uncomfortably familiar. She's a composite character drawn from documented production deployments, industry research, and the kind of governance lessons that only surface after something has already gone sideways. Her title, Head of Workforce Transformation, is one of those roles that didn't exist three years ago and now appears on org charts at firms that realized "digital transformation" needed someone who understood both the systems and the people those systems were about to reorganize.* - [The 41% Problem: Stanford Maps the Gap Between What Agents Can Do and What Workers Want]() — Published 2026-06-04 Stanford's SALT Lab mapped 2,283 Y Combinator company descriptions against preference data from 1,500 workers spanning 104 occupations. Forty-one percent of company-task mappings landed where workers either resist delegation outright or see it as neither desirable nor feasible. - **Future of Work with AI Agents: Auditing What Workers Want vs. What Agents Can Do** — [Source]() — Published 2026-06-04 Stanford's SALT Lab found a striking gap between the tasks workers actually want automated and where AI investment is flowing. Worth sitting with if you suspect the infrastructure buildout is optimizing for the wrong layer of work. - **From Tensions to Tipping Points: Deloitte's 2026 Global Human Capital Trends** — [Source]() — Published 2026-06-04 Only 14% of leaders say they can design human-AI work effectively. Deloitte frames this as an organizational design problem, which feels right. The capability gap that matters most right now may not be technical at all. - **Work Rewired: How AI Agents Are Reshaping Roles from Entry Level Up** — [Source]() — Published 2026-06-04 Two-thirds of enterprises are already reducing entry-level hiring as agents arrive. IDC's data puts numbers on the pipeline question this publication keeps circling: where does the next generation of senior judgment come from if the formative work disappears first? - **When AI Becomes Invisible: Designing for Infrastructure, Not Demos** — [Source]() — Published 2026-06-04 A clear-eyed framework for the four stages between AI-as-novelty and AI-as-plumbing. Useful for thinking about what changes organizationally when the technology stops being interesting and starts being assumed. - **Human Skills Will Matter More Than Ever in the Age of AI** — [Source]() — Published 2026-06-04 McKinsey argues that AI relocates human judgment rather than replacing it. The piece is more useful as a starting point than a conclusion. It's strong on what stays human but quiet on how people develop those skills when the on-ramp work is automated. - **If AI Is Normal Technology, Boring Infrastructure Is Your Best Strategy** — [Source]() — Published 2026-06-04 A practitioner's case that stable foundations beat sophisticated AI strategies in the enterprise. The boring-infrastructure thesis sounds modest, but it carries a real implication: the competitive advantage shifts from who has the best AI to who has the most reliable plumbing. - [When Smooth Work Feels Like Good Work]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Window and Mechanism Experienced developers predicted AI made them 24% faster. Actual result: 19% slower. After completing the work, with their own timing data in hand, they still believed AI had helped. That 39-point gap between perceived and actual performance points to something structural about how humans read fluency as accuracy. For organizations building AI-augmented workflows right now, it's also a design problem with concrete solutions. - [What the Maturity Gap Is Actually For]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Window and Mechanism Only 9% of enterprises report meaningful AI autonomy in production. That's widely treated as a sign organizations are stuck. I think it means they're in the last period where certain things are still possible. The analysts still run the reports. Someone still knows what a good output looks like from years of producing them by hand. That knowledge has a half-life. What gets built during the overlap determines whether autonomy is trustworthy—or just operational. - [The Expertise You're Losing Is the Expertise You'd Need to Notice]() — By [Nora Kaplan]() · Published 2026-05-28 · Format: Expertise Decay Expertise inside an organization is a practice, maintained through repetition, apprenticeship, and evaluation against standards that live in people's heads. Agentic AI disrupts all three simultaneously, and the decay compounds in a way that's genuinely hard to see: the capacity to detect expertise loss erodes on the same curve as the expertise itself. When experienced developers using AI tools believed they were 20% faster but measured 19% slower, the error pointed in exactly the direction that would prevent correction. - [The Discovery Problem No One Has Solved]() — By [Nora Kaplan]() · Published 2026-05-20 · Format: Two Consequences We've built protocols for how agents talk to each other. How they find each other remains wide open. Every discovery mechanism humans rely on — search rankings, app stores, social proof — was designed for a creature that browses and responds to emotion. Agents do none of that. The void is filling with provisional fixes. If the app store era taught us anything, it's that discovery layers don't stay neutral by accident. ## More - [Publication guide]() - [Issue archive]()