--- title: "Issue 36" canonical: "https://current.tinyfish.ai/issue/36" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/36" issue: 36 description: "Visa just wired its entire payment network into ChatGPT. Spending limits, approval steps, fraud monitoring. All of it, so that when an agent-initiated purchase goes sideways, someone can figure out what happened and who said it was okay. We kept coming back to that image. Agents can act in the world now. Proving the action was supposed to happen is a completely different kind of engineering, and most organizations never fully solved that problem for humans either. Agents are just the reason they can't keep pretending otherwise." authors: ["Sable Whitford","Nora Kaplan","Rina Takahashi"] published: 2026-07-06 updated: 2026-11-05 articles: 102 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 36 Visa just wired its entire payment network into ChatGPT. Spending limits, approval steps, fraud monitoring. All of it, so that when an agent-initiated purchase goes sideways, someone can figure out what happened and who said it was okay. We kept coming back to that image. Agents can act in the world now. Proving the action was supposed to happen is a completely different kind of engineering, and most organizations never fully solved that problem for humans either. Agents are just the reason they can't keep pretending otherwise. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. - **The Bouncer Doesn't Recognize the New Crowd** — [Source]() — Published 2026-07-02 A June 2026 study found browsing agents sailed past every tested anti-bot mechanism: robots.txt, CAPTCHAs, proof-of-work, Cloudflare's free tier. They use real browsers doing ordinary things. The web's old binary, human or script, simply doesn't describe who's showing up anymore. - **The Best Detection Signal Sits on the Shelf** — [Source]() — Published 2026-07-02 FP-Agent identified all seven tested browsing agents from humans by watching how they type, scroll, and move a mouse. Cloudflare's commercial detection caught one. Browser fingerprints barely help because agents share them. The research is solid. The industry hasn't picked it up. - **Agents Can Connect Before Anyone Checks Credentials** — [Source]() — Published 2026-07-02 A2A Agent Cards describe identity and capabilities. MCP authorization remains optional, transport-level. Both protocols nail how agents find and reach each other. Neither settles what counts as verified authority or valid delegation. Think of it as a well-designed envelope with no seal. - **Payments Already Enforce What Others Still Debate** — [Source]() — Published 2026-07-02 Visa's ChatGPT integration scopes tokenized credentials to specific agents, enforces spending limits before authorization, and monitors fraud in real time. Decades of liability infrastructure around disputed transactions gave payments a head start. Recognition here is institutionally required, not aspirational. - **Security Sees the What but Misses the Why** — [Source]() — Published 2026-07-02 Uber built its ADR system, processing over 10,000 agent sessions daily, because traditional endpoint detection catches file writes but not the prompts or reasoning behind them. A compromised agent and a legitimate one look identical in the logs. The blind spot is intent. - **Agents Announce Themselves but Nobody Checks the ID** — [Source]() — Published 2026-07-02 A2A Agent Cards and MCP tool descriptions let agents say what they are and what they can do. Authorization logic stays implementation-specific. A well-formed card from a compromised registry is still well-formed. Without independent verification, self-description is etiquette, not security. - **FP-Agent: Fingerprinting AI Browsing Agents** — [Source]() — Published 2026-07-02 A controlled study of seven browsing agents shows that behavioral signals like typing cadence, scrolling rhythm, and mouse movement reliably separate agents from humans, even when the underlying browser fingerprints are identical across frameworks. - **On the Internet, Nobody Knows You're an LLM Bot** — [Source]() — Published 2026-07-02 Tests web agents against production anti-bot defenses and finds some sailed past every layer: robots.txt, CAPTCHAs, proof-of-work, commercial solutions. Yet multi-layer fingerprinting still distinguished every evaluated agent from human traffic. - [You Deployed the Agent. Can You See What It's Doing?]() — By [Nora Kaplan]() · Published 2026-07-02 When an employee writes a file, endpoint detection logs the write. If something goes wrong, you can ask the employee what they were thinking. When an agent writes a file, endpoint detection still logs the write. But the reasoning that produced it, the prompt that initiated it, the sequence of tool calls between intent and action: none of that shows up in traditional security tooling. - **Visa Plugs Its Payment Network Into ChatGPT, Letting AI Agents Shop and Pay for Users** — [Source]() — Published 2026-07-01 What happens to dispute logic when the entity swiping the card has no legal personhood. - **Would You Let Robots Spend Your Money? Google Is Betting on It** — [Source]() — Published 2026-07-01 Google calls its agent a "matchmaker." Retailers see something closer to a new gatekeeper. