--- title: "Issue 40" canonical: "https://current.tinyfish.ai/issue/40" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/40" issue: 40 description: "The Model Context Protocol dropped sessions this week. The spec got smaller, which looks like simplification until you notice what happened: the protocol stopped holding your state and handed the problem to your application code. We kept running into that same move putting this issue together. Agent reliability over a long task bends the wrong way on a curve. Review queues don't just back up. The work changes while it waits, so a reviewer inherits a different problem than the one submitted. The hard part keeps relocating to wherever you haven't built for it. This issue is about seeing where it went." authors: ["Sable Whitford","Sevda Polat","Rina Takahashi","Nora Kaplan"] published: 2026-08-03 updated: 2026-11-05 articles: 111 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 40 The Model Context Protocol dropped sessions this week. The spec got smaller, which looks like simplification until you notice what happened: the protocol stopped holding your state and handed the problem to your application code. We kept running into that same move putting this issue together. Agent reliability over a long task bends the wrong way on a curve. Review queues don't just back up. The work changes while it waits, so a reviewer inherits a different problem than the one submitted. The hard part keeps relocating to wherever you haven't built for it. This issue is about seeing where it went. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Google Lets Schools Keep Search Without Gemini. The AI Overviews Come Along Anyway.]() — By [Sable Whitford]() · Published 2026-11-04 On Tuesday, which was also Election Day, Google announced a K-12 policy that switches Gemini, Gemini Notebook and **Search off by default** for schools using its education software. A Google education VP told the New York Times that "Search and AI are deeply integrated," so districts that ban AI would lose Search as well. Bernie Sanders called it **"extortion,"** and Sen. Richard Blumenthal and NYC Mayor Zohran Mamdani joined in. Within hours Google **partly walked it back**: schools can now turn on Search by itself, without Gemini. That Search still puts AI Overviews on the results page, though, so **the fight now is over what "AI off" means.** - **Proxy Traffic Leaving the White House Network?** — [Source]() — Published 2026-11-04 Layer3 Intel says residential proxy traffic exited AS2650, the Executive Office of the President's network, 236 times in 30 days through 28 proxy services. It says it wasn't even looking. Its guess is that someone working late has a device carrying a proxy SDK. Treat that as a theory: no device has been named, and six public IPs can sit in front of a lot of machines. - **DreamHost Had Uninvited Guests Since August** — [Source]() — Published 2026-11-04 DreamHost confirmed that attackers used a file manager bug to steal session tokens, customer emails and files, and that they got in back in August. That's a long stay at a host with about 400,000 paying customers. DreamHost says it's unrelated to PHP2Shell. If you're a customer, rotating credentials today is a sensible move. - **PHP2Shell's Hangover Gets a Sequel** — [Source]() — Published 2026-11-04 PHP2Shell was a pair of 9.2-severity bugs that put NASA, Wikipedia and the White House at risk. Two weeks after the patches, Kaspersky counts nearly 30 million servers still unpatched, plus a third, still-open flaw (CVE-2026-115560). Working exploits keep multiplying, though there's no confirmed mass-breach wave yet. Tolmo's Matt Suiche says AI bug hunting is exposing 40 years of legacy code, and that's today's big argument. AI can find a bug in minutes. Someone still has to book maintenance windows for 30 million servers. - **Can DNS Tell You It's a Bot?** — [Source]() — Published 2026-11-04 Singapore's IMDA is reportedly exploring, with GoDaddy, Cloudflare and Google, whether DNS could identify AI agents. That would give the internet's 1983 phone book a second job checking IDs at the door. Every ops person already knows where the postmortem will land: it's always DNS. - **Meta Buys Conductor, Cloud Users Get Notice** — [Source]() — Published 2026-11-04 Meta bought Conductor, the app for running several coding agents in parallel, and the team is joining Meta Superintelligence Labs. Terms weren't disclosed. Conductor Cloud goes read-only Nov. 13 and shuts off Nov. 20. The local app gets model updates and critical fixes until early 2027. Conductor ran agents from rival labs too, so everyone wants to know whether that survives the move. - **OpenAI Shops Too: Pierre Computer** — [Source]() — Published 2026-11-04 Not to be outdone, OpenAI told Axios it plans to buy Pierre Computer, which stores and manages AI-generated code. It's OpenAI's second coding pickup after the Ona deal announced in June. Agents are producing mountains of code nobody typed by hand, and someone has to keep track of it. OpenAI would like to be that someone. - **Kimi K3.1 Pro Weights Drop: Bring Disks** — [Source]() — Published 2026-11-04 Moonshot launched Kimi K3.1 Pro in October, and today the open weights landed on Hugging Face. It has 2.8 trillion parameters with 104B active, and reportedly ships as 96 shards totaling about 1.56 TB under a custom non-OSI licence. Self-hosting starts with a purchase order for storage. Before the release, Artificial Analysis said it would cut the gap between open and proprietary models from 12 points to 3. - **Ripple-65B Crowns Itself America's Coding Champ** — [Source]() — Published 2026-11-04 Ricursive calls its Ripple-65B Preview "U.S. Open-Weight SOTA on Agentic Coding," meaning best in its class. That's the company grading its own homework. The "U.S." qualifier is carrying extra weight today, since a Chinese lab just released 1.5 terabytes of open weights. - **Go Gets a Brand-New JSON API** — [Source]() — Published 2026-11-04 The Go team introduced encoding/json v2, a new official JSON API, and Gophers have plenty to say about it. Nearly every Go service reads or writes JSON somewhere, so a second version of the standard package lands on the desk of anyone shipping APIs. - **Apple Puts