--- title: "Market Pulse" canonical: "https://current.tinyfish.ai/issue/36/market-pulse" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/36/market-pulse" issue: 36 section: "market-pulse" description: "Reading the agent ecosystem through a practitioner's lens" authors: ["Nora Kaplan","Rina Takahashi"] published: 2026-07-06 updated: 2026-07-02 articles: 19 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 36 — Market Pulse Reading the agent ecosystem through a practitioner's lens ### Digital Body Language - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. ### Recognition Surface Map Agents act before the systems around them can identify, bound, or account for what happened. That gap between capability and recognition looks different depending on where you stand. Some surfaces were designed for simpler questions. The web's defenses assumed visitors were human or script, nothing in between. Enterprise security assumed that logging what software did was the same as understanding why. Protocol designers got connection working and left verification for later. One domain stands apart. Payments, shaped by decades of disputed-transaction liability, may already have the institutional muscle to enforce agent recognition while everyone else is still drafting proposals. Six surfaces, one pattern: the agents declared independence before the controls were ready. - **The Bouncer Doesn't Recognize the New Crowd** — [Source]() — Published 2026-07-02 Tag: Web Defenses A June 2026 study found browsing agents sailed past every tested anti-bot mechanism: robots.txt, CAPTCHAs, proof-of-work, Cloudflare's free tier. They use real browsers doing ordinary things. The web's old binary, human or script, simply doesn't describe who's showing up anymore. - **The Best Detection Signal Sits on the Shelf** — [Source]() — Published 2026-07-02 Tag: Behavioral Fingerprinting FP-Agent identified all seven tested browsing agents from humans by watching how they type, scroll, and move a mouse. Cloudflare's commercial detection caught one. Browser fingerprints barely help because agents share them. The research is solid. The industry hasn't picked it up. - **Agents Can Connect Before Anyone Checks Credentials** — [Source]() — Published 2026-07-02 Tag: Protocol Identity A2A Agent Cards describe identity and capabilities. MCP authorization remains optional, transport-level. Both protocols nail how agents find and reach each other. Neither settles what counts as verified authority or valid delegation. Think of it as a well-designed envelope with no seal. - **Payments Already Enforce What Others Still Debate** — [Source]() — Published 2026-07-02 Tag: Payment Authorization Visa's ChatGPT integration scopes tokenized credentials to specific agents, enforces spending limits before authorization, and monitors fraud in real time. Decades of liability infrastructure around disputed transactions gave payments a head start. Recognition here is institutionally required, not aspirational. - **Security Sees the What but Misses the Why** — [Source]() — Published 2026-07-02 Tag: Enterprise Monitoring Uber built its ADR system, processing over 10,000 agent sessions daily, because traditional endpoint detection catches file writes but not the prompts or reasoning behind them. A compromised agent and a legitimate one look identical in the logs. The blind spot is intent. - **Agents Announce Themselves but Nobody Checks the ID** — [Source]() — Published 2026-07-02 Tag: Self-Declaration A2A Agent Cards and MCP tool descriptions let agents say what they are and what they can do. Authorization logic stays implementation-specific. A well-formed card from a compromised registry is still well-formed. Without independent verification, self-description is etiquette, not security. ### Research Landscape - **FP-Agent: Fingerprinting AI Browsing Agents** — [Source]() — Published 2026-07-02 A controlled study of seven browsing agents shows that behavioral signals like typing cadence, scrolling rhythm, and mouse movement reliably separate agents from humans, even when the underlying browser fingerprints are identical across frameworks. How stark is the gap? Behavioral fingerprinting caught all seven agents in a Cloudflare case study; Cloudflare's own bot detection flagged one. So what shifts? Detection built around how agents interact with pages consistently outperforms detection built around what identity signals they present. - **On the Internet, Nobody Knows You're an LLM Bot** — [Source]() — Published 2026-07-02 Tests web agents against production anti-bot defenses and finds some sailed past every layer: robots.txt, CAPTCHAs, proof-of-work, commercial solutions. Yet multi-layer fingerprinting still distinguished every evaluated agent from human traffic. Where do current defenses stand? Porous against today's agents, though behavioral fingerprinting at the right layer still reliably tells agents apart from humans. What does recognition actually require? An infrastructure investment in behavioral instrumentation, not a policy update or a vendor upgrade. ### Recognition Turned Inward - [You Deployed the Agent. Can You See What It's Doing?]() — By [Nora Kaplan]() · Published 2026-07-02 When an employee writes a file, endpoint detection logs the write. If something goes wrong, you can ask the employee what they were thinking. When an agent writes a file, endpoint detection still logs the write. But the reasoning that produced it, the prompt that initiated it, the sequence of tool calls between intent and action: none of that shows up in traditional security tooling. ### Further Reading - **Visa Plugs Its Payment Network Into ChatGPT, Letting AI Agents Shop and Pay for Users** — [Source]() — Published 2026-07-01 What happens to dispute logic when the entity swiping the card has no legal personhood. - **Would You Let Robots Spend Your Money? Google Is Betting on It** — [Source]() — Published 2026-07-01 Google calls its agent a "matchmaker." Retailers see something closer to a new gatekeeper. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-07-01 62% experimenting, no function above 10% scaling. The governance gap in one stat. - **2025: The State of Generative AI in the Enterprise** — [Source]() — Published 2026-07-01 $37B in enterprise AI spend, 76% purchased. Shadow AI is outrunning institutional recognition infrastructure. - **Governance Gaps in Agent Interoperability Protocols: What MCP, A2A, and ACP Cannot Express** — [Source]() — Published 2026-07-01 A preprint naming the quiet part: current protocols handle connection but lack primitives for contestation. ### Past Articles - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. - [What Governance Governs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Governance Gap Companies with governance tooling deploy twelve times more AI projects to production. Only 4 of 13 frontier-autonomy agents disclose safety evaluations for agentic deployment. The first figure tells you whether a system has been authorized to run. The second tells you whether anyone has rigorously checked what it does once running. They share a vocabulary. They measure fundamentally different things. And the infrastructure accumulating around the first may be quietly relieving pressure to build the second. - [The Test Suite Was the Hero]() — By [Nora Kaplan]() · Published 2026-06-12 · Format: Verification at Scale Anthropic's Dynamic Workflows can now orchestrate a thousand subagents in parallel. The showcase was a Bun runtime port: 750,000 lines of Zig to Rust, 99.8% test pass rate, eleven days. Impressive. But research on Claude's failure patterns finds that 71% of failures are consistent misinterpretation, not random error. A thousand agents inheriting the same flawed specification converge, confidently, on the same wrong answer. The Bun port had a deterministic test suite to catch that. Most enterprise domains don't. - [What the Bill Can't Measure]() — By [Rina Takahashi]() · Published 2026-06-03 · Format: The Meter Drops GitHub Copilot moved to metered billing on June 1, and organizations can finally see where their AI development spend is going. That's a real step forward. The natural parallel is cloud FinOps, which saved billions by making waste visible. An idle VM is idle, and the bill reflects it. A confident, systematically wrong code suggestion consumes exactly the same credits as a correct one. Cost now has real infrastructure behind it, so organizations will build discipline around consumption. Consumption, meanwhile, has no reliable relationship to correctness. ## Other sections in Issue 36 - [Daily Brief]() - [Foundations]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()