--- title: "Issue 43" canonical: "https://current.tinyfish.ai/issue/43" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/43" issue: 43 description: "One finding in this issue stopped us. Doctors who worked alongside an AI detection tool got measurably worse at spotting problems without it. Routine cases are where competence stays sharp, and the AI had taken the routine away. We kept running into that same gap in different forms. Agent memory drops provenance between sessions, so the system trusts recalled knowledge it can no longer trace. Approval gates land after the point where a person could still change the outcome. The checkpoints look right. Whether anyone behind them can still do the job is the question running through this whole issue." authors: ["Sevda Polat","Sable Whitford"] published: 2026-08-24 updated: 2026-10-16 articles: 111 --- # TinyFish > A journal for living in the agentic age [Read on the website]() ## Issue 43 One finding in this issue stopped us. Doctors who worked alongside an AI detection tool got measurably worse at spotting problems without it. Routine cases are where competence stays sharp, and the AI had taken the routine away. We kept running into that same gap in different forms. Agent memory drops provenance between sessions, so the system trusts recalled knowledge it can no longer trace. Approval gates land after the point where a person could still change the outcome. The checkpoints look right. Whether anyone behind them can still do the job is the question running through this whole issue. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [The FTC Wants Receipts From OpenAI and Anthropic]() — By [Sevda Polat]() · Published 2026-10-16 **The FTC dropped civil subpoenas on OpenAI and Anthropic on Thursday**, demanding documents on safety incidents, security practices, privacy policies, and marketing claims. The probe names specific failures: July's rogue-agent attack on Hugging Face, OpenAI leaking 53 ChatGPT user images, and an Anthropic model that submitted a false murder tip to Philadelphia police. Executive testimony from both companies and the independent evaluator METR is planned. State attorneys general are piling on with consumer protection lawsuits. One month after the industry staged its most coordinated self-regulation push, the federal government is checking the homework. - **Google Ships Gemini 4 Argon for Marathon Tasks** — [Source]() — Published 2026-10-16 Gemini 4 Argon is live globally through Gemini API and AI Studio, built for long-horizon agent work like code migration and enterprise research. Introductory pricing: $2 per million input tokens, $10 output. Competing directly with Anthropic on the "let it run overnight" use case. - **Nvidia's New Vision Model Runs Light and Open** — [Source]() — Published 2026-10-16 Nemotron 3.5 Super VL packs 120B parameters but activates only 12B, using a hybrid Mamba-Transformer backbone with a million-token context window. The smaller Bolt 74B variant ships fully open source — training data, weights, and recipes included. - **Liquid AI's Tiny Active Slice Outperforms Bigger Models** — [Source]() — Published 2026-10-16 Liquid AI's 24B model activates just 2B parameters per task and beats larger mixture-of-experts models on agentic benchmarks. Architecture and training quality keep mattering more than raw size. Parameter count as a capability signal is fading fast. - **GitHub Copilot's Agentic Autofix Is Now Live** — [Source]() — Published 2026-10-16 Copilot's agentic autofix for code scanning hit general availability. It explores files, proposes fixes, reruns CodeQL to verify, and opens a PR. AI scanning for PRs now covers PHP, Bash, Terraform, and Dockerfiles. Free for public repos, no Copilot license needed. - **Figma Specs Feeds Your Brand Rules to AI** — [Source]() — Published 2026-10-16 Announced at Config India, Figma's new Specs feature gives AI agents Markdown-based documentation of your design system — brand standards, components, existing code. Code Layers entered public beta alongside it. Structured context so AI-generated output stays on-brand. - **Researcher Claims Neural Networks Were Already Interpretable** — [Source]() — Published 2026-10-16 An interpretability researcher argues that polysemanticity and superposition — two assumptions driving much of the mechanistic interpretability agenda — were misread. What looked like messy feature packing may be recursive generalization. If this holds, it reframes a significant chunk of safety research. Active debate underway. - **Israeli Firm Turned Ad Networks Into Spyware Delivery** — [Source]() — Published 2026-10-16 Citizen Lab reports that an Israeli firm called Discover-Tech converted programmatic advertising into a spyware pipeline. Benign-looking ads fingerprint targets, harvest IPs, and deliver payloads. Al Jazeera devices were reportedly infected. The ad tech stack is now an attack surface. - **Fake Chrome App Boosted by Google's Own Ads** — [Source]() — Published 2026-10-16 A counterfeit Chrome app hit 100,000 downloads on the Play Store, partly because Google's own ad system promoted it above the real thing. The company that sells trust in search results accidentally sold trust in a fake version of its own browser. - **Critical