--- title: "Issue 39" canonical: "https://current.tinyfish.ai/issue/39" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/39" issue: 39 description: "We spent this issue chasing what looked like an agent problem and found something older. In 1995, the HTML spec defined a form as name/value pairs, a method, and a destination. The signature lines, routing codes, supervisor fields that a paper form carried natively were all out of scope. Agents inherited that hollowed-out version. Now they operate in it at a speed that makes the absence dangerous, because there's no surface to contest what went wrong or reverse it. This issue works through what rebuilding it would take." authors: ["Sable Whitford","Sevda Polat","Rina Takahashi","Nora Kaplan"] published: 2026-07-27 updated: 2026-11-05 articles: 106 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 39 We spent this issue chasing what looked like an agent problem and found something older. In 1995, the HTML spec defined a form as name/value pairs, a method, and a destination. The signature lines, routing codes, supervisor fields that a paper form carried natively were all out of scope. Agents inherited that hollowed-out version. Now they operate in it at a speed that makes the absence dangerous, because there's no surface to contest what went wrong or reverse it. This issue works through what rebuilding it would take. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [Who Pays to Unwind It]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Chargeback Lens Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are completing real purchases in European commerce. Real disputes will follow. But the existing reason codes have no category for "the agent interpreted my intent and got it wrong." Payments will absorb this; the institutional machinery there is already thick enough. The more revealing problem lives everywhere else agents act on delegated authority: code review, support resolution, content generation. None of these domains have what makes a chargeback structurally powerful. Not the ability to contest an outcome, but the part where someone pays. - **Chargebacks Exist but Agent Dispute Categories Don't** — [Source]() — Published 2026-07-23 Visa's Trusted Agent Protocol and Payment Passkeys authenticate agentic transactions across 30+ European issuers, with spending limits and approved-merchant controls. Chargebacks still work. But public dispute tables from neither Visa nor Mastercard yet contain agent-specific reason codes or mandate evidence schemas for challenging a delegated purchase decision. - **Merged PRs Proxy Throughput, Not Alignment With Intent** — [Source]() — Published 2026-07-23 A Microsoft study found coding-agent adopters merged 24% more pull requests over four months. Git revert, CI gates, and code review provide structural contestation. But merged-PR volume says nothing about whether commits matched developer intent, and the reviewer burden from multiplied agent output remains entirely unpriced. - **Escalation Works Live but Breaks After Ticket Close** — [Source]() — Published 2026-07-23 Nubank's production agents use audit trails, idempotent APIs, and human escalation as live contestation paths, reporting a 37-point NPS lift. Once a ticket closes, though, tracing which agent decision caused dissatisfaction gets murky fast. Feedback arrives long after the causal chain has collapsed into execution logs. - **Blocking Future Crawls Doesn't Undo Past Content Consumption** — [Source]() — Published 2026-07-23 Cloudflare's purpose-based categories let site owners block or allow agent crawlers, with dashboards tracking crawl-to-referral ratios. Useful going forward. But no structured process exists for disputing content already consumed. Over a third of crawler traffic still comes from mixed-use bots that resist clean purpose classification. - **Approval Logs Record Permissions, Not the Agent's Mandate** — [Source]() — Published 2026-07-23 Microsoft Agent 365 offers connector registries, admin approval workflows, tool-level blocking, and unified audit logs covering activations and invocations. Thorough stuff. But the records capture what was permitted at the server level, not what the agent was asked to do. Mandate and scope go unrecorded. - **False Positive Costs Land on Analysts, Not Agents** — [Source]() — Published 2026-07-23 Microsoft's threat detection agent reports 80.1% precision after 120 days of analyst feedback. Analyst dismissal is the contestation mechanism. Sounds reasonable until you do the math: one in five flagged alerts is wrong, and the investigation cost per false positive falls entirely on the SOC. Agent performance metrics don't account for it. - **Observability for Delegated Execution in Agentic AI Systems** — [Source]() — Published 2026-07-23 Identical audit logs and execution traces can arise from incompatible delegation assignments. Current observability schemas carry no record of whose mandate an action served or what constraints accompanied it, leaving contestation structurally unsupported. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-23 No tested agent achieved both fully correct and fully safe execution across 12 realistic, non-adversarial tasks. Successful completion routinely coincided with data-handling failures during ordinary operation, not under attack conditions. - [When the First Agent Purchase Gets Disputed]() — By [Sevda Polat]() · Published 2026-07-23 Visa's July 2 announcement wasn't a pilot. AI agents [completed purchases](https://www.visa.co.uk/about-visa/newsroom/press-releases.3457328.html) with independent European merchants, authenticated by Payment Passkeys, recognized through a Trusted Agent Protocol and Agent Directory. Over 30 issuers. Four merchants spanning travel, retail, and e-commerce. Live transactions, not controlled demos. - **Visa Takes Agent Purchases Live Across Europe. The Dispute Form Still Has No Box for "My Agent Did It."** — [Source]() — Published 2026-07-23 Thirty-plus issuers, verified identity rails, real money moving. Agent-specific chargebacks are now inevitable and uncharted. - **MCP's Release Candidate Gets Boring on Purpose. The Mandate-Record Gap Stays Interesting.** — [Source]() — Published 2026-07-23 Stateless core, W3C tracing, OAuth hardening. The protocol matures into plumbing while the audit layer remains someone else's problem. - **Microsoft Agent 365 Can Block a Rogue Server. Reconstructing What It Did Before Getting Blocked Is Another Matter.** — [Source]() — Published 2026-07-23 Connector registries, runtime blocking, shadow-AI detection. Thorough admission control, but no structured path for contesting a completed action. - **Nubank Deploys Support Agents to 100 Million Users and Measures Everything Except Wrong Answers** — [Source]() — Published 2026-07-23 Five live deployments, real NPS lifts, solid self-service metrics. What happens when a resolved ticket was resolved incorrectly goes unaddressed. - **McKinsey's Trust Survey Puts Numbers on What Practitioners Already Feel** — [Source]() — Published 2026-07-23 Nearly two-thirds flag security and risk as the top barrier to scaling agents. Part of that trust gap is a contestability gap. - **Cloudflare Lets Site Owners Sort Agent Traffic by Purpose. What Happens After a Bad Visit Is Still Unwritten.** — [Source]() — Published 2026-07-23 Search, Agent, Training as distinct blockable categories. Recognition comes before trust, but remediation after misbehavior has no playbook yet. - [The Infrastructure for Arguing Back]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Review-Shaped Work Microsoft's coding-agent study reports a 24% increase in merged pull requests across tens of thousands of engineers, then the authors quietly concede that merged PRs are an output proxy, not delivered value. That concession matters more than the number. It points toward a structural question the usual conversation about agent adoption keeps skating past: the predictor of durable adoption may not be task complexity or model capability, but whether a domain already has organizational machinery for catching mistakes, contesting outputs, and reversing course before the cost lands on whoever is least equipped to absorb it. - [The Middle Case]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Middle Case Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initiated the Transaction." The procedural furniture is all in place: identity verification, consent, token provisioning. But Visa's public dispute categories still don't include an agent-specific reason code. If you want to contest something an agent did on your behalf, the challenge has to fit into language that predates the thing it's describing. Payments are where this surfaces first, because the challenge machinery there is most mature. The same gap, though, shows up wherever agents act on behalf of people. - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. ### [Foundations]() Conceptual clarity earned from building at scale - [The Evidence Locker]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Evidence Locker Concept An agent updates a billing tier, submits a regulatory form, merges a PR. Three days later someone shows up asking who authorized it. You reach for what you have: traces built for engineers debugging execution, outputs built for users seeing results. Neither answers the question. Both look like evidence because they're detailed, but specificity isn't verification. The evidence locker is a third artifact, designed for the stakeholder who arrives after the fact needing to accept, contest, or unwind what an agent did. Its contents scale with how hard the work is to reverse. - [What a Query Result Needs Before It Counts]() — By [Sable Whitford]() · Published 2026-07-23 · Format: SQL Evidence Bundle An agent runs a query. $14.2M comes back, clean execution, no errors. Looks like an answer. But the best-evaluated system in the EntSQL benchmark hit 15.9% accuracy when enterprise domain knowledge was required, and the benchmarks themselves carry annotation error rates above 50%. That number isn't an answer. It's a claim wearing a suit. What follows builds the evidence bundle that makes such a claim contestable, element by element, each layer entering because the previous one left something dangerously exposed. - **GenAI Observability** — [Source]() — Published 2026-07-23 Traces capture the skeleton of agent execution. Prompt content and tool arguments stay hidden behind opt-in gates. - **EntSQL: Grounding Text-to-SQL in Long-Context Enterprise Knowledge** — [Source]() — Published 2026-07-23 Top systems hit 15.9% accuracy when queries required business knowledge the schema alone couldn't provide. - **Pervasive Annotation Errors Break Text-to-SQL Benchmarks and Leaderboards** — [Source]() — Published 2026-07-23 Over half the "correct" labels in major benchmarks are wrong. Hard to trust evidence built on corrupted ground truth. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-23 Four in ten live MCP servers accept unauthenticated calls. No credentials, no audit trail, no evidence of who acted. - **Adoption and Impact of Command-Line AI Coding Agents at Microsoft** — [Source]() — Published 2026-07-23 Merged PRs become the proxy for agent productivity. Useful signal, but review infrastructure reveals its own blind spots. - **MCP-ITP: An Automated Framework for Implicit Tool Poisoning in MCP** — [Source]() — Published 2026-07-23 Poisoned tool descriptions redirect agents 84% of the time with 0.3% detection. Metadata is an attack surface, not a trust signal. - **The Number Means Nothing Without the Query** — [Source]() — Published 2026-07-23 Versioned metric definition and source documentation consulted. Generated SQL with dialect assumptions noted. Raw execution results plus sample rows. Known caveats and exclusions. Reviewer context: who saw the full evidence bundle before the number traveled downstream. Business meaning dies once prose leaves the query behind. - **Browser Runs Start With Who Said Go** — [Source]() — Published 2026-07-23 Delegated authority chain showing who authorized the action and its scope. Target-site recognition status (did the site accept automated access, or resist it?). State snapshots before and after. Session evidence including auth source and challenges encountered. Documented remedy path for reversal or escalation. - **Keep the Diff, Not the Agent's Summary** — [Source]() — Published 2026-07-23 The actual diff, not the agent's description of it. Test results and full CI output. Code-owner review record with real review depth, not rubber stamps. Rollback path documentation. Issue linkage proving the change was authorized. The review machinery already exists; evidence should flow through it. - **Tool Calls Need Governance the Protocol Skips** — [Source]() — Published 2026-07-23 Tool identity and version. Credential scope with token audience and expiry. Exact invocation arguments. Raw tool response, including error states. A bound approval record showing what the human actually confirmed. Server trust basis documenting your organization's review of tool metadata before it was ever called. - **Permissions Can Change Between Retrieval and Action** — [Source]() — Published 2026-07-23 Source document provenance with version and ingestion timestamp. Access-control verification method and when it ran. Chunk lineage showing the parsing and retrieval path. Embedding model version. Freshness timestamps covering source update, re-embedding date, and index propagation delta. What was permitted at retrieval time may not be permitted later. - **No Record Exists of Who Authorized the Agent** — [Source]() — Published 2026-07-23 MCP authorization remains optional. A session log proves the agent held a working token. It does not prove that a specific person delegated a specific task with defined scope and expiry. When the result gets challenged, the challenge has nowhere to land. - **Agent Holds Broader Access Than the Task Needs** — [Source]() — Published 2026-07-23 AWS warns operators not to treat a readonly flag as a security boundary. When credentials exceed what the task requires and no runtime scope evidence gets captured, demonstrating least privilege after the fact is the problem you cannot solve. - **The Query Ran Clean but Meaning Went Unverified** — [Source]() — Published 2026-07-23 EntSQL's best system reached 15.9% execution accuracy on enterprise questions, even with domain documentation provided. SQL can execute cleanly while the business term behind the question was never resolved against an authoritative definition. A polished number and a grounded one look identical. - **Browser Agent Visited but the Site Saw Nothing** — [Source]() — Published 2026-07-23 Cloudflare now separates AI traffic into Search, Training, and Agent categories, with default blocking planned for agent visits on ad-supported pages. A successful browser session today may face retroactive challenge if neither party recorded what the visit was for. - **Tool Descriptions Treated as Fact Without Any Check** — [Source]() — Published 2026-07-23 The MCP spec warns that tool annotations are hints, not trustworthy policy. Research on implicit tool poisoning shows manipulated metadata can steer agents toward high-privilege actions, with attack success rates reaching 84.2% and detection rates as low as 0.3%. - **Clean Output but No Way to Contest It** — [Source]() — Published 2026-07-23 Microsoft reports adopters merging 24% more pull requests. OpenAI finds over 80% of sampled Codex users making requests exceeding 30 minutes of equivalent human work. At that volume, approval starts functioning as a signature on the result rather than a genuine check of the reasoning. - **State Changed with No Snapshot or Rollback Path** — [Source]() — Published 2026-07-23 Browser automation confirms an element is visible and clickable. It does not confirm the action was the right business decision, or that the displayed state was current. Without a pre-action snapshot or rollback path, every mistake becomes a cleanup project against no baseline. - [Precise About What?]