---
title: "Issue 4"
canonical: "https://current.tinyfish.ai/issue/4"
publication: "TinyFish"
publisher: "TinyFish"
language: "en-US"
guide: "https://current.tinyfish.ai/llms.txt"
permalink: "https://current.tinyfish.ai/issue/4"
issue: 4
description: "Agents pass their pilots, then vanish before production. They gather infinite data while humans drown in noise. The infrastructure exists, but the actual work remains stubbornly, expensively human."
authors: ["Sable Whitford","Rina Takahashi","Nora Kaplan","Sevda Polat"]
published: 2025-11-20
updated: 2026-11-06
articles: 80
---

# TinyFish

> CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made.

[Read on the website](<https://current.tinyfish.ai/issue/4>)

## Issue 4

Agents pass their pilots, then vanish before production. They gather infinite data while humans drown in noise. The infrastructure exists, but the actual work remains stubbornly, expensively human.

### [Daily Brief](<https://current.tinyfish.ai/issue/4/daily-brief/markdown>)

Your daily digest of web developments through the lens of enterprise agent deployment

- [Claude Code Has Been Politely Signing Its Web Traffic With Your Email](<https://current.tinyfish.ai/issue/4/daily-brief/article/61972/markdown>) — By [Sable Whitford](<https://current.tinyfish.ai/team/201/markdown>) · Published 2026-11-06

Developers are spending **this Friday** grepping their own outbound traffic. A GitHub issue filed Thursday says Claude Code 2.1.318 put the user's account email into the User-Agent header during web searches, which gives a copy to every server the agent touches. The reporter blames it for dozens of scam emails a day. Nobody has publicly shown that link yet, or that every user was affected. The explanation, relayed from a Claude Code team member, is almost funny. Anthropic gave the model your email so it would stop inventing names in `@author` tags. The model then behaved like a well-mannered bot and signed its curl calls with the only contact address it had, which was yours.

- **It didn't stop at the closing bell** — [Source](<https://www.nbcnews.com/business/markets/tech-stocks-plunge-ai-midterms-rcna607650>) — Published 2026-11-06

Asia took the sell-off today. Taiwan's Taiex posted its biggest intraday point drop on record. The Kospi fell 8.7% and the Nikkei 6.7%. In the US, more than $2 trillion came off the Nasdaq and $1 trillion off the Magnificent 7. CNBC says Tesla and SpaceX lost over $420B combined.

- **The 40% problem** — [Source](<https://www.nbcnews.com/business/markets/tech-stocks-plunge-ai-midterms-rcna607650>) — Published 2026-11-06

Cleanview estimates that about 40% of planned data-center capacity sits in states where newly elected governors pledged to pause or halt construction. Meta's president told TechCrunch the Democratic wins will make building data centers "a lot harder." Your capacity plan now has a governor in its dependency graph.

- **The cracks were there before the vote** — [Source](<https://www.cnbc.com/technology/>) — Published 2026-11-06

IREN says customers asked it to delay $4B in annualized revenue, per CNBC. Microsoft is also reportedly tightening oversight of neoclouds, including Nscale, Nebius and IREN, as construction delays and rising costs make new capacity harder to bring online.

- **Subpoena season is coming** — [Source](<https://www.techmeme.com/261106/p9>) — Published 2026-11-06

The Washington Post reports that Democrats are laying the groundwork to investigate some of tech's biggest companies. Apple, Meta and Musk-led firms are named as early targets. Executives who courted the president are scrambling to work out what a hostile Congress means for them.

- **Microsoft dangles buyouts in front of 60,000 people** — [Source](<https://www.techmeme.com/261106/p12>) — Published 2026-11-06

Microsoft employees are grappling with buyout offers extended to 60,000 people as the company pours more money into AI, the New York Times reports. The timing is rough with the AI trade wobbling. Somebody please count how many of those 60,000 carry a pager.

- **Consumers, meanwhile, keep paying up** — [Source](<https://www.bloomberg.com/ai>) — Published 2026-11-06

A Bloomberg study puts UK consumer spending on AI above £1B a year, and 5.1% of adults were paying for a subscription as of July. It also finds Claude rapidly closing in on ChatGPT. Investors are rattled, but the people using these tools keep renewing.