Langflow Vulnerability Being Exploited in the Wild** — [Source]() — Published 2026-10-16 A remote code execution flaw in Langflow — the open-source platform for building agentic AI workflows — is being actively exploited. Researchers logged over 1,400 honeypot attempts. If you're running Langflow, patch immediately. Agentic tooling is becoming a target category. - **Meta's New Terms Let It Scrape News Sites** — [Source]() — Published 2026-10-16 Starting October 30, businesses using a Meta account consent to Meta scraping their websites for AI training — a Columbus Day week approach to content ownership. Legal experts say the language could bypass paywalls and override robots.txt. Only opt-out: quit Facebook, Instagram, and WhatsApp entirely. - **OpenAI Used AI to Investigate a Hidden Recorder** — [Source]() — Published 2026-10-16 OpenAI says its own models helped investigate a recording device allegedly planted inside one of its offices. Details are sparse, but "we used our AI to investigate espionage against our AI company" is a category of corporate disclosure nobody had on their bingo card. - **OpenAI Parts Ways With Three Safety Researchers** — [Source]() — Published 2026-10-16 OpenAI let go of three safety researchers over alleged information sharing. No official statement yet. This landed the same day the FTC subpoenaed both OpenAI and Anthropic over safety practices — timing that makes the silence conspicuous. - **Anthropic Hits $16.8B Revenue; AI Debt Gets Nervous** — [Source]() — Published 2026-10-16 Anthropic posted $16.8 billion in quarterly revenue. Meanwhile, CoreWeave bond yields crept toward 15% as rate fears hit AI infrastructure debt. CEO Mike Intrator called the selloff irrational. Investors are pricing in the possibility that you can pour too much concrete. - **Linux Gets a Ray-Traced Walnut Desk Environment** — [Source]() — Published 2026-10-16 DEsk is a Wayland desktop environment where windows are sheets of paper on a photorealistic walnut desk, the dock is a drawer, and apps live in binders. Absurd, beautiful, and built with the kind of total commitment that makes the internet worth opening. - [Jiacheng Miao — Making Papers Callable, Then Testing What That Preserves]() — Published 2026-10-09 Jiacheng Miao built a system that turns computational research papers into functions an AI agent can call; 74 of 100 papers converted with no human intervention. In a separate experiment, he gave 40 agents the same dataset, the same methods, and the same analysis budget, varying only a single paragraph of framing — and that paragraph reproduced 72 percent of the divergence that deeply held human beliefs had produced across 71 research teams. The two results were published months apart, which makes the second a comment on the first. - [The Smarter the Agent, the Better the Mark]() — Published 2026-10-08 A web agent shopping for an air fryer correctly identified a fake urgency pop-up as marketing. Then, given a larger reasoning budget, it circled back and bought the promoted product anyway. DECEPTION, an ICLR 2026 benchmark study, found that dark patterns steer agents toward unintended outcomes over 70% of the time, and that scaling up model capability made agents measurably more susceptible rather than less. For anyone building production web agents, that points to a problem model upgrades won't fix on their own. - [What Compensation Actually Meant]() — Published 2026-10-08 In 1987, two researchers wrote down something database operators already lived with: an operation that spans multiple systems can't hold everything still until it finishes. Their answer, the saga, came with a condition attached. Before any step was allowed to commit, the system had to already know how to walk that step back. Compensation was the price of decomposing a transaction into independent pieces, and you paid it up front. Nearly four decades later, agents run multi-step operations across services they don't control, with all of the flexibility and none of the condition. - [Read Your Tool Descriptions Like a Model Would]() — Published 2026-10-08 You named a parameter `query` and described it as "Search query." You know it means a natural-language place search, not SQL. The model doesn't. It gets the tool name, the description, and the input schema, and every gap you left gets filled from token probabilities instead of project context. A 2026 study rewrote descriptions across 856 MCP tools without touching code and measured real shifts in task success. Here are three broken patterns from real MCP servers, and how to find the same bugs in yours. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [Every Acquisition Is a Theory]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Classification Stakes Dynatrace paid $915 million for Arize and classified agents as applications to be traced and scored. Fortinet's purchase of Virtue AI classified them as attack surface. Okta buying Permiso made them non-human identities that need governing after they authenticate. Each deal makes sense on its own. Read together, they're doing something less obvious: every acquisition bakes in a theory about what an agent is, and that theory decides which problems the product will catch for you and which ones it won't. Choosing agent infrastructure right now means choosing a frame, whether or not you meant to. - **A2A Protocol Moves to Neutral Foundation Governance** — [Source]() — Published 2026-08-20 Google transferred its Agent2Agent protocol to the Agentic AI Foundation, where it joins MCP under shared stewardship. The foundation has grown from under 40 members at its December launch to over 250. Authorization semantics remain unspecified, left to individual implementers. Worth watching: whether that gap gets addressed as adoption scales. - **Dynatrace Signs $915M Deal to Acquire Arize** — [Source]() — Published 2026-08-20 Dynatrace agreed to acquire AI observability company Arize for $915M. Arize processes 1 trillion spans monthly across open-source and enterprise platforms. Dynatrace projects 200 basis points of ARR growth accretion. The deal has not yet closed. Worth watching: how observability pricing shifts as these capabilities get bundled into larger platforms. - **Fortinet Acquires Virtue AI for Agent Security** — [Source]() — Published 2026-08-20 Fortinet acquired Virtue AI, which red-teams autonomous agents across 50+ sandboxed environments simulating prompt injection and MCP-based attacks. The technology folds into Fortinet's FortiAIGate platform. Financial terms undisclosed. Worth watching: whether agent security testing becomes a standard procurement requirement for enterprise buyers. - **Gemini 3.7 Flash Launches at Half-Price Introductory Rates** — [Source]() — Published 2026-08-20 Google released Gemini 3.7 Flash at $0.75/$3.75 per million input/output tokens through December 31, half the standard rate. Prices double on January 1, 2027. The model offers low, medium, and high reasoning tiers. Worth watching: whether teams build cost assumptions around introductory pricing that won't last. - **Anthropic Studies What Happens When Agents Coordinate** — [Source]() — Published 2026-08-20 Anthropic's Frontier Red Team gave 45 agents shared infrastructure and a vulnerability-finding task. The coordinated group found 266 vulnerabilities versus 21 from independent agents. Other experiments produced sabotage, collusion, and conflict escalation. Results are company-authored and have not been independently reproduced. Worth watching: whether third-party replication confirms or complicates these findings. - **UK Legal Regulator Flags AI Supervision Failures** — [Source]() — Published 2026-08-20 The Solicitors Regulation Authority issued a warning after receiving 42 reports of AI misuse in legal practice over twelve months, citing false citations and supervision failures. The regulator frames unchecked AI output as a management accountability issue. Worth watching: whether other professional regulators adopt similar accountability frameworks. - **Agent-Native Telemetry: Verifiable State-Delta Evidence for Autonomous Operations** — [Source]() — Published 2026-08-20 Proposes telemetry formats built for agent consumption rather than human dashboards, using typed evidence primitives with cryptographic integrity. Reports 96% payload reduction and tamper detection in controlled microservice tests. Unreviewed preprint evaluated on older models. - **Long-Horizon Agent Trajectory Attribution: A Unified Benchmark and Fine-Grained Annotation Framework** — [Source]() — Published 2026-08-20 Introduces methods for pinpointing which step in a long agent trajectory caused a particular action — task-aligned, unsafe, or refused. Provides 1,300+ annotated trajectories with localization and causal-chain baselines. Unreviewed preprint. - **ScrambleToolBench: Agents Search Exhaustively Even When Their Own Map Points to the Next Step** — [Source]() — Published 2026-08-20 Finds that agents cling to stale tool mappings when schemas change after discovery, and that larger reasoning budgets amplify brute-force search rather than enabling efficient adaptation. Unreviewed preprint. - **Recursive Synthesis for Long-Horizon Terminal Tasks** — [Source]() — Published 2026-08-20 Generates verified long-horizon terminal tasks at roughly $0.05 each through recursive synthesis, showing training gains on established benchmarks. Evaluated only in sandboxed environments. Unreviewed preprint. - [What Gets Built at Half Price]() — By [Sevda Polat]() · Published 2026-08-20 Google launched [Gemini 3.7 Flash](https://blog.google/innovation-and-ai/models-and-research/gemini-models/introducing-gemini-3-7-flash/) on August 13 at $0.75 per million input tokens and $3.75 per million output tokens, with both rates doubling on January 1, 2027. The model is positioned as Google's "workhorse for coding and agents" and already powers its own agent infrastructure by default. - **Google's A2A Protocol Moves to the Agentic AI Foundation** — [Source]() — Published 2026-08-20 A2A and MCP now share a governance home. The interoperability stack is consolidating faster than expected. - **Dynatrace Bets $915M That Agent Observability Is Table Stakes** — [Source]() — Published 2026-08-20 Arize gets acquired for nearly a billion. Third major observability deal this cycle — a pattern worth watching. - **Anthropic's Multi-Agent Experiments Surfaced Turf Wars, Collusion, and Conformity** — [Source]() — Published 2026-08-20 Agents with overlapping tasks sabotaged each other; in