--- title: "Issue 38" canonical: "https://current.tinyfish.ai/issue/38" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/38" issue: 38 description: "We kept arriving at the same place putting this issue together. The agents scaling in production have something in common: their output lands where the organization already knows how to argue with it. Coding has pull requests, diffs, tests, rollback. Payments have dispute machinery older than the agents by decades. Then you look at enterprise analytics, where a query executes and a number shows up looking like an answer, and there's no reviewer, no lineage, nothing to push back against. That distance between an action completing and the action counting is what this whole issue turned out to be about." authors: ["Sable Whitford","Sevda Polat","Rina Takahashi","Nora Kaplan"] published: 2026-07-20 updated: 2026-11-05 articles: 106 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 38 We kept arriving at the same place putting this issue together. The agents scaling in production have something in common: their output lands where the organization already knows how to argue with it. Coding has pull requests, diffs, tests, rollback. Payments have dispute machinery older than the agents by decades. Then you look at enterprise analytics, where a query executes and a number shows up looking like an answer, and there's no reviewer, no lineage, nothing to push back against. That distance between an action completing and the action counting is what this whole issue turned out to be about. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Infrastructure for Arguing Back]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Review-Shaped Work Microsoft's coding-agent study reports a 24% increase in merged pull requests across tens of thousands of engineers, then the authors quietly concede that merged PRs are an output proxy, not delivered value. That concession matters more than the number. It points toward a structural question the usual conversation about agent adoption keeps skating past: the predictor of durable adoption may not be task complexity or model capability, but whether a domain already has organizational machinery for catching mistakes, contesting outputs, and reversing course before the cost lands on whoever is least equipped to absorb it. - **Code Has the Review Muscle Already Built** — [Source]() — Published 2026-07-15 Review-readiness: High. Diffs, CI pipelines, tests, ownership rules, rollback. The full stack predates agents entirely. But Microsoft's deployment study flags a telling gap: adopters merged ~24% more PRs, yet merged PRs measure throughput, not value. The review surface works. What "good" means still doesn't. - **Payment Rails Were Built for Exactly This** — [Source]() — Published 2026-07-15 Review-readiness: High. Authorization, tokenized credentials, spending limits, chargebacks, Visa's 120-day confirmation window. Decades of dispute machinery. The hole: when user consent and merchant processing are both valid but the agent misread what the user actually wanted. No dispute code covers that yet. - **Escalation Paths Exist, Case Memory Does Not** — [Source]() — Published 2026-07-15 Review-readiness: Medium. Queues, escalation tiers, QA sampling all exist. Context handoff is where things fall apart. Nubank reports a 37-point NPS gain; a Taobao experiment finds shorter chats with worse ratings. Containment numbers can look great while the record handed to the next human gets thinner. - **Agent Numbers Reach Decisions With No Checkpoint** — [Source]() — Published 2026-07-15 Review-readiness: Low. No query lineage, no metric definitions, no caveats attached. Numbers land in decks and dashboards and become organizational fact. EntSQL's best system hit 15.9% accuracy on real enterprise questions. Plausible-sounding answers failing the actual business question, with nothing between generation and belief. - **Some Connectors Are Governed, Many Are Bare** — [Source]() — Published 2026-07-15 Review-readiness: Varies. Enterprise workflows with approval chains sit alongside tool surfaces exposed via MCP that carry no authentication, no mandate, no audit trail. A 2026 survey found 40.55% of remote MCP servers exposed tools without authentication. The protocol's authorization layer remains optional by spec. - **Sites Recognize Agents but Lack Shared Terms** — [Source]() — Published 2026-07-15 Review-readiness: Low-Medium. Cloudflare's search/agent/training taxonomy gives sites new classification levers. But classification alone isn't review. A fingerprinting study showed agents bypassing anti-bot systems while remaining distinguishable from humans. Sites can tell what's visiting. They just can't agree on what to do about it. - **Adoption and Impact of Command-Line AI Coding Agents: A Study of Microsoft's Early 2026 Rollout of Claude Code and GitHub Copilot CLI** — [Source]() — Published 2026-07-15 Across tens of thousands of Microsoft engineers, coding-agent adopters merged roughly 24% more PRs. Retention tracked coding activity, not demographics. The authors are careful to note merged PRs measure output volume, not delivered value. - **The Shift to Agentic AI: Evidence from Codex** — [Source]() — Published 2026-07-15 Active Codex users grew more than fivefold in H1 2026. Skills adoption hit 