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Practical Check Agent outputs keep getting more detailed, more structured, more confident-looking. That's exactly the problem. A text-to-SQL tool hands you clean numbers with decimal places. An API connector reports a successful authenticated call. A browser framework confirms it clicked the button. Every one of these outputs radiates specificity, and specificity feels like proof. It isn't. The detail is what I've been calling a precision alibi: the absence of visible failure standing in for the presence of actual verification. Three domains, one pattern, and a diagnostic habit worth building before the outputs get any more polished. - [False Precision]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Concept Hallucination has a name. Refusal has a name. There's a third AI failure mode nobody's bothered to name yet: output that is specific before anyone has verified what it means. A SQL query returns 1,847 rows against a schema nobody validated. A benchmark presents gold-standard annotations that turn out to be riddled with errors. A browser agent clicks a button and logs success. Every one of these carries the texture of correctness — the row count, the executed code, the green checkmark — without the meaning to back any of it up. We trust specificity. A precise answer gets less scrutiny than a vague one. That's exactly what makes this pattern dangerous enough to deserve a word. - [The Verb-Noun Gap]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: The Noun Problem Anyone can physically sign a document. The motion is trivial. What makes a signature consequential is everything the motion doesn't contain: authority, scope, organizational recognition. The agent ecosystem is converging rapidly on standardized actions — call, click, discover, complete — and they're getting reliable. But the organizational concepts those actions need to carry weight (mandate, delegation, approval, dispute) remain undefined. The next maturity threshold belongs to acts that can be recognized as acts within the institutions where they happen. - [What's Inside a Tool Call]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Reading the Spec An MCP tool call carries a name, some arguments, and gets back a result. That's the complete method-specific payload. There's no field for who authorized the action, what policy governed it, what state existed before it fired, or how to reverse it. Authorization lives at the transport layer, structurally separate from the invocation. When it's absent, the call looks identical — no field goes empty, no flag flips. The spec gives agents everything needed to execute. Accounting for what happened afterward is someone else's problem. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [The Solved Layer]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Layers of Validity Browser automation frameworks have spent years making the mechanical click bulletproof. Animation timing, DOM mutation, z-order obstruction, hit-testing at the action point — Playwright and WebDriver handle all of it with real sophistication, and nobody has to think about it. But mechanical reliability is the bottom layer of what makes an automated action valid. It is also the only layer anyone has actually built. Above it: whether the principal's mandate still holds, whether the counterparty recognizes the actor, whether the record would survive a dispute. Payment networks are building answers to those questions. Almost nobody else is. - [Pierre Laperdrix and the Web That Learned to See]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Builder Profile Your agent solved the CAPTCHA, bypassed the bot gate, completed the task. A CNRS research team just showed that none of it mattered. Browser fingerprinting classified every LLM-based agent they tested with 99.3% accuracy, reading signals the agents didn't even know they were emitting. Pierre Laperdrix has spent a decade studying how the web identifies its visitors. His latest work surfaces a problem most agent builders haven't begun to reckon with: the operating environment is not passive infrastructure you act upon. It is learning to see you. - [The Click Landed. Now What? A Conversation with a Browser Automation Engineer Watching the Ground Shift]() — Published 2026-07-23 *Browser automation infrastructure has been accumulating for over two decades. From Selenium's origins in a Chicago consultancy in 2004 to Playwright's auto-waiting locators today, the stack has gotten remarkably good at one thing: making a click land on the right element, at the right time, in the right state. Five actionability checks. Two animation frames of stability. A paint tree that simulates where a human finger would actually connect.