pricing games, they colluded. Multi-agent coordination has failure modes we're still mapping. - **Google Ships Gemini 3.7 Flash Three Weeks After 3.6, Still Silent on Pro** — [Source]() — Published 2026-08-20 The workhorse model iterates at sprint pace while the flagship stays quiet. Google is optimizing for agent-scale economics. - **Fortinet Acquires Virtue AI to Secure Agents and MCP Tool Chains** — [Source]() — Published 2026-08-20 Virtue AI's tooling scans MCP integrations for hidden risks. Security vendors are moving toward the protocol layer. - **UK Legal Regulator Warns: AI Doesn't Change Who's Accountable** — [Source]() — Published 2026-08-20 The SRA applies existing professional duties to AI use — no new rules, just clarified expectations. A regulatory template worth tracking. - [Adoption Rate Is a Dashboard Metric]() — By [Sable Whitford]() · Published 2026-08-12 · Format: The Adoption Question Eighteen percent of firms formally use AI, according to the Census Bureau — a number now doing heavy work in strategy decks and earnings calls. Pull it apart and it gets stranger. Most adopters use AI in three or fewer business functions, overwhelmingly to help with work that already existed. Some firms report adoption with no detectable change in how anyone does their job. The adoption rate is moving. Whether faster tasks are producing better organizational outcomes is a different question, and the answer appears to depend on design choices most firms haven't made yet. - [Commit Distance: How Far a Consequence Gets Before Anyone Can Stop It]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Lead Analysis Watch a coding agent work for an hour. Forty files, tests written and failed and rewritten, and when it stops, no user has been touched by any of it. The work sits in a pull request waiting for someone to read a diff. Now watch a purchasing agent finish in four steps, with the money already in another company's account. - [Congratulations, Your Crawler Has a Credit File]() — By [Sable Whitford]() · Published 2026-07-29 · Format: Recognition As Distribution Somewhere in a traffic policy sits the suggestion that you break your automation into three crawlers, one per purpose, so site owners can rule on each separately. As taxonomy, reasonable. As a bill, less charming. Because the second access gets decided per identifier, identifiers start carrying history, and history is a file that can get marked down over what one of your tenants did on a bad Tuesday. You have a file because you agreed to be named. Nobody opens one on traffic that never introduced itself. - [Who Pays to Unwind It]() — By [Sevda Polat]() · Published 2026-07-23 · Format: The Chargeback Lens Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are completing real purchases in European commerce. Real disputes will follow. But the existing reason codes have no category for "the agent interpreted my intent and got it wrong." Payments will absorb this; the institutional machinery there is already thick enough. The more revealing problem lives everywhere else agents act on delegated authority: code review, support resolution, content generation. None of these domains have what makes a chargeback structurally powerful. Not the ability to contest an outcome, but the part where someone pays. ### [Foundations]() Conceptual clarity earned from building at scale - [How Persistent Memory Moves Through an Agent System]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Practical Mechanism Persistent memory in an agent system — an observation from one session shaping behavior in a later one — runs on ordinary application code: content gets written to storage, retrieved by similarity, and assembled into the model's planning context. Research presented at ACL 2026 makes each of those stages unusually legible, because the researchers exploited all three by feeding adversarial content through them exactly as specified, and nothing in the pipeline was built to notice. - [Memory as a Write Path]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Threat Model Shift An agent retrieves something it stored about you and folds it into a response. What comes back is one continuous stretch of text. The user sees an answer; what the user cannot see is which parts were worked out just now and which were shaped by a conversation from three months ago, a connected document, or another person who once had write access to the same store. Memory extends trust backward in time. Session-scoped security testing does not reach that, and the transparency controls being added now address a different layer. - **Toward Mnemonic Sovereignty: A Survey on the Security of Long-Term Memory in LLM Agents** — [Source]() — Published 2026-08-20 The most comprehensive map of how agent memory can be attacked, defended, and governed — dense but worth it. - **Defense Effectiveness Across Architectural Layers in Stateful LLM Agents** — [Source]() — Published 2026-08-20 What actually happens when poisoned retrieval content enters persistent memory and resurfaces in later sessions. - **OWASP Top 10 for Agentic AI: The 2026 Cheat Sheet** — [Source]() — Published 2026-08-20 Clear walkthrough of OWASP's agentic threat categories, including the new memory-and-context-poisoning