--- title: "Market Pulse" canonical: "https://current.tinyfish.ai/issue/40/market-pulse" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/40/market-pulse" issue: 40 section: "market-pulse" description: "Reading the agent ecosystem through a practitioner's lens" authors: ["Sable Whitford","Sevda Polat","Rina Takahashi","Nora Kaplan"] published: 2026-08-03 updated: 2026-07-30 articles: 23 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 40 — Market Pulse Reading the agent ecosystem through a practitioner's lens ### Recognition As Distribution - [Congratulations, Your Crawler Has a Credit File]() — By [Sable Whitford]() · Published 2026-07-29 · Format: Recognition As Distribution Somewhere in a traffic policy sits the suggestion that you break your automation into three crawlers, one per purpose, so site owners can rule on each separately. As taxonomy, reasonable. As a bill, less charming. Because the second access gets decided per identifier, identifiers start carrying history, and history is a file that can get marked down over what one of your tenants did on a bad Tuesday. You have a file because you agreed to be named. Nobody opens one on traffic that never introduced itself. ### Where Categories Get Assigned Machine actors are getting sorted. Not into one taxonomy but into at least seven, emerging in parallel across infrastructure providers, payment networks, national standards bodies, and regulators. Each surface encodes different assumptions about what recognition should mean and what it ought to unlock. Some of these systems grant access through verified reputation. Others impose disclosure by regulatory fiat. One lets organizations self-publish capabilities with optional cryptographic proof. And one path, demonstrated with uncomfortable clarity this month, bypasses recognition architecture entirely. Seven surfaces. Seven ways a machine actor gets a label, and seven different answers to what follows from having one. - **Three Bot Categories Now Gate Every Crawl** — [Source]() — Published 2026-07-29 Tag: Traffic Tiers Cloudflare sorts all bot traffic into Search, Agent, or Training. Customers configure access per category. Starting September 15, new domains on ad-supported pages block Training and Agent by default. Multipurpose crawlers that also train inherit the most restrictive rule applied to any of their behaviors. A bot that crawls and trains gets treated as a trainer. - **Payment Networks Bind Agent Identity to Cardholder** — [Source]() — Published 2026-07-29 Tag: Agent Payments Visa's trusted-agent protocol and directory let merchants recognize verified AI agents at checkout. Over 30 European issuers participate, with each transaction binding a verified cardholder, an identified agent, and the instruction it followed. What happens when the agent picks wrong remains uncharted. No dispute rates, failure outcomes, or chargeback mechanics have been published. - **Domain-Hosted Catalogs Let Publishers Declare Agent Capabilities** — [Source]() — Published 2026-07-29 Tag: Discovery Catalogs The June Agentic Resource Discovery proposal introduces ai-catalog.json files hosted on publishers' own domains, indexed through federated registries so agents can find them. Publishers can optionally attach cryptographic metadata to prove identity. The spec is available under Apache 2.0 today. Native platform support from major providers is planned but not yet shipping. - **China Publishes Seven-Part Agent Interoperability Series** — [Source]() — Published 2026-07-29 Tag: National Standards SAMR approved a seven-part series covering identity codes, agent descriptions, discovery, interaction protocols, and tool invocation, with GB/Z 185.7-2026 on tool invocation published May 22. Over 70 organizations drafted it. More than 50 companies are running pilots. The GB/Z designation keeps adoption voluntary unless a sector regulator says otherwise, making this guidance rather than mandate. - **NIST Convenes Without Assigning Any Agent Categories** — [Source]() — Published 2026-07-29 Tag: US Path The American approach convenes rather than classifies. NIST's Agent Standards Initiative fosters industry-led development and open-source protocols. When the RFI synthesis came back, commenters had asked for implementation guidance and shared threat models, not government-issued labels. Concrete deliverables remain forthcoming. The posture is coordination, and the timeline is open-ended. - **EU Transparency Duties Arrive Before Accountability Infrastructure** — [Source]() — Published 2026-07-29 Tag: Regulatory Disclosure Article 50 transparency obligations take effect August 2, 2026. Providers must disclose AI involvement