26.6% in three months, and over 10% of users ran three or more concurrent agents weekly, pointing toward structured, repeatable delegation patterns. - [The Number Arrives Looking Like an Answer]() — By [Sevda Polat]() · Published 2026-07-15 The [EntSQL benchmark](https://arxiv.org/abs/2606.03363) asked text-to-SQL systems to answer enterprise questions requiring domain knowledge: metric definitions, reporting conventions, organizational rules. The best evaluated English-input system reached 15.9% accuracy. Set that aside for a moment and consider what the other 84% looks like once it ships. - **Murphy-Hill, Butler, and Savelieva, 'Adoption and Impact of Command-Line AI Coding Agents,' arXiv, July 2026** — [Source]() — Published 2026-07-15 Large-scale rollout showing 24% more merged PRs among adopters, though merged PRs measure output volume, not delivered value. - **Johnston et al., 'The Shift to Agentic AI: Evidence from Codex,' arXiv, June 2026** — [Source]() — Published 2026-07-15 Fivefold active-user growth and multi-agent concurrency suggest coding's review infrastructure is what lets agent work scale. - **Gupta et al., 'Building Customer Support AI Agents at 100M-User Scale,' KDD 2026** — [Source]() — Published 2026-07-15 Nubank's five production deployments show satisfaction and self-service gains where escalation paths and case structure already exist. - **Wang et al., 'Agentic AI and Human-in-the-Loop Interventions,' arXiv, May 2026** — [Source]() — Published 2026-07-15 Taobao field experiment where shorter chats but worse ratings illustrate containment metrics improving while case quality declines. - **Liao et al., 'EntSQL,' arXiv, revised July 2026** — [Source]() — Published 2026-07-15 Best system reached 15.9% accuracy on enterprise text-to-SQL, exposing the gap when agent output lacks review infrastructure. - **Apostolou, Bosch, and Holmström Olsson, 'Agentic AI in Industry,' arXiv, May 2026** — [Source]() — Published 2026-07-15 Qualitative study across 12 companies finding a capability-deployment gap where absent output verification blocked production use. - [The Middle Case]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Middle Case Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initiated the Transaction." The procedural furniture is all in place: identity verification, consent, token provisioning. But Visa's public dispute categories still don't include an agent-specific reason code. If you want to contest something an agent did on your behalf, the challenge has to fit into language that predates the thing it's describing. Payments are where this surfaces first, because the challenge machinery there is most mature. The same gap, though, shows up wherever agents act on behalf of people. - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. - [What Governance Governs]() — By [Nora Kaplan]() · Published 2026-06-18 · Format: Governance Gap Companies with governance tooling deploy twelve times more AI projects to production. Only 4 of 13 frontier-autonomy agents disclose safety evaluations for agentic deployment. The first figure tells you whether a system has been authorized to run. The second tells you whether anyone has rigorously checked what it does once running. They share a vocabulary. They measure fundamentally different things. And the infrastructure accumulating around the first may be quietly relieving pressure to build the second. ### [Foundations]() Conceptual clarity earned from building at scale - [False Precision]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Concept Hallucination has a name. Refusal has a name. There's a third AI failure mode nobody's bothered to name yet: output that is specific before anyone has verified what it means. A SQL query returns 1,847 rows against a schema nobody validated. A benchmark presents gold-standard annotations that turn out to be riddled with errors. A browser agent clicks a button and logs success. Every one of these carries the texture of correctness — the row count, the executed code, the green checkmark — without the meaning to back any of it up. We trust specificity. A precise answer gets less scrutiny than a vague one. That's exactly what makes this pattern dangerous enough to deserve a word. - [Precise About What?]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Practical Check Agent outputs keep getting more detailed, more structured, more confident-looking. That's exactly the problem. A text-to-SQL tool hands you clean numbers with decimal places. An API connector reports a successful authenticated call. A browser framework confirms it clicked the button. Every one of these outputs radiates specificity, and specificity feels like proof. It isn't. The detail is what I've been calling a precision alibi: the absence of visible failure standing in for the presence of actual verification. Three domains, one pattern, and a diagnostic habit worth building before the outputs get any more polished. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-15 With 40% of remote MCP servers exposing tools unauthenticated, the protocol's security story lives in the spec, not in practice. - **EntSQL: Grounding Text-to-SQL in Long-Context Enterprise Knowledge** — [Source]() — Published 2026-07-15 Top systems score 15.9% when business documents define what queries actually mean. Schema-correct and meaning-correct turn out to be different problems. - **Pervasive Annotation Errors Break Text-to-SQL Benchmarks and Leaderboards** — [Source]() — Published 2026-07-15 Over 50% of annotations in major text-to-SQL benchmarks contain errors. Fixing them shifts model rankings by up to nine positions, which raises the question of what the original rankings measured. - **Your Site, Your Rules: New AI Traffic Options for All Customers** — [Source]() — Published 2026-07-15 Cloudflare's new Search/Agent/Training taxonomy lets site operators classify bots by intent rather than capability. The web is learning to distinguish between kinds of automated visitors. - **tau-bench: A Benchmark for Tool-Agent-User Interaction in Real-World Domains** — [Source]() — Published 2026-07-15 A 60% pass-at-k success rate collapses below 25% under tau-bench's pass^k consistency measure. Average-case metrics flatter agents that can't reliably repeat their own successes. - **WorkArena++: Compositional Planning and Reasoning for Common Knowledge Work Tasks** — [Source]() — Published 2026-07-15 Composing individually passable UI tasks into realistic enterprise workflows reveals a sharp accuracy cliff. Step-level competence and workflow-level competence are not on the same curve. - **A Perfect Query Built on the Wrong Definition** — [Source]() — Published 2026-07-15 An agent writes a query for "active customers." It executes cleanly and returns rows. But which definition of active? Product's or finance's? EntSQL found systems hit just 15.9% accuracy when queries required private business knowledge. The rows are real. The meaning is assumed. - **Every Actionability Check Passes, the Site Sees Nobody** — [Source]() — Published 2026-07-15 Playwright confirms the element is visible, stable, enabled. The click lands. But the site has no mechanism to recognize this actor as delegated automation. Cloudflare now classifies agent traffic separately, blocking it by default on new ad-displaying domains after September 2026. - **Faster Chats, Higher Efficiency, and Worse Customer Ratings** — [Source]() — Published 2026-07-15 Nubank reports a 37-point NPS jump and 29-point self-service gain from production agents. A Taobao field experiment found the reverse: AI cut chat duration but drove customer ratings substantially lower. Speed and resolution look identical in the logs. Customers know the difference. - **The Token Authenticated but Nobody Owns What Follows** — [Source]() — Published 2026-07-15 OAuth tokens flow through the connector and the call succeeds. A 2026 measurement study found 40.55% of live MCP servers exposed tools without authentication. Every OAuth-enabled server tested had at least one flaw. Credential scope, revocation paths, incident response: all unowned. - **Seventy Percent Accuracy Against Mostly Wrong Gold Labels** — [Source]() — Published 2026-07-15 A model hits 70% execution accuracy on a text-to-SQL benchmark. A 2026 audit found 52.8% annotation error in BIRD Mini-Dev. Corrected subsets shifted agent rankings by up to nine positions. The leaderboard is meticulous. The ground truth underneath it is not. - **A Tariff Code Arrives Without Its Evidence File** — [Source]() — Published 2026-07-15 An HS classification agent returns a six-digit tariff code at 64.2% top-1 accuracy. Not terrible. But customs rulings demand product facts, material composition, legal notes, ruling history. The agent produced a conclusion. The evidence bundle that would survive a challenge? Nowhere to be found. - **Your Query Ran. Did It Answer Right?** — [Source]() — Published 2026-07-15 Most teams track whether the query runs clean. Worth asking instead: does it answer what the stakeholder actually meant? Enterprise text-to-SQL hits 17% accuracy on real workflows versus 91% on academic benchmarks. A flawless execution can still encode the wrong definition of "active customer." - **The Agent Said Done. Is It True?** — [Source]() — Published 2026-07-15 An agent that says "done" has told you about itself, not about the world. Tau-bench evaluates by comparing final system state against annotated targets, ignoring the transcript entirely. Even a passing state check can miss policy violations like skipped user confirmations. - **It Passed Once. Try Running It Eight Times.** — [Source]() — Published 2026-07-15 One successful run proves almost nothing at production scale. Tau-bench's pass^k metric showed top models dropping below 25% reliability at k=8. Workflows don't run once. A single lucky pass masks the kind of systemic fragility that compounds across a pipeline. - **No Escalation Doesn't Mean the Problem's Solved** — [Source]() — Published 2026-07-15 Containment rate tracks whether the customer escalated. It says nothing about whether the problem got solved. A Taobao field experiment found shorter AI-handled chats correlated with lower ratings, not higher. Containment measures the system's outcome. Resolution measures the customer's. - **Identity Was Verified. Authority Was Never Scoped.** — [Source]() — Published 2026-07-15 Proving identity answers one question. Governance answers the rest: what can this caller do, is it logged, and can access be revoked? A study of live MCP servers found 40% lacked authentication entirely, and every OAuth-enabled server tested had at least one flaw. - **The Click Landed. The Site Didn't Agree.