--- title: "Issue 35" canonical: "https://current.tinyfish.ai/issue/35" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/35" issue: 35 description: "We spent this issue pulling apart something nobody thinks about: the click. When a person clicks a button, they carry context the browser never had to record. Intent, authority, the judgment that this action should happen now. Agents perform the same gesture and none of that travels with it. The web assumed someone was sitting there. What we didn't expect is where the fixes are arriving first: payments and compliance, the domains where confused delegation costs real money. Better models won't solve this. The accountability infrastructure has to exist before agents can be trusted with anything that matters." authors: ["Sable Whitford","Rina Takahashi","Nora Kaplan"] published: 2026-06-29 updated: 2026-11-05 articles: 106 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 35 We spent this issue pulling apart something nobody thinks about: the click. When a person clicks a button, they carry context the browser never had to record. Intent, authority, the judgment that this action should happen now. Agents perform the same gesture and none of that travels with it. The web assumed someone was sitting there. What we didn't expect is where the fixes are arriving first: payments and compliance, the domains where confused delegation costs real money. Better models won't solve this. The accountability infrastructure has to exist before agents can be trusted with anything that matters. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. - **OpenAI Gives Enterprises One View of Agent Costs** — [Source]() — Published 2026-06-25 OpenAI's Global Admin Console (June 18, 2026) pulls ChatGPT and Codex credit usage into one dashboard, broken out by user, product, and model, with layered spend limits at the workspace, group, and individual level. The problem is basic but stubborn: you can't budget for agent costs you can't see. - **OpenAI Puts $150M Behind Deployment Capacity Gap** — [Source]() — Published 2026-06-25 OpenAI committed $150 million on June 14, 2026, to a partner network targeting 300,000 certified consultants by year-end. The subtext is telling: the bottleneck for enterprise AI has shifted from what models can do to whether organizations can rewire workflows and absorb the change. - **A2A Protocol Finds Neutral Ground at Linux Foundation** — [Source]() — Published 2026-06-25 Google's Agent2Agent protocol moved under Linux Foundation governance in June 2025, backed by 100+ companies including AWS, Cisco, Salesforce, and Microsoft. The playbook is familiar: interoperability standards don't earn adoption across competing vendors without stewardship that sits on neutral ground. - **Anthropic Swaps Static Keys for Scoped Agent Credentials** — [Source]() — Published 2026-06-25 Anthropic's Workload Identity Federation (GA June 17, 2026) replaces long-lived API keys with short-lived, scoped credentials verified against OIDC-compliant identity providers. Each workload gets its own service account, roles, and audit trail. When agents touch systems of record, "who did what" stops being optional. - **OpenTelemetry Builds a Vocabulary for Agent Instrumentation** — [Source]() — Published 2026-06-25 OpenTelemetry's GenAI semantic conventions (v1.42.0) define spans, metrics, and events for model calls, agent operations, tool execution, and MCP interactions. Still maturing, but the premise holds: shared instrumentation vocabulary is a prerequisite for debugging, optimizing, or accounting for agent behavior at any scale. - **EU AI Act Turns Governance Language Into Build Requirements** — [Source]() — Published 2026-06-25 EU AI Act transparency rules take effect August 2026, with high-risk obligations following from December 2027. Activity logging, technical documentation, human oversight, incident reporting. What reads as policy language on paper becomes engineering work in practice: logs, provenance records, and reversal paths someone actually has to build. - **Linux Foundation Launches the Agent2Agent Protocol Project** — [Source]() — Published 2026-06-25 A2A shifts from Google's stewardship to Linux Foundation governance with 100+ supporting companies. Foundation neutrality changes the adoption calculus, though it sidesteps the authorization questions the spec itself leaves deliberately open. - **A2A Protocol v0.3.0 Specification** — [Source]() — Published 2026-06-25 The v0.3.0 spec standardizes transport, task lifecycle, and agent discovery while explicitly deferring authorization to implementers. Credential handling stays out-of-band; authorization logic is "implementation-specific." These remain design goals, not compliance claims. - **MCP Authorization Specification (2025-06-18)** — [Source]() — Published 2026-06-25 MCP's authorization spec