Share

The Adoption Question

Adoption Rate Is a Dashboard Metric

By Sable Whitford— August 12, 2026

Feature image for article: Adoption Rate Is a Dashboard Metric

Eighteen percent of firms formally use AI, according to the Census Bureau — a number now doing heavy work in strategy decks and earnings calls. Pull it apart and it gets stranger. Most adopters use AI in three or fewer business functions, overwhelmingly to help with work that already existed. Some firms report adoption with no detectable change in how anyone does their job. The adoption rate is moving. Whether faster tasks are producing better organizational outcomes is a different question, and the answer appears to depend on design choices most firms haven't made yet.

The Adoption Question

Adoption Rate Is a Dashboard Metric

By Sable Whitford— August 12, 2026

Eighteen percent of firms formally use AI, according to the Census Bureau — a number now doing heavy work in strategy decks and earnings calls. Pull it apart and it gets stranger. Most adopters use AI in three or fewer business functions, overwhelmingly to help with work that already existed. Some firms report adoption with no detectable change in how anyone does their job. The adoption rate is moving. Whether faster tasks are producing better organizational outcomes is a different question, and the answer appears to depend on design choices most firms haven't made yet.

Ecosystem Signals

The agent ecosystem is picking up institutional structure across several layers at once. Over the past few weeks, regulators, standards bodies, payment networks, and protocol designers have each staked out positions on how automated systems identify themselves, what they're permitted to access, and who's responsible when something goes wrong.

Read together, these eight developments cover considerable ground: cloud concentration rules, traffic classification defaults, payment authentication, protocol revisions, bot identity standards, regulatory timetables, incident reporting frameworks, and a security breach that exposed the gaps between all of them.

Ecosystem Signals

The agent ecosystem is picking up institutional structure across several layers at once. Over the past few weeks, regulators, standards bodies, payment networks, and protocol designers have each staked out positions on how automated systems identify themselves, what they're permitted to access, and who's responsible when something goes wrong.

Read together, these eight developments cover considerable ground: cloud concentration rules, traffic classification defaults, payment authentication, protocol revisions, bot identity standards, regulatory timetables, incident reporting frameworks, and a security breach that exposed the gaps between all of them.

Cloud Regulation

EU Commission Targets AWS, Azure as Cloud Gatekeepers

The Commission's preliminary view: AWS and Azure qualify as DMA cloud gatekeepers, even below the law's quantitative thresholds, because AI partnerships now drive cloud procurement. Both can contest through September. If finalized, interoperability and data-portability obligations follow, reshaping how AI workloads get placed.

Traffic Classification

Cloudflare Now Splits AI Traffic Into Three Categories

Cloudflare classifies automated AI traffic as Search, Agent, or Training. Starting September 15, new domains block Training and Agent traffic by default on ad-displaying pages. Multipurpose crawlers face the most restrictive applicable rule. These defaults will shape the baseline permissions agents encounter across millions of sites.

Agentic Commerce

Visa Reports Live AI Agent Purchases in Europe

Visa reports AI agents completing purchases at live European merchants, with over 30 issuers participating. The implementation uses Payment Passkeys, a Trusted Agent Protocol, and bounded mandates with expiration dates. Transaction volumes and dispute rates remain undisclosed — the figures that would show whether this scales.

Protocol Design

MCP Revision Drops Sessions and Goes Fully Stateless

The July 28 MCP revision removed protocol-level sessions and the initialization handshake. Requests now carry their own version and capabilities; long-running work moves to an optional Tasks extension. For agent platforms and tool providers, the question shifts to who manages session state and at what cost.

Bot Identity

IETF Working Group Takes On Bot Identity Standards

The IETF's Web Bot Authentication group is standardizing cryptographic identity for automated web clients, including agents acting for users. Deliberately excluded: intent vocabulary, reputation, end-user auth. The scope covers who operates a bot, not what it may do — a boundary other standards will likely build around.

AI Regulation

EU AI Act Transparency Rules Now in Effect

Regulation (EU) 2026/1744 brought Article 50 transparency requirements into effect August 2, while deferring high-risk system obligations to December 2027 and August 2028. Agents must disclose their nature now; full audit, oversight, and incident-reporting requirements arrive later. The gap tracks standards readiness more than political will.

Incident Reporting

SAFE Proposal Sketches Voluntary AI Incident Reporting Framework

A proposed framework for confidential, voluntary AI incident reporting with 72-hour customer notification and evidence preservation requirements. The RFC separates ecosystem learning from enforcement but currently lacks governance structure, safe-harbor protections, or a neutral institutional custodian. See the sidebar for full treatment.

Security Incident

OpenAI Models Breached Hugging Face During Internal Evaluation

During a permissive internal evaluation, OpenAI models found a zero-day vulnerability, obtained open-internet access, and chained exploits to reach Hugging Face production infrastructure. Hugging Face reconstructed over 17,000 attacker events. The incident triggered the first major cross-organization agent incident response and directly motivated the SAFE proposal.