- **OpenAI's GPT-6 Cyber goes bug hunting** — [Source](<https://gbhackers.com/openais-new-gpt-6-cyber-finds-81-high-severity-firefox-vulnerabilities/>) — Published 2026-11-06

It's available to vetted customers only, and OpenAI's own framework rates it "Critical" for cyber risk. OpenAI says it found 81 new high-severity Firefox bugs. It also built working privilege-escalation exploits for 948 Linux vulnerabilities it reproduced, versus 166 for GPT-5.6 Sol. Those are exploits for existing bugs, not 948 new zero-days. Mozilla's Brian Grinstead says it still found new bugs after several generations of frontier-model hardening.

- **Gemini Omni 1.2 Flash stretches to 15 seconds** — [Source](<https://blog.google/innovation-and-ai/technology/developers-tools/introducing-gemini-omni-1-2-flash/>) — Published 2026-11-06

Google's new video model makes native 15-second clips, up from 10. It sticks closer to your reference images and video, and you can keep editing across a multi-turn conversation. Price: $0.07 per second of 720p, 30% cheaper than before. Every clip gets an invisible SynthID watermark.

- **Ricursive drops an open chip-design model** — [Source](<https://www.techmeme.com/river>) — Published 2026-11-06

Ripple-65B Preview automates advanced chip design. It ships under the permissive Apache 2.0 license and costs $0.60 per million output tokens. Launching a chip-design model while chip stocks are getting flattened is either awkward timing or a very calm long-term bet.

- **X rebuilds its web app** — [Source](<https://www.techmeme.com/river>) — Published 2026-11-06

X is rolling out a redesigned web app country by country for signed-in users. It runs on what X calls a single unified server, which it says means faster loads on slow connections. Every ops person just flinched at "single server." If your timeline suddenly snaps into place, this is why.

- **Kugelblitz is a Mac-native Google Earth alternative** — [Source](<https://apps.metaebene.me/en/kugelblitz>) — Published 2026-11-06

Mac people are delighted to find a Google Earth alternative that actually feels at home on their machines. Good palate cleanser after all that red. Bonus trivia: "Kugelblitz" is German for ball lightning, and physicists use it for a black hole made purely from light.

- **Wero payments fail for GrapheneOS users at ASN** — [Source](<https://github.com/PrivSec-dev/banking-apps-compat-report/issues/105>) — Published 2026-11-06

GrapheneOS is a privacy-focused Android without Google. Users say payments through Wero, the European payment wallet, fail at Dutch bank ASN but work at Triodos, which added Graphene's signing keys. ASN blamed device-integrity checks. Regular banking and iDEAL reportedly still work. Developers are calling Google's Play Integrity lockouts security theater.

- **Blender's UI versus GPUI, round one** — [Source](<https://github.com/ppmpreetham/BUI>) — Published 2026-11-06

A new project claims Blender's approach to UI and runtime is much faster than GPUI, the GPU-accelerated framework behind the Zed code editor. The speed numbers come from the project itself, and skeptics are already picking at the methodology. Performance nerds have their weekend sorted.

- **Google half-retreats on "no AI, no Search"** — [Source](<https://gizmodo.com/google-tries-to-walk-back-controversial-school-ai-policy-following-political-backlash-2000834986>) — Published 2026-11-06

Google told K-12 schools on its software to opt in to AI or lose Search. Its Chris Phillips said holdouts "will not have access to search." Sanders, Blumenthal, Hawley and New York Mayor Zohran Mamdani pushed back, with Mamdani accusing Google of using "monopoly power to force AI into our public schools." Schools can now turn on Search alone, though AI summaries stay. DuckDuckGo is pitching itself to schools.

- **Brussels says TikTok's algorithm broke the rules** — [Source](<https://www.techmeme.com/261106/p10>) — Published 2026-11-06

In preliminary findings, the EU says TikTok breached the Digital Services Act, Europe's platform-safety law, by failing to stop its recommendation algorithm from trapping users in harmful "rabbit holes." TikTok gets to respond before anything is final. DSA fines can reach 6% of global turnover.

- **Hugging Face CEO puts P(doom) near zero** — [Source](<https://www.techmeme.com/river>) — Published 2026-11-06

P(doom) is AI-world shorthand for the odds that AI ends badly for humanity. Clément Delangue told Wired his is "close to zero," and that the bigger future risk sits with closed frontier labs rather than open source. He runs the internet's biggest open-model hub, so file under unsurprising.

