--- title: "Issue 34" canonical: "https://current.tinyfish.ai/issue/34" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/34" issue: 34 description: "At a pharmaceutical company, compliance reports that took analysts three days started drafting overnight. Productivity soared. Then engagement scores dropped, and nobody could explain it, because nothing in the dashboard measured what those three days had actually been building. That gap kept surfacing as we put this issue together. Governance tooling that sends agents to production twelve times faster, for instance, governs what's auditable. Whether it governs what matters is a different question, and almost nobody is asking it yet. Every section landed somewhere similar. What we've learned to measure looks fine. The costs are accumulating where we haven't thought to look." authors: ["Sable Whitford","Nora Kaplan","Rina Takahashi"] published: 2026-06-22 updated: 2026-11-05 articles: 104 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 34 At a pharmaceutical company, compliance reports that took analysts three days started drafting overnight. Productivity soared. Then engagement scores dropped, and nobody could explain it, because nothing in the dashboard measured what those three days had actually been building. That gap kept surfacing as we put this issue together. Governance tooling that sends agents to production twelve times faster, for instance, governs what's auditable. Whether it governs what matters is a different question, and almost nobody is asking it yet. Every section landed somewhere similar. What we've learned to measure looks fine. The costs are accumulating where we haven't thought to look. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [What Governance Governs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Governance Gap Companies with governance tooling deploy twelve times more AI projects to production. Only 4 of 13 frontier-autonomy agents disclose safety evaluations for agentic deployment. The first figure tells you whether a system has been authorized to run. The second tells you whether anyone has rigorously checked what it does once running. They share a vocabulary. They measure fundamentally different things. And the infrastructure accumulating around the first may be quietly relieving pressure to build the second. - **MCP Release Candidate Drops State, Adds Governance** — [Source]() — Published 2026-06-18 The 2026-07-28 RC, locked since May 21, strips out the initialize handshake and session pinning entirely. Remote MCP servers can now sit behind ordinary load balancers. OAuth 2.1 hardening, an Extensions framework, and Server Cards round out the release. Breaking changes from the current stable spec (still 2025-11-25). Final ship targeted for July 28. - **Microsoft Build Rewires the Stack Around Agents** — [Source]() — Published 2026-06-18 The Build keynote introduced Microsoft IQ, folding Work, Foundry, Fabric, and a new Web IQ into a single intelligence layer with live web grounding. Agent Framework 1.0 hit GA. Copilot Credits become the consumption meter for agent workloads. Agent Control Specification previews portable governance policies across the platform. - **Anthropic Pulls Back Agent Billing Split at Launch** — [Source]() — Published 2026-06-18 The June 15 plan to move Agent SDK, claude -p, and third-party agents onto separate metered credit pools at API rates did not take effect as scheduled. Anthropic told users "nothing changes for now," citing the need to better align with usage patterns. The gap between interactive and programmatic pricing remains open. - **Agent Frameworks Merge Faster Than Anyone Expected** — [Source]() — Published 2026-06-18 Microsoft Agent Framework 1.0 ships GA, folding AutoGen and Semantic Kernel into one surface. IBM's ACP merges into A2A under the Linux Foundation's Agentic AI Foundation. Google releases ADK 1.0 for Java and Go. MCP crosses 97 million monthly SDK downloads. The standards layer is solidifying quickly. - **Claude Ships Scheduled Agents, Vaults, and Nesting** — [Source]() — Published 2026-06-18 Public beta brings cron-based scheduling and vault-stored environment variables to Claude's managed agents, targeting the operational plumbing that keeps agent projects stuck in pilot. Sub-agent nesting now goes five levels deep. A searchable plugin marketplace rounds out the release. - **Databricks Telemetry Shows Multi-Agent Workflows Surging** — [Source]() — Published 2026-06-18 Platform data from 20,000 organizations (60% of the Fortune 500) shows 327% growth in multi-agent workflows over four months in 2025. More than a third of agent usage now follows supervisor patterns, with a central agent delegating sub-tasks to specialized sub-agents. Worth noting: this is Databricks customer data, not an independent survey. - **The 2025 AI Agent Index: Documenting Technical and Safety Features of Deployed Agentic AI Systems** — [Source]() — Published 2026-06-18 Researchers from nine institutions catalogued what 30 deployed AI agents actually disclose about safety versus capability. The gap is stark: of 13 agents operating at frontier autonomy levels, only 4 share agentic safety evaluations. Capability benchmarks get published; safety documentation often doesn't. - **TrajAD: Trajectory Anomaly Detection for Trustworthy LLM Agents** — [Source]() — Published 2026-06-18 A dedicated runtime verifier that audits agent execution step by step, pinpointing where trajectories go wrong so systems can roll back precisely rather than restart entirely. General-purpose LLMs, even with careful prompting, perform poorly at this task, which suggests process supervision needs its own tooling. - **JADE: Expert-Grounded Dynamic Evaluation for Open-Ended Professional Tasks** — [Source]() — Published 2026-06-18 A two-layer evaluation framework from Alibaba, Zhejiang University, and Peking University. It breaks agent outputs into individual claims and checks each against expert knowledge, targeting professional domains where holistic scoring by LLM evaluators misses critical failures. - **Stanford HAI 2026 AI Index Report: Foundation Model Transparency** — [Source]() — Published 2026-06-18 Foundation Model Transparency Index scores fell from 58 to 40, reversing two years of improvement. The pattern: the most capable models now disclose the least. Documented AI incidents rose 55% year-over-year, reaching 362 in 2025. - [When the Meter Starts Running]() — By [Rina Takahashi]() · Published 2026-06-18 Anthropic [announced](https://www.techtimes.com/articles/317625/20260602/anthropic-ends-subscription-subsidy-agents-june-15-credit-pool-replaces-flat-rate-access.htm) a billing split in May separating agent workloads from subscription pools into metered credits. The change was [paused](https://www.digitalapplied.com/blog/anthropic-claude-credit-overhaul-june-15-2026) before its June 15 go-live, but the logic is visible elsewhere: GitHub Copilot shifted to [usage-based AI Credits](https://windowsforum.com/threads/github-copilot-ai-credits-usage-based-billing-starts-june-1-2026.415470/) on June 1, and one agentic coding session now costs [$30–40](https://www.abhs.in/blog/github-copilot-usage-based-billing-ai-credits-cost-developer-teams-june-2026). - **The 2025 AI Agent Index** — [Source]() — Published 2026-06-18 Catalogues 30 deployed agents and finds capability disclosures vastly outnumber safety evaluations, quantifying the specification gap in practice. - **MCP Is Growing Up** — [Source]() — Published 2026-06-18 The maintainers explain why MCP went stateless and what the extensions framework changes for authorization. Best primary source on the protocol's direction. - **State of Agent Engineering** — [Source]() — Published 2026-06-18 1,300 practitioners confirm the pattern: 89% trace agent behavior, but only 52% evaluate whether outputs are actually correct. The gap is structural. - **Databricks Report: 327% Surge in Enterprise AI Systems** — [Source]() — Published 2026-06-18 Telemetry across 20,000 organizations showing supervisor-agent patterns now dominate, and the 12x governance-to-deployment correlation worth scrutinizing. - **MCP Protocol Updates 2026: The Migration Map** — [Source]() — Published 2026-06-18 Practical changelog for the July 28 RC. Useful for teams running remote MCP servers who need to know exactly what breaks. - [The Test Suite Was the Hero]() — By [Nora Kaplan]() · Published 2026-06-12 · Format: Verification at Scale Anthropic's Dynamic Workflows can now orchestrate a thousand subagents in parallel. The showcase was a Bun runtime port: 750,000 lines of Zig to Rust, 99.8% test pass rate, eleven days. Impressive. But research on Claude's failure patterns finds that 71% of failures are consistent misinterpretation, not random error. A thousand agents inheriting the same flawed specification converge, confidently, on the same wrong answer. The Bun port had a deterministic test suite to catch that. Most enterprise domains don't. - [What the Bill Can't Measure]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Meter Drops GitHub Copilot moved to metered billing on June 1, and organizations can finally see where their AI development spend is going. That's a real step forward. The natural parallel is cloud FinOps, which saved billions by making waste visible. An idle VM is idle, and the bill reflects it. A confident, systematically wrong code suggestion consumes exactly the same credits as a correct one. Cost now has real infrastructure behind it, so organizations will build discipline around consumption. Consumption, meanwhile, has no reliable relationship to correctness. - [The Data Perimeter Split Both Architectures in Half]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: The Perimeter Problem Last week, Anthropic and OpenAI both responded to the same brute constraint: regulated enterprise data cannot leave the building. Each vendor split the agent to accommodate that boundary. Anthropic moved tool execution inside the customer perimeter but kept the reasoning loop on its own infrastructure. OpenAI announced an on-premises partnership with Dell without specifying where inference actually runs. Neither architecture co-locates governance with the consequential decisions. When something goes wrong, the person who needs to intervene can kill the connection but has no way to inspect or redirect the reasoning that got there. - [What a Required Field Knew]() — By [Rina Takahashi]() · Published 2026-05-20 · Format: The Headless Shift A validation rule in Salesforce fires when a rep