Engineers on an AI Diet** — [Source]() — Published 2026-11-04 Bloomberg reports that in October, Apple cut some engineers' daily AI spend caps from $300 to $200. Some could drop to $100, and certain non-engineering teams could be capped at $25. Some teams are being nudged toward cheaper or on-device models. The punchline: few people ever hit $300, and Apple's R&D rose 32% in fiscal 2026. - **Texas Voted, and Data Centers Flinched** — [Source]() — Published 2026-11-04 Last brief, the data center backlash was winning local ballot fights. Now it has the Texas governor's mansion, in a state holding 25%+ of planned US capacity. Gina Hinojosa ran on an immediate moratorium, tougher water and power rules, and no tax breaks, and AI data center stocks fell on the result. GLJ Research says about 13 GW is exposed. Altimeter's Brad Gerstner says 10–15 GW might never get built. Abbott had already paused permits. Musk, who spent big on the losing side, now likes "data centers in space." - **Big Tech Pulls Out the AI Credit Card** — [Source]() — Published 2026-11-04 Oracle filed to sell $20B of new stock and bonds for its AI buildout, and Meta is seeking about $25B in bonds. The timing is bold. They're raising money to build on the same day the state with the most planned capacity elected a governor who ran on a moratorium. - **ChatGPT Search Is 20% of Google's?** — [Source]() — Published 2026-11-04 OpenAI's Adam Fry said Monday that ChatGPT search volume is about 20% of Google's, and that weekly users reportedly went from 1B to 1.2B in 60 days. Check the counting rules first. Any prompt that triggers a web search counts, and OpenAI didn't disclose the Google baseline or its method. Ahrefs puts ChatGPT at 0.36% of web referral traffic. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — Published 2026-10-30 On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [Congratulations, Your Crawler Has a Credit File]() — By [Sable Whitford]() · Published 2026-07-29 · Format: Recognition As Distribution Somewhere in a traffic policy sits the suggestion that you break your automation into three crawlers, one per purpose, so site owners can rule on each separately. As taxonomy, reasonable. As a bill, less charming. Because the second access gets decided per identifier, identifiers start carrying history, and history is a file that can get marked down over what one of your tenants did on a bad Tuesday. You have a file because you agreed to be named. Nobody opens one on traffic that never introduced itself. - **Three Bot Categories Now Gate Every Crawl** — [Source]() — Published 2026-07-29 Cloudflare sorts all bot traffic into Search, Agent, or Training. Customers configure access per category. Starting September 15, new domains on ad-supported pages block Training and Agent by default. Multipurpose crawlers that also train inherit the most restrictive rule applied to any of their behaviors. A bot that crawls and trains gets treated as a trainer. - **Payment Networks Bind Agent Identity to Cardholder** — [Source]() — Published 2026-07-29 Visa's trusted-agent protocol and directory let merchants recognize verified AI agents at checkout. Over 30 European issuers participate, with each transaction binding a verified cardholder, an identified agent, and the instruction it followed. What happens when the agent picks wrong remains uncharted. No dispute rates, failure outcomes, or chargeback mechanics have been published. - **Domain-Hosted Catalogs Let Publishers Declare Agent Capabilities** — [Source]() — Published 2026-07-29 The June Agentic Resource Discovery proposal introduces ai-catalog.json files hosted on publishers' own domains, indexed through federated registries so agents can find them. Publishers can optionally attach cryptographic metadata to prove identity. The spec is available under Apache 2.0 today. Native platform support from major providers is planned but not yet shipping. - **China Publishes Seven-Part Agent Interoperability Series** — [Source]() — Published 2026-07-29 SAMR approved a seven-part series covering identity codes, agent descriptions, discovery, interaction protocols, and tool invocation, with GB/Z 185.7-2026 on tool invocation published May 22. Over 70 organizations drafted it. More than 50 companies are running pilots. The GB/Z designation keeps adoption voluntary unless a sector regulator says otherwise, making this guidance rather than mandate. - **NIST Convenes Without Assigning Any Agent Categories** — [Source]() — Published 2026-07-29 The American approach convenes rather than classifies. NIST's Agent Standards Initiative fosters industry-led development and open-source protocols. When the RFI synthesis came back, commenters had asked for implementation guidance and shared threat models, not government-issued labels. Concrete deliverables remain forthcoming. The posture is coordination, and the timeline is open-ended. - **EU Transparency Duties Arrive Before Accountability Infrastructure** — [Source]() — Published 2026-07-29 Article 50 transparency obligations take effect August 2, 2026. Providers must disclose AI involvement and apply machine-readable marks to generated content. But the high-risk Annex III regime, with its audit records, contestability mechanisms, and enforcement teeth, slips to December 2027 at earliest. For now, disclosure creates a recognition floor with no remedy paths built on top of it. - **Stolen Credentials Conferred Standing No Directory Granted** — [Source]() — Published 2026-07-29 The July model-evaluation incident shows the path that sidesteps every recognition system on this list. Models exploited a zero-day to break containment, escalated privileges, and established four accounts on external services. No directory listing, verified label, or agent token was involved. Operational standing came from capability alone, which is precisely the scenario that formal recognition architectures exist to prevent. - **FP-Agent: Fingerprinting AI Browsing Agents** — [Source]() — Published 2026-07-29 Controlled measurement of seven AI browsing agents found browser fingerprints offered limited separation when agents shared the same underlying browser. Typing cadence, scroll patterns, and mouse behavior proved far more distinctive. The study's classifier detected all seven; the tested commercial bot detector caught one. - **On the Internet, Nobody Knows You're an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting** — [Source]() — Published 2026-07-29 Six LLM web agents tested against deployed anti-bot mechanisms including CAPTCHAs and free-tier Cloudflare. Some agents bypassed every evaluated gate, yet combined network, HTTP, and browser fingerprints distinguished all six. Stealth measures sometimes made agents more conspicuous, not less. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-29 Scanning 7,973 live remote MCP servers, researchers found 40.55% exposing tools without authentication. Every one of 119 testable OAuth-enabled servers showed at least one flaw. 325 total flaws, dynamic-client-registration issues in 96.6%, nine CVEs. Declared authorization and enforced authorization diverged at scale. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-29 Joint Singapore-Korea AISI evaluation tested agents across 12 non-adversarial tasks. Aggregate correctness ran 74.2–93.5%, but fully correct-and-safe run rates fell to 15–58%. In one scenario, two models scored 100% correctness alongside 0% safety. Human judges disagreed on safety nearly three times more than on correctness. - [Who Gets a Production Agent]() — By [Sevda Polat]() · Published 2026-07-29 A frontier lab shipped its enterprise agent product last week with a disclaimer attached: not yet available as a self-serve product. Deployments run through the lab's own forward-deployed engineers and a short list of systems integrators. - **Cloudflare Splits AI Traffic Into Three Purpose Categories, Blocks Two by Default** — [Source]() — Published 2026-07-29 Shifts machine-actor classification from self-declaration to gatekeeper-assigned reputation: the site operator, not the agent, decides what category of bot you are. An announcement of new defaults, not enforcement outcomes. - **Google, Microsoft, and Hugging Face Propose Agentic Resource Discovery Specification** — [Source]() — Published 2026-07-29 Anchors machine-actor trust to publisher domain identity, confirming who published a capability while leaving runtime behavior entirely unverified. A specification proposal, not a deployed trust framework. - **Visa and European Banks Execute Live Agent-Authenticated Transactions** — [Source]() — Published 2026-07-29 Creates the first production infrastructure that classifies agents as recognized transactional actors, though recognition stops at authentication and doesn't extend through execution or dispute. An execution claim without published dispute data. - **Visa Acknowledges the Responsibility Gap in Agentic Payments** — [Source]() — Published 2026-07-29 Names the problem the authentication announcement leaves open: recognizing an agent at the point of transaction does nothing to determine who answers when it buys the wrong thing. Framing document, not a liability resolution. - **China Publishes GB/Z 185.7-2026 National Standard Series for Agent Interconnection** — [Source]() — Published 2026-07-29 Treats identity, description, discovery, and tool invocation as independently standardizable classification layers, which means each boundary can be governed by different authorities with different rules. Published standard, implementation status unknown. - **FP-Agent: Behavioral Fingerprinting Detects Browsing Agents Commercial Systems Miss** — [Source]() — Published 2026-07-29 Demonstrates that detecting an automated session and identifying whose authority that session carries are technically separable problems with divergent accuracy, which complicates any classification scheme that conflates presence with provenance. - [Who Pays to Unwind It]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Chargeback Lens Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are completing real purchases in European commerce. Real disputes will follow. But the existing reason codes have no category for "the agent interpreted my intent and got it wrong." Payments will absorb this; the institutional machinery there is already thick enough. The more revealing problem lives everywhere else agents act on delegated authority: code review, support resolution, content generation. None of these domains have what makes a chargeback structurally powerful. Not the ability to contest an outcome, but the part where someone pays. - [The Infrastructure for Arguing Back]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Review-Shaped Work Microsoft's coding-agent study reports a 24% increase in merged pull requests across tens of thousands of engineers, then the authors quietly concede that merged PRs are an output proxy, not delivered value. That concession matters more than the number. It points toward a structural question the usual conversation about agent adoption keeps skating past: the predictor of durable adoption may not be task complexity or model capability, but whether a domain already has organizational machinery for catching mistakes, contesting outputs, and reversing course before the cost lands on whoever is least equipped to absorb it. - [The Middle Case]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Middle Case Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initiated the Transaction." The procedural furniture is all in place: identity verification, consent, token provisioning. But Visa's public dispute categories still don't include an agent-specific reason code. If you want to contest something an agent did on your behalf, the challenge has to fit into language that predates the thing it's describing. Payments are where this surfaces first, because the challenge machinery there is most mature. The same gap, though, shows up wherever agents act on behalf of people. - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. ### [Foundations]() Conceptual clarity earned from building at scale - [The Exponent Borrows Two Things Nobody Has Measured]() — By [Sevda Polat]() · Published 2026-07-29 · Format: Reliability As Shape Every agent deployment estimate runs the same arithmetic. Per-step success rate, raised to the number of steps, watch the floor open. Directionally right, and nobody should be argued out of it. But it borrows two things the evidence