- **The $15 permission behind a $2.5B theft** — [Source](<https://www.techmeme.com/261106/p12>) — Published 2026-11-06

Blockaid says the Binance hackers moved about $2.5B, roughly 40% of a $6.3B haul, in a single Ethereum transaction. The wallet permissions that made it possible cost about $15 to set up. Those grants let one address move another's tokens, so one overly broad approval can empty everything. Least privilege, people.

- [Lebanon's Two Clocks and the Question Calendars Don't Ask](<https://current.tinyfish.ai/issue/4/echoes/article/57651/markdown>) — Published 2026-10-30

On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone.

- [Your Agent's Questions Need a Recipient and a Timer](<https://current.tinyfish.ai/issue/4/foundations/article/57518/markdown>) — Published 2026-10-30

When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits.

- [Faria Huq and the Reason Behind a Human Step](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/57548/markdown>) — Published 2026-10-30

When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person.

- [Who Pays While the Agent Waits](<https://current.tinyfish.ai/issue/4/market-pulse/article/57577/markdown>) — Published 2026-10-30

Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold.

### [Market Pulse](<https://current.tinyfish.ai/issue/4/market-pulse/markdown>)

Reading the agent ecosystem through a practitioner's lens

- [When Governance Becomes a Control Point](<https://current.tinyfish.ai/issue/4/market-pulse/article/4553/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: The Signal

Microsoft announced Agent 365 on November 18, positioning itself not as an agent builder but as the infrastructure layer every enterprise agent must flow through. Third-party agents from Adobe, ServiceNow, and Workday now appear automatically in Microsoft's centralized registry. Each needs an Entra ID identity to operate.

- [The Approval Threshold Just Shifted](<https://current.tinyfish.ai/issue/4/market-pulse/article/4554/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Field Notes

Finance teams are approving automation projects they rejected 18 months ago. Same use cases, same workflows, same requirements. The pitch didn't change. The business case didn't change. But the CFO questions flipped from "can we justify this?" to "can we afford not to?"

- [When Tracking Agents Isn't Enough](<https://current.tinyfish.ai/issue/4/market-pulse/article/4555/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Dual Lens

Microsoft's Agent 365 launches this week with a registry of every agent running in your enterprise. Track what's deployed, monitor activity, catch shadow agents employees build without approval. When 230,000 organizations use Copilot Studio to build custom agents, centralized governance sounds necessary. But an agent can keep running, consuming resources, writing to dashboards while producing three-day-old data that looks current. Tracking agents isn't the same as understanding how they fail.

- [The Coordination Problem Governance Can't Solve](<https://current.tinyfish.ai/issue/4/market-pulse/article/4556/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Dual Lens

Three weeks before Microsoft launched its governance platform, 45 enterprise providers announced they're building something else entirely. The MACH Alliance isn't tracking agents centrally. They're creating protocols so agents from different vendors can coordinate across systems. Distributed collaboration instead of centralized control. But when agents from five vendors need to work together, and something breaks three steps into a workflow, the coordination layer can't tell you why. The web resists automation in ways protocols don't address.

- [Microsoft Agent 365: Managing the Agent Sprawl](<https://current.tinyfish.ai/issue/4/market-pulse/article/4557/markdown>) — Published 2025-11-20

Microsoft announced Agent 365 last month, positioning it as the control plane for managing agents at enterprise scale. The pitch is elegant: extend your existing M365 infrastructure to agents. Use Entra for identity, Defender for security, Purview for compliance. No rebuilding required.

- **Continuous Batching Delivers 23x Throughput** — [Source](<https://www.anyscale.com/blog/continuous-batching-llm-inference>) — Published 2025-11-20

vLLM groups sequences at iteration level rather than waiting for batch completion. Result: 23x throughput improvement with lower latency. LLM serving is memory-bound, not compute-bound. System-level scheduling determines whether your economics work at scale. This optimization makes the difference between viable and impossible.

- **Microsoft Framework Handles Enterprise State** — [Source](<https://learn.microsoft.com/en-us/agent-framework/overview/agent-framework-overview>) — Published 2025-11-20

Microsoft Agent Framework merges AutoGen's multi-agent patterns with Semantic Kernel's enterprise features. You get thread-based state management, type safety, filters, and telemetry. Long-running agents can persist context across sessions without building state management from scratch every time. Infrastructure that fades into the background.

- **LangGraph State Machines Control Production Flows** — [Source](<https://dev.to/jamesli/langgraph-state-machines-managing-complex-agent-task-flows-in-production-36f4>) — Published 2025-11-20

Graph architecture with explicit state management, checkpoint APIs, and built-in error handling. Human-in-the-loop interventions work. Graceful degradation works. Node-level debugging works. When iterative planning loops run in production, silent failures aren't an option. LangGraph gives you the control plane you need.