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-07-01 62% experimenting, no function above 10% scaling. The governance gap in one stat. - **2025: The State of Generative AI in the Enterprise** — [Source]() — Published 2026-07-01 $37B in enterprise AI spend, 76% purchased. Shadow AI is outrunning institutional recognition infrastructure. - **Governance Gaps in Agent Interoperability Protocols: What MCP, A2A, and ACP Cannot Express** — [Source]() — Published 2026-07-01 A preprint naming the quiet part: current protocols handle connection but lack primitives for contestation. - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. - [What Governance Governs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Governance Gap Companies with governance tooling deploy twelve times more AI projects to production. Only 4 of 13 frontier-autonomy agents disclose safety evaluations for agentic deployment. The first figure tells you whether a system has been authorized to run. The second tells you whether anyone has rigorously checked what it does once running. They share a vocabulary. They measure fundamentally different things. And the infrastructure accumulating around the first may be quietly relieving pressure to build the second. - [The Test Suite Was the Hero]() — By [Nora Kaplan]() · Published 2026-06-12 · Format: Verification at Scale Anthropic's Dynamic Workflows can now orchestrate a thousand subagents in parallel. The showcase was a Bun runtime port: 750,000 lines of Zig to Rust, 99.8% test pass rate, eleven days. Impressive. But research on Claude's failure patterns finds that 71% of failures are consistent misinterpretation, not random error. A thousand agents inheriting the same flawed specification converge, confidently, on the same wrong answer. The Bun port had a deterministic test suite to catch that. Most enterprise domains don't. - [What the Bill Can't Measure]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Meter Drops GitHub Copilot moved to metered billing on June 1, and organizations can finally see where their AI development spend is going. That's a real step forward. The natural parallel is cloud FinOps, which saved billions by making waste visible. An idle VM is idle, and the bill reflects it. A confident, systematically wrong code suggestion consumes exactly the same credits as a correct one. Cost now has real infrastructure behind it, so organizations will build discipline around consumption. Consumption, meanwhile, has no reliable relationship to correctness. ### [Foundations]() Conceptual clarity earned from building at scale - [Capability Surfaces and Consequence Surfaces]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Conceptual Anchor Agent demos keep getting more impressive. An agent navigates a website, checks out, coordinates with other agents via A2A, assembles a report. The capability is real. And yet something tells you this isn't shipping to production next quarter. That instinct has a structural explanation: the infrastructure for what agents can reach and invoke is expanding far faster than the infrastructure for proving what happened, whether it was authorized, and what to do when something goes wrong. Two surfaces, two timescales, and the gap between them is where deployments stall. - [One Refund, Four Layers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Tools & Practice A browser automation framework runs five checks before a refund button click fires. The tool call carries an order ID and an amount. The auth layer verifies the connection. Every layer does its job, and none of them can answer the most basic question afterward: was this refund supposed to happen? One $47.99 reversal, traced through four layers of infrastructure, shows exactly where the checking stops. - **Visa Plugs Its Payment Network Into ChatGPT, Letting AI Agents Shop and Pay for Users** — [Source]() — Published 2026-07-01 Spending limits, merchant restrictions, fraud monitoring: Visa is building the consequence infrastructure that makes agent commerce possible at all. - **OWASP Top 10 for Agentic Applications (2026)** — [Source]() — Published 2026-07-01 A security framework built specifically for systems that plan, decide, and act across workflows. The threat model itself is the interesting part. