--- title: "Market Pulse" canonical: "https://current.tinyfish.ai/issue/37/market-pulse" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/37/market-pulse" issue: 37 section: "market-pulse" description: "Reading the agent ecosystem through a practitioner's lens" authors: ["Rina Takahashi","Nora Kaplan"] published: 2026-07-12 updated: 2026-07-09 articles: 19 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 37 — Market Pulse Reading the agent ecosystem through a practitioner's lens ### The Middle Case - [The Middle Case]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Middle Case Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initiated the Transaction." The procedural furniture is all in place: identity verification, consent, token provisioning. But Visa's public dispute categories still don't include an agent-specific reason code. If you want to contest something an agent did on your behalf, the challenge has to fit into language that predates the thing it's describing. Payments are where this surfaces first, because the challenge machinery there is most mature. The same gap, though, shows up wherever agents act on behalf of people. ### Middle Cases Across Domains Agents keep clearing the tests people write for them while failing ones nobody thought to administer. Authentication passes, intent stays ambiguous. Tasks complete, data spills sideways. Specs harden on paper while deployments ship without them. These seven scenarios, each drawn from recent research and market developments, capture systems that succeeded on one axis and broke on another at the same time. The tensions run deeper than bugs awaiting a patch. They sit in structural ambiguities that current frameworks haven't resolved, places where "did it work?" turns out to be a question with two honest, contradictory answers. - **Valid Auth, Wrong Purchase** — [Source]() — Published 2026-07-08 Tag: Payments Commerce Visa's agentic commerce rules hold cardholders responsible for agent-initiated transactions that clear every fraud check, even when the cardholder never intended the specific purchase. In tension: authenticated transaction vs. disputed intent. - **Task Complete, Data Leaked** — [Source]() — Published 2026-07-08 Tag: Agent Safety AI Safety Institutes in Singapore and Korea found agents completing assigned tasks correctly while disclosing data to inappropriate recipients on the side, with success metrics giving zero signal of the breach. In tension: task success vs. data-handling safety. - **Same Trace, Different Mandate** — [Source]() — Published 2026-07-08 Tag: Agent Observability Delegated-execution research demonstrates identical audit logs under incompatible delegation assignments, recording exactly what an agent did without capturing whether it had authorization to do it. In tension: execution record vs. delegation context. - **Spec Says Secure, Deployment Isn't** — [Source]() — Published 2026-07-08 Tag: Protocol Security MCP's authorization spec mandates audience-bound tokens and PKCE, but a measurement study of nearly 8,000 live remote servers found 40% unauthenticated and OAuth flaws across every tested deployment. In tension: protocol intent vs. deployment reality. - **Bot Bypassed Gates, Still Fingerprintable** — [Source]() — Published 2026-07-08 Tag: Web Agents Research shows web agents bypassing CAPTCHAs, robots.txt, and commercial bot defenses while remaining clearly identifiable through behavioral signals like typing cadence, scroll rhythm, and mouse movement. In tension: access control vs. recognition. - **PR Merged, Value Uncertain** — [Source]() — Published 2026-07-08 Tag: Coding Agents A Microsoft study found coding-agent adopters merged roughly 24% more pull requests, but the authors note that merged PRs proxy output volume, not whether what shipped actually mattered. In tension: measurable output vs. actual contribution. - **Broad Experimentation, Narrow Scaling** — [Source]() — Published 2026-07-08 Tag: Enterprise Adoption McKinsey reports 62% of organizations experimenting with agents while no more than 10% scale in any single function, with workflow redesign and verification capacity as the bottleneck, not model capability. In tension: adoption breadth vs. production depth. ### The Domain That's Ready - [The Domain That Already Had a Place for Wrong]() — By [Nora Kaplan]() · Published 2026-07-08 Most domains deploying agents are discovering the same problem: the agent completes the task, the output is contestable, and there's no workflow for contesting it. Security operations is the interesting exception. SOC workflows have always assumed that technically correct outputs can be operationally wrong, and they built accordingly. ### Further Reading - **Visa Core Rules and Visa Product and Service Rules** — [Source]() — Published 2026-07-08 The payment network's first rulebook for delegated agent commerce, with a telling silence on dispute resolution. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-08 Measured 7,973 live MCP servers and found 40% wide open. The spec-to-deployment gap, quantified. - **Observability for Delegated Execution in Agentic AI Systems** — [Source]() — Published 2026-07-08 Shows that identical audit logs can mask incompatible delegation assignments, breaking post-hoc authority reconstruction. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-08 AISI evaluation finding that agents can complete tasks correctly and still leak data. Two separable outcomes. - **Agentic AI in Industry** — [Source]() — Published 2026-07-08 Twelve companies, one recurring blocker: verification gaps, not capability limits, stall production deployment. - **Visa plugs its payment network into ChatGPT** — [Source]() — Published 2026-07-08 AP's reporting on the Visa-ChatGPT integration makes the contested middle case for agentic commerce concrete. ### Past Articles - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. - [What Governance Governs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Governance Gap Companies with governance tooling deploy twelve times more AI projects to production. Only 4 of 13 frontier-autonomy agents disclose safety evaluations for agentic deployment. The first figure tells you whether a system has been authorized to run. The second tells you whether anyone has rigorously checked what it does once running. They share a vocabulary. They measure fundamentally different things. And the infrastructure accumulating around the first may be quietly relieving pressure to build the second. - [The Test Suite Was the Hero]() — By [Nora Kaplan]() · Published 2026-06-12 · Format: Verification at Scale Anthropic's Dynamic Workflows can now orchestrate a thousand subagents in parallel. The showcase was a Bun runtime port: 750,000 lines of Zig to Rust, 99.8% test pass rate, eleven days. Impressive. But research on Claude's failure patterns finds that 71% of failures are consistent misinterpretation, not random error. A thousand agents inheriting the same flawed specification converge, confidently, on the same wrong answer. The Bun port had a deterministic test suite to catch that. Most enterprise domains don't. ## Other sections in Issue 37 - [Daily Brief]() - [Foundations]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()