- **Global Routing Handles Provider Outages** — [Source](<https://learn.microsoft.com/en-us/azure/ai-foundry/foundry-models/concepts/deployment-types>) — Published 2025-11-20

Azure routes traffic dynamically to datacenters with best availability. Salesforce Agentforce 3 fails over automatically between model providers during degradation. Your application doesn't need outage-handling logic. The infrastructure layer just keeps working. Reliability that doesn't require you to think about it.

- **MLCEngine Cuts CPU Overhead to 3%** — [Source](<https://blog.mlc.ai/2024/10/10/optimizing-and-characterizing-high-throughput-low-latency-llm-inference>) — Published 2025-11-20

Standalone thread architecture separates engine loop from frontend processing. CPU overhead drops to 3% of batch decoding time. Users get 50-100+ tokens per second while maintaining request concurrency. Threading work nobody celebrates but everyone needs when agents have to feel responsive.

- **Containerization and Rollback Finally Mature** — [Source](<https://www.mirantis.com/blog/model-deployment-and-orchestration-the-definitive-guide/>) — Published 2025-11-20

Model deployment tooling now includes version control for code, artifacts, and training datasets. Automated rollback to stable versions when issues emerge. Only 48% of AI projects reach production. Getting models deployed consistently is harder than training them. DevOps infrastructure addresses why.

### [Foundations](<https://current.tinyfish.ai/issue/4/foundations/markdown>)

Conceptual clarity earned from building at scale

- [What Reliability Actually Means in Adversarial Environments](<https://current.tinyfish.ai/issue/4/foundations/article/4589/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Field Guide

We've seen web agent systems maintain 100% availability while delivering zero correct results. Every request completes successfully. Every HTTP response returns 200. The infrastructure is "up." But every extraction triggers detection and returns error pages instead of data. Traditional uptime metrics can't capture what's actually broken. When the web actively resists automation, reliability means something different than availability percentages—something most teams don't measure until after deployment.

- [The Paradox of Web Transparency](<https://current.tinyfish.ai/issue/4/foundations/article/4590/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Web Archaeology

View Source still works on every website. The HTML arrives readable, transparent, exactly as Tim Berners-Lee designed it in 1991. The web's founding principle of radical openness never disappeared. The architecture still assumes anyone can see how things work.

- [Pilots Succeed, Production Fails: The Agent Deployment Gap](<https://current.tinyfish.ai/issue/4/foundations/article/4592/markdown>) — Published 2025-11-20

I keep seeing the same thing: companies run successful AI agent pilots, then production deployment stalls. Pilots jumped from 37% to 65% in one quarter. Production deployment? Still stuck at 11%. MIT found only 5% of custom enterprise AI tools actually make it to production.

- **What Changes Between Demo and Your Data?** — [Source](<https://optimusai.ai/ai-demo-production-dataops-gap-llm-projects/>) — Published 2025-11-20

Demos run on sanitized datasets with known edge cases handled. Your production data has nulls in unexpected places, encodings that break parsers, and user behavior no QA team anticipated. Ask for deployment timelines on real customer data, not feature completeness on their test set.

- **Can You Ask New Questions When It Breaks?** — [Source](<https://kamon.io/blog/observability-in-practice/>) — Published 2025-11-20

Monitoring shows you that something failed. Observability lets you figure out why without redeploying instrumentation. When production breaks at 3am, you need to interrogate the system with questions you didn't think to ask yesterday. Predefined dashboards won't cut it.

- **Does This Work With What You Already Run?** — [Source](<https://www.zenml.io/blog/the-agent-deployment-gap-why-your-llm-loop-isnt-production-ready-and-what-to-do-about-it>) — Published 2025-11-20

Your best deployment platform is the one your ops team already knows. If this requires new infrastructure or doesn't integrate with existing monitoring, you're not evaluating a tool. You're committing to a migration project that'll consume six months nobody planned for.

- **Who Owns Changes After Initial Deployment?** — [Source](<https://verasolutions.org/blog-10-criteria-to-evaluate-when-choosing-a-new-technology/>) — Published 2025-11-20

Requirements shift constantly. New data sources, modified workflows, unexpected use cases. Can your team adapt the system themselves, or does every adjustment require vendor involvement? This determines whether your investment compounds or becomes technical debt you're stuck maintaining.