explicitly prohibits token passthrough to prevent confused-deputy attacks, mandating audience-bound credentials via OAuth 2.1 and RFC 8707. Authorization remains optional for implementations, but the prohibitions reveal where designers see real risk. - **Announcing the Agent2Agent Protocol (A2A)** — [Source]() — Published 2026-06-25 Google's original A2A launch framed the protocol as complementary to MCP: tools versus coordination. Launched with 50+ partners, the protocol moved to foundation governance in under three months, a pace that suggests institutional urgency around standardization. - [The Binding Constraint Moved]() — By [Nora Kaplan]() · Published 2026-06-25 Nearly nine in ten organizations [report regular AI use](https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai/). But when McKinsey asked about scaling agents, the picture inverted: 23 percent are scaling them anywhere, and no single business function has crossed 10 percent. A lot of experimentation. Very little that looks like deployment. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-06-25 88% adoption, yet no function has scaled agents past 10%. That gap is a demand signal for operational infrastructure, not more models. - **New Usage Analytics and Updated Spend Controls for Enterprises** — [Source]() — Published 2026-06-25 Per-user credit tracking and model-level spend caps signal that AI cost governance is becoming a first-class admin surface, not a finance afterthought. - **Secure Access to the Claude Platform with Workload Identity Federation** — [Source]() — Published 2026-06-25 Replacing static API keys with scoped, auditable, per-workload credentials. Agent authorization is quietly becoming its own infrastructure layer. - **Linux Foundation Launches the Agent2Agent Protocol Project** — [Source]() — Published 2026-06-25 A2A moves from Google-originated spec to neutral governance. A specific kind of institutional furniture: shared standards nobody owns. - **EU AI Act: Regulatory Framework Overview** — [Source]() — Published 2026-06-25 Transparency rules hit August 2026, high-risk obligations by December 2027. Governance language on a regulatory calendar becomes system requirements with deadlines. - **Visa and OpenAI: Building the Future of AI Commerce** — [Source]() — Published 2026-06-25 Spending limits, merchant restrictions, tokenized credentials, fraud monitoring. Payment networks are shipping pre-built operational guardrails before agentic commerce fully arrives. - [What Governance Governs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Governance Gap Companies with governance tooling deploy twelve times more AI projects to production. Only 4 of 13 frontier-autonomy agents disclose safety evaluations for agentic deployment. The first figure tells you whether a system has been authorized to run. The second tells you whether anyone has rigorously checked what it does once running. They share a vocabulary. They measure fundamentally different things. And the infrastructure accumulating around the first may be quietly relieving pressure to build the second. - [The Test Suite Was the Hero]() — By [Nora Kaplan]() · Published 2026-06-12 · Format: Verification at Scale Anthropic's Dynamic Workflows can now orchestrate a thousand subagents in parallel. The showcase was a Bun runtime port: 750,000 lines of Zig to Rust, 99.8% test pass rate, eleven days. Impressive. But research on Claude's failure patterns finds that 71% of failures are consistent misinterpretation, not random error. A thousand agents inheriting the same flawed specification converge, confidently, on the same wrong answer. The Bun port had a deterministic test suite to catch that. Most enterprise domains don't. - [What the Bill Can't Measure]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Meter Drops GitHub Copilot moved to metered billing on June 1, and organizations can finally see where their AI development spend is going. That's a real step forward. The natural parallel is cloud FinOps, which saved billions by making waste visible. An idle VM is idle, and the bill reflects it. A confident, systematically wrong code suggestion consumes exactly the same credits as a correct one. Cost now has real infrastructure behind it, so organizations will build discipline around consumption. Consumption, meanwhile, has no reliable relationship to correctness. - [The Data Perimeter Split Both Architectures in Half]() — By [Rina Takahashi]() · Published 2026-05-27 · Format: The Perimeter Problem Last week, Anthropic and OpenAI both responded to the same brute constraint: regulated enterprise data cannot leave the building. Each vendor split the agent to accommodate that boundary. Anthropic moved tool execution inside the customer perimeter but kept the reasoning loop on its own infrastructure. OpenAI announced an on-premises partnership