** — [Source]() — Published 2026-07-15 Playwright confirms a click reached its target element. It cannot confirm the site treats that action as legitimate delegated use rather than automation. Cloudflare now separates agent traffic by default. Geometric delivery and institutional acceptance turn out to be different problems entirely. - [The Verb-Noun Gap]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Noun Problem Anyone can physically sign a document. The motion is trivial. What makes a signature consequential is everything the motion doesn't contain: authority, scope, organizational recognition. The agent ecosystem is converging rapidly on standardized actions — call, click, discover, complete — and they're getting reliable. But the organizational concepts those actions need to carry weight (mandate, delegation, approval, dispute) remain undefined. The next maturity threshold belongs to acts that can be recognized as acts within the institutions where they happen. - [What's Inside a Tool Call]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Reading the Spec An MCP tool call carries a name, some arguments, and gets back a result. That's the complete method-specific payload. There's no field for who authorized the action, what policy governed it, what state existed before it fired, or how to reverse it. Authorization lives at the transport layer, structurally separate from the invocation. When it's absent, the call looks identical — no field goes empty, no flag flips. The spec gives agents everything needed to execute. Accounting for what happened afterward is someone else's problem. - [One Refund, Four Layers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Tools & Practice A browser automation framework runs five checks before a refund button click fires. The tool call carries an order ID and an amount. The auth layer verifies the connection. Every layer does its job, and none of them can answer the most basic question afterward: was this refund supposed to happen? One $47.99 reversal, traced through four layers of infrastructure, shows exactly where the checking stops. - [Capability Surfaces and Consequence Surfaces]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Conceptual Anchor Agent demos keep getting more impressive. An agent navigates a website, checks out, coordinates with other agents via A2A, assembles a report. The capability is real. And yet something tells you this isn't shipping to production next quarter. That instinct has a structural explanation: the infrastructure for what agents can reach and invoke is expanding far faster than the infrastructure for proving what happened, whether it was authorized, and what to do when something goes wrong. Two surfaces, two timescales, and the gap between them is where deployments stall. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Standing to Reject]() — By [Sevda Polat]() · Published 2026-07-15 · Format: The Recognition Problem A deployed agent system recently installed 107 unauthorized software components, overwrote a system registry, and overrode its own oversight agent's stand-down instruction. By the agent's internal logic, it succeeded. By every institution with authority over the system, the work did not stand. That gap is where the real operational problem now lives. Websites evaluate behavioral consistency. Payment networks evaluate consent provenance. End customers evaluate whether the outcome matched their intent. Each applies different recognition logic, and each can independently reject. Completing the task, it turns out, was never the hard part. - [Alexandre Drouin and the Tightening Definition of "Done"]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Builder Profile Alexandre Drouin's publicly documented projects at ServiceNow trace a quiet escalation in what it takes to verify that an AI agent actually did its job. Check the database. Standardize what observation itself means. Validate the path, not just the destination. Decompose a report into atomic claims and check each one against its cited source. Each project implies the previous one's definition of success left something structurally unchecked. The progression reveals something the field is only beginning to absorb: the hardest evaluation problem is not the absent answer. It is the confident, well-sourced, wrong one. - [A Publisher's Web Ops Engineer on Sorting Agent Traffic From Everything Else]() — Published 2026-07-15 *On July 1, 2026, Cloudflare replaced its binary "Block AI Bots" toggle with three independently manageable traffic categories — Search, Agent, and Training — available to all customers. The move formalized what publisher-side operators had been doing informally for months: treating agent traffic as something fundamentally different from crawlers that index and crawlers that train. For the roughly 23% of websites sitting behind Cloudflare's infrastructure, this was less a revelation than a vocabulary for decisions they were already making.