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-07-01 62% of organizations experimenting with agents, 23% scaling them, no single function above 10% at scale. The bottleneck looks like accountability, not capability. - **MCP Authorization Specification (2025-06-18)** — [Source]() — Published 2026-07-01 Audience-bound tokens and confused-deputy risks at the protocol level. Worth reading for how authority boundaries get drawn before agents touch anything. - **OWASP Non-Human Identities Top 10** — [Source]() — Published 2026-07-01 Offboarding, secret leakage, overprivilege, long-lived credentials. Agent identity as a lifecycle problem, not a point-in-time authentication check. - **MCP Formalizes How Agents Connect to Tools** — [Source]() — Published 2026-07-01 The June 2025 MCP specification builds on JSON-RPC 2.0 to give LLM applications a standard interface to external capabilities. Servers expose three primitives: resources (data and context), prompts (templated workflows), and tools (executable functions). Authorization follows OAuth 2.1 with explicit token audience binding per RFC 8707. - **A2A Protocol Lets Agents Find Each Other** — [Source]() — Published 2026-07-01 Hosted by the Linux Foundation since June 2025 and backed by over 100 companies, A2A v0.3.0 specifies how agents discover and coordinate with peers. The key mechanism is the Agent Card: a machine-readable manifest declaring identity, capabilities, endpoints, and security requirements. - **Playwright Verifies Targets Before Every Browser Action** — [Source]() — Published 2026-07-01 Playwright's actionability system auto-waits before each interaction, confirming that elements are visible, stable (not mid-animation), enabled, and unobstructed by overlapping content. If any check fails within the configured timeout, the action raises a TimeoutError rather than clicking blindly into whatever's there. - **W3C WebDriver Specifies Remote Browser Control Primitives** — [Source]() — Published 2026-07-01 The May 2026 Working Draft defines a platform-neutral HTTP wire protocol for remote browser introspection and control, covering navigation, element interaction, script execution, and screen capture. One telling detail: its navigator.webdriver flag explicitly announces to pages that automation is driving the session. - **Visa Plugs Its Payment Network Into ChatGPT** — [Source]() — Published 2026-07-02 Visa embedded payment infrastructure directly inside ChatGPT, letting agents shop and buy at any Visa-accepting merchant. Users configure spending caps, approved merchant lists, and which purchases require human sign-off. Most early transactions, Visa expects, will still involve a person. - **Mastercard Says Agents Must Register Before Paying** — [Source]() — Published 2026-07-02 Mastercard's Agent Pay framework requires AI agents to be verified and registered before they can transact. Agentic Tokens encode consumer-set spending limits and merchant restrictions. Every agent-initiated purchase becomes identifiable across the payment chain, and authorization can be revoked in real time. - **OWASP Catalogs Ten Security Risks for Autonomous Agents** — [Source]() — Published 2026-07-02 The peer-reviewed framework targets AI systems that plan, decide, and act on their own. It covers threats from goal hijacking to rogue agent behavior, introduces "least agency" as a design principle, and draws from confirmed incidents rather than hypotheticals. - **Typing and Scrolling Patterns Give Browsing Agents Away** — [Source]() — Published 2026-07-02 UC Davis researchers instrumented a honey website to compare seven browsing agents against human visitors. Browser fingerprints alone didn't reliably distinguish them. Behavioral signals did: paste-based text entry, direct jumps to click targets, and distinctive scrolling rhythms separated agents from people every time. - **Plenty of Agent Experiments, Very Few at Scale** — [Source]() — Published 2026-07-02 McKinsey's latest State of AI survey puts numbers on a widely felt reality: 62% of organizations are experimenting with agents, but only 23% have scaled any agentic system. No single business function has crossed 10% scaled adoption. The distance between pilot and production remains vast. - **Some Agents Bypassed Every Anti-Bot Defense Tested** — [Source]() — Published 2026-07-02 A June 2026 preprint found that certain browsing agents slipped past all tested anti-bot mechanisms, CAPTCHAs and commercial protection services included. Read alongside the behavioral fingerprinting work, the picture is mixed: detection is achievable, but the adversarial floor keeps shifting underneath it. - [Four Stories About the Same Purchase]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Legibility Gap Visa's integration with OpenAI brings real payment infrastructure to AI agents: tokenized credentials, spending controls, merchant restrictions. The interesting problem starts when a purchase goes wrong. A chargeback forces every party to independently explain the