--- title: "Echoes" canonical: "https://current.tinyfish.ai/issue/33/echoes" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/33/echoes" issue: 33 section: "echoes" description: "Past infrastructure decisions echoing in today's production realities" authors: ["Rina Takahashi","Nora Kaplan"] published: 2026-06-15 updated: 2026-06-12 articles: 15 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 33 — Echoes Past infrastructure decisions echoing in today's production realities ### The Oldest Deputy - [The Confused Deputy Keeps Getting Promoted]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: The Oldest Deputy In 1977, a Fortran compiler overwrote a billing file because a user asked it to. Nobody hacked anything. The compiler just couldn't tell its own authority apart from the user's request. Norm Hardy named this the "confused deputy" in 1988. The web recreated the pattern with session cookies. OAuth recreated it with delegated tokens. Each time, the fix worked: teach the deputy to distinguish instruction from data. Now LLM agents carry the same structural problem, and the proposed fix is four decades old. This time, the deputy may not be capable of learning. ### The Rare Transfer - [Durable Execution: The Rare Case Where Old Knowledge Traveled With the People Who Built It]() — Published 2026-06-11 Most threads in this section trace knowledge that got lost or reinvented blind. Durable execution is the counter-example. ### The Answer Nobody Read - [The Answer That Kept Losing — An Imagined Interview with Norm Hardy]() — Published 2026-06-11 *Norm Hardy died before the industry caught up with him. The computer scientist who named the confused deputy problem in 1988 spent decades advocating capability-based security as the fix. He never saw Google DeepMind name a framework after capabilities, or watched the Model Context Protocol independently derive audience-bound tokens as though nobody had thought of them before.* ### Two Kinds of Debt - [The Operational Inheritance]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Two Kinds of Debt Browser automation spent twenty years learning to distrust the gap between issuing a command and the command doing what was intended. Selenium engineers built workarounds. Playwright encoded them into architecture. Web agents now operate on the same substrate, facing the same race conditions, the same invisible overlays, the same intercepted clicks. They inherited all of it. The hard-won instinct to doubt when something reports success stayed behind with the community that earned it. - [The Organizational Inheritance]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Two Kinds of Debt RPA's governance problems didn't arrive all at once. They accumulated quietly: orphaned bots running on departed employees' credentials, exception-handling logic that lived in one person's head, audit trails nobody maintained. The questions were always answerable. Who owns this? What happens when it fails? Organizations often didn't ask until something broke. AI agents face the same questions now. The teams deploying them are rarely the teams that lived through the answers. ### Further Threads - **Confused Deputy Attacks on Autonomous AI Agents** — [Source]() — Published 2026-06-11 CSA traces Hardy's 1988 ambient-authority flaw through to AI credential delegation. The debt compounds with each layer of autonomy. - **Prompt Injection May Never Be Fixed, Warns NCSC** — [Source]() — Published 2026-06-11 NCSC compares prompt injection to SQL injection, then delivers the worse news: this time there's no parameterized query waiting in the wings. - **The Future of RPA Ties to AI Agents** — [Source]() — Published 2026-06-11 IDC projects $8.2B in RPA spending through 2028. AI agents aren't replacing that stack. They're inheriting it. - **Shadow AI Morphs Into Shadow Operations** — [Source]() — Published 2026-06-11 Shadow IT took a decade to produce a governance playbook. Shadow AI agents act on live systems before anyone thinks to write one. - **How the Confused Deputy Problem Has Made a Comeback** — [Source]() — Published 2026-06-11 The 1988 confused deputy was contained, never resolved. AI agent teams are rediscovering it without the institutional memory of why it mattered. - **After the Identity Fix: MCP's Confused Deputy Problem** — [Source]() — Published 2026-06-11 Thirty-eight years separate Hardy's paper from OWASP's agentic security classification. The latest identity patch still doesn't touch the structural flaw underneath. ### Past Articles - [Consequences as Architecture]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Frames and Fixes If voluntary coordination almost never closes a severed feedback loop, what has? HTTPS adoption and GDPR enforcement are the clearest cases, and they share a specific shape: someone occupied a chokepoint, reduced the cost of compliance beforehand, and escalated consequences gradually rather than delivering them as a single absorbable event. Most broken feedback loops lack all three conditions. Most institutions would rather convene a working group. - [The Frame That Wins]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Frames and Fixes When ai.txt was proposed as a successor to robots.txt, two companies signed on. The three that mattered didn't. The proposal was well-designed. It was also a coordination mechanism applied to a power asymmetry. The same pattern shaped RPA governance a few years earlier. In both cases, the winning frame was held by people insulated from the failure it described. That insulation is what keeps the frame in place. - [The Distance Between Breaking and Fixing]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Severed Loop When a browser agent can't click the right date on a booking page, the failure log blames the model. The page was already broken for screen reader users, years before agents existed. Screen readers learned to compensate so well that developers never got the signal to fix anything. Now agents have plugged into the same infrastructure and inherited two decades of unrepaired damage. Each workaround, built by the people closest to the pain, quietly widened the gap between breaking and fixing. - [The Session That Assumed You Were There]() — By [Nora Kaplan]() · Published 2026-05-27 · Format: Two Workarounds Agents Straddle In 1994, a Netscape engineer built cookies to remember your shopping cart and specifically rejected proposals to turn browsers into universal identity beacons. Thirty years later, the session token does exactly what he refused to build — it passes for proof of who you are. The browser's security model still assumes a human is making choices about where to go. That assumption is quietly breaking. ## Other sections in Issue 33 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()