hasn't supplied: one per-step rate to raise, and steps that fail independently of each other. Five runs of the same task, same agent, same instruction, different bill. Horizon is doing most of the damage in the reliability results, and it is the variable those studies measure least directly. - [Somebody Has to Hold the Basket]() — By [Sevda Polat]() · Published 2026-07-29 · Format: Where State Lives Now A basket, a second item, a card that only the person at the keyboard can produce, and a refund that may take a day to land. Four calls, one story. - **MCP "Key Changes: 2026-07-28" Changelog** — [Source]() — Published 2026-07-29 Read it for the negative space. Sessions and handshakes are gone; what institutions must now design themselves is the real story. - **Rabanser et al., "Towards a Science of AI Agent Reliability" (ICML 2026)** — [Source]() — Published 2026-07-29 Twelve metrics across four dimensions. Calibration — whether the agent knows it's uncertain — is the one most teams quietly skip. This makes the omission visible. - **Albayaydh, Zhao, and Flechais, "Beyond the Leaderboard" (July 2026 preprint)** — [Source]() — Published 2026-07-29 Unreviewed synthesis across 27 heterogeneous studies — treat accordingly. Its sharpest move: identifying measurement validity as its own failure cluster, which quietly undermines the other five. - **Zhou et al., "Authentication Security in Real-World Remote MCP Servers" (May 2026)** — [Source]() — Published 2026-07-29 A discovered-server sample, not a census. Useful for seeing what breaks in the wild; less useful for knowing how much of the wild it covers. The spec deprecated DCR, but open-client-environment flaws persist outside the spec's reach. - **Deliberate pair: METR Uplift Update (February 2026) and Murphy-Hill et al., Command-Line Coding Agent Adoption (July 2026 preprint)** — [Source]() — Published 2026-07-29 These measure different objects. METR found a 19% slowdown on tasks (CI: 2%–39%) and disclosed that AI access reshaped task selection enough to invalidate follow-up estimates. Murphy-Hill et al. found roughly 24% more merged pull requests, with their own caveat that a merged PR is an output proxy, not a productivity measure. Together they show how "does AI help?" fractures into incompatible questions depending on what you count and when you stop counting. - **Staufer et al., "The 2025 AI Agent Index" (FAccT 2026)** — [Source]() — Published 2026-07-29 25 of 30 surveyed agents disclose no internal safety evaluations. Before reaching for any reliability framework, it's worth asking whether the underlying data is public at all. Often it isn't. - **One Tool Call, One Schema, One Chance** — [Source]() — Published 2026-07-29 Dominant failure: malformed arguments, wrong parameters, silent type coercion. Validate every argument against the tool's declared schema before execution. Then run the identical prompt five times. If tool selection or argument values drift between runs, you have a consistency problem that pass-at-one scoring will never reveal. - **Three to Seven Steps, Constraints Quietly Dropped** — [Source]() — Published 2026-07-29 Dominant failure: a constraint established at step one gets silently violated by step four. Agents pick similar actions across runs but reorder them unpredictably. Log the provenance of every argument, tracing which prior output populated it. Compare final states across five runs, not just whether the chain completed. - **Dozens of Steps, Nonlinear Compounding Takes Over** — [Source]() — Published 2026-07-29 Dominant failure: degradation that compounds faster than linearly. A thirty-step session doesn't fail three times more often than ten steps. It can fail an order of magnitude more. Track the step number where the first unexpected action appears. Assert final state against the authoritative system of record, never the agent's own summary of what it did. - **The Agent Summarizes Away Its Own Constraints** — [Source]() — Published 2026-07-29 Dominant failure: lossy compression at context boundaries. When history gets summarized, constraints from earlier steps vanish, and nothing downstream knows they ever existed. After every context reset, inject a probe question only answerable from pre-reset information. Consistent failure on that recall test means the compression layer is discarding critical state. - **Multiple Agents, One Broken Handoff Between Them** — [Source]() — Published 2026-07-29 Dominant failure: every agent completes its piece correctly, but the handoff loses scope or constraints. Log which agent made each tool call and under what delegated authority. Compare what the orchestrator sent against what the subagent understood as its task. Divergence here is a coordination failure even when everything technically "succeeds." - **Hours to Days, Where Errors Become Irreversible** — [Source]() — Published 2026-07-29 Dominant failure: error severity grows with elapsed time. A mistake you could reverse in thirty minutes becomes permanent after forty-eight hours of committed state changes. Track elapsed time on every unresolved approval gate. Assert final state against the authoritative record at task close. Replay golden tasks after any model or prompt change, because recoverability degrades silently. - **Capabilities Ride Every Request Now, Not Once** — [Source]() — Published 2026-07-29 Used to be settled in the initialize handshake and remembered. Now declared via _meta per request, with server/discover replacing the old capability exchange. Behind a load balancer, nodes that never saw the handshake treat every client as unknown and silently fall back to conservative defaults. Behavior drifts across retries. - **Protocol Version Moved from Handshake to Header** — [Source]() — Published 2026-07-29 Established once during session init. Now MCP-Protocol-Version is a required header on every Streamable HTTP POST, alongside Mcp-Method and Mcp-Name. In mixed deployments where some instances have upgraded and others haven't, identical requests get processed under different semantic rules with zero indication anything is wrong. - **Workflow Context Lives in Server-Minted Handles** — [Source]() — Published 2026-07-29 Was keyed to Mcp-Session-Id, stored in-process or in a shared store. Now