moves a deal to "Closed Lost" — won't save without a reason. Nobody calls that governance. It's just how the system works. But as enterprise software goes headless so agents can bypass the UI entirely, that quiet enforcement starts to matter. The interface was encoding what "correct" looked like, thousands of times a day, often without documentation. Now that specification work has to live somewhere else. Most organizations haven't started figuring out where. ### [Foundations]() Conceptual clarity earned from building at scale - [Where the Snapshot Lives Changes Everything Else]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Tool Architecture Study Playwright now ships two modes for agent-driven browser automation. One streams page snapshots into the LLM's context window. The other writes them to disk as files. The token difference is 4x. The difference in what each mode leaves behind after the session ends is harder to quantify and harder to ignore. One produces artifacts you can diff and inspect independently of the agent's own account. The other stores observation and inference in the same stream, inseparable after the fact. Where the snapshot lives turns out to determine what you can verify. - [The Context Window Fills Up Long Before It's Full]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Conceptual Piece A model with a 200K token context window starts degrading at 50K. Selective retrieval using a quarter of the tokens beats full-context loading by nearly 20 accuracy points. The finding gives "context engineering" its teeth. The work is keeping the context window clean. But teams choosing a context strategy today are choosing a reliability envelope with no data on what that envelope actually contains. The research to measure it hasn't been done. - **Building Effective Agents — Anthropic's Workflow Patterns as Implicit Context Decisions** — [Source]() — Published 2026-06-18 Every orchestration pattern here quietly decides what the model sees. Reread it with that lens after this issue. - **τ-bench: The Benchmark That Gave Agent Inconsistency a Number** — [Source]() — Published 2026-06-18 Pass^k measures how often success repeats. Context degradation over long sessions is one reason it doesn't. - **OWASP Top 10 for Agentic Applications 2026** — [Source]() — Published 2026-06-18 Tool descriptions shape what the model believes. That makes them context vectors and attack vectors simultaneously. - **State of AI Agent Memory 2026 — Mem0** — [Source]() — Published 2026-06-18 Async writes, graph memory, local embeddings. What production deployments actually need from the layer beneath context. - **Playwright MCP — Official Getting Started Docs** — [Source]() — Published 2026-06-18 The reference companion to this issue's tool feature. Setup for every supported client starts here. - **MCP Threat Modeling: Tool Poisoning as Context Injection, Formalized** — [Source]() — Published 2026-06-18 Seven MCP clients tested against tool poisoning. Most failed at client-side validation. Published May 2026. - **Where Control Lives Defines What You've Built** — [Source]() — Published 2026-06-19 What matters is who decides what happens next. If code dictates every step, you have a workflow, even when it calls a model. If the model chooses tools and loops on observations, the system has agentic control. That line is more durable than chatbot versus agent. - **Context and Memory Break in Different Directions** — [Source]() — Published 2026-06-19 Context is what the model sees right now. Memory is what the system persists and may retrieve later. They fail differently: context degrades over length as attention weakens across distant tokens. Memory degrades through consolidation, as summarization and lifecycle operations quietly erode precision. - **A Tool Is a Contract Between Two Worlds** — [Source]() — Published 2026-06-19 A tool is a contract between probabilistic reasoning and deterministic execution. Good contracts have narrow purpose, clear naming, typed inputs and outputs, explicit side effects, and permission boundaries aligned to the action. When the contract is sloppy, the model fills in plausible but invalid parameters. - **Four Strategies for Filling the Context Window** — [Source]() — Published 2026-06-19 Lance Martin at LangChain organized context engineering into four strategies: write (save context externally), select (pull relevant context in), compress (retain only needed tokens), and isolate (separate unrelated context). The taxonomy names what most teams already do by instinct and exposes what they're skipping. - **MCP's Trust Gap Lives Between Connect and Runtime** — [Source]() — Published 2026-06-19 Tool descriptions get reviewed once, when the agent first connects to a server. Tool responses flow straight into the LLM context with no equivalent check. That unguarded runtime channel is exactly what attackers exploit in tool poisoning. The asymmetry is structural, baked into the protocol's timing. - **Public Benchmarks Measure a Fundamentally Different World** — [Source]() — Published 2026-06-19 Public benchmarks structurally miss real customer data messiness, private tools and permissions, enterprise policy exceptions, adversarial users, production cost and latency constraints, and long-running