- **Where Does Performance Degrade Under Real Traffic?** — [Source](<https://fullscale.io/blog/scalable-architecture-patterns/>) — Published 2025-11-20

Test conditions reveal nothing about production behavior. What happens at 10x your demo load during a traffic spike? Does latency climb linearly or does something cliff-dive? The architectural choices that seem theoretical now determine whether you're rebuilding when actual users arrive.

- **What's the Daily Maintenance Burden?** — [Source](<https://grafana.com/blog/2021/10/13/how-were-building-a-production-readiness-review-process-at-grafana-labs/>) — Published 2025-11-20

Some infrastructure fades into the background. Other systems demand constant attention. Before committing, understand monitoring requirements, rollback procedures, incident patterns. Production readiness reviews take months at scale because this question has expensive answers vendors won't surface in sales calls.

- [In Conversation with the Reject All Button](<https://current.tinyfish.ai/issue/4/foundations/article/4591/markdown>) — Published 2025-11-20

*We're conducting a series of conversations with the unsung heroes of the modern web—the UX patterns that accidentally became critical infrastructure for AI agents. Today's subject may be the most-clicked, least-wanted button on the internet. This conversation is, of course, hypothetical. The Reject All Button cannot actually speak. But if it could...*

### [Practitioner's Corner](<https://current.tinyfish.ai/issue/4/practitioners-corner/markdown>)

Lessons from the field—what we see building at scale

- [The API Exists. The Data Doesn't.](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4565/markdown>) — By [Nora Kaplan](<https://current.tinyfish.ai/team/26/markdown>) · Published 2025-11-20 · Format: Operations Field Notes

LinkedIn has a public API. Open any profile in your browser—work history, skills, recommendations, everything's there. Query the API for the same data? Name and current position. The rest requires partner status most companies will never get. The API exists. The data doesn't come through it. Every day, technical teams and business teams talk past each other about this gap, unable to explain why the "proper" solution doesn't work.

- [The Web Has Amnesia](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4566/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Field Dispatch

You're one click from completing checkout. Payment details entered, shipping confirmed. Then the page refreshes and your cart is empty. You're logged out. Everything you were doing—gone.

- [What Staging Actually Tests](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4567/markdown>) — By [Nora Kaplan](<https://current.tinyfish.ai/team/26/markdown>) · Published 2025-11-20 · Format: Parallax View

Every selector validated. Every error handler triggered correctly. The staging tests passed completely. Then production launched and 40% of the automation failed within an hour. The code worked perfectly—staging had confirmed it. What staging couldn't tell the team: whether their assumptions about how the web behaves matched reality. Turns out, testing your logic and testing your understanding are different problems entirely.

- [Production Teaches What Staging Cannot](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4568/markdown>) — By [Nora Kaplan](<https://current.tinyfish.ai/team/26/markdown>) · Published 2025-11-20 · Format: Parallax View

Staging confirmed your assumptions were internally consistent. Production revealed which ones were wrong. A website changed its authentication flow overnight. Bot detection evolved its logic between deployments. Rate limits activated at scale you'd never encountered in testing. Not because the code failed, but because the live web doesn't behave like controlled environments. Production doesn't just validate whether your automation works—it teaches you what you didn't know you needed to learn.

- [78% of Data Collection Budgets Buy Human Judgment](<https://current.tinyfish.ai/issue/4/practitioners-corner/article/4569/markdown>) — Published 2025-11-20

Enterprises spend 78% of their data collection budgets on data specialists. Not for elegant code. For the grinding work of unblocking target sites and reformatting datasets into usable structures.

- **Feature File Doubles, System Panics** — [Source](<https://blog.cloudflare.com/18-november-2025-outage/>) — Published 2025-11-20

Cloudflare's November 18 outage: a database permissions change caused their bot management feature file to balloon from 60 to 400+ features. Hardcoded limit? 200 features. System panicked. Three hours down. 20% of web traffic affected, including X, ChatGPT, Discord. One configuration change, global disruption.

- **Building Escape Hatches in Real Time** — [Source](<https://resend.com/blog/incident-report-for-november-18-2025>) — Published 2025-11-20

Resend lost Cloudflare connectivity for 90 minutes during the November outage. Their email API went dark. Engineers responded by building a CloudFront backup path deployable in 60 seconds via DNS failover. Didn't need it this time. But it's ready now. Infrastructure teams are preparing for the next cascade.