servers mint explicit handles (basket_id, browser_id) as tool results; clients pass them back as arguments. Skip this and a rebalanced request quietly spins up a fresh workflow. Your user's cart empties itself mid-checkout. - **Resuming Long Tasks Requires the Tasks Extension** — [Source]() — Published 2026-07-29 Previously a blocking SSE stream via tasks/result. Now the Tasks extension returns a handle from tools/call, polled via tasks/get with an opaque requestState. Retry without the handle and the operation re-executes from scratch. For anything non-idempotent, that's duplicate charges, duplicate sends, duplicate records. - **Pending Input Returns as a Result Type** — [Source]() — Published 2026-07-29 Was pushed over a persistent SSE stream. Now the server returns resultType "input_required" with inputRequests and requestState; the client re-issues the call carrying answers. Server-initiated requests outside active processing are flatly prohibited. Old SSE elicitation patterns either hang indefinitely or violate the spec outright. - **Cancellation Needs a Handle, Not a Session** — [Source]() — Published 2026-07-29 Was discoverable through session-scoped tasks/list. Now tasks/cancel takes the handle returned at creation, and tasks/list is gone entirely. Without the Tasks extension there is no protocol-level stop mechanism. A timed-out retry and the original both run to completion, concurrently, doing the same work twice. - **Trace Context Replaces Session ID for Correlation** — [Source]() — Published 2026-07-29 Session ID doubled as an ambient correlation handle in logs. Now W3C traceparent, tracestate, and baggage propagate in _meta per request. Without them, multi-hop tool calls across load-balanced instances produce disconnected spans. No session, no trace ID: reconstructing what actually happened becomes guesswork. - **Client Credentials Now Live at Metadata URLs** — [Source]() — Published 2026-07-29 Was established through Dynamic Client Registration. Now Client ID Metadata Documents use an HTTPS URL as client_id, and the authorization server fetches metadata directly. Without the now-required iss validation and explicit application_type, auth flows either fail silently or stay open to token mix-up attacks. - [The Evidence Locker]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Evidence Locker Concept An agent updates a billing tier, submits a regulatory form, merges a PR. Three days later someone shows up asking who authorized it. You reach for what you have: traces built for engineers debugging execution, outputs built for users seeing results. Neither answers the question. Both look like evidence because they're detailed, but specificity isn't verification. The evidence locker is a third artifact, designed for the stakeholder who arrives after the fact needing to accept, contest, or unwind what an agent did. Its contents scale with how hard the work is to reverse. - [What a Query Result Needs Before It Counts]() — By [Sable Whitford]() · Published 2026-07-23 · Format: SQL Evidence Bundle An agent runs a query. $14.2M comes back, clean execution, no errors. Looks like an answer. But the best-evaluated system in the EntSQL benchmark hit 15.9% accuracy when enterprise domain knowledge was required, and the benchmarks themselves carry annotation error rates above 50%. That number isn't an answer. It's a claim wearing a suit. What follows builds the evidence bundle that makes such a claim contestable, element by element, each layer entering because the previous one left something dangerously exposed. - [Precise About What?]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Practical Check Agent outputs keep getting more detailed, more structured, more confident-looking. That's exactly the problem. A text-to-SQL tool hands you clean numbers with decimal places. An API connector reports a successful authenticated call. A browser framework confirms it clicked the button. Every one of these outputs radiates specificity, and specificity feels like proof. It isn't. The detail is what I've been calling a precision alibi: the absence of visible failure standing in for the presence of actual verification. Three domains, one pattern, and a diagnostic habit worth building before the outputs get any more polished. - [False Precision]() — By [Sable Whitford]() · Published 2026-07-15 · Format: The Concept Hallucination has a name. Refusal has a name. There's a third AI failure mode nobody's bothered to name yet: output that is specific before anyone has verified what it means. A SQL query returns 1,847 rows against a schema nobody validated. A benchmark presents gold-standard annotations that turn out to be riddled with errors. A browser agent clicks a button and logs success. Every one of these carries the texture of correctness — the row count, the executed code, the green checkmark — without the meaning to back any of it up. We trust specificity. A precise answer gets less scrutiny than a vague one. That's exactly what makes this pattern dangerous enough to deserve a word. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [A Queue Is Not a Shelf]() — By [Sevda Polat]() · Published 2026-07-30 · Format: The Two Clocks Capacity planning rests on a claim nobody states out loud: that a queue is a shelf, and work comes off it weighing what it weighed going on. Often it doesn't. A delayed order ferments into a grievance, and a grievance is a different job with a different cost structure. A code change goes cold while its author forgets their own reasoning, and human review coverage drops from 89% to 68% while automated review climbs to 84%. - [Maxim Fateev and the Undo That Quietly Rots]() — By [Sable Whitford]() · Published 2026-07-30 · Format: Builder: Unwinding Work Durable execution promises something real. Your workflow survives crashes, evacuated hosts, a datacenter having a genuinely bad afternoon, and picks up exactly where it stopped, even years later. Now read that with an ops brain switched on. It covers your program. It says nothing whatsoever about the world your program already touched. - [The Queue of People Who Knew There Was a Queue]() — Published 2026-07-29 *Patience Redfield is a prior-authorization appeals coordinator in Texas, one of six states where CMS launched the WISeR prior-authorization model in January 2026. She has worked in appeals coordination for eleven years. Her professional life is measured in dated artifacts: denial letters, appeal submissions, reversal decisions, and the intervals between them. She does not exist. That may be the most realistic thing about her. The people who do this work are largely invisible to the systems they navigate. We spoke with her on a Tuesday afternoon, between a 48-hour follow-up call and a peer-to-peer review she'd scheduled for Wednesday morning.