with Dell without specifying where inference actually runs. Neither architecture co-locates governance with the consequential decisions. When something goes wrong, the person who needs to intervene can kill the connection but has no way to inspect or redirect the reasoning that got there. ### [Foundations]() Conceptual clarity earned from building at scale - [The OTel GenAI Spec Has an Implicit Reader]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Trace Anatomy The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't. - [Four Stories About the Same Purchase]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Legibility Gap Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own. - **OWASP Top 10 for Agentic Applications 2026** — [Source]() — Published 2026-06-25 Agent risk scales with authority and side effects, not just model vulnerability. - **EU AI Act: Regulatory Framework for Artificial Intelligence** — [Source]() — Published 2026-06-25 High-risk AI systems must log actions, document decisions, and guarantee human oversight. - **NIST SP 800-63B: Digital Identity Guidelines for Authentication** — [Source]() — Published 2026-06-25 Identity infrastructure reads automated, cloud-origin access as a fraud signal, not proof of delegation. - **OWASP Non-Human Identities Top 10** — [Source]() — Published 2026-06-25 Service account risks compound when the credential holder can reason and plan. - **MCP 2025-06-18 Authorization Specification** — [Source]() — Published 2026-06-25 The protocol settles transport-layer auth mechanics but leaves governance questions explicitly open. - **Users Deserve More Than the Agent's Own Story** — [Source]() — Published 2026-06-25 The person who delegated the task needs to confirm their intent was followed, constraints held, and the outcome actually matches what they asked for. Instead, they get the agent's self-reported summary. Step-by-step visibility, constraint status at each decision point, and a binding link between what was approved and what was executed? Almost never there. - **Developers Are Best Served, but Gaps Remain** — [Source]() — Published 2026-06-25 Developers have the richest tooling today. OpenTelemetry's GenAI conventions cover model calls, tool invocations, latency, and errors. Still, production reveals blind spots: replay capability, final-state verification against the systems the agent actually touched, cost attribution at workflow granularity, and records that tie approvals to specific executions. - **Service Providers Can't Tell Who Sent the Request** — [Source]() — Published 2026-06-25 When a service receives a request from an agent, the fundamental question is simple: is this session legitimately delegated, and should we treat it as authorized? No standard mechanism lets a browser-based agent declare its identity or delegation chain in a way the receiving service can verify. Most anti-abuse systems just flag automation as suspicious. - **Auditors Keep Getting Logs Built for Debugging** — [Source]() — Published 2026-06-25 Auditors need reproducible evidence: who authorized what, whether policies were followed, and whether final states are correct across every system the agent touched. What they actually receive are engineering traces built to diagnose failures. Separation of principals, constraint records at action boundaries, delegation-chain evidence? These are rarely captured in any structured form. - **Regulators Need Records That Don't Exist Yet** — [Source]() — Published 2026-06-25 Regulators want documentation of oversight mechanisms, risk controls, incident definitions, and operating boundaries. Reasonable asks. But current agent systems produce neither regulator-legible records nor governance artifacts. Proving interruptibility, demonstrating human oversight design, reporting incident rates against exposure denominators: these require records most deployments never generate in the first place. - **Payment Rails Are Ahead of Every Other Channel** — [Source]() — Published 2026-06-25 Commerce counterparties need transaction-level proof of consumer intent, spending limits, and agent identity for fraud scoring and dispute resolution. Visa and Mastercard are building agent-recognition rails, which puts them ahead of the curve. Generic web automation for procurement, benefits enrollment, and vendor management has nothing comparable for binding a mandate to a transaction. - **A Login Is Not a Mandate to Act** — [Source]() — Published 2026-06-25 Session cookies prove someone authenticated. They say nothing about whether that person wanted this particular agent to book this particular flight at this particular price. Sufficient intent proof ties approval to the specific execution target, page state, and consequences. Approving a plan and authorizing what actually happened are different things entirely. - **Seven