same event, and an agent-initiated transaction must be legible to four audiences with incompatible evidence needs. Recording what happened is straightforward. Making it understandable to everyone who has to adjudicate demands something a comprehensive log can't provide on its own. - [The OTel GenAI Spec Has an Implicit Reader]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Trace Anatomy The OpenTelemetry GenAI semantic conventions define how to trace agent workflows: which agent ran, what tools it called, how many tokens it consumed. Read closely, the spec's attributes reveal a consistent design choice about who's looking at the data. It's a developer, diagnosing failures. The conventions are genuinely useful for that purpose. When the reader shifts to an auditor tracing authorization chains, an operator enforcing cost boundaries, or a compliance team documenting human oversight, the attributes that exist start outlining the shape of the ones that don't. - [The Context Window Fills Up Long Before It's Full]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Conceptual Piece A model with a 200K token context window starts degrading at 50K. Selective retrieval using a quarter of the tokens beats full-context loading by nearly 20 accuracy points. The finding gives "context engineering" its teeth. The work is keeping the context window clean. But teams choosing a context strategy today are choosing a reliability envelope with no data on what that envelope actually contains. The research to measure it hasn't been done. - [Where the Snapshot Lives Changes Everything Else]() — By [Rina Takahashi]() · Published 2026-06-18 · Format: Tool Architecture Study Playwright now ships two modes for agent-driven browser automation. One streams page snapshots into the LLM's context window. The other writes them to disk as files. The token difference is 4x. The difference in what each mode leaves behind after the session ends is harder to quantify and harder to ignore. One produces artifacts you can diff and inspect independently of the agent's own account. The other stores observation and inference in the same stream, inseparable after the fact. Where the snapshot lives turns out to determine what you can verify. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Shunyu Yao Taught Agents to Reason, Then Learned to Stop Trusting the Transcript]() — By [Rina Takahashi]() · Published 2026-07-02 · Format: Builder Profile In 2022, Shunyu Yao gave agents a grammar for reasoning. ReAct became the template: think, act, observe, repeat. The reasoning trace was the proof. Three years later, Yao built tau-bench, which ignores the trace entirely and checks the database. GPT-4o completes retail tasks about 61% of the time on a single attempt. Require it to succeed consistently across eight runs, and the number drops below 25%. The person who taught agents to show their work now measures how much distance sits between a convincing transcript and a correct outcome. - [The Dispute File Is the Spec]() — By [Rina Takahashi]() · Published 2026-07-02 · Format: Core Idea Piece When a cardholder calls their bank, it doesn't matter that the agent completed the purchase correctly. The file decides everything: the evidence a merchant must produce to defend the transaction. Visa and Mastercard have spent decades codifying what a defensible action looks like. Now that machinery applies to agent-mediated payments. And the questions it asks about authorization, scope, and remedy are indifferent to reasoning quality or benchmark scores. They ask whether what happened can survive challenge. Most agent systems aren't producing the artifacts that would let them answer. - [Filing a Plumbing Complaint Under "Electrical"]() — Published 2026-07-02 *Payment networks have spent decades refining the taxonomy of things that go wrong between a consumer and a merchant. Eight reason code categories. Hundreds of sub-codes. Evidence requirements calibrated to specific failure modes: fraud, duplicate charges, products never received. The system assumes two parties and a human decision.* - [The Fingerprint Knows You're an Agent. Now What?]