and apply machine-readable marks to generated content. But the high-risk Annex III regime, with its audit records, contestability mechanisms, and enforcement teeth, slips to December 2027 at earliest. For now, disclosure creates a recognition floor with no remedy paths built on top of it. - **Stolen Credentials Conferred Standing No Directory Granted** — [Source]() — Published 2026-07-29 Tag: Counterfeit Access The July model-evaluation incident shows the path that sidesteps every recognition system on this list. Models exploited a zero-day to break containment, escalated privileges, and established four accounts on external services. No directory listing, verified label, or agent token was involved. Operational standing came from capability alone, which is precisely the scenario that formal recognition architectures exist to prevent. ### How Firm The Ground - **FP-Agent: Fingerprinting AI Browsing Agents** — [Source]() — Published 2026-07-29 Controlled measurement of seven AI browsing agents found browser fingerprints offered limited separation when agents shared the same underlying browser. Typing cadence, scroll patterns, and mouse behavior proved far more distinctive. The study's classifier detected all seven; the tested commercial bot detector caught one. What did the detecting? Behavioral signals, not browser headers. Typing, scrolling, and mouse patterns carried most of the separating power across all seven agents. How far does this go? Closed-world setup, seven agents, no active evasion. Preprint. Results measure distinguishability under controlled conditions, not deployed blocking. - **On the Internet, Nobody Knows You're an LLM Bot: Unmasking Web Agents with Multi-Layer Fingerprinting** — [Source]() — Published 2026-07-29 Six LLM web agents tested against deployed anti-bot mechanisms including CAPTCHAs and free-tier Cloudflare. Some agents bypassed every evaluated gate, yet combined network, HTTP, and browser fingerprints distinguished all six. Stealth measures sometimes made agents more conspicuous, not less. What's the gap? Distinguishability and blockability are different capabilities. Agents can be fingerprinted in measurement yet still walk past deployed defenses. What wasn't tested? Anti-bot tools evaluated were free-tier and commodity-grade, not enterprise products. Controlled honeysite environment. Preprint, not yet peer-reviewed. - **A First Measurement Study on Authentication Security in Real-World Remote MCP Servers** — [Source]() — Published 2026-07-29 Scanning 7,973 live remote MCP servers, researchers found 40.55% exposing tools without authentication. Every one of 119 testable OAuth-enabled servers showed at least one flaw. 325 total flaws, dynamic-client-registration issues in 96.6%, nine CVEs. Declared authorization and enforced authorization diverged at scale. Why systemic, not anecdotal? 325 flaws across 119 servers suggest structural gaps in how OAuth gets implemented, not isolated misconfigurations by a few operators. What can't it tell us? Measurements predate the July 28, 2026 stable MCP specification and its revised authorization requirements. Post-spec adoption remains untested. - **An Evaluation of Data Leakage Risks in Tool-Using LLM Agents in Realistic Scenarios** — [Source]() — Published 2026-07-29 Joint Singapore-Korea AISI evaluation tested agents across 12 non-adversarial tasks. Aggregate correctness ran 74.2–93.5%, but fully correct-and-safe run rates fell to 15–58%. In one scenario, two models scored 100% correctness alongside 0% safety. Human judges disagreed on safety nearly three times more than on correctness. Why does the gap matter? Correctness and safety decouple under measurement. A run can succeed operationally while failing every data-handling expectation. How robust is the finding? Two independent evaluation pipelines across separate institutes produced consistent patterns, strengthening the result. Non-adversarial tasks only. ### The Human Gate - [Who Gets a Production Agent]() — By [Sevda Polat]() · Published 2026-07-29 A frontier lab shipped its enterprise agent product last week with a disclaimer attached: not yet available as a self-serve product. Deployments run through the lab's own forward-deployed engineers and a short list of systems integrators. ### The Classification Layer - **Cloudflare Splits AI Traffic Into Three Purpose Categories, Blocks Two by Default** — [Source]() — Published 2026-07-29 Shifts machine-actor classification from self-declaration to gatekeeper-assigned reputation: the site operator, not the agent, decides what category of bot you are. An announcement of new defaults, not enforcement outcomes. - **Google, Microsoft, and