Links Between a User and a Receipt** — [Source]() — Published 2026-06-25 Robust delegation keeps seven elements distinct: human requester, agent identity, runtime identity, tool authorization, resource audience, approval binding, and audit record. Collapse any one of them and disputes become a fog. Token audience validation matters here because without it, credentials drift silently across service boundaries. - **Rules in Someone's Head Produce Zero Evidence** — [Source]() — Published 2026-06-25 If spending limits and vendor restrictions live only in policy documents nobody reads, agents can't demonstrate they stayed within bounds. Compliance that holds up requires versioned, machine-readable rules referenced in the execution trace, with per-action assertions computed before the action runs. Not claimed after. - **The Agent Said It Worked. Did It?** — [Source]() — Published 2026-06-25 A clean transcript can sit alongside a duplicate order, a wrong database entry, or a leaked credential. Verification means querying the authoritative downstream system directly and comparing intended state against observed state. Worth noting: even failed agent runs may have changed something on the other side. - **Inputs and Outputs Break Into Separate Problems** — [Source]() — Published 2026-06-25 Where did the retrieved data come from, and was it licensed for this use? That's one problem. Whether the generated output maintains integrity from creation through delivery is another. C2PA addresses output credentials reasonably well. Input-source provenance at scale remains largely an open question. - **Records Must Convince People Who Weren't There** — [Source]() — Published 2026-06-25 The parties who most need to trust an execution record are the ones absent when it ran: the merchant, the auditor, the regulator months later. That trust requires cryptographic hashing at production time, append-only storage, trusted timestamps, and legibility without access to proprietary agent-platform tooling. - [The Context Window Fills Up Long Before It's Full]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Conceptual Piece A model with a 200K token context window starts degrading at 50K. Selective retrieval using a quarter of the tokens beats full-context loading by nearly 20 accuracy points. The finding gives "context engineering" its teeth. The work is keeping the context window clean. But teams choosing a context strategy today are choosing a reliability envelope with no data on what that envelope actually contains. The research to measure it hasn't been done. - [Where the Snapshot Lives Changes Everything Else]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Tool Architecture Study Playwright now ships two modes for agent-driven browser automation. One streams page snapshots into the LLM's context window. The other writes them to disk as files. The token difference is 4x. The difference in what each mode leaves behind after the session ends is harder to quantify and harder to ignore. One produces artifacts you can diff and inspect independently of the agent's own account. The other stores observation and inference in the same stream, inseparable after the fact. Where the snapshot lives turns out to determine what you can verify. - [The Accessibility Tree Wasn't Built for AI Agents]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Perception Walkthrough Accessibility trees were built for screen readers, not AI agents. But both share the same constraint: neither can see a web page. Both need it translated into structured, sequential text. Playwright MCP builds its entire browser automation architecture around that convergence, using accessibility snapshots that cost a fraction of what screenshots require per interaction. The token savings are real and they compound across multi-step workflows. So does the downside: on 95.9% of the web's top million pages, the underlying markup has detectable failures. The agent inherits every one of them. - [The Number You Didn't Ask About]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: Reliability Lens An agent succeeds at a task 70% of the time. Frame the results one way and you can report 97%. Frame them differently and you report 34%. Same system, same math, a 63-point gap created entirely by which question the benchmark decided to answer. Nearly every major agent benchmark chooses the generous framing. The number that captures what production actually feels like, consecutive successes across a full workload, is one that almost nobody reports. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [What a Click Carries]() — By [Rina Takahashi]() · Published 2026-06-24 · Format: Central Idea Piece When a person clicks a button on a webpage, the infrastructure only sees the click. It never sees the reading, the context, the judgment, the acceptance of responsibility that preceded it. It never had to. The entire web assumed a human was present, so thoroughly that nobody wrote it down. Now agents produce identical HTTP requests without any of that invisible context. The sessions still fire. But the click has stopped carrying what every downstream system quietly depended on it to carry. - [What WorkArena's Task Design Makes Visible]() — By [Nora Kaplan]() · Published 2026-06-24 · Format: Builder Profile One benchmark task asks an agent to create a hardware asset in ServiceNow. The agent fills in fields, clicks submit, reaches a confirmation screen. WorkArena ignores the confirmation screen entirely. Its validator queries the database directly, checking whether saved values match the spec. An agent that navigated perfectly but corrupted data underneath would look like a success to anyone watching. That design choice, buried in validation code, surfaces a problem anyone deploying agents inside enterprise systems will eventually have to solve. - [Show Me the Record — A Compliance Officer Confronts Her First Agent Workflow]() — Published 2026-06-24 *Prudence Tracewell describes herself as "the person whose signature means the firm thought about it." As Head of Supervisory Compliance at a mid-tier broker-dealer, she has spent fourteen years ensuring that when regulators come asking questions, the answers already exist in the record. Before that, she spent six years as an SEC examiner. She knows what those questions sound like from both sides of the table.* - [Money Makes Agents Legible]() — By [Rina Takahashi]() · Published 2026-06-24 An agent that fills out a form or monitors a price can operate in a gray area for a while. Nobody asks for its credentials. But the moment an agent tries to spend money on someone's behalf, a whole chain of participants needs to know it's there. - **MCP Authorization Specification (2025-06-18)** — [Source]() — Published 2026-06-24 Names the confused-deputy problem with real precision, then makes authorization optional. The gap between specification and enforcement is the story. - **OpenAI's Computer-Using Agent (January 2025)** — [Source]() — Published 2026-06-24 The 58.1% WebArena score against 78.2% human performance is notable. The safety architecture that gap demands is more so. - **OWASP Top 10 for Agentic Applications (2026)** — [Source]() — Published 2026-06-24 Quietly redraws the threat model: the unit of security analysis becomes multi-step autonomous action, not individual model output. - **Anthropic Computer Use Tool Documentation** — [Source]() — Published 2026-06-24 Read the implementation guidance and you see the operational price of treating the GUI as an API: sandboxed containers, domain allowlists, human confirmation at every turn. - **OpenAI on Prompt Injection (November 2025)** — [Source]() — Published 2026-06-24 Makes explicit what practitioners already feel: injection risk scales with agent authority. More access and longer autonomy raise the cost of each failure. - [Retry Logic Assumes a Contract That LLM Agents Can't Keep]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: Retry Collision Retry logic in distributed systems works because of a quiet contract: same input, same execution path. An idempotency key ties attempts together, and the server returns a cached result instead of executing again. Agent systems inherit this discipline. But when an LLM decides which tools to call, token sampling variance means the same prompt can produce different tool selections, different parameters, different ordering on retry. Each individual tool call can be perfectly idempotent, and the composed sequence still produces different side effects on each attempt. One developer documented an agent double-charging a customer $847 when a timed-out payment triggered a retry that took a different path through the same workflow. - [The Web Wasn't Built for This]() — By [Nora Kaplan]() · Published 2026-06-19 · Format: Builder Profile To a person with a browser, a form field is a text box. To a machine trying to operate that same page, it's a hundred lines of nested HTML with the semantically important element buried under presentational scaffolding a visual cortex would simply ignore. Magnus Müller's Browser Use project started from a hobbyist's question about connecting LLMs to the web. His design choices since — rejecting vision-based navigation, treating site instability as a condition to absorb — trace the real complexity: the web was built for human interpreters, and operating it as a machine surfaces a mismatch that no selector strategy can bridge. - [The Wall That Used to Be There]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Enforcement Gap An agent running on an 8K-context model that entered a loop used to crash. The window filled, the API errored, the run died. That was an accidental safety