--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/34/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/34/foundations" issue: 34 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Rina Takahashi","Nora Kaplan"] published: 2026-06-22 updated: 2026-06-19 articles: 23 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 34 — Foundations Conceptual clarity earned from building at scale ### Tool Architecture Study - [Where the Snapshot Lives Changes Everything Else]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Tool Architecture Study Playwright now ships two modes for agent-driven browser automation. One streams page snapshots into the LLM's context window. The other writes them to disk as files. The token difference is 4x. The difference in what each mode leaves behind after the session ends is harder to quantify and harder to ignore. One produces artifacts you can diff and inspect independently of the agent's own account. The other stores observation and inference in the same stream, inseparable after the fact. Where the snapshot lives turns out to determine what you can verify. ### Conceptual Piece - [The Context Window Fills Up Long Before It's Full]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Conceptual Piece A model with a 200K token context window starts degrading at 50K. Selective retrieval using a quarter of the tokens beats full-context loading by nearly 20 accuracy points. The finding gives "context engineering" its teeth. The work is keeping the context window clean. But teams choosing a context strategy today are choosing a reliability envelope with no data on what that envelope actually contains. The research to measure it hasn't been done. ### Further Reading - **Building Effective Agents — Anthropic's Workflow Patterns as Implicit Context Decisions** — [Source]() — Published 2026-06-18 Every orchestration pattern here quietly decides what the model sees. Reread it with that lens after this issue. - **τ-bench: The Benchmark That Gave Agent Inconsistency a Number** — [Source]() — Published 2026-06-18 Pass^k measures how often success repeats. Context degradation over long sessions is one reason it doesn't. - **OWASP Top 10 for Agentic Applications 2026** — [Source]() — Published 2026-06-18 Tool descriptions shape what the model believes. That makes them context vectors and attack vectors simultaneously. - **State of AI Agent Memory 2026 — Mem0** — [Source]() — Published 2026-06-18 Async writes, graph memory, local embeddings. What production deployments actually need from the layer beneath context. - **Playwright MCP — Official Getting Started Docs** — [Source]() — Published 2026-06-18 The reference companion to this issue's tool feature. Setup for every supported client starts here. - **MCP Threat Modeling: Tool Poisoning as Context Injection, Formalized** — [Source]() — Published 2026-06-18 Seven MCP clients tested against tool poisoning. Most failed at client-side validation. Published May 2026. ### Concepts Worth Knowing The agent ecosystem coins vocabulary faster than it retires confusion. Terms with real engineering consequences get compressed into conference shorthand until the original distinction vanishes entirely. Concepts that should have precise boundaries end up meaning whatever the speaker needs them to mean that afternoon. These six cards mark where that confusion tends to concentrate. Each isolates one distinction and makes it concrete. A few will feel obvious once stated plainly. Others might shift something you thought was already settled. The goal is sharper lines between ideas that blur easily, so the harder conversations that build on them have somewhere solid to stand. - **Where Control Lives Defines What You've Built** — [Source]() — Published 2026-06-19 Tag: System Design What matters is who decides what happens next. If code dictates every step, you have a workflow, even when it calls a model. If the model chooses tools and loops on observations, the system has agentic control. That line is more durable than chatbot versus agent. - **Context and Memory Break in Different Directions** — [Source]() — Published 2026-06-19 Tag: Core Concepts Context is what the model sees right now. Memory is what the system persists and may retrieve later. They fail differently: context degrades over length as attention weakens across distant tokens. Memory degrades through consolidation, as summarization and lifecycle operations quietly erode precision. - **A Tool Is a Contract Between Two Worlds** — [Source]() — Published 2026-06-19 Tag: Tool Design A tool is a contract between probabilistic reasoning and deterministic execution. Good contracts have narrow purpose, clear naming, typed inputs and outputs, explicit side effects, and permission boundaries aligned to the action. When the contract is sloppy, the model fills in plausible but invalid parameters. - **Four Strategies for Filling the Context Window** — [Source]() — Published 2026-06-19 Tag: Context Strategy Lance Martin at LangChain organized context engineering into four strategies: write (save context externally), select (pull relevant context in), compress (retain only needed tokens), and isolate (separate unrelated context). The taxonomy names what most teams already do by instinct and exposes what they're skipping. - **MCP's Trust Gap Lives Between Connect and Runtime** — [Source]() — Published 2026-06-19 Tag: Security Model Tool descriptions get reviewed once, when the agent first connects to a server. Tool responses flow straight into the LLM context with no equivalent check. That unguarded runtime channel is exactly what attackers exploit in tool poisoning. The asymmetry is structural, baked into the protocol's timing. - **Public Benchmarks Measure a Fundamentally Different World** — [Source]() — Published 2026-06-19 Tag: Evaluation Gap Public benchmarks structurally miss real customer data messiness, private tools and