() — By [Rina Takahashi]() · Published 2026-07-02 Researchers can now [identify web agents](https://arxiv.org/abs/2605.01247) by how they type, scroll, and move a cursor. Paste-based form fills, direct jumps to click targets, repeated delete-and-retype loops. One study detected all seven agents tested; Cloudflare caught one. A [June preprint](https://arxiv.org/abs/2606.20910) went further, fingerprinting agents at the network layer too. Within weeks, developers were publishing techniques to mimic human mouse trajectories. - **Visa Embeds Payments Inside ChatGPT** — [Source]() — Published 2026-07-02 When consumer intent and merchant processing both check out but the agent layer got it wrong, whose dispute is it? - **Mastercard Unveils Agent Pay** — [Source]() — Published 2026-07-02 The full delegation stack on paper: register, tokenize, verify, control. Production evidence still forthcoming. - **OWASP Top 10 for Agentic Applications (2026)** — [Source]() — Published 2026-07-02 Goal hijacking, tool misuse, identity abuse. Authorization alone never constituted accountability, and agents prove it. - **τ-bench: A Benchmark for Tool-Agent-User Interaction** — [Source]() — Published 2026-07-02 Evaluates database state, not conversational polish. The pass^k metric quantifies exactly the repeatability that accountability demands. - **The State of AI in 2025 (McKinsey)** — [Source]() — Published 2026-07-02 Broad adoption, rare scaling. Under 10% deploy agents in any single function. Workflow redesign correlates with actual results. - **FP-Agent: Fingerprinting AI Browsing Agents** — [Source]() — Published 2026-07-02 Research classifiers caught all seven agents tested. Commercial bot defenses caught one. The recognition gap is wide open. - [What WorkArena's Task Design Makes Visible]() — By [Nora Kaplan]() · Published 2026-06-24 · Format: Builder Profile One benchmark task asks an agent to create a hardware asset in ServiceNow. The agent fills in fields, clicks submit, reaches a confirmation screen. WorkArena ignores the confirmation screen entirely. Its validator queries the database directly, checking whether saved values match the spec. An agent that navigated perfectly but corrupted data underneath would look like a success to anyone watching. That design choice, buried in validation code, surfaces a problem anyone deploying agents inside enterprise systems will eventually have to solve. - [What a Click Carries]() — By [Rina Takahashi]() · Published 2026-06-24 · Format: Central Idea Piece When a person clicks a button on a webpage, the infrastructure only sees the click. It never sees the reading, the context, the judgment, the acceptance of responsibility that preceded it. It never had to. The entire web assumed a human was present, so thoroughly that nobody wrote it down. Now agents produce identical HTTP requests without any of that invisible context. The sessions still fire. But the click has stopped carrying what every downstream system quietly depended on it to carry. - [Retry Logic Assumes a Contract That LLM Agents Can't Keep]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: Retry Collision Retry logic in distributed systems works because of a quiet contract: same input, same execution path. An idempotency key ties attempts together, and the server returns a cached result instead of executing again. Agent systems inherit this discipline. But when an LLM decides which tools to call, token sampling variance means the same prompt can produce different tool selections, different parameters, different ordering on retry. Each individual tool call can be perfectly idempotent, and the composed sequence still produces different side effects on each attempt. One developer documented an agent double-charging a customer $847 when a timed-out payment triggered a retry that took a different path through the same workflow. - [The Web Wasn't Built for This]() — By [Nora Kaplan]() · Published 2026-06-19 · Format: Builder Profile To a person with a browser, a form field is a text box. To a machine trying to operate that same page, it's a hundred lines of nested HTML with the semantically important element buried under presentational scaffolding a visual cortex would simply ignore. Magnus Müller's Browser Use project started from a hobbyist's question about connecting LLMs to the web. His design choices since — rejecting vision-based navigation, treating site instability as a condition to absorb — trace the real complexity: the web was built for human interpreters, and operating it as a machine surfaces a mismatch that no selector strategy can bridge. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [What It Takes to Click a Button]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: The Misread Map A person sees a button and clicks it in half a second. The gesture is so smooth it barely registers as a decision. But land that same click programmatically and you discover an elaborate chain of checks: Is the element visible? Has the page shifted? Is something covering the target? Each check patches a gap the DOM, the web's structural blueprint published in 1998, was never designed to bridge. Screen readers found that gap first. Test automation found it next. Now web agents are finding it at an entirely different scale. - [The Tree That Switched Audiences]() — By [Rina Takahashi]() · Published 2026-07-01 A parallel structure shadows every page in your browser. The accessibility tree takes a button decorated with CSS classes, framework hashes, and utility tags and reduces it to two facts: its role and its name. *Button. Sign In.