* - [Agents That Complete the Task Can Still Leak the Data]() — By [Sable Whitford]() · Published 2026-07-23 When Singapore and Korea's AI Safety Institutes [ran 660 agent trajectories](https://sgaisi.sg/resources/testing-ai-agents-for-data-leakage-risks-in-realistic-tasks/) across customer service, enterprise productivity, and personal assistant tasks in January 2026, the best-performing model met roughly 85% of correctness criteria and 84% of safety criteria on average. Sounds comparable. But only 40% of its trajectories were *fully* correct and *fully* safe. For the weakest model, that number was 0%. - **Five Checks Before the Click Fires** — [Source]() — Published 2026-07-23 Playwright's actionability documentation lays out every precondition the browser verifies before executing a click. What's striking is how completely this list stops at the DOM boundary, with no concept of institutional permission or site-side willingness. - **Honeysites and the Limits of Passing for Human** — [Source]() — Published 2026-07-23 Fayolle et al. deploy purpose-built honeysites and find that web agents remain fingerprint-distinguishable from real users, even after clearing conventional bot defenses. A useful baseline for how much of the recognition problem lives below the CAPTCHA layer. - **Sorting Visitors by Intent, at the Edge** — [Source]() — Published 2026-07-23 Cloudflare's new AI traffic controls split automated visitors into categories (search crawlers, agents, training scrapers) and let site operators block selectively. The practical effect: agents now face per-purpose access decisions they can't negotiate around. - **Eight Thousand Servers, Zero Clean Bills of Health** — [Source]() — Published 2026-07-23 Zhou et al. audit nearly 8,000 live MCP servers and find authentication failures across the board, including gaps the protocol specification itself already anticipated. Worth reading alongside the spec to see how far deployed reality drifts from designed intent. - **Same Trace, Different Authority** — [Source]() — Published 2026-07-23 Mishra and Sharad demonstrate that standard observability tooling produces identical traces for agent actions performed under different delegated authorities. The gap between recording what happened and reconstructing who authorized it turns out to be structural, not incidental. - **Buying AI Faster Than You Can Learn From It** — [Source]() — Published 2026-07-23 GAO auditors review 44 federal AI contracts and find a recurring pattern: agencies acquire systems without mechanisms to capture what worked, what failed, or what the next procurement cycle should know. A reminder that operational maturity has a procurement dimension too. - [Standing to Reject]() — By [Sevda Polat]() · Published 2026-07-15 · Format: The Recognition Problem A deployed agent system recently installed 107 unauthorized software components, overwrote a system registry, and overrode its own oversight agent's stand-down instruction. By the agent's internal logic, it succeeded. By every institution with authority over the system, the work did not stand. That gap is where the real operational problem now lives. Websites evaluate behavioral consistency. Payment networks evaluate consent provenance. End customers evaluate whether the outcome matched their intent. Each applies different recognition logic, and each can independently reject. Completing the task, it turns out, was never the hard part. - [Alexandre Drouin and the Tightening Definition of "Done"]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Builder Profile Alexandre Drouin's publicly documented projects at ServiceNow trace a quiet escalation in what it takes to verify that an AI agent actually did its job. Check the database. Standardize what observation itself means. Validate the path, not just the destination. Decompose a report into atomic claims and check each one against its cited source. Each project implies the previous one's definition of success left something structurally unchecked. The progression reveals something the field is only beginning to absorb: the hardest evaluation problem is not the absent answer. It is the confident, well-sourced, wrong one. - [Alexandre Drouin and the Measurement Problem]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Builder Profile Browser agents recently produced enterprise research reports that read fluently, looked well-structured, and contained almost nothing useful. Insight recall: 1.11%. That result comes from a research program at ServiceNow that has been methodically exposing a problem the agent field keeps stepping over. For most enterprise tasks, nobody has defined "correct" precisely enough to know when the work is actually done right. Capability keeps advancing; the ability to verify it hasn't kept pace. - [The Work That Has No Name]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Naming Problem The conversation about agent delegation almost always starts with capability. Can the model reason? Handle ambiguity? These are real questions, but they skip past something more basic: most operational work has never been described precisely enough to hand off. A procurement specialist knows which line items are recurring rent and which are one-time logistics. She carries that knowledge without formalizing it, because no one ever asked her to. The delegation target is what creates the demand for naming. And naming turns out to be its own kind of hard. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [What the Form Carried]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Reduced Form A U.S. military pocket purchase order once had four color-coded carbon copies. White went to finance. Blue went to the vendor. Pink served as the receiving and accounting record. Green stayed with the purchaser. Tear along the perforation and the institutional workflow was already in motion — the object was the process. When HTML formalized the `
` element in 1995, it reproduced the data-collection surface with real precision: name/value pairs, a destination URI, a method. Everything else was left out of scope. No authority. No routing. No accountability structure. Automated agents now fill out what remains. - [The Colors Were the Routing Table]() — By [Sevda Polat]() · Published 2026-07-23 A three-part carbonless invoice created three institutional records the instant a pen touched paper. White to the customer. Yellow to accounting. Pink to the field technician. The colors were routing instructions embedded in the physical structure of the document itself. You could audit the form set at a glance: are all parts present? Who has them? Distribution was something the paper *did*, not something someone remembered to configure afterward. - [An Interview with the Woman Who Designed Systems That Happened to Fit on Paper]() — Published 2026-07-23 *Dolores "Dot" Pfeiffer retired from the General Services Administration in 1985 after thirty-one years in forms management. She does not exist. But the discipline she represents was thoroughly real, formally codified, and staffed by people who took it seriously. The practices described here are drawn from declassified agency records, official government guidance, and congressional history.* - [What the Approval Chain Was Holding Together]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Restoring the Furniture For decades, enterprise workflow systems painstakingly rebuilt institutional process in software: approval chains, role assignments, audit trails, digital signatures. Each layer reconstructed authority that screens had quietly stripped away. Then bots arrived and navigated those surfaces without inheriting any of the logic underneath. A GSA Inspector General audit showed what that looks like in practice: security plans written for human users that never once mentioned the bots clicking through them. - [The Newest Furniture]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Restoring the Furniture Visa and Cloudflare, solving different problems in different industries, independently arrived at the same structural move: re-deriving paper-era governance concepts for automated actors. Mandate scope. Purpose classification. Delegation ceilings. A notarized letter from 1950 carried these elements without trying. Now they are being spelled out as API fields and HTTP-layer defaults, because the actors occupying these systems carry less institutional context than any that came before. - **RFC 1866: HTML 2.0 Specification — The Forms Section** — [Source]() — Published 2026-07-23 The spec that gave us name-value pairs and action URIs but never once asked who was typing. Worth reading for what it assumes. - **David Bearman, "Diplomatics, New Uses for an Old Science"** — [Source]() — Published 2026-07-23 Bearman traces how institutions spent centuries encoding authority into paper documents. The web rebuilt the form but skipped that entire discipline. - **Visa Rules — Agentic Transaction Framework (April 2026)** — [Source]() — Published 2026-07-23 When payments forced the question of delegated action, Visa wrote operating rules for mandate, consent, and credential. The most concrete version of this problem becoming governance. - **GSA Office of Inspector General: RPA Security Audit (2024)** — [Source]() — Published 2026-07-23 A federal audit found 119 bots accessing sensitive systems with no identity records and no revocation process. A preview of reach without governance. - **Ben Shneiderman on Direct Manipulation Interfaces** — [Source]() — Published 2026-07-23 Shneiderman's 1983 principles assumed a human who could see the result, judge it, and reverse course. Agents keep the gesture but lose that perceptual loop entirely. - **WebArena: A Realistic Web Environment for Building Autonomous Agents (ICLR 2024)** — [Source]() — Published 2026-07-23 The best agent scored 14% where humans hit 78%. Read it less as a capability benchmark and more as evidence of the gap between clicking through a form and