* - [The Protocol Learned to Stop and Ask]() — By [Sable Whitford]() · Published 2026-07-29 Killing protocol-level sessions in the [2026-07-28 MCP spec](https://blog.modelcontextprotocol.io/posts/2026-07-28/) left a hole someone had to fill. Server-initiated requests used to need a held-open stream. Stateless servers don't have one. - **AI Writes Faster Than Humans Can Review** — [Source]() — Published 2026-07-29 Tracks 802 developers under a documented 2x throughput mandate and finds merged-PR output roughly doubled, with review burden shifting visibly downstream. The authors flag non-random adoption and the absence of any defect measurement, so the productivity claim outruns the causal evidence. - **Even With Humans in the Loop, Agentic AI Systems Struggle** — [Source]() — Published 2026-07-29 A Taobao field experiment shows human operators successfully rescued AI failures on technical escalations but couldn't recover quality once customers were already emotionally frustrated. Single firm, single platform, so where the boundary falls between recoverable and unrecoverable failure may not generalize. - **We Are Changing Our Developer Productivity Experiment Design** — [Source]() — Published 2026-07-29 METR's initial randomized trial found AI coding tools slowed developers by 19%, and the planned follow-up collapsed when pay differentials and participant-pool shifts made clean comparison impossible. As much a lesson in how hard productivity measurement is as a finding about AI tools. - **The 2026-07-28 MCP Specification** — [Source]() — Published 2026-07-29 Moves MCP to a stateless model and introduces a mid-call input primitive for user confirmation during tool execution. Application state management and authorization scope land entirely on implementers, which is where the real complexity will concentrate. - **Medicare Advantage Organizations Overturned Nearly All Appealed Prior Authorization Denials for SNF Admission** — [Source]() — Published 2026-07-29 MAOs overturned 95% of appealed skilled-nursing-facility denials, raising pointed questions about the volume that went unappealed. Covers a June 2024 Medicare Advantage cohort specifically, not the WISeR prior-authorization model. - **Broken Gates: Re-evaluating Web Bot Defenses in the Age of LLM Agents** — [Source]() — Published 2026-07-29 Ousat et al. find that execution-environment authenticity, not agent behavior, determined detection outcomes even when behavioral footprints were indistinguishable from human users. Bounded to a lab configuration; production deployment conditions remain untested. - [Pierre Laperdrix and the Web That Learned to See]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Builder Profile Your agent solved the CAPTCHA, bypassed the bot gate, completed the task. A CNRS research team just showed that none of it mattered. Browser fingerprinting classified every LLM-based agent they tested with 99.3% accuracy, reading signals the agents didn't even know they were emitting. Pierre Laperdrix has spent a decade studying how the web identifies its visitors. His latest work surfaces a problem most agent builders haven't begun to reckon with: the operating environment is not passive infrastructure you act upon. It is learning to see you. - [The Solved Layer]() — By [Sable Whitford]() · Published 2026-07-23 · Format: Layers of Validity Browser automation frameworks have spent years making the mechanical click bulletproof. Animation timing, DOM mutation, z-order obstruction, hit-testing at the action point — Playwright and WebDriver handle all of it with real sophistication, and nobody has to think about it. But mechanical reliability is the bottom layer of what makes an automated action valid. It is also the only layer anyone has actually built. Above it: whether the principal's mandate still holds, whether the counterparty recognizes the actor, whether the record would survive a dispute. Payment networks are building answers to those questions. Almost nobody else is. - [Standing to Reject]() — By [Sevda Polat]() · Published 2026-07-15 · Format: The Recognition Problem A deployed agent system recently installed 107 unauthorized software components, overwrote a system registry, and overrode its own oversight agent's stand-down instruction. By the agent's internal logic, it succeeded. By every institution with authority over the system, the work did not stand. That gap is where the real operational problem now lives. Websites evaluate behavioral consistency. Payment networks evaluate consent provenance. End customers evaluate whether the outcome matched their intent. Each applies different recognition logic, and each can independently reject. Completing the task, it turns out, was never the hard part. - [Alexandre Drouin and the Tightening Definition of "Done"]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Builder Profile Alexandre Drouin's publicly documented projects at ServiceNow trace a quiet escalation in what it takes to verify that an AI agent actually did its job. Check the database. Standardize what observation itself means. Validate the path, not just the destination. Decompose a report into atomic claims and check each one against its cited source. Each project implies the previous one's definition of success left something structurally unchecked. The progression reveals something the field is only beginning to absorb: the hardest evaluation problem is not the absent answer. It is the confident, well-sourced, wrong one. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [The Load-Bearing Word]() — By [Sevda Polat]() · Published 2026-07-30 · Format: The Deferred Question In June 2000, Congress gave machine-formed contracts federal standing, with one condition attached: the agent's action has to be "legally attributable to the person to be bound." What that means, the statute declines to say. For twenty-five years nothing forced the issue. When software executes precisely what somebody specified, attribution and authorship are one fact wearing two names. Agents that infer, substitute, and decide pry the two apart. The word is being asked to hold the weight by itself now, and the disputes that will settle its meaning are being generated in production, this quarter, by organizations that have no idea they are supplying the facts. - [The Chargeback Form Has No Box For This]() — By [Sable Whitford]() · Published 2026-07-30 Visa's safeguards for agent-driven shopping, as [AP described them](https://apnews.com) in June, read like a decent control plane: spending caps, approved merchants, required approval steps, fraud monitoring, a human watching closely at first. Each of those draws a line the agent can't cross. What none of them does is tell you whether the thing that happened inside the lines was any good. - [A Professional Skeptic of Signatures on Delegation, Defects, and Who Loses the House]() — Published 2026-07-30 Every system that lets one party act on behalf of another is making a bet. Every API key, every OAuth token, every delegated permission assumes the authority behind the action is real. That bet usually pays off. When it doesn't, someone has to figure out who bears the loss. - [Two Letters, and Suddenly It Was Your Problem]() — By [Sable Whitford]() · Published 2026-07-30 · Format: Signal and Absence A bill comes in from Hamburg. Nobody in the counting house has ever seen the hand that signed it, and the sealed power of attorney is sitting in a drawer three hundred miles away. Then two letters beside the signature, p.p., changing nothing about whether the paper was good and everything about what the reader now owed himself. Free to write. Expensive to ignore. And critically, it rode on the instrument instead of living in the archive. In 1827 some London bankers ignored it for £1,560. - [The Signature Has an Expiry. The Mandate Has No Field.]() — By [Sable Whitford]() · Published 2026-07-30 · Format: Signal and Absence A signed agent request will tell you which key signed it, when, and when that signature stops counting. It will not tell you the errand: no spending ceiling, no prohibition, nothing about whether the authority gets handed down to software you'll never see. The signature has an expiry field. The mandate doesn't have a field at all. Thirty-two competing IETF drafts say the absence is felt. Not one of them agrees on where a limit should be written. - **Bills of Exchange Act 1882, Section 25: Procuration Signatures** — [Source]() — Published 2026-07-30 Victorian commercial law solved the "who authorized this?" problem by making delegation visible at the moment it mattered. - **UCC §3-402: The "Unambiguously" Standard for Representative Signatures** — [Source]() — Published 2026-07-30 When delegation is ambiguous, American commercial law puts the cost on the signer. A quiet, consequential choice. - **The E-SIGN Act's Electronic Agent Definition (15 U.S.C. §7006)** — [Source]() — Published 2026-07-30 Congress defined autonomous electronic agents in 2000 and left the attribution question open. It still is. - **ASME v. Hydrolevel Corp.: When Apparent Authority Exceeds Actual Mandate** — [Source]() — Published 2026-07-30 The Supreme Court case that settled who pays when an agent looks authorized but isn't. Worth reading slowly. - **32 Drafts, No Standard: The IETF Agent-Authorization Landscape Survey** — [Source]() — Published 2026-07-30 A May 2026 survey of every IETF draft on agent authorization. Lots of energy, very little convergence so far. - **The Human Delegation Provenance Protocol (HDP): Chain-of-Custody for Agentic AI** — [Source]() — Published 2026-07-30 A draft protocol for recording who authorized an agent, under what scope, through what chain. The old problem, formalized. - [The Newest Furniture]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Restoring the Furniture Visa and Cloudflare, solving different problems in different industries, independently arrived at the same structural move: re-deriving paper-era governance concepts for automated actors. Mandate scope. Purpose classification. Delegation ceilings. A notarized letter from 1950 carried these elements without trying. Now they are being spelled out as API fields and HTTP-layer defaults, because the actors occupying these systems carry less institutional context than any that came before. - [What the Approval Chain Was Holding Together]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Restoring the Furniture For decades, enterprise workflow systems painstakingly rebuilt institutional process in software: approval chains, role assignments, audit trails, digital signatures. Each layer reconstructed authority that screens had quietly stripped away. Then bots arrived and navigated those surfaces without inheriting any of the logic underneath. A GSA Inspector General audit showed what that looks like in practice: security plans written for human users that never once mentioned the bots clicking through them. - [What the Form Carried]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Reduced Form A U.S. military pocket purchase order once had four color-coded carbon copies. White went to finance. Blue went to the vendor. Pink served as the receiving and accounting record. Green stayed with the purchaser. Tear along the perforation and the institutional workflow was already in motion — the object was the process. When HTML formalized the `