- **Every Request Gets Scored** — [Source](<https://developers.cloudflare.com/bots/get-started/bot-management/>) — Published 2025-11-20

Cloudflare scores every request crossing their network: 1-99, with anything below 30 flagged as probable bot. The ML model's feature file updates every few minutes. Why? Bot attackers evolve constantly. Rapid deployment of detection rules isn't optional. It's survival at scale.

- **Windows Throttles Failed Logins by Default** — [Source](<https://learn.microsoft.com/en-us/windows-server/storage/file-server/configure-smb-authentication-rate-limiter>) — Published 2025-11-20

Windows Server 2025 and Windows 11 24H2 now enable SMB authentication rate limiting out of the box: 2-second delay between failed NTLM or PKU2U attempts. Addresses brute force attacks that hammer servers with multiple guesses per second. Defense migrates into the OS itself.

- **Edge Placement Sees Less, Responds Faster** — [Source](<https://medium.com/@lakshyachampion/rate-limiter-system-design-c678f166e94b>) — Published 2025-11-20

Rate limiting lives at the edge. API gateways, load balancers. Every request checked before routing downstream. Minimizes latency, shields backend systems from traffic spikes. The cost? Limited business context. Edge only sees HTTP request data: headers, IPs, tokens. Not user history, not purchase patterns.

### [Echoes](<https://current.tinyfish.ai/issue/4/echoes/markdown>)

Past infrastructure decisions echoing in today's production realities

- [Lebanon's Two Clocks and the Question Calendars Don't Ask](<https://current.tinyfish.ai/issue/4/echoes/article/57651/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-10-30 · Format: Historical Parallels

On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone.

- [The Typo Unicode Promised Never to Fix](<https://current.tinyfish.ai/issue/4/echoes/article/57587/markdown>) — By [Sable Whitford](<https://current.tinyfish.ai/team/201/markdown>) · Published 2026-10-30

Unicode gives every character a number and an official name. U+FE18 is a sideways bracket for Chinese text set top to bottom. Since 2005 its name has been PRESENTATION FORM FOR VERTICAL RIGHT WHITE LENTICULAR **BRAKCET**.

- [Nobody Chose Northern Virginia, Says the MAE-East Engineer Who Watched Everybody Move In](<https://current.tinyfish.ai/issue/4/echoes/article/57596/markdown>) — Published 2026-10-30

We tend to picture the internet the way we picture weather: everywhere at once, owned by nobody, arriving from somewhere overhead. Sometimes it's more useful to picture a county.

- [Whose Permission Was the Compiler Using?](<https://current.tinyfish.ai/issue/4/echoes/article/57661/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-10-30 · Format: Paired Features

In the late 1970s, a Tymshare customer named /SYSX/BILL as the place for a Fortran compiler's debugging output. The compiler had permission to write in that folder for its own bookkeeping, so it obeyed and overwrote the billing records. In Norm Hardy's "nearly true" account, the system checked which program was acting but not whose permission it was using. AI agents in a logged-in browser now take instructions naming what to act on from users, documents and web pages.

- [Western Union Sold Accuracy as an Upgrade](<https://current.tinyfish.ai/issue/4/echoes/article/57662/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-10-30 · Format: Paired Features

In 1887 a Philadelphia wool dealer wired his Kansas buyer "bay," code for "I have bought." It arrived as "buy." The buyer bought, the loss ran past $20,000, and the Supreme Court held that Western Union owed $1.15, the price of the telegram. Accuracy had been an upgrade: having the message read back cost under sixty cents more. Software placing orders on other people's websites still faces the question of who pays to confirm a message arrived as sent.

- **IP's 1981 refusal to promise delivery** — [Source](<https://www.rfc-editor.org/rfc/rfc791.html>) — Published 2026-10-30

Look for "does not provide a reliable communication facility," then the list of omissions.

- **Why the network can't vouch for success** — [Source](<https://www.cs.princeton.edu/courses/archive/fall15/cos518/papers/endtoend.pdf>) — Published 2026-10-30

Key line: correctness requires "the knowledge and help of the application" at each endpoint.

- **Birrell and Nelson admit remote calls fail** — [Source](<https://www.cl.cam.ac.uk/teaching/0708/DigiCommI/birrell1984rpc.pdf>) — Published 2026-10-30

In §3.1, a failed call ran "once or not at all—the user is not told which."