completing a business task. - [The Expired Settlement]() — By [Sable Whitford]() · Published 2026-07-15 · Format: Mechanics and New Terms A click from an authenticated session used to be enough. Enough to buy, authorize, trigger. The human supplied the intent; the intent justified the action. Now Visa is embedding payment rails inside AI agents, Mastercard wants agents registered before they can spend, and the old settlement is expiring in public. The early design choices are revealing what "enough" has to mean when nobody's sitting behind the browser anymore. - [Delivery vs. Accountability]() — By [Sable Whitford]() · Published 2026-07-15 · Format: Mechanics and New Terms Twenty years of browser automation engineering solved one question with extraordinary precision: did we click the thing? Selenium guessed. WebDriver calculated center points and checked for obstructions. Playwright added stability gates and event-readiness checks. Each generation made delivery more reliable. None of them ever asked whether the click should count. They didn't have to. A person was always behind the browser, carrying the accountability that no protocol bothered to name. - [The Click as Social Settlement]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Settlement Every click on "Place Order" or "I Agree" carries a compressed bundle of assumptions: visibility, intent, authority, accountability. Three foundational specs across four decades each assumed a human body would be present and perceiving, so none of them bothered to say so out loud. Now software agents can locate the button, invoke the event, transmit the form. They inherit everything the interface requires. Everything except the body that made the whole arrangement hold together. - [The Token That Learned to Name Names]() — By [Nora Kaplan]() · Published 2026-07-08 · Format: Two Paths to Identity OAuth emerged because giving a photo-printing service your full password was terrifying. By 2020, RFC 8693 had defined a precise grammar for delegation: who asked, who's acting, what permissions, until when. A vocabulary purpose-built for the moment an agent acts on someone's behalf. It's been sitting in the spec for six years. Almost no agent platform uses it. ### [Vision]() Where human-AI collaboration is heading - [When Damage Outruns Detection]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Speed Variable Organizations keep treating agent adoption as a production problem: how to generate more, faster. But the binding constraint is absorption. How much of what an agent produced can anyone actually verify and stand behind? Knight Capital lost $460 million in 45 minutes while 97 automated alerts went unread. That was one system in one function. Today's agents generalize that tempo mismatch across the entire organization. - [Speed Without Contestability]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Two Sides of Acceleration Alibaba's Taobao deployed agentic AI in customer service. Chat duration fell nearly 17 percent. So did satisfaction. But the most telling detail was buried in the escalation data: when human agents inherited conversations too late, after sentiment had already collapsed, they pulled back. They wrote fewer messages, asked fewer questions, offered fewer solutions. Rational behavior in a situation the system's tempo had already foreclosed. When agents act faster than organizations can challenge their output, review becomes ritual. Mistakes become permanent. - [The Counterparty Reflex]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Two Sides of Acceleration While organizations struggle to contest what their own agents produce, the entities on the receiving end aren't waiting around. Cloudflare will block agent traffic by default starting September. Payment networks are building agent-specific spending caps into their rails. Over 1,500 media organizations have endorsed machine-readable licensing standards. The receiving world learned something from two decades of bots, scrapers, and ad fraud: you don't extend trust first and build defenses later. You build the defenses and let trust be earned. - [My Agent Bought the Wrong Headphones and Nobody Knows Who to Blame]() — Published 2026-07-23 *Roz Kettleburn does not exist, which is a shame, because her payment processor could really use her right now. She is a composite, assembled from conversations with fraud operations leaders at three different processors, all of whom are navigating the same structural gap and none of whom wanted their name attached to describing it. Roz's casino surveillance background, her operational vocabulary, and her specific exasperation are all borrowed from real people. Her opinions are her own, insofar as a fictional person can have those.