mechanism, and it worked. Context windows now stretch past a million tokens, and the accidental wall is gone. A recent multi-agent loop ran for eleven days and $47,000 before a human noticed the billing dashboard. The team had monitoring. They could see it happening. They couldn't stop it programmatically. Watching and stopping, it turns out, require entirely different infrastructure. - [APIs for Websites That Don't Have APIs]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Builder Profile Suchintan Singh describes Skyvern as building "APIs for websites that don't have APIs." It sounds like a pitch deck line. But the phrase does real work if you've spent years watching ML platforms get measured by marketplace revenue, not model accuracy, and Selenium scripts break every time a frontend developer renames a CSS class. His team built a harder benchmark, scored below 50% on it, and published the results anyway. The architecture and the measurement both point the same direction: web agents are an infrastructure problem that the AI framing keeps obscuring. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [What the Click Was Holding Together]() — By [Nora Kaplan]() · Published 2026-06-24 · Format: Anchor Essay A mouse click is four assertions compressed into one gesture: I'm here, I see what I'm doing, I have the authority, and I mean to do it now. Nobody needed to name those components separately, because a person was always holding them together. Audit logs, session tokens, approval workflows — all built on the assumption that the click was self-interpreting. Now software can reproduce the gesture perfectly while the meaning doesn't arrive with it. The screen can operate. It cannot testify. - [The Checkbox That Can't Testify]() — By [Rina Takahashi]() · Published 2026-06-25 The W3C defines CAPTCHA as a "[Completely Automated Public Turing Test](https://www.w3.org/TR/turingtest/)," built to tell computers and humans apart. That framing made sense when the threat was a script trying to scrape a form or stuff a ballot box. Human or not. Binary gate. - [The 3am Screenshot That Revealed the Bot Was Never Really Inside the System]() — Published 2026-06-25 *Deb Kowalski led the RPA Center of Excellence at a large Midwest insurer from 2018 to 2021. She started in claims processing and got promoted into automation because she understood the workflows better than anyone in IT. She spent the next three years discovering what that knowledge was actually worth when the bots stopped working.* - [The Click Was Never Simple]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Mechanics and Money Playwright's auto-waiting documentation lists five preconditions that must be satisfied before a click executes. Attached. Visible. Stable. Receiving events. Enabled. A person resolves all five in a glance without noticing. Written out for a machine, they read like a catalog of everything that's ever gone wrong with a button. - [Money Complains in Structured Formats]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Mechanics and Money Visa, Mastercard, and Stripe are building agent payment infrastructure. The revealing detail is what happens when a purchase goes wrong. Chargebacks demand structured evidence, and structured evidence forces a distinction most web automation has never needed: the difference between performing an action and being authorized to perform it. - **RFC 9309 — The Robots Exclusion Protocol** — [Source]() — Published 2026-06-25 The full text of the standard includes a line worth memorizing: its rules "are not access authorization." That single caveat, baked in from the beginning, now sits at the center of every AI data-licensing dispute. - **Ironies of Automation — Lisanne Bainbridge (1983)** — [Source]() — Published 2026-06-25 Written in 1983, five pages long, and still the sharpest description of what happens when you automate the easy parts: the human inherits the hardest residual decisions with the least context to make them. Every AI approval button is a case study waiting to be filed here. - **Visa Plugs Its Payment Network into ChatGPT** — [Source]() — Published 2026-06-25 AP's reporting on the first major payment network building agent recognition into existing card rails. Read it for the Forrester analyst who notes, almost in passing, that dispute protocols for agent-initiated purchases don't actually exist yet. - **Consent in Crisis: The Rapid Decline of the AI Data Commons** — [Source]() — Published 2026-06-25 Longpre and colleagues audited 14,000 web domains and found robots.txt files contradicting their own sites' Terms of Service at remarkable scale. A detailed look at what happens when a voluntary signaling protocol gets pressed into service as legal consent. - **Playwright Documentation — Auto-waiting** — [Source]() — Published 2026-06-25 Five conditions a