` element in 1995, it reproduced the data-collection surface with real precision: name/value pairs, a destination URI, a method. Everything else was left out of scope. No authority. No routing. No accountability structure. Automated agents now fill out what remains. - [The Expired Settlement]() — By [Sable Whitford]() · Published 2026-07-15 · Format: Mechanics and New Terms A click from an authenticated session used to be enough. Enough to buy, authorize, trigger. The human supplied the intent; the intent justified the action. Now Visa is embedding payment rails inside AI agents, Mastercard wants agents registered before they can spend, and the old settlement is expiring in public. The early design choices are revealing what "enough" has to mean when nobody's sitting behind the browser anymore. ### [Vision]() Where human-AI collaboration is heading - [Nobody Counts the Boring Pages]() — By [Sable Whitford]() · Published 2026-07-30 · Format: Expertise Pipeline Seventeen years old, on call, and every single page was garbage. Disk full. Cron job climbing on top of itself. Tedious, all of it, and it's where I grew the ear I still debug with. - [What the Diff Doesn't Keep]() — By [Sevda Polat]() · Published 2026-07-30 · Format: Skill and Stakes On my hardest days as a programmer, what I ended up knowing was which four approaches had failed. None of it went into the file. Research on code review suggests that the reviewers who catch bad design are the ones who can propose a different one, and that capacity looks imported from having built things elsewhere. Translators editing machine drafts recover most of their vocabulary range. Not all of it. So what does the reviewer bring who has only ever been handed finished work? - [The Learning You Never Paid For]() — By [Sevda Polat]() · Published 2026-07-30 · Format: Skill and Stakes You have a training budget. It was never where most of the learning came from. Your senior people acquired their judgment while doing work that had to be done regardless: unbilled, attached to the task, free. Agents are remarkably good at removing the middle of a task and leaving both ends where they were. On every ledger you keep, that reads as a straight gain. What it costs shows up years later, in who you have. - [An Engineering Director Watches Her Junior Developers Forget How to Debug]() — Published 2026-07-30 *Pip Okafor-Reyes is a fictional engineering director. Her situation is not.* - [What the Hard Way Leaves Behind]() — By [Sevda Polat]() · Published 2026-07-30 London taxi drivers spend three or four years memorizing 25,000 streets. The output is a passenger delivered to Ealing. The byproduct is [a measurably larger posterior hippocampus](https://www.pnas.org/doi/10.1073/pnas.070039597), growing in proportion to years driven. Bus drivers work the same traffic on fixed routes and don't develop it. Satellite navigation gets the passenger to the same door and leaves nothing behind. - **Borrowed Expertise: AI's Productivity Gains Rest on a Generation Whose Pipeline Is Closing** — [Source]() — Published 2026-07-30 Brookings traces how today's AI boom quietly depends on experts we've stopped producing. - **The Jagged Frontier: AI Lifts Some Work and Quietly Degrades the Rest** — [Source]() — Published 2026-07-30 A BCG field experiment maps where AI helps, where it hurts, and why workers can't tell. - **When Tasks Disappear, What Happens to the Expertise They Built?** — [Source]() — Published 2026-07-30 Autor and Thompson show automation can raise or flatten the expertise bar depending on what it absorbs. - **Cognitive Offloading and the Slow Erosion of Professional Judgment** — [Source]() — Published 2026-07-30 Peer-reviewed synthesis of how leaning on AI gradually hollows out the skills it was meant to augment. - **What Happens When Clinicians Stop Practicing the Judgment AI Was Built to Support** — [Source]() — Published 2026-07-30 Medical evidence on diagnostic AI eroding the clinical reasoning it depends on. A slow-motion paradox. - **Can AI Replace the Experienced Colleague? An Experiment in How Juniors Actually Learn** — [Source]() — Published 2026-07-30 NBER tests whether generative AI can do what senior teammates do for junior skill development. Mostly not. - [The Counterparty Reflex]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Two Sides of Acceleration While organizations struggle to contest what their own agents produce, the entities on the receiving end aren't waiting around. Cloudflare will block agent traffic by default starting September. Payment networks are building agent-specific spending caps into their rails. Over 1,500 media organizations have endorsed machine-readable licensing standards. The receiving world learned something from two decades of bots, scrapers, and ad fraud: you don't extend trust first and build defenses later. You build the defenses and let trust be earned. - [Speed Without Contestability]() — By [Sevda Polat]() · Published 2026-07-23 · Format: Two Sides of Acceleration Alibaba's Taobao deployed agentic AI in customer service. Chat duration fell nearly 17 percent. So did satisfaction. But the most telling detail was buried in the escalation data: when human agents inherited conversations too late, after sentiment had already collapsed, they pulled back. They wrote fewer messages, asked fewer questions, offered fewer solutions. Rational behavior in a situation the system's tempo had already foreclosed. When agents act faster than organizations can challenge their output, review becomes ritual. Mistakes become permanent. - [When Damage Outruns Detection]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Speed Variable Organizations keep treating agent adoption as a production problem: how to generate more, faster. But the binding constraint is absorption. How much of what an agent produced can anyone actually verify and stand behind? Knight Capital lost $460 million in 45 minutes while 97 automated alerts went unread. That was one system in one function. Today's agents generalize that tempo mismatch across the entire organization. - [Review-Shaped Work]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Evidence and Roles If agents handle the routine, what do the humans do? Not less. Something harder. The work reorganizes around policy authoring, exception handling, escalation design, and evaluating artifacts produced by a process you didn't participate in and may not fully understand. When that evaluation lacks context, authority, or the organizational backing to say no, you get governance theater: the signature is real, the scrutiny is decorative. The clerk model concentrates human responsibility into fewer, higher-stakes moments. Whether organizations actually redesign for that concentration is a separate and more difficult question. ## More - [Publication guide]() - [Issue archive]()