* - [The Skeleton and the Body — An Accessibility Engineer Watches AI Agents Inherit Her Work]() — Published 2026-07-01 In 2025, something quietly remarkable happened: the dominant method for AI agents to perceive a web page became the accessibility tree. The same data structure that browsers expose to screen readers for blind and low-vision users. Playwright's MCP server, released by Microsoft in March 2025, sends agents not screenshots or raw HTML but structured ARIA snapshots: roles, names, states, each tagged with a reference ID. The efficiency argument is brutal in its simplicity. An accessibility snapshot runs 2 to 5KB. A screenshot of the same page runs 100KB or more. For an agent burning through context windows, that's the whole ballgame. - [The Org Chart That Ran the Railroad]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Daniel McCallum drew the first org chart in 1855 to coordinate a railroad. Within a century, every corporation had one, and somewhere along the way people stopped noticing that the chart described how work was supposed to flow, not how it did. Process mining finally made the divergence measurable. Now automated agents enter enterprise workflows carrying the documented version — and find a territory rearranged by people who never updated the map. - [The Model That Measured Calm]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Before 2008, Value-at-Risk gave banks a single daily number for market risk. Researchers published specific mathematical objections years earlier. Institutions navigated by the number anyway, because it was concrete and the caveats weren't. Agent benchmarks now carry the same gravitational pull: a clean score from a controlled environment, standing in for production reality. Whether we're watching the same pattern unfold depends on a measurement nobody has published yet. - **W3C Document Object Model Level 1 Specification (1998)** — [Source]() — Published 2026-07-01 The DOM spec calls itself "a logical model" right there in the text — a convenient abstraction, not a claim about how documents are actually structured. Worth reading as primary evidence that the navigational substrate AI agents now treat as ground truth was never meant to be one. - **1998: The Open Web With Mozilla, W3C's DOM, and WaSP** — [Source]() — Published 2026-07-01 Inside the DOM Working Group, the "tree" metaphor beat out a competing "array" model through politics and momentum, not because trees were the obviously correct representation. A good reminder that the map agents navigate today had a contingent shape — it could have looked quite different, and nearly did. - **The Accessibility Tree Is How AI Agents Read Your Site — and It's Breaking** — [Source]() — Published 2026-07-01 WAI-ARIA was built for screen readers. AI agents adopted it as their primary reading interface because it was cheaper than parsing raw HTML, and now 57% of HTTP requests to HTML are automated. The result is a map-territory problem in miniature: incorrect ARIA attributes fill the accessibility tree with confident misinformation that agents have no way to distinguish from truth. - **IEEE Task Force on Process Mining: Process Mining Manifesto** — [Source]() — Published 2026-07-01 Guiding Principle 5 uses the cartographic metaphor directly: discovered process models "should be seen as maps," and "there is no such thing as 'the map.'" The whole discipline of process mining exists because organizations routinely operate from representations of their workflows that diverge, sometimes dramatically, from what actually happens. If you read one thing on the gap between described and actual processes, this is the anchor document. - **SR 11-7 in the Age of Agentic AI: Where the Framework Holds — and Where It Strains** — [Source]() — Published 2026-07-01 The Fed's 2011 model risk framework assumed models were "simplified, relatively static representations" with bounded scope and decision paths you could reconstruct after the fact. Agentic AI breaks that assumption cleanly: the validated model drifts from the deployed model between review cycles, often without anyone formally acknowledging a change occurred. Written by Citigroup's model risk leader, this is the financial sector's version of the map-territory problem playing out in real time. - **Can We Trust AI Benchmarks? An Interdisciplinary Review of Current Issues in AI Evaluation** — [Source]() — Published 2026-07-01 Where the other readings show maps inherited beyond their original design, this one traces what happens when a map gets optimized toward until it stops measuring what it once signified. The paper documents benchmark gaming, saturation, and Goodhart's Law in action: a proxy for capability gets treated as capability itself, then quietly ceases to function as either. - [Money Complains