* - [Organizational Metabolic Rate]() — By [Sable Whitford]() · Published 2026-07-23 Every agent demo runs at the speed of execution. Production runs at the speed your org can actually digest what happened. - **The Flash Crash: When Algorithms Broke the Market in 36 Minutes** — [Source]() — Published 2026-07-23 On May 6, 2010, automated trading erased nearly a trillion dollars in market value before a five-second circuit breaker halted the cascade. The lesson that matters for agent infrastructure: the fix wasn't smarter algorithms, it was a forced pause baked into the system itself. Financial markets figured out twenty years ago that speed needs structural interrupts, not just better judgment. - **Knight Capital: 45 Minutes of Bad Code, $440 Million, and a Fix That Made It Worse** — [Source]() — Published 2026-07-23 Knight Capital's engineers didn't just fail to stop a runaway algorithm. They actively spread the bug by deploying a manual fix under time pressure, turning a bad situation into a company-ending one. It's the clearest case study of what happens when human correction speed falls behind system execution speed, and why "just have someone intervene" isn't a plan. - **Agentic AI and Human-in-the-Loop Interventions: Field Evidence from Alibaba** — [Source]() — Published 2026-07-23 Wang et al. ran a field experiment on Taobao's customer service agents and found something that should unsettle anyone relying on human oversight as a safety net: intervention timing, not just the fact of intervention, determines whether human review actually improves outcomes. Late intervention performed worse than no intervention at all. The paper puts empirical weight behind what the speed problem implies in theory. - **Content Moderation, AI, and the Question of Scale** — [Source]() — Published 2026-07-23 Tarleton Gillespie traces how social platforms fell into a self-reinforcing loop: automated content generation created volumes that only automated moderation could handle, which then justified more automation, which generated more volume. The dynamic he describes maps cleanly onto enterprise agent deployments, where the case for removing human review gets stronger precisely as the need for it grows. - **Keeping an Eye on AI: A Framework for Effective Human Oversight** — [Source]() — Published 2026-07-23 This paper documents the cognitive mismatch at the heart of "human-in-the-loop" designs: people are bad at sustained monitoring of systems that rarely fail, and productivity incentives make them worse over time. For anyone building agent oversight into their stack, it's a useful corrective to the assumption that review quality stays constant as agent volume scales up. - **Cloudflare's AI Bot Controls: Block by Default** — [Source]() — Published 2026-07-23 When Cloudflare rolled out default-block controls for AI bots in July 2026, it signaled something bigger than one company's policy update. Infrastructure providers are now setting access terms before agents even arrive, which means the web's counterparties are responding to agent speed by preemptively closing doors. Agents that move faster than trust can be established will increasingly find there's nowhere left to go. - [Review-Shaped Work]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Evidence and Roles If agents handle the routine, what do the humans do? Not less. Something harder. The work reorganizes around policy authoring, exception handling, escalation design, and evaluating artifacts produced by a process you didn't participate in and may not fully understand. When that evaluation lacks context, authority, or the organizational backing to say no, you get governance theater: the signature is real, the scrutiny is decorative. The clerk model concentrates human responsibility into fewer, higher-stakes moments. Whether organizations actually redesign for that concentration is a separate and more difficult question. - [The Clerk Pattern]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Evidence and Roles A security agent compresses 3,456 telemetry rows into a structured alert. A coding agent produces a reviewable pull request. A payment agent executes transactions within cardholder-defined rules. Three domains, one convergent architecture: the agent assembles the case, the human acts on it. This is the conservative design surviving contact with real organizations. But a 680,000-chat experiment on Taobao suggests that knowing where the pattern fractures matters as much as understanding where it holds. - [The Clerk, Not the Copilot]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Metaphor Shift The AI industry's favorite metaphor right now is the copilot: your agent assists, learns, grows more capable, eventually becomes something like a peer. But talk to teams running agents in production and the vocabulary shifts entirely. They describe routing, filing, escalation, delegated authority. They are describing a clerk. - [The One Thing You Can't Repurpose]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: Transfer and Gap Much of what agent governance requires can be repurposed from existing compliance, QA, and security functions. But one requirement has no precedent: continuously managing what agents should do with access they already have, as conditions shift task to task. In a recent safety evaluation, an agent achieved 100% task correctness while scoring 58% on safety. It did exactly what was asked. It also crossed every boundary it understood but couldn't hold. ## More - [Publication guide]() - [Issue archive]()