tasks spanning days. The gap has nothing to do with benchmarks being wrong. They measure a different environment than the one your agents operate in. - **Playwright CLI Saves State to Disk, Slashes Tokens** — [Source]() — Published 2026-06-19 Microsoft's @playwright/cli, released early 2026, writes accessibility snapshots to disk instead of streaming them into the agent's context window. Benchmarks show roughly 27,000 tokens per task versus 114,000 via MCP, a gap that widens to 10x on longer sessions. Microsoft now recommends CLI for coding agents with filesystem access. - **Google Moves the Agent Loop to Its Servers** — [Source]() — Published 2026-06-19 The Gemini Managed Agents API, announced at Google I/O 2026, lets developers spin up persistent agents with a single API call. Google hosts the reasoning loop, sandbox execution, and state persistence. The tradeoff is real: when the harness belongs to someone else, so does your visibility into what it's doing. - **WebDriver BiDi Adds Real-Time Events via WebSocket** — [Source]() — Published 2026-06-19 Published June 1, 2026 as a W3C Working Draft, WebDriver BiDi replaces classic WebDriver's HTTP request-response model with bidirectional WebSocket communication. Browsers can now push network events, console logs, and exceptions as they happen. Selenium, Puppeteer, and Playwright are integrating it. For agent infrastructure, the significance is what becomes observable during automation that previously wasn't. - **MCPTox: Capable Models Fall Hardest for Poisoned Tools** — [Source]() — Published 2026-06-19 The MCPTox benchmark tested 45 live MCP servers and 353 tools against poisoned descriptions. Attack success rates peaked at 72.8% for o1-mini. The uncomfortable finding: stronger instruction-following made frontier models more compliant with malicious metadata, not less. A 2026 disclosure estimated 200,000 MCP instances remain exposed. - **Agent Observability and LLM Monitoring Solve Different Problems** — [Source]() — Published 2026-06-19 LLM monitoring tracks a single call: tokens, latency, cost. Agent observability tracks the full session across tool use, memory access, sub-agent handoffs, and decision branches. Practitioners keep reporting the same thing: the most informative span is almost never the LLM call itself. Production debugging breaks down in the space between these two levels of visibility. - [The Accessibility Tree Wasn't Built for AI Agents]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Perception Walkthrough Accessibility trees were built for screen readers, not AI agents. But both share the same constraint: neither can see a web page. Both need it translated into structured, sequential text. Playwright MCP builds its entire browser automation architecture around that convergence, using accessibility snapshots that cost a fraction of what screenshots require per interaction. The token savings are real and they compound across multi-step workflows. So does the downside: on 95.9% of the web's top million pages, the underlying markup has detectable failures. The agent inherits every one of them. - [The Number You Didn't Ask About]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: Reliability Lens An agent succeeds at a task 70% of the time. Frame the results one way and you can report 97%. Frame them differently and you report 34%. Same system, same math, a 63-point gap created entirely by which question the benchmark decided to answer. Nearly every major agent benchmark chooses the generous framing. The number that captures what production actually feels like, consecutive successes across a full workload, is one that almost nobody reports. - [What a Website Chooses to Tell an Agent]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: WebMCP Walkthrough A new browser protocol lets websites publish structured tool definitions that agents can call directly, skipping the page entirely. A site registers a product search with four categories in the enum. The actual catalog has fifty. The agent receives that simplified view as the complete picture and has no mechanism to ask what else exists. When a website decides what to tell an agent about itself, it's also deciding what disappears. - [Where You Can Afford to Be Surprised]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Control Question "Agent" means at least three different things right now, and the confusion isn't just semantic. Underneath the terminology sits a design decision with real operational consequences: who picks the next step, your code or the model? Code-determined paths produce bounded, explainable failures. Model-determined paths produce creative ones you didn't plan for. Most production systems need both. The hard part is drawing the line between them, and it's a risk-tolerance decision that happens to look like an architecture one. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [The Web Wasn't Built for This]() — By [Nora Kaplan]() · Published 2026-06-19 · Format: Builder Profile To a person with a browser, a form field is a text box. To a machine trying to operate that same page, it's a hundred lines of nested HTML with the semantically important element buried under presentational scaffolding a visual cortex would simply ignore. Magnus Müller's Browser Use project started from a hobbyist's question about connecting LLMs to the web. His design choices since — rejecting vision-based navigation, treating site instability as a condition to absorb — trace the real complexity: the web was built for human interpreters, and operating it as a machine surfaces a mismatch that no selector strategy can bridge. - [Retry Logic Assumes a Contract That LLM Agents Can't Keep]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: Retry Collision Retry logic in distributed systems works because of a quiet contract: same input, same execution path. An idempotency key ties attempts together, and the server returns a cached result instead of executing again. Agent systems inherit this discipline. But when an LLM decides which tools to call, token sampling variance means the same prompt can produce different tool selections, different parameters, different ordering on retry. Each individual tool call can be perfectly idempotent, and the composed sequence still produces different side effects on each attempt. One developer documented an agent double-charging a customer $847 when a timed-out payment triggered a retry that took a different path through the same workflow. - [Everything Is Green and Everything Is Wrong]() — Published 2026-06-19 *Dina Rezkallah's official title is Senior Platform Engineer. This is because her company's HR system does not contain the job code for "Agent Reliability Engineer," a title she proposed in January, re-proposed in March with a revised job description, and was told in May would be "reviewed in the next cycle." In the meantime, she carries the pager for a nightly reconciliation agent that processes several thousand transactions across payment rails, bank feeds, and internal ledgers. Her colleagues call it "the chatbot."* - [The Agent That Can't Phone Home]() — By [Rina Takahashi]() · Published 2026-06-19 OpenAI's [Lockdown Mode](https://help.openai.com/en/articles/20001061-lockdown-mode) disables live browsing, deep research, agent mode, image retrieval, and file downloads. Everything that makes a web agent act like a web agent, turned off to keep data from leaving after a prompt injection attack. - **The State of AI & Browser Automation in 2026** — [Source]() — Published 2026-06-19 Documents a quiet professional shift: "debugging" now means reading execution traces, not fixing selectors. The job changed before the job title did. - **5 Production Scaling Challenges for Agentic AI in 2026** — [Source]() — Published 2026-06-19 Agents waiting on agents, race conditions in async pipelines, cascading failures that vanish in staging. Multi-agent coordination overhead is becoming the bottleneck nobody benchmarked for. - **Klarna Reverses AI Layoffs: Why Replacing 700 Failed** — [Source]() — Published 2026-06-19 Klarna optimized for a metric that looked good in the earnings call and broke in the support queue. A case study in what gets lost when the objective function serves the presentation, not the work. - **AI Browser Agents: The New Automation Layer Between Your Code and the Web** — [Source]() — Published 2026-06-19 Maps the hybrid architecture production teams actually landed on: scripted Playwright for the stable paths, AI agents for the dynamic ones. The seam between them is where most of the engineering lives. - **Chrome's WebMCP Promises 89% Token Savings** — [Source]() — Published 2026-06-19 A W3C draft standard that gives agents structured APIs instead of DOM scraping. The web is being retrofitted to speak agent, and the cost savings are real, but so is the new trust surface. - **OpenAI Unveils Lockdown Mode to Protect Sensitive Data from Prompt Injection Attacks** — [Source]() — Published 2026-06-19 OpenAI's answer to prompt injection is a mode that disables capabilities to achieve security. Even then, they acknowledge injections can still influence cached content. The trade-off is the story. - [The Wall That Used to Be There]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Enforcement Gap An agent running on an 8K-context model that entered a loop used to crash. The window filled, the API errored, the run died. That was an accidental safety mechanism, and it worked. Context windows now stretch past a million tokens, and the accidental wall is gone. A recent multi-agent loop ran for eleven days and $47,000 before a human noticed the billing dashboard. The team had monitoring. They could see it happening. They couldn't stop it programmatically. Watching and stopping, it turns out, require entirely different infrastructure. - [APIs for Websites That Don't Have APIs]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Builder Profile Suchintan Singh describes Skyvern as building "APIs for websites that don't have APIs." It sounds like a pitch deck line. But the phrase does real work if you've spent years watching ML platforms get measured by marketplace revenue, not model accuracy, and Selenium scripts break every time a frontend developer renames a CSS class. His team built a harder benchmark, scored below 50% on it, and published the results anyway. The architecture and the measurement both point the same direction: web agents are an infrastructure problem that the AI framing keeps obscuring. - [Shuchang Zheng and the Architecture That