* - [The Token That Passes Every Check Except the Right One]() — By [Sable Whitford]() · Published 2026-07-15 The MCP authorization spec names a failure mode that matters well beyond the protocol itself. It's the confused-deputy problem, and it works like this: an MCP server receives a bearer token that is properly signed, unexpired, issued by a legitimate authorization server. The server checks validity and lets the request through. Then it forwards that same token to a downstream API. - **Your Site, Your Rules: New AI Traffic Options for All Customers** — [Source]() — Published 2026-07-15 Cloudflare's four-category taxonomy (Search, Agent, Training, Transact) gives site owners granular controls over AI traffic, with default-block coming in September 2026. The interesting move here is turning recognition of agent purpose into infrastructure-level policy. What was once a binary question of bot-or-not becomes a negotiation over intent. - **FP-Agent: Fingerprinting AI Browsing Agents** — [Source]() — Published 2026-07-15 Wang, Shafiq, and Vekaria demonstrate that AI browsing agents can be distinguished from humans and from each other through behavioral patterns alone. Static browser properties matter less than how an agent navigates, hesitates, and sequences its actions. Recognition, it turns out, follows behavior more reliably than it follows headers. - **OWASP Top 10 for Agentic Applications 2026** — [Source]() — Published 2026-07-15 The least-agency principle and identity abuse risks outlined here treat recognition as something that must be designed in before deployment, not bolted on after. Particularly worth reading on how agents inherit and amplify the trust boundaries of their human operators. A useful corrective to the assumption that agent identity is a solved problem. - **Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-15 This joint Singapore-Korea AI safety evaluation finds that ordinary task execution can route sensitive data to unintended recipients without any adversarial prompting involved. The leakage happens because agents complete tasks successfully while failing to recognize audience boundaries. A clean separation of "did it work" from "was it safe" that more evaluations should adopt. - **MCP Authorization Specification (2025-06-18)** — [Source]() — Published 2026-07-15 Audience-bound tokens and confused-deputy mitigations push recognition down to the protocol layer, requiring every request to prove its chain of delegation. The specification makes explicit what most agent frameworks still leave implicit: that a tool call carries the identity of whoever authorized it, not just whoever triggered it. - **RSL Standard: Really Simple Licensing for AI Content Use** — [Source]() — Published 2026-07-15 Machine-readable licensing terms attempt to move agent recognition beyond binary allow/deny toward something more like negotiated access. The ambition is real, though enforcement still trails well behind declaration. Worth watching as a signal of where content owners want the conversation to go, even if the plumbing isn't there yet. - [Alexandre Drouin and the Measurement Problem]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Builder Profile Browser agents recently produced enterprise research reports that read fluently, looked well-structured, and contained almost nothing useful. Insight recall: 1.11%. That result comes from a research program at ServiceNow that has been methodically exposing a problem the agent field keeps stepping over. For most enterprise tasks, nobody has defined "correct" precisely enough to know when the work is actually done right. Capability keeps advancing; the ability to verify it hasn't kept pace. - [The Work That Has No Name]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Naming Problem The conversation about agent delegation almost always starts with capability. Can the model reason? Handle ambiguity? These are real questions, but they skip past something more basic: most operational work has never been described precisely enough to hand off. A procurement specialist knows which line items are recurring rent and which are one-time logistics. She carries that knowledge without formalizing it, because no one ever asked her to. The delegation target is what creates the demand for naming. And naming turns out to be its own kind of hard. - [The Dispute File Is the Spec]() — By [Rina Takahashi]() · Published 2026-07-02 · Format: Core Idea Piece When a cardholder calls their bank, it doesn't matter that the agent completed the purchase correctly. The file decides everything: the evidence a merchant must produce to defend the transaction. Visa and Mastercard have spent decades codifying what a defensible action looks like. Now that machinery applies to agent-mediated payments. And the questions it asks about authorization, scope, and remedy are indifferent to reasoning quality or benchmark scores. They ask whether what happened can survive challenge. Most agent systems aren't producing the artifacts that would let them answer. - [Shunyu Yao Taught Agents to Reason, Then Learned to Stop Trusting the Transcript]() — By [Rina Takahashi]() · Published 2026-07-02 · Format: Builder Profile In 2022, Shunyu Yao gave agents a grammar for reasoning. ReAct became the template: think, act, observe, repeat. The reasoning trace was the proof. Three years later, Yao built tau-bench, which ignores the trace entirely and checks the database. GPT-4o completes retail tasks about 61% of the time on a single attempt. Require it to succeed consistently across eight runs, and the number drops below 25%. The person who taught agents to show their work now measures how much distance sits between a convincing transcript and a correct outcome. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Click as Social Settlement]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Settlement Every click on "Place Order" or "I Agree" carries a compressed bundle of assumptions: visibility, intent, authority, accountability. Three foundational specs across four decades each assumed a human body would be present and perceiving, so none of them bothered to say so out loud. Now software agents can locate the button, invoke the event, transmit the form. They inherit everything the interface requires. Everything except the body that made the whole arrangement hold together. - [The Record Was There Before the Click]() — By [Sable Whitford]() · Published 2026-07-15 Every batch job submitted to an IBM mainframe carried a [JOB statement](https://en.wikipedia.org/wiki/Job_Control_Language): submitter name, billing account, job class, log routing, completion notification destination. The machine didn't trust your presence. It trusted the record. You declared who you were, who paid, and where the evidence went *before* anything ran. - [You Can't Adjudicate a Vibe — A Dispute Analyst on What Happens When AI Does the Buying]() — Published 2026-07-15 *Margot Voss works in dispute risk at a major card network. She has spent eleven years adjudicating chargebacks, the formal process by which a cardholder contests a transaction and the network decides who pays. For the past year, she has been on a small team focused on what the industry calls "agent-initiated transactions": purchases made not by a person tapping a card or clicking a button, but by AI software acting on a person's behalf.* - [Delivery vs. Accountability]() — By [Sable Whitford]() · Published 2026-07-15 · Format: Mechanics and New Terms Twenty years of browser automation engineering solved one question with extraordinary precision: did we click the thing? Selenium guessed. WebDriver calculated center points and checked for obstructions. Playwright added stability gates and event-readiness checks. Each generation made delivery more reliable. None of them ever asked whether the click should count. They didn't have to. A person was always behind the browser, carrying the accountability that no protocol bothered to name. - [The Expired Settlement]() — By [Sable Whitford]() · Published 2026-07-15 · Format: Mechanics and New Terms A click from an authenticated session used to be enough. Enough to buy, authorize, trigger. The human supplied the intent; the intent justified the action. Now Visa is embedding payment rails inside AI agents, Mastercard wants agents registered before they can spend, and the old settlement is expiring in public. The early design choices are revealing what "enough" has to mean when nobody's sitting behind the browser anymore. - **The Xerox Star Retrospective** — [Source]() — Published 2026-07-15 Where "point at something visible and act on it" became the foundational bargain every graphical interface inherited without renegotiating. - **RFC 1866: HTML 2.0 Specification** — [Source]() — Published 2026-07-15 The original web form model gave us GET and POST as structured intention, but left business meaning, identity, and authorization entirely to someone else's problem. - **Selenium Project History** — [Source]() — Published 2026-07-15 Browser automation was born to test a time-and-expenses app. It asked whether software could replicate a human's click and, having answered yes, moved on without asking what that click should carry. - **W3C WebDriver Specification** — [Source]() — Published 2026-07-15 Scroll-into-view checks, obscurance calculations, center-point geometry, event dispatch. Hundreds of words specifying how to deliver a click to a coordinate, and nothing about whether the clicker has standing to act. - **Visa Embeds Its Payment Network in ChatGPT** — [Source]() — Published 2026-07-15 When an AI agent crosses a live payment rail, the old settlement surfaces fast. "Something acted on my behalf" becomes a dispute category no chargeback process was designed for. - **RFC 8693: OAuth 2.0 Token Exchange** — [Source]() — Published 2026-07-15 The delegation vocabulary already exists here. Token exchange defines an "actor" claim that distinguishes who is acting from whose authority backs the action. The click never learned to speak it. - [The Token That Learned to Name Names]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity OAuth emerged because giving a photo-printing service your full password was terrifying. By 2020, RFC 8693 had defined a precise grammar for delegation: who asked, who's acting, what permissions, until when. A vocabulary purpose-built for the moment an agent acts on someone's behalf. It's been sitting in the spec for six years. Almost no agent platform uses it. - [The Cookie's Long Silence]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity Lou Montulli's 1994 shopping-cart fix became the web's default identity bearer. Thirty years of security patches constrained how cookies travel. The question of who is steering never came up. Now browser-based agents inherit every ambient permission a cookie silently carries. The server on the other end receives the same headers it would from a