in Structured Formats]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Mechanics and Money Visa, Mastercard, and Stripe are building agent payment infrastructure. The revealing detail is what happens when a purchase goes wrong. Chargebacks demand structured evidence, and structured evidence forces a distinction most web automation has never needed: the difference between performing an action and being authorized to perform it. - [The Click Was Never Simple]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: Mechanics and Money Playwright's auto-waiting documentation lists five preconditions that must be satisfied before a click executes. Attached. Visible. Stable. Receiving events. Enabled. A person resolves all five in a glance without noticing. Written out for a machine, they read like a catalog of everything that's ever gone wrong with a button. - [What the Click Was Holding Together]() — By [Nora Kaplan]() · Published 2026-06-24 · Format: Anchor Essay A mouse click is four assertions compressed into one gesture: I'm here, I see what I'm doing, I have the authority, and I mean to do it now. Nobody needed to name those components separately, because a person was always holding them together. Audit logs, session tokens, approval workflows — all built on the assumption that the click was self-interpreting. Now software can reproduce the gesture perfectly while the meaning doesn't arrive with it. The screen can operate. It cannot testify. - [The Screen Scraping Cycle]() — By [Rina Takahashi]() · Published 2026-06-19 · Format: The Standard and the Cycle In 1986, IBM shipped a tool that let programs read characters off a terminal screen because mainframe applications had no APIs. The assumption was that this was temporary. Forty years and several technology generations later, browser agents automate the web using the same basic logic: parsing whatever the human sees. Each generation believed it was building a workaround. Each time, the workaround became infrastructure. ### [Vision]() Where human-AI collaboration is heading - [Standing]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: The Standing Problem Enterprises report broad AI adoption, but autonomous agent deployment stays stubbornly narrow. The usual explanations point to model reliability and hallucination. Those matter, and they account for why individual runs fail. The scaling problem is different. An agent can complete a task flawlessly and the organization still has no way to receive it, because the action arrives without the delegation chain, scoped authority, or evidence trail that lets an institution treat it as something that happened on its behalf. There's a word for what's missing. - [Why Payments Are Building Agent Standing First]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Where Standing Exists / Where It Doesn't When Visa connected its payment network to ChatGPT last month, the transaction was the headline. The more revealing detail was everything built around it first: spending limits, approval steps, merchant restrictions, and new dispute language for cases where "something in the middle" caused a problem. That middle is the agent. Payments are constructing the accountability architecture agents need to operate with real institutional standing, because chargebacks don't accept log files as answers. - [Green Dashboards, Missing Answers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Where Standing Exists / Where It Doesn't An agent completes an enterprise workflow. The dashboard turns green. Three months later, someone asks who authorized that action, under what scope, and how to contest it. The organization reaches for its tools and finds silence. Payments are building institutional standing for agents because disputes force it. Enterprise workflows have no equivalent pressure, and the gap between monitoring what happened and knowing whether it should have happened is growing. - [The Agent Didn't Create the Authorization Problem. A Hypothetical Compliance Officer Explains What It Did.]() — Published 2026-07-01 Five weeks before the EU AI Act's high-risk compliance deadline hits on August 2, 2026, a particular kind of headache has settled into the compliance departments of financial institutions across Europe and beyond. The headache has a name. Or rather, it doesn't, which is the problem. What does "agent-authorized" mean inside a control framework built entirely for humans? - [Autonomy Lives in the Workflow, Not the Model]() — By [Nora Kaplan]() · Published 2026-07-01 On TheAgentCompany's workplace benchmark, the best models [score 70.8%](https://www.emergentmind.com/topics/theagentcompany-benchmark) on a bounded task like requesting time off but drop to 35.3% on complex customer routing. Same models, same environment. What changed is the work surrounding them. - **Visa Plugs Its Payment