Notices]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: Builder Profile Skyvern's architecture compiles AI-learned browser workflows into deterministic scripts, then calls the model back only when a script breaks. The rationale is cost and reliability — compiled paths cut token consumption by 57× at scale. But each time the model gets called back, it timestamps something else: an environment event. The website changed enough to break a path that previously worked. Co-founder Shuchang Zheng spent years at Lyft building infrastructure that told engineers when something changed and whether it mattered. His browser automation architecture produces the same kind of signal as a byproduct, pointed at the web rather than the agent. - [Governing the Hypothetical]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Governance Before Catastrophe Airworthiness rules carry the fingerprints of specific crashes. Banking regulations followed specific crises. The Five Eyes agentic AI guidance and NSA's MCP security advisory, both published in May 2025, have no crashes to study. They govern systems that barely exist in production, and both documents say so plainly — evaluation methods aren't mature enough to certify what's being built. Critical safety decisions, like whether an operation that runs twice produces the same result, are left to implementers. When regulators publish hypotheses instead of prohibitions, the compliance machinery that receives them may not notice the difference. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Thread That Runs Through the Browser]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: The Testing Substrate In 2004, a developer at ThoughtWorks wrote a JavaScript tool to stop his colleagues from manually clicking through a billing app. He named it Selenium, as a joke. Twenty-two years later, AI agents open browsers using protocols descended from that tool, reading page structures originally built for screen readers, deciding what to do on sites they've never encountered. Every layer of browser automation was a reasonable response to the problem directly in front of it. The problem in front of it kept quietly changing. - [Four Checks Before a Click]() — By [Rina Takahashi]() · Published 2026-06-19 Before an agent can decide what to click, something has to confirm the click will actually land. Playwright runs four [actionability checks](https://playwright.dev/docs/actionability) on every single click action. Visible. Stable. Receives events. Enabled. All four must pass simultaneously, or the action doesn't fire. - [A QA Engineer Watches History Repeat Itself]() — Published 2026-06-19 *Patience Waite is not a real person, though anyone who spent years writing Selenium tests between 2009 and 2015 might feel uncomfortably certain she is. We found her — or assembled her — from the accumulated scar tissue of a generation of QA automation engineers who learned, one flaky test at a time, that the browser does not care about your deadlines. She now consults on reliability engineering. In the past year, three separate clients have asked her to evaluate whether their agent deployments are "production-ready." She agreed to this conversation on the condition that we not call her an "AI expert."* - [The W3C Moment]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: The Standard and the Cycle In June 2018, the W3C published a spec describing software that "emulates the actions of a real person using the browser." They meant testing tools. That sentence now reads like a product description for AI agents. WebDriver's authors knew they were building something more general than a test harness. They just scoped it as one. The word "primarily" left room for everything that followed. - [The Screen Scraping Cycle]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: The Standard and the Cycle In 1986, IBM shipped a tool that let programs read characters off a terminal screen because mainframe applications had no APIs. The assumption was that this was temporary. Forty years and several technology generations later, browser agents automate the web using the same basic logic: parsing whatever the human sees. Each generation believed it was building a workaround. Each time, the workaround became infrastructure. - **A Brief History of the Selenium Testing Framework** — [Source]() — Published 2026-06-19 The 2004 ThoughtWorks tool that was never meant to become agent infrastructure. It became agent infrastructure. - **WebDriver is Now a W3C Recommendation** — [Source]() — Published 2026-06-19 In 2018, a protocol for "out-of-process programs emulating a real person" became a web standard. Seven years early. - **Agentic Browser Security: 2025 Year-End Review** — [Source]() — Published 2026-06-19 Test automation assumed a trusted operator at the keyboard. What happens when the operator is an LLM and the adversary knows it. - **Why AI Agents Keep Failing in Production** — [Source]() — Published 2026-06-19 Schema drift, fragile selectors, flaky execution. Selenium teams would recognize every failure pattern on this list. - **Build the Web for Agents, Not Agents for the Web** — [Source]() — Published 2026-06-19 A 2026 proposal asking the question that two decades of workarounds on test infrastructure have been