programmatic click must satisfy before it fires. A surprisingly readable catalog of everything that goes wrong between "the element exists on the page" and "someone actually clicked it." - **OWASP Non-Human Identities Top 10 (2025)** — [Source]() — Published 2026-06-25 When software agents use machine credentials, audit logs lose the ability to tell who actually acted. OWASP names this session-attribution gap as a live security vulnerability, which gives the identity question real teeth. - [The Screen Scraping Cycle]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: The Standard and the Cycle In 1986, IBM shipped a tool that let programs read characters off a terminal screen because mainframe applications had no APIs. The assumption was that this was temporary. Forty years and several technology generations later, browser agents automate the web using the same basic logic: parsing whatever the human sees. Each generation believed it was building a workaround. Each time, the workaround became infrastructure. - [The W3C Moment]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: The Standard and the Cycle In June 2018, the W3C published a spec describing software that "emulates the actions of a real person using the browser." They meant testing tools. That sentence now reads like a product description for AI agents. WebDriver's authors knew they were building something more general than a test harness. They just scoped it as one. The word "primarily" left room for everything that followed. - [The Thread That Runs Through the Browser]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: The Testing Substrate In 2004, a developer at ThoughtWorks wrote a JavaScript tool to stop his colleagues from manually clicking through a billing app. He named it Selenium, as a joke. Twenty-two years later, AI agents open browsers using protocols descended from that tool, reading page structures originally built for screen readers, deciding what to do on sites they've never encountered. Every layer of browser automation was a reasonable response to the problem directly in front of it. The problem in front of it kept quietly changing. - [The Organizational Inheritance]() — By [Rina Takahashi]() · Published 2026-06-11 · Format: Two Kinds of Debt RPA's governance problems didn't arrive all at once. They accumulated quietly: orphaned bots running on departed employees' credentials, exception-handling logic that lived in one person's head, audit trails nobody maintained. The questions were always answerable. Who owns this? What happens when it fails? Organizations often didn't ask until something broke. AI agents face the same questions now. The teams deploying them are rarely the teams that lived through the answers. ### [Vision]() Where human-AI collaboration is heading - [The Accountability Inversion]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Central Thesis The assumption is straightforward: better models unlock broader autonomy, and the most technically adventurous organizations lead agent adoption. The evidence points somewhere unexpected. Heavily regulated, accountability-dense environments are reaching production first. Compliance monitoring, clinical documentation, financial back-office. The places you'd expect to move slowest are moving fastest. The gating factor for agent deployment at scale turns out to be whether anyone can later prove who authorized what, within what limits, and where the records live. Banks solved a version of this problem fifty years ago. The structural logic is worth revisiting. - [Why the Most Regulated Industries Are Deploying Agents First]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Accountability in Practice Mastercard's Agent Pay announcement read more like a policy document than a product launch. That's the point. Payments, financial compliance, and regulated operations are deploying agents faster than anyone expected, drawing on decades of managing authorization, audit trails, and dispute resolution to provide exactly the scaffolding agents need. Regulation pre-answered the hardest delegation questions. Everyone else is still improvising. - [The Demo-Mode Trap]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Accountability in Practice Marketing, content generation, internal ops. Low regulatory exposure, minimal chargeback liability, and nobody goes to jail if a draft is slightly off. These should be the easy domains for agent deployment. Yet McKinsey found no more than 10% of organizations scaling agents in any single function. Without the forcing function of expensive failure, teams never built the delegation infrastructure that regulated industries take for granted. Agents stay stuck as fast interns. - [We Built the Infrastructure Agents Need — We Just Built It for Examiners]() — Published 2026-06-25 *The following is a hypothetical interview. Any resemblance to an actual compliance executive willing to speak on the record about agent deployment in regulated financial services is, frankly, implausible enough to confirm the point.