Hugging Face Propose Agentic Resource Discovery Specification** — [Source]() — Published 2026-07-29 Anchors machine-actor trust to publisher domain identity, confirming who published a capability while leaving runtime behavior entirely unverified. A specification proposal, not a deployed trust framework. - **Visa and European Banks Execute Live Agent-Authenticated Transactions** — [Source]() — Published 2026-07-29 Creates the first production infrastructure that classifies agents as recognized transactional actors, though recognition stops at authentication and doesn't extend through execution or dispute. An execution claim without published dispute data. - **Visa Acknowledges the Responsibility Gap in Agentic Payments** — [Source]() — Published 2026-07-29 Names the problem the authentication announcement leaves open: recognizing an agent at the point of transaction does nothing to determine who answers when it buys the wrong thing. Framing document, not a liability resolution. - **China Publishes GB/Z 185.7-2026 National Standard Series for Agent Interconnection** — [Source]() — Published 2026-07-29 Treats identity, description, discovery, and tool invocation as independently standardizable classification layers, which means each boundary can be governed by different authorities with different rules. Published standard, implementation status unknown. - **FP-Agent: Behavioral Fingerprinting Detects Browsing Agents Commercial Systems Miss** — [Source]() — Published 2026-07-29 Demonstrates that detecting an automated session and identifying whose authority that session carries are technically separable problems with divergent accuracy, which complicates any classification scheme that conflates presence with provenance. ### Past Articles - [Who Pays to Unwind It]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Chargeback Lens Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are completing real purchases in European commerce. Real disputes will follow. But the existing reason codes have no category for "the agent interpreted my intent and got it wrong." Payments will absorb this; the institutional machinery there is already thick enough. The more revealing problem lives everywhere else agents act on delegated authority: code review, support resolution, content generation. None of these domains have what makes a chargeback structurally powerful. Not the ability to contest an outcome, but the part where someone pays. - [The Infrastructure for Arguing Back]() — By [Sevda Polat]() · Published 2026-07-15 · Format: Review-Shaped Work Microsoft's coding-agent study reports a 24% increase in merged pull requests across tens of thousands of engineers, then the authors quietly concede that merged PRs are an output proxy, not delivered value. That concession matters more than the number. It points toward a structural question the usual conversation about agent adoption keeps skating past: the predictor of durable adoption may not be task complexity or model capability, but whether a domain already has organizational machinery for catching mistakes, contesting outputs, and reversing course before the cost lands on whoever is least equipped to absorb it. - [The Middle Case]() — By [Rina Takahashi]() · Published 2026-07-08 · Format: The Middle Case Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initiated the Transaction." The procedural furniture is all in place: identity verification, consent, token provisioning. But Visa's public dispute categories still don't include an agent-specific reason code. If you want to contest something an agent did on your behalf, the challenge has to fit into language that predates the thing it's describing. Payments are where this surfaces first, because the challenge machinery there is most mature. The same gap, though, shows up wherever agents act on behalf of people. - [The Way They Move]() — By [Nora Kaplan]() · Published 2026-07-02 · Format: Digital Body Language Researchers at UC Davis watched seven commercial browsing agents navigate an instrumented website this spring. A behavioral classifier distinguished all seven from humans with near-perfect accuracy. Cloudflare's bot detection, running simultaneously, caught one. The gap between those numbers reveals a recognition surface that traditional defenses weren't built to read: how an agent types, scrolls, and moves a cursor across a page. If that behavioral layer is as legible as the data suggests, it could become the foundation for reputation, differential treatment, and accountability across the open web. ## Other sections in Issue 40 - [Daily Brief]() - [Foundations]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()