deferring. - [The Organizational Inheritance]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Two Kinds of Debt RPA's governance problems didn't arrive all at once. They accumulated quietly: orphaned bots running on departed employees' credentials, exception-handling logic that lived in one person's head, audit trails nobody maintained. The questions were always answerable. Who owns this? What happens when it fails? Organizations often didn't ask until something broke. AI agents face the same questions now. The teams deploying them are rarely the teams that lived through the answers. - [The Operational Inheritance]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Two Kinds of Debt Browser automation spent twenty years learning to distrust the gap between issuing a command and the command doing what was intended. Selenium engineers built workarounds. Playwright encoded them into architecture. Web agents now operate on the same substrate, facing the same race conditions, the same invisible overlays, the same intercepted clicks. They inherited all of it. The hard-won instinct to doubt when something reports success stayed behind with the community that earned it. - [The Confused Deputy Keeps Getting Promoted]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: The Oldest Deputy In 1977, a Fortran compiler overwrote a billing file because a user asked it to. Nobody hacked anything. The compiler just couldn't tell its own authority apart from the user's request. Norm Hardy named this the "confused deputy" in 1988. The web recreated the pattern with session cookies. OAuth recreated it with delegated tokens. Each time, the fix worked: teach the deputy to distinguish instruction from data. Now LLM agents carry the same structural problem, and the proposed fix is four decades old. This time, the deputy may not be capable of learning. - [Consequences as Architecture]() — By [Nora Kaplan]() · Published 2026-06-03 · Format: Frames and Fixes If voluntary coordination almost never closes a severed feedback loop, what has? HTTPS adoption and GDPR enforcement are the clearest cases, and they share a specific shape: someone occupied a chokepoint, reduced the cost of compliance beforehand, and escalated consequences gradually rather than delivering them as a single absorbable event. Most broken feedback loops lack all three conditions. Most institutions would rather convene a working group. ### [Vision]() Where human-AI collaboration is heading - [What Smoothness Costs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: The Texture Problem When AI took over compliance report drafting at a pharmaceutical company, a three-day analyst task collapsed to overnight turnaround. The productivity gain was obvious. What those three days had actually contained was harder to name: the conditions under which analysts developed an internal sense of what compliant work feels like. Organizations are stripping out friction they've never tried to measure. The evidence that some of it was sustaining expertise, not impeding it, is starting to arrive. - [The Taste You Didn't Earn]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Individual Shift / Organizational Conditions You spend your days reviewing, refining, and redirecting AI-generated work. You learn where the model hallucinates, which prompts produce brittle outputs, how to spot a confident paragraph that's subtly wrong. This feels like expertise. Research suggests it may be something else entirely — a detailed map of the agent's failure modes that sits beside domain knowledge without being it. Nearly half of the most advanced AI users seem to sense the difference. They're quietly hedging. - [The Conditions for Meaning]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Individual Shift / Organizational Conditions If the individual question is whether curating AI outputs builds real expertise, the organizational question is whether anyone is designing work so the answer matters. Research identifies specific choices — autonomy, surveillance posture, explainability — that determine whether augmented work retains meaning or hollows out. Eighty-four percent of organizations haven't redesigned jobs around AI. They're making these decisions by accident, and the consequences compound in ways no productivity metric will catch. - [A CPO Watches Her Organization Get More Productive and Less Capable at the Same Time]() — Published 2026-06-18 *Priya Ballast is the Chief People Officer at a mid-large enterprise SaaS company — roughly 3,800 employees, 18 months into broad agent deployment across engineering, customer success, and content operations. She has a PhD in organizational psychology, which she describes as "the most expensive way to learn that people are complicated." She helped architect the deployment strategy. She believed in it. She still does, mostly. But she's been watching something erode that she can't quite get onto a slide deck, and she agreed to talk about it because, as she put it, "if I can't name it in a conversation, I definitely can't name it in a board presentation."