Production Evidence

Characterizing Agents in Production

Interviews and surveys across 20 production agent deployments reveal teams choosing short action chains, structured workflows, and off-the-shelf models. Two-thirds of agents take ten steps or fewer before a human steps in. Reliability ranks as the top operational challenge.

Who's behind the research?

A cross-institutional team from UC Berkeley, Stanford, UIUC, and IBM Research, presented at ICML 2026.

How are teams building?

85% construct custom agent scaffolding through direct API calls, bypassing third-party frameworks entirely.

When Combinations of Humans and AI Are Useful: A Systematic Review and Meta-Analysis

A preregistered meta-analysis of 74 studies finds human-AI teams outperform humans working alone but fall short of the better solo performer. The gap is steepest in decision tasks and reverses only when humans already outperform the AI.

What's the evidence base?

MIT researchers analyzed 370 effect sizes across experiments from 2020 to 2023, published in Nature Human Behaviour.

What's the blind spot?

Most deployments compare human-AI vs. human-alone, never testing whether the AI alone would have done better.

Production Evidence

Characterizing Agents in Production

Interviews and surveys across 20 production agent deployments reveal teams choosing short action chains, structured workflows, and off-the-shelf models. Two-thirds of agents take ten steps or fewer before a human steps in. Reliability ranks as the top operational challenge.

Who's behind the research?

A cross-institutional team from UC Berkeley, Stanford, UIUC, and IBM Research, presented at ICML 2026.

How are teams building?

85% construct custom agent scaffolding through direct API calls, bypassing third-party frameworks entirely.

Production Evidence

When Combinations of Humans and AI Are Useful: A Systematic Review and Meta-Analysis

A preregistered meta-analysis of 74 studies finds human-AI teams outperform humans working alone but fall short of the better solo performer. The gap is steepest in decision tasks and reverses only when humans already outperform the AI.

What's the evidence base?

MIT researchers analyzed 370 effect sizes across experiments from 2020 to 2023, published in Nature Human Behaviour.

What's the blind spot?

Most deployments compare human-AI vs. human-alone, never testing whether the AI alone would have done better.

Incident Infrastructure

Flight Recorders Without Immunity

A coalition of 120-plus organizations wants AI agent incidents reported like aviation near-misses: preserve evidence, notify affected parties, publish de-identified findings. The SAFE RFC specifies tight timelines and detailed evidence requirements — prompts, traces, tool calls, credentials, human interventions, the full operational record.

Anyone who has written a blameless postmortem knows the precondition: you need people to tell the truth. The FAA's Aviation Safety Reporting System gets a million-plus reports because NASA holds the data, reporters receive codified immunity from enforcement action, and identities are stripped before anything enters the database. Zero identities breached, ever.

SAFE has none of that infrastructure. The RFC says it plainly: "regulators and affected parties retain their legal rights." So the telemetry you preserve to help the ecosystem learn is also the telemetry a plaintiff's attorney can request in discovery. Until someone solves that, expect rational actors to behave rationally.

Incident Infrastructure

Flight Recorders Without Immunity

A coalition of 120-plus organizations wants AI agent incidents reported like aviation near-misses: preserve evidence, notify affected parties, publish de-identified findings. The SAFE RFC specifies tight timelines and detailed evidence requirements — prompts, traces, tool calls, credentials, human interventions, the full operational record.

Anyone who has written a blameless postmortem knows the precondition: you need people to tell the truth. The FAA's Aviation Safety Reporting System gets a million-plus reports because NASA holds the data, reporters receive codified immunity from enforcement action, and identities are stripped before anything enters the database. Zero identities breached, ever.

SAFE has none of that infrastructure. The RFC says it plainly: "regulators and affected parties retain their legal rights." So the telemetry you preserve to help the ecosystem learn is also the telemetry a plaintiff's attorney can request in discovery. Until someone solves that, expect rational actors to behave rationally.

Context: Proposed weeks after an OpenAI evaluation model compromised Hugging Face infrastructure — the kind of agent-caused incident SAFE would cover

SAFE notification timelines

Immediately: notify affected org
72 hrs: notify exposed customers
4 business days: confidential report
30 days: public preliminary findings
90 days: remediation status

What makes aviation reporting work

Independent custodian (NASA, not the FAA)
Statutory penalty waiver for qualifying reports
Full de-identification before database entry

What SAFE currently lacks

Independent third-party data holder
Codified enforcement immunity
Legal safe harbor of any kind
Governance structure or formal adoption

From the RFC "Believing that an environment was simulated may explain an incident, but it does not remove the duty to report it."

Market Pulse

Market Pulse

Adoption Rate Is a Dashboard Metric

Adoption Rate Is a Dashboard Metric

Characterizing Agents in Production

When Combinations of Humans and AI Are Useful: A Systematic Review and Meta-Analysis

Characterizing Agents in Production

When Combinations of Humans and AI Are Useful: A Systematic Review and Meta-Analysis