* - [The Compliance Stack That Agents Already Needed]() — By [Nora Kaplan]() · Published 2026-06-25 Five weeks from now, the EU AI Act's [Article 50 transparency rules](https://digital-strategy.ec.europa.eu/en/policies/regulatory-framework-ai) take effect. Any AI system that interacts directly with a person must disclose that fact. AI-generated content needs machine-readable marking. Deepfakes require visible labels. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-06-25 88% of organizations report using AI, but fewer than 10% have scaled agents in any single function. The gap between adoption and actual EBIT impact tells you where the accountability problem lives. - **Mastercard Unveils Agent Pay, Pioneering Agentic Payments Technology** — [Source]() — Published 2026-06-25 Mastercard's framework for agent registration, scope control, and dispute resolution is the clearest public example of accountability architecture being built before mass deployment, not bolted on after. - **Visa Plugs Its Payment Network into ChatGPT, Letting AI Agents Shop and Pay for Users** — [Source]() — Published 2026-06-25 Spending limits, merchant restrictions, human approval gates. Visa's live integration with ChatGPT shows what agentic commerce looks like when trust infrastructure comes first and scale follows. - **OWASP Top 10 for Agentic Applications for 2026** — [Source]() — Published 2026-06-25 The security community now treats agentic systems as a categorically different risk surface from static language models. Worth reading for the taxonomy alone. - **Generative AI at Work** — [Source]() — Published 2026-06-25 A field study of 5,000+ customer support agents found AI lifted novice productivity by 15%, while top performers who deferred to it saw quality erode. The accountability implications of uneven gains deserve more attention than they're getting. - **The 2026 AI Index Report** — [Source]() — Published 2026-06-25 Stanford's annual synthesis captures the tension in one place: capability benchmarks approaching saturation while documented AI incidents climbed to 362. If you read one broad overview, make it this. - [The Conditions for Meaning]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Individual Shift / Organizational Conditions If the individual question is whether curating AI outputs builds real expertise, the organizational question is whether anyone is designing work so the answer matters. Research identifies specific choices — autonomy, surveillance posture, explainability — that determine whether augmented work retains meaning or hollows out. Eighty-four percent of organizations haven't redesigned jobs around AI. They're making these decisions by accident, and the consequences compound in ways no productivity metric will catch. - [The Taste You Didn't Earn]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Individual Shift / Organizational Conditions You spend your days reviewing, refining, and redirecting AI-generated work. You learn where the model hallucinates, which prompts produce brittle outputs, how to spot a confident paragraph that's subtly wrong. This feels like expertise. Research suggests it may be something else entirely — a detailed map of the agent's failure modes that sits beside domain knowledge without being it. Nearly half of the most advanced AI users seem to sense the difference. They're quietly hedging. - [What Smoothness Costs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: The Texture Problem When AI took over compliance report drafting at a pharmaceutical company, a three-day analyst task collapsed to overnight turnaround. The productivity gain was obvious. What those three days had actually contained was harder to name: the conditions under which analysts developed an internal sense of what compliant work feels like. Organizations are stripping out friction they've never tried to measure. The evidence that some of it was sustaining expertise, not impeding it, is starting to arrive. - [Monitoring the Monitors]() — By [Nora Kaplan]() · Published 2026-06-11 · Format: Lessons and Designs Organizations are building increasingly sophisticated systems to monitor whether their AI agents perform well. Almost none are checking whether the humans evaluating those agents still can. Evidence from the few domains where measurement exists — developer productivity, medical diagnostics — reveals a durable gap between perceived and actual human capability. The instrument to detect oversight degradation needs to be built now, while the people who could design it still have the expertise to know what it should measure. ## More - [Publication guide]() - [Issue archive]()