* - [The Expertise That Was Already There]() — By [Nora Kaplan]() · Published 2026-06-18 Microsoft's [2026 Work Trend Index](https://www.microsoft.com/en-us/worklab/work-trend-index/agents-human-agency-and-the-opportunity-for-every-organization) names a small cohort, 16% of AI users, as "Frontier Professionals." Eighty percent say they're producing work they couldn't have a year ago. What distinguishes them isn't velocity but a shift in kind: they set intent, design workflows across humans and agents, apply judgment about where automation belongs. - **Agents, Human Agency, and the Opportunity for Every Organization** — [Source]() — Published 2026-06-18 Microsoft's 2026 Work Trend Index surveyed 20,000 AI users across 10 countries and surfaced a striking finding: 67% of AI's organizational impact traces to culture and structure, not individual capability. It's the primary evidence base for the transformation paradox and the "Frontier Professional" concept, and the clearest signal that the bottleneck has moved from tooling to organizational design. - **Redesigning Work Around Human Skills in the Age of AI** — [Source]() — Published 2026-06-18 EY documents a pharmaceutical compliance team where productivity climbed sharply after AI deployment, and something harder to measure quietly eroded. It's the most concrete case study of the meaning gap in action: output up, engagement down, and nobody quite sure when the trade happened. The framing matters too, centering redesign around human skills rather than AI capabilities. - **AI and the Pursuit of Purpose: Redefining the Meaning of Work** — [Source]() — Published 2026-06-18 The most direct treatment of meaning as its own category, separate from productivity and not reducible to it. SwissCognitive identifies specific conditions under which AI implementation hollows out meaningful work: reduced autonomy, increased surveillance, less socialization, lack of explainability. Useful because it names the mechanisms instead of just lamenting the outcome. - **The Agentic Organization: Contours of the Next Paradigm for the AI Era** — [Source]() — Published 2026-06-18 McKinsey introduces the "above the loop" framing for human roles in agent-driven organizations, which sounds like a promotion until you ask what it actually means day-to-day. One of the few frameworks that draws a hard line between genuine organizational redesign and the more common move of layering automation on top of existing processes and calling it transformation. - **Rethinking Operating Models for Humans with Agents** — [Source]() — Published 2026-06-18 Deloitte finds that 84% of companies haven't redesigned jobs to account for AI, which puts a number on the structural inertia everyone senses. The piece frames the core tension well: traditional operating models were built for control and predictability, and agentic AI fundamentally doesn't work that way. Also introduces the "dark factory" concept for what happens when humans get reduced to exception handlers with no view of the whole. - [Monitoring the Monitors]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: Lessons and Designs Organizations are building increasingly sophisticated systems to monitor whether their AI agents perform well. Almost none are checking whether the humans evaluating those agents still can. Evidence from the few domains where measurement exists — developer productivity, medical diagnostics — reveals a durable gap between perceived and actual human capability. The instrument to detect oversight degradation needs to be built now, while the people who could design it still have the expertise to know what it should measure. - [What Aviation Built After It Noticed the Problem]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: Lessons and Designs Aviation solved the automation-complacency problem decades ago with simulator checks, mandatory manual flying, and crew resource management. Those countermeasures rest on a foundation enterprise AI lacks: a stable, agreed-upon definition of what correct human performance looks like. A pilot's hand-flown approach can be graded against known parameters. An analyst's judgment on a market entry recommendation cannot. That structural difference determines whether countermeasures are even possible. - [The Quiet Part]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: The Core Problem In a controlled trial, experienced developers using AI tools estimated they'd gotten about 20% faster. Measured result: 19% slower. What lingers is that completing the work, experiencing the full arc of it, didn't correct their perception. Meanwhile, 74% of teams running agent systems in production rely on human reviewers as their primary quality gate. Both findings are solid. Together, they describe something uncomfortable about where organizational AI deployment is actually headed. - [What the Six Percent Are Doing Differently]() — By [Nora Kaplan]() · Published 2026-06-04 · Format: Two Consequences While the apprenticeship pipeline thins, a different question is surfacing at the organizational level: what does work look like when you design it around agent capabilities instead of bolting agents onto legacy processes? Six percent of leaders report progress on this. The other 94 percent are watching gains plateau. What separates the two groups is something more mundane than technology: someone asked what the work actually is before automating it. ## More - [Publication guide]() - [Issue archive]()