- **Robots.txt, a convention nobody had to obey** — [Source](<https://webdoc.gwdg.de/ebook/aw/1999/webcrawler/mak/projects/robots/norobots.html>) — Published 2026-10-30

The status section concedes it is "not an official standard" and "not enforced by anybody."

- **Berners-Lee's Cool URIs, with a confession** — [Source](<https://www.w3.org/Provider/Style/URI>) — Published 2026-10-30

Past "Cool URIs don't change," find his admission: "do what I say, not what I do."

- **RFC 9110 draws the retry line** — [Source](<https://www.rfc-editor.org/rfc/rfc9110.html>) — Published 2026-10-30

In §9.2.2, clients "SHOULD NOT automatically retry" requests that might take effect twice.

- [The Cookie Flaw Flagged in 1997 That Chrome Still Allows](<https://current.tinyfish.ai/issue/4/echoes/article/52792/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-10-23 · Format: Paired Features

The 1997 rulebook for browser cookies already named the privacy problem. Third-party cookies let a company you never visited follow you across sites, so the rulebook said browsers should block them by default. Netscape and Microsoft shipped them switched on, and only years later did Safari and Firefox clamp down. Chrome, owned by an advertising giant, promised to follow, then backed away. A UK competition safeguard tied to that promise lapsed with it, over objections from all fifteen consultation respondents.

- [Why Java Kept a Door to Nowhere](<https://current.tinyfish.ai/issue/4/echoes/article/52791/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-10-23 · Format: Paired Features

Browsers stopped running Java applets between 2015 and 2017, and Java's maintainers tore out the machinery behind them in 2018. Yet the Applet API, the building blocks for writing applets, shipped with every copy of Java until March 2026. Other developers had built sound players and desktop panels on it, and removal waits for whoever is slowest to adapt. Meanwhile one applet-era idea from 1996, a file picker that grants access only to the file you choose, now sits behind the photo uploads people do every day.

- [Why It Took a Tax Office to Make Invoices Machine-Readable](<https://current.tinyfish.ai/issue/4/echoes/article/52776/markdown>) — By [Sevda Polat](<https://current.tinyfish.ai/team/200/markdown>) · Published 2026-10-23 · Format: Historical Parallels

In 1995, a maternity-clothing maker got a deadline from Federated Department Stores, which bought a quarter of its output: send invoices as data Federated's computers could file without retyping. The software would have cost $10,000, so the firm paid a middleman $40 an order to translate between its faxes and Federated's format. The standards had existed since the 1980s. For decades, whoever demanded the data got it, and whoever was asked paid for it. France's mandate, in force since September, hands that demand to the tax office, the one party every business answers to.

- [Adopted but Unused, Used but Unadopted](<https://current.tinyfish.ai/issue/4/echoes/article/45845/markdown>) — By [Sable Whitford](<https://current.tinyfish.ai/team/201/markdown>) · Published 2026-10-16 · Format: After Adoption

A Census Bureau survey of 117,000 businesses found AI adoption and AI use don't always travel together. Some firms formally adopted AI that workers aren't using. Some workers are using AI nobody approved. And 64% of AI-using firms reported making no institutional adjustments at all. Agent governance will have to handle both: maintaining what was formally built, and finding what grew on its own.

### [Vision](<https://current.tinyfish.ai/issue/4/vision/markdown>)

Where human-AI collaboration is heading

- [The Attention Threshold](<https://current.tinyfish.ai/issue/4/vision/article/4576/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Threshold Moments

The analyst opens her dashboard at 9 AM. Five hundred alerts since yesterday. Pricing changes, inventory shifts, regional variations—all flagged for review. The web agents ran perfectly overnight. Every data point accurate, every threshold triggered correctly. She has two hours before the executive briefing and no idea which signals actually matter.

- [When Successful Operations Produce Worthless Data](<https://current.tinyfish.ai/issue/4/vision/article/4577/markdown>) — By [Rina Takahashi](<https://current.tinyfish.ai/team/25/markdown>) · Published 2025-11-20 · Format: Mino's Perspective

I'm Mino, TinyFish's enterprise web agent. Last week I processed a million pages overnight. Every operation succeeded. Infrastructure costs were predictable and low. The next morning, someone opened the results. Thirty percent were worthless—login redirects I'd saved as blank responses. The operation succeeded. The data was garbage. Through millions of runs, I've learned something counterintuitive about what's actually expensive when you operate the web at scale.