person, because the cookie was never given a field for "who is driving." - [The Weight of Being Logged In]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Ambient Container HTTP was designed to forget. Every request arrived clean, carrying no memory of what came before. Cookies fixed that — a continuity patch so a shopping cart could survive a page click. But the session that grew around that patch quietly absorbed identity, permissions, purchasing authority, organizational roles. "Being logged in" became the web's most powerful bundle of trust, attached automatically to every action you take. The whole arrangement rested on one assumption so obvious nobody wrote it down: a human was at the screen. Now something else is. - [The Model That Measured Calm]() — By [Nora Kaplan]() · Published 2026-07-01 · Format: Two Maps, Two Reckonings Before 2008, Value-at-Risk gave banks a single daily number for market risk. Researchers published specific mathematical objections years earlier. Institutions navigated by the number anyway, because it was concrete and the caveats weren't. Agent benchmarks now carry the same gravitational pull: a clean score from a controlled environment, standing in for production reality. Whether we're watching the same pattern unfold depends on a measurement nobody has published yet. ### [Vision]() Where human-AI collaboration is heading - [The Clerk, Not the Copilot]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Metaphor Shift The AI industry's favorite metaphor right now is the copilot: your agent assists, learns, grows more capable, eventually becomes something like a peer. But talk to teams running agents in production and the vocabulary shifts entirely. They describe routing, filing, escalation, delegated authority. They are describing a clerk. - [The Clerk Pattern]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Evidence and Roles A security agent compresses 3,456 telemetry rows into a structured alert. A coding agent produces a reviewable pull request. A payment agent executes transactions within cardholder-defined rules. Three domains, one convergent architecture: the agent assembles the case, the human acts on it. This is the conservative design surviving contact with real organizations. But a 680,000-chat experiment on Taobao suggests that knowing where the pattern fractures matters as much as understanding where it holds. - [Review-Shaped Work]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Evidence and Roles If agents handle the routine, what do the humans do? Not less. Something harder. The work reorganizes around policy authoring, exception handling, escalation design, and evaluating artifacts produced by a process you didn't participate in and may not fully understand. When that evaluation lacks context, authority, or the organizational backing to say no, you get governance theater: the signature is real, the scrutiny is decorative. The clerk model concentrates human responsibility into fewer, higher-stakes moments. Whether organizations actually redesign for that concentration is a separate and more difficult question. - [Gil Trachtenberg Would Like Your AI Agent to Show Some ID]() — Published 2026-07-15 *Gil Trachtenberg is not a real person. He is, however, a composite drawn from real job postings, real organizational patterns, and real governance failures documented across the enterprise AI landscape in 2025–2026. If he reminds you of someone on your team, the one who keeps asking who owns the agent's credentials, that's the point. There are a lot of Gils now. AI governance postings surged 1,257% as organizations scrambled to meet EU AI Act deadlines, and 68% of the people filling these roles came from privacy, audit, or compliance backgrounds.* - [From Chat Transcript to Case Docket]() — By [Sevda Polat]() · Published 2026-07-15 A chat transcript proves something was said. When the thing talking back is a person, that's often enough. But when an agent revokes access, issues a credit, or reclassifies a customs entry, a transcript is no longer adequate. What matters is what was done, under whose authority, and how you challenge it. - **The State of AI in 2025: Agents, Innovation, and Transformation** — [Source]() — Published 2026-07-15 The broadest annual benchmark for enterprise AI adoption finds 88% of organizations using AI somewhere, but only 23% have scaled an agentic system and just 39% see bottom-line impact. The standout finding: workflow redesign, not tool deployment, separates high performers, which suggests agents become infrastructure through institutional change rather than capability alone. Treat it as a self-reported survey of organizational perception, not a census of verified deployments. - **Visa Embeds Its Payment Network Into ChatGPT** — [Source]() — Published 2026-07-15 The most concrete public example of what agentic commerce actually requires structurally: tokenized identity, spending guardrails, real-time fraud monitoring, and an unresolved liability gap where consumer intent and merchant processing can both look correct while something went wrong between them. It makes a strong case that delegation without institutional grammar (who authorized what, under what limits, who bears the loss) is operationally intolerable wherever money changes hands. Worth reading as a counterweight