--- title: "Market Pulse" canonical: "https://current.tinyfish.ai/issue/39/market-pulse" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/39/market-pulse" issue: 39 section: "market-pulse" description: "Reading the agent ecosystem through a practitioner's lens" authors: ["Sevda Polat","Rina Takahashi","Nora Kaplan"] published: 2026-07-27 updated: 2026-07-23 articles: 20 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 39 — Market Pulse Reading the agent ecosystem through a practitioner's lens ### The Chargeback Lens - [Who Pays to Unwind It]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Chargeback Lens Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are completing real purchases in European commerce. Real disputes will follow. But the existing reason codes have no category for "the agent interpreted my intent and got it wrong." Payments will absorb this; the institutional machinery there is already thick enough. The more revealing problem lives everywhere else agents act on delegated authority: code review, support resolution, content generation. None of these domains have what makes a chargeback structurally powerful. Not the ability to contest an outcome, but the part where someone pays. ### What's the Chargeback? Chargebacks. Git reverts. Escalation queues. Admin approvals. Analyst dismissals. Every domain deploying agents has borrowed some existing mechanism for pushing back when things go wrong. They're holding up better than you'd expect. The harder problem is the one agents uniquely introduce: an action that was authorized, executed correctly, and still wrong. Someone delegated authority, the agent exercised it faithfully, and the result doesn't match what anyone actually wanted. Across six domains, the same gap keeps surfacing. Contestation infrastructure handles execution failures reasonably well. What nobody has built yet is a structured way to challenge the mandate itself. - **Chargebacks Exist but Agent Dispute Categories Don't** — [Source]() — Published 2026-07-23 Tag: Agentic Payments Visa's Trusted Agent Protocol and Payment Passkeys authenticate agentic transactions across 30+ European issuers, with spending limits and approved-merchant controls. Chargebacks still work. But public dispute tables from neither Visa nor Mastercard yet contain agent-specific reason codes or mandate evidence schemas for challenging a delegated purchase decision. - **Merged PRs Proxy Throughput, Not Alignment With Intent** — [Source]() — Published 2026-07-23 Tag: AI Coding A Microsoft study found coding-agent adopters merged 24% more pull requests over four months. Git revert, CI gates, and code review provide structural contestation. But merged-PR volume says nothing about whether commits matched developer intent, and the reviewer burden from multiplied agent output remains entirely unpriced. - **Escalation Works Live but Breaks After Ticket Close** — [Source]() — Published 2026-07-23 Tag: Customer Support Nubank's production agents use audit trails, idempotent APIs, and human escalation as live contestation paths, reporting a 37-point NPS lift. Once a ticket closes, though, tracing which agent decision caused dissatisfaction gets murky fast. Feedback arrives long after the causal chain has collapsed into execution logs. - **Blocking Future Crawls Doesn't Undo Past Content Consumption** — [Source]() — Published 2026-07-23 Tag: Web Access Cloudflare's purpose-based categories let site owners block or allow agent crawlers, with dashboards tracking crawl-to-referral ratios. Useful going forward. But no structured process exists for disputing content already consumed. Over a third of crawler traffic still comes from mixed-use bots that resist clean purpose classification. - **Approval Logs Record Permissions, Not the Agent's Mandate** — [Source]() — Published 2026-07-23 Tag: Enterprise Tools Microsoft Agent 365 offers connector registries, admin approval workflows, tool-level blocking, and unified audit logs covering activations and invocations. Thorough stuff. But the records capture what was permitted at the server level, not what the agent was asked to do. Mandate and scope go unrecorded. - **False Positive Costs Land on Analysts, Not Agents** — [Source]() — Published 2026-07-23 Tag: Security Operations Microsoft's threat detection agent reports 80.1% precision after 120 days of analyst feedback. Analyst dismissal is the contestation mechanism. Sounds reasonable until you do the math: one in five flagged alerts is wrong, and the investigation cost per false positive falls entirely on the SOC. Agent performance metrics don't account for it. ### Records, Not Replays - **Observability for Delegated Execution in Agentic AI Systems** — [Source]() — Published 2026-07-23 Identical audit logs and execution traces can arise from incompatible delegation assignments. Current observability schemas carry no record of whose mandate an action served or what constraints accompanied it, leaving contestation structurally unsupported. Where's the gap? Not in logging volume. Current schemas simply don't encode delegation scope, so contestation has no semantic foundation to build on. Who's behind this? Researchers from Splunk and Cisco, practitioners working inside the observability infrastructure where this absence actually lives. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-23 No tested agent achieved both fully correct and fully safe execution across 12 realistic, non-adversarial tasks. Successful completion routinely coincided with data-handling failures during ordinary operation, not under attack conditions. Why should builders care? Task success and data safety vary independently. An agent can finish the job while violating every constraint a mandate record would carry. Who ran this evaluation? The Singapore and Korea AI Safety Institutes jointly, lending the findings cross-jurisdictional institutional weight. ### First Disputes - [When the First Agent Purchase Gets Disputed]() — By [Sevda Polat]() · Published 2026-07-23 Visa's July 2 announcement wasn't a pilot. AI agents [completed purchases](https://www.visa.co.uk/about-visa/newsroom/press-releases.3457328.html) with independent European merchants, authenticated by Payment Passkeys, recognized through a Trusted Agent Protocol and Agent Directory. Over 30 issuers. Four merchants spanning travel, retail, and e-commerce. Live transactions, not controlled demos. ### Further Reading - **Visa Takes Agent Purchases Live Across Europe. The Dispute Form Still Has No Box for "My Agent Did It."** — [Source]() — Published 2026-07-23 Thirty-plus issuers, verified identity rails, real money moving. Agent-specific chargebacks are now inevitable and uncharted. - **MCP's Release Candidate Gets Boring on Purpose. The Mandate-Record Gap Stays Interesting.** — [Source]() — Published 2026-07-23 Stateless core, W3C tracing, OAuth hardening. The protocol matures into plumbing while the audit layer remains someone else's problem. - **Microsoft Agent 365 Can Block a Rogue Server. Reconstructing What It Did Before Getting Blocked Is Another Matter.** — [Source]() — Published 2026-07-23 Connector registries, runtime blocking, shadow-AI detection. Thorough admission control, but no structured path for contesting a completed action. - **Nubank Deploys Support Agents to 100 Million Users and Measures Everything Except Wrong Answers** — [Source]() — Published 2026-07-23 Five live deployments, real NPS lifts, solid self-service metrics. What happens when a resolved ticket was resolved incorrectly goes unaddressed. - **McKinsey's Trust Survey Puts Numbers on What Practitioners Already Feel** — [Source]() — Published 2026-07-23 Nearly two-thirds flag security and risk as the top barrier to scaling agents. Part of that trust gap is a contestability gap. - **Cloudflare Lets Site Owners Sort Agent Traffic by Purpose. What Happens After a Bad Visit Is Still Unwritten.** — [Source]() — Published 2026-07-23 Search, Agent, Training as distinct blockable categories. Recognition comes before trust, but remediation after misbehavior has no playbook yet. ### Past Articles - [The Infrastructure for Arguing Back]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Review-Shaped Work Microsoft's coding-agent study reports a 24% increase in merged pull requests across tens of thousands of engineers, then the authors quietly concede that merged PRs are an output proxy, not delivered value. That concession matters more than the number. It points toward a structural question the usual conversation about agent adoption keeps skating past: the predictor of durable adoption may not be task complexity or model capability, but whether a domain already has organizational machinery for catching mistakes, contesting outputs, and reversing course before the cost lands on whoever is least equipped to absorb it. - [The Middle Case]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Middle Case Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initiated the Transaction." The procedural furniture is all in place: identity verification, consent, token provisioning. But Visa's public dispute categories still don't include an agent-specific reason code. If you want to contest something an agent did on your behalf, the challenge has to fit into language that predates the thing it's describing. Payments are where this surfaces first, because the challenge machinery there is most mature. The same gap, though, shows up wherever agents act on behalf of people. - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. - [The Furniture Is Arriving Before the House Is Built]() — By [Rina Takahashi]() · Published 2026-06-25 · Format: The Furniture Arrives Across the agent ecosystem, multiple players are simultaneously shipping the same category of development: admin consoles, spend controls, identity federation, observability conventions. Institutional furniture that normally arrives after a technology category has settled. But with 88% of organizations using AI regularly and only 23% scaling agents anywhere, the furniture is showing up in the gap between experimentation and production. That timing suggests something specific about where this market actually sits, and what's quietly becoming the real bottleneck. ## Other sections in Issue 39 - [Daily Brief]() - [Foundations]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()