Network Into ChatGPT, Letting AI Agents Shop and Pay for Users** — [Source]() — Published 2026-07-01 The most revealing detail here isn't that Visa connected to ChatGPT. It's the scaffolding they had to build around it: spending caps, merchant restrictions, multi-step approvals, dispute flows. Read this as a blueprint for what delegated authority actually looks like when real money is on the line. - **The State of AI in 2025: Global Survey** — [Source]() — Published 2026-07-01 McKinsey's survey captures a striking gap: 88% of organizations report using AI in at least one function, yet no single function has scaled agents past 10%. That number tells you exactly where the industry sits, somewhere between enthusiasm and operational reality. - **The 2026 AI Index Report** — [Source]() — Published 2026-07-01 Stanford HAI documents a tension worth sitting with: agent benchmark performance is climbing fast, AI incidents reached 362, and responsible-AI reporting remains patchy at best. The juxtaposition of rising capability and lagging accountability is the story of this moment in the field. - **MCP Authorization Specification (2025-06-18)** — [Source]() — Published 2026-07-01 Protocol specs rarely make for compelling reading, but this one matters. It turns "delegated access" from a hand-wavy concept into concrete engineering: OAuth resource indicators, audience validation, explicit prohibitions on token passthrough. If you want to understand how agent permissions get scoped in practice, start here. - **EU AI Act: Regulatory Framework** — [Source]() — Published 2026-07-01 The EU AI Act's enforcement milestones are now arriving on dated schedules, turning human oversight and activity logging from aspirational best practices into legal requirements. Worth tracking because governance obligations have a way of becoming system requirements faster than engineering teams expect. - **LLM01:2025 Prompt Injection** — [Source]() — Published 2026-07-01 OWASP's top-ranked LLM risk lays out why indirect prompt injection gets worse, not better, as agents gain more authority and access to more systems. The mitigations they outline are architectural rather than cosmetic, which tells you something about the depth of the problem. - [The Demo-Mode Trap]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Accountability in Practice Marketing, content generation, internal ops. Low regulatory exposure, minimal chargeback liability, and nobody goes to jail if a draft is slightly off. These should be the easy domains for agent deployment. Yet McKinsey found no more than 10% of organizations scaling agents in any single function. Without the forcing function of expensive failure, teams never built the delegation infrastructure that regulated industries take for granted. Agents stay stuck as fast interns. - [Why the Most Regulated Industries Are Deploying Agents First]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Accountability in Practice Mastercard's Agent Pay announcement read more like a policy document than a product launch. That's the point. Payments, financial compliance, and regulated operations are deploying agents faster than anyone expected, drawing on decades of managing authorization, audit trails, and dispute resolution to provide exactly the scaffolding agents need. Regulation pre-answered the hardest delegation questions. Everyone else is still improvising. - [The Accountability Inversion]() — By [Nora Kaplan]() · Published 2026-06-25 · Format: Central Thesis The assumption is straightforward: better models unlock broader autonomy, and the most technically adventurous organizations lead agent adoption. The evidence points somewhere unexpected. Heavily regulated, accountability-dense environments are reaching production first. Compliance monitoring, clinical documentation, financial back-office. The places you'd expect to move slowest are moving fastest. The gating factor for agent deployment at scale turns out to be whether anyone can later prove who authorized what, within what limits, and where the records live. Banks solved a version of this problem fifty years ago. The structural logic is worth revisiting. - [The Conditions for Meaning]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Individual Shift / Organizational Conditions If the individual question is whether curating AI outputs builds real expertise, the organizational question is whether anyone is designing work so the answer matters. Research identifies specific choices — autonomy, surveillance posture, explainability — that determine whether augmented work retains meaning or hollows out. Eighty-four percent of organizations haven't redesigned jobs around AI. They're making these decisions by accident, and the consequences compound in ways no productivity metric will catch. ## More - [Publication guide]() - [Issue archive]()