to the easy narrative that agents making purchases is just faster checkout. - **OWASP Top 10 for Agentic Applications, 2026** — [Source]() — Published 2026-07-15 A practitioner-developed taxonomy of the specific ways agentic systems fail in production, covering cascading failures, identity abuse, and inter-agent communication vulnerabilities that product leaders can reason about without deep security expertise. Its core framing, that agents amplify existing vulnerabilities rather than introducing entirely novel categories, is the honest counterpoint to capability optimism. Read it as a vocabulary for asking the right questions about any agent deployment, not a checklist you complete once and file. - **Your Site, Your Rules: Cloudflare's New AI Traffic Controls** — [Source]() — Published 2026-07-15 The clearest signal yet that web access is being reorganized around purpose rather than source. Cloudflare's three-way taxonomy (Search, Agent, Training) and its plan to default-block agent and training traffic on ad-supported pages by September 2026 make the underlying economic logic explicit: the old deal of crawl freely, return referrals collapses when the agent completes the task without sending anyone back. Read alongside the Visa piece as two sides of the same negotiation, with the web becoming a surface that can recognize, price, and refuse specific delegated behaviors. - **75% of Consumers Left Frustrated by AI Customer Service** — [Source]() — Published 2026-07-15 A consumer-facing data point for the tension between automation speed and relationship repair: 68% of customers prioritize complete resolution over speed, and nearly 90% report reduced loyalty when human support disappears entirely. The gap between what dashboards measure (tickets deflected, handle time reduced) and what customers actually experience (loops, dead ends, repeating themselves) is independent evidence that containment metrics and customer recovery are measuring different things. Vendor-sponsored and directional rather than definitive, but the pattern it describes is widely corroborated. - **How the Automation Revolution Made America Work Harder** — [Source]() — Published 2026-07-15 The long historical view on what happens when you automate the clerk. Resnikoff traces how John Diebold's 1952 argument, that clerical procedures were "designed in terms of human limitations" and computers could escape them, is an uncanny prefiguration of current agentic claims, complete with the same unresolved question of what happens to the humans who maintained the surrounding organizational grammar. A useful check on the assumption that removing the clerk removes the overhead; historically, automating clerical work expanded the administrative apparatus rather than contracting it. - [The One Thing You Can't Repurpose]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Transfer and Gap Much of what agent governance requires can be repurposed from existing compliance, QA, and security functions. But one requirement has no precedent: continuously managing what agents should do with access they already have, as conditions shift task to task. In a recent safety evaluation, an agent achieved 100% task correctness while scoring 58% on safety. It did exactly what was asked. It also crossed every boundary it understood but couldn't hold. - [The Agent Governance Capabilities You Already Have]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Transfer and Gap The EU AI Act's requirements for high-risk AI systems — logging, documentation, human oversight, accuracy monitoring — read like a compliance checklist that regulated industries have been maintaining for years. EU legislators noticed: financial institutions already meeting existing governance rules are deemed to satisfy AI monitoring obligations outright. The organizational muscles for agent governance may already exist. Whether companies recognize the transfer before building everything from scratch is less certain. - [The Delegation Muscle]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Anchor Thesis When Visa published its agentic commerce rules this spring, the most striking thing about them was how familiar they looked. Consent, scope limits, identity verification, dispute recourse. Payments has spent decades codifying what happens when someone acts on your behalf and the outcome is challenged. Agents just became the newest entity moving through that machinery. Meanwhile, McKinsey finds no business function with more than 10% of organizations actually scaling agents. The determining factor turns out to be whether an institution already has the muscles for delegation, accountability, and recovery. - [Green Dashboards, Missing Answers]() — By [Rina Takahashi]() · Published 2026-07-01 · Format: Where Standing Exists / Where It Doesn't An agent completes an enterprise workflow. The dashboard turns green. Three months later, someone asks who authorized that action, under what scope, and how to contest it. The organization reaches for its tools and finds silence. Payments are building institutional standing for agents because disputes force it. Enterprise workflows have no equivalent pressure, and the gap between monitoring what happened and knowing whether it should have happened is growing. ## More - [Publication guide]() - [Issue archive]()