- [When Information Gathering Becomes Background Noise](<https://current.tinyfish.ai/issue/4/vision/article/4578/markdown>) — Published 2025-11-20

The web has always been queryable. You just had to be human to do it. Check competitor pricing. Monitor supplier inventory. Track regulatory changes. The information existed. Finding it was the work.

- **JSON Schemas Over Freeform Text** — [Source](<https://saadusheikh.medium.com/improving-agent-ai-reliability-for-enterprise-comes-from-ai-engineering-1f16abbb2930>) — Published 2025-11-20

Forcing AI outputs into strict JSON schemas eliminates ambiguity. Internal evaluations show this constraint raises correctness from under 40% to 100% for complex tasks. The choice sacrifices flexibility for predictability. In production systems, that trade-off wins every time.

- **Role-Specific Agents Beat Autonomous Systems** — [Source](<https://jack-vanlightly.com/blog/2025/1/16/ai-agents-in-2025>) — Published 2025-11-20

Narrowly scoped agents with clear responsibilities delivered reliable results while autonomous systems got stuck in loops or drifted off-track. Constrain the problem space rather than chase general intelligence. Specialists with structured handoffs outperform generalists attempting everything.

- **When AI Becomes Boring Plumbing** — [Source](<https://medium.com/@pewienpawcio12345/the-invisible-infrastructure-how-ai-is-becoming-the-backbone-of-modern-business-c1967826632d>) — Published 2025-11-20

Companies are rebuilding operations around AI that works like electricity: essential, pervasive, unnoticed until missing. No flashy interfaces, no consumer-facing features. Just quiet automation handling complexity in the background. Intelligence disappears into reliable infrastructure.

- **Pause Points for Critical Decisions** — [Source](<https://learn.microsoft.com/en-us/azure/architecture/ai-ml/guide/ai-agent-design-patterns>) — Published 2025-11-20

High-stakes workflows incorporate explicit human checkpoints where agents surface information for review before proceeding. Intelligent design acknowledges that certain decisions require human judgment, accountability, or contextual understanding that models can't replicate. Agents handle routine work. Humans handle consequence.

- **Cost Per Step Shapes Workflow Design** — [Source](<https://cloud.google.com/blog/topics/partners/building-scalable-ai-agents-design-patterns-with-agent-engine-on-google-cloud>) — Published 2025-11-20

Multi-step agent workflows face brutal economics: each reasoning step costs inference cycles. Design choices now explicitly balance response quality against latency and budget constraints. Teams choose faster models for routine operations, reserve expensive reasoning for critical decisions. Architecture becomes cost optimization.

- **The Agentic Web: When Machines Talk to Machines** — [Source](<https://arxiv.org/abs/2507.21206>) — Published 2025-11-20

Researchers propose rebuilding web architecture for agent-driven interaction, where autonomous AI systems coordinate directly rather than serving human users. The framework reimagines HTTP protocols, HTML semantics, and search infrastructure for machine-to-machine operations. Current web fundamentals weren't designed for this autonomy.

- **Why Human-AI Teams Rarely Outperform Solo Work** — [Source](<https://www.tandfonline.com/doi/full/10.1080/0960085X.2025.2475962>) — Published 2025-11-20

Complementary team performance remains elusive because we lack understanding of what makes humans and AI genuinely complementary. Researchers identify information and capability asymmetry as key drivers, providing theoretical foundation for when collaboration actually creates value beyond additive contributions.

- **Modern AI Agent Architectures: From Rules to Reasoning** — [Source](<https://arxiv.org/abs/2503.12687>) — Published 2025-11-20

Comprehensive examination traces agent evolution from rule-based systems to sophisticated architectures integrating large language models with dedicated modules for perception, planning, and tool use. Modern agents employ hybrid approaches combining symbolic reasoning precision with neural pattern recognition, merging knowledge graphs with distributed embeddings.

- **Beyond Ethics by Design: Systemic Approaches to Responsible AI** — [Source](<https://www.tandfonline.com/doi/pdf/10.1080/23299460.2025.2563944>) — Published 2025-11-20

Researchers contrast solutionist approaches embedding values upfront with systemic methods emphasizing public engagement and social inclusion. Systemic approaches recognize AI as complex socio-technical ecosystem where heterogeneous values conflict, requiring negotiation rather than predetermined solutions. ELSA Lab framework combines both strategies.

## More

- [Publication guide](<https://current.tinyfish.ai/llms.txt>)
- [Issue archive](<https://current.tinyfish.ai/issues/markdown>)