permissions, enterprise policy exceptions, adversarial users, production cost and latency constraints, and long-running tasks spanning days. The gap has nothing to do with benchmarks being wrong. They measure a different environment than the one your agents operate in. ### What's Happening Now Six months ago, where browser state lives and who runs the reasoning loop looked like implementation details. They've turned out to be architectural choices with long shadows, shaping cost, security posture, and what's even visible to the people responsible for governing these systems. Several developments this month make those fault lines tangible. A token benchmark puts a number on context architecture. A managed platform absorbs the agent harness entirely. A W3C draft rewires what browsers report in real time. And two lines of research quantify gaps the field has mostly hand-waved about: one in tool security, one in observability. Infrastructure choices are becoming governance choices, whether anyone planned for that or not. - **Playwright CLI Saves State to Disk, Slashes Tokens** — [Source]() — Published 2026-06-19 Tag: Browser Automation Microsoft's @playwright/cli, released early 2026, writes accessibility snapshots to disk instead of streaming them into the agent's context window. Benchmarks show roughly 27,000 tokens per task versus 114,000 via MCP, a gap that widens to 10x on longer sessions. Microsoft now recommends CLI for coding agents with filesystem access. - **Google Moves the Agent Loop to Its Servers** — [Source]() — Published 2026-06-19 Tag: Agent Platforms The Gemini Managed Agents API, announced at Google I/O 2026, lets developers spin up persistent agents with a single API call. Google hosts the reasoning loop, sandbox execution, and state persistence. The tradeoff is real: when the harness belongs to someone else, so does your visibility into what it's doing. - **WebDriver BiDi Adds Real-Time Events via WebSocket** — [Source]() — Published 2026-06-19 Tag: Web Standards Published June 1, 2026 as a W3C Working Draft, WebDriver BiDi replaces classic WebDriver's HTTP request-response model with bidirectional WebSocket communication. Browsers can now push network events, console logs, and exceptions as they happen. Selenium, Puppeteer, and Playwright are integrating it. For agent infrastructure, the significance is what becomes observable during automation that previously wasn't. - **MCPTox: Capable Models Fall Hardest for Poisoned Tools** — [Source]() — Published 2026-06-19 Tag: Agent Security The MCPTox benchmark tested 45 live MCP servers and 353 tools against poisoned descriptions. Attack success rates peaked at 72.8% for o1-mini. The uncomfortable finding: stronger instruction-following made frontier models more compliant with malicious metadata, not less. A 2026 disclosure estimated 200,000 MCP instances remain exposed. - **Agent Observability and LLM Monitoring Solve Different Problems** — [Source]() — Published 2026-06-19 Tag: Agent Operations LLM monitoring tracks a single call: tokens, latency, cost. Agent observability tracks the full session across tool use, memory access, sub-agent handoffs, and decision branches. Practitioners keep reporting the same thing: the most informative span is almost never the LLM call itself. Production debugging breaks down in the space between these two levels of visibility. ### Past Articles - [The Accessibility Tree Wasn't Built for AI Agents]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Perception Walkthrough Accessibility trees were built for screen readers, not AI agents. But both share the same constraint: neither can see a web page. Both need it translated into structured, sequential text. Playwright MCP builds its entire browser automation architecture around that convergence, using accessibility snapshots that cost a fraction of what screenshots require per interaction. The token savings are real and they compound across multi-step workflows. So does the downside: on 95.9% of the web's top million pages, the underlying markup has detectable failures. The agent inherits every one of them. - [The Number You Didn't Ask About]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: Reliability Lens An agent succeeds at a task 70% of the time. Frame the results one way and you can report 97%. Frame them differently and you report 34%. Same system, same math, a 63-point gap created entirely by which question the benchmark decided to answer. Nearly every major agent benchmark chooses the generous framing. The number that captures what production actually feels like, consecutive successes across a full workload, is one that almost nobody reports. - [What a Website Chooses to Tell an Agent]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: WebMCP Walkthrough A new browser protocol lets websites publish structured tool definitions that agents can call directly, skipping the page entirely. A site registers a product search with four categories in the enum. The actual catalog has fifty. The agent receives that simplified view as the complete picture and has no mechanism to ask what else exists. When a website decides what to tell an agent about itself, it's also deciding what disappears. - [Where You Can Afford to Be Surprised]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Control Question "Agent" means at least three different things right now, and the confusion isn't just semantic. Underneath the terminology sits a design decision with real operational consequences: who picks the next step, your code or the model? Code-determined paths produce bounded, explainable failures. Model-determined paths produce creative ones you didn't plan for. Most production systems need both. The hard part is drawing the line between them, and it's a risk-tolerance decision that happens to look like an architecture one. ## Other sections in Issue 34 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()