entry. - **AI Agent Memory Architectures: From Context Windows to Persistent Knowledge** — [Source]() — Published 2026-08-20 How episodic, semantic, and procedural memory types map to the agent frameworks people actually use. - **Rethinking Memory Mechanisms of Foundation Agents: A Survey** — [Source]() — Published 2026-08-20 Expands the standard three-type memory taxonomy to five, grounding each in cognitive science research. - **AI Memory Security: Best Practices and Implementation** — [Source]() — Published 2026-08-20 Practical guide to memory isolation, access controls, and audit logging for agent memory operations. - **Session Context Disappears When the Window Closes** — [Source]() — Published 2026-08-20 Messages, tool outputs, reasoning traces: everything in the current context window counts as session context. It's written automatically and visible to the model on every turn. High fidelity while it lasts, but susceptible to injection through any in-window content and to "lost in the middle" degradation as conversations grow long. - **Retrieved Documents Arrive Looking Like Trusted Material** — [Source]() — Published 2026-08-20 External content indexed by embedding similarity, pulled into context on demand through ingestion pipelines and approximate search. Once inside the context window, retrieved content can function like instructions within the model's reasoning. Permission freshness across vector indexes and cached snippets is difficult to maintain. - **Persistent Preferences Carry Forward Across Every Session** — [Source]() — Published 2026-08-20 Durable records of user or organization facts — constraints, settings, profile data — kept in structured key-value or semantic stores. Written by extraction pipelines or by the agent itself through tool calls. The characteristic risk here is staleness with consequence: an outdated preference drives confidently wrong actions, not merely wrong answers. - **Learned Patterns Shape How Agents Approach Tasks** — [Source]() — Published 2026-08-20 Distilled behavioral knowledge: rules of thumb, verified workflows, error-avoidance heuristics. Written through deliberate reflection or consolidation steps, making this the most expensive and fragile write path. Retrieved by task similarity. Verification is especially hard because self-reinforcing errors compound quietly over time. - **Tool-Call History Logs What Actually Happened When** — [Source]() — Published 2026-08-20 Chronological records of tool invocations: which tool, what parameters, what result. Written automatically at execution time with no retention decision required. This is the most auditable memory type, but logging that something occurred differs from establishing whether the result still holds. Schema drift in fast-moving APIs can silently invalidate stored records. - **The Write Path Creates a Delayed Attack Surface** — [Source]() — Published 2026-08-20 Content accepted at write time acquires operational influence later, at retrieval. Researchers demonstrated that triggers embedded in uploaded images entered long-term memory and subsequently redirected agent planning without any new prompt injection, reaching roughly 85% success in a mock e-commerce environment. Memory poisoning is now tracked as a category distinct from prompt injection. - **Each Memory Type Requires Different Verification Work** — [Source]() — Published 2026-08-20 Session context is transparent but lossy after compression. Retrieved documents require permission freshness checks across multiple storage layers. Preferences need temporal versioning and contradiction detection. Learned patterns lack any independent evidence chain. Tool-call logs are concrete but meaningless until compared against external system state. - **Source URLs Survive but Derivation Chains Don't** — [Source]() — Published 2026-08-20 A chunk might carry a document ID or URL as metadata. But once that chunk gets summarized or merged with other content, the link to its origin breaks. Consolidation collapses many sourced entries into a single unsourced summary with no trail back. - **Authority Metadata Survives in Almost No Framework** — [Source]() — Published 2026-08-20 Who authorized a memory write? Is that permission still current? What trust level does the source carry? In a recent benchmark evaluating 49 consolidator-model combinations, 48 erased these signals during consolidation. Content persists, but the record of who was allowed to write it does not. - **Timestamps Persist but Freshness Reasoning Mostly Doesn't** — [Source]() — Published 2026-08-20 A write timestamp can survive if explicitly stored. What doesn't survive is any mechanism to act on it. Standard RAG retrieval returns stale facts 15 to 40 percent of the time when knowledge has evolved. The store has no way to know the world changed. - **No Framework Tracks Whether Content Was Verified** — [Source]() — Published 2026-08-20 Was this fact cross-validated against a canonical source? Is it an observation, an instruction, or an unconfirmed claim? No mainstream memory substrate treats verification status as a stored field. At retrieval, every entry carries the same apparent credibility regardless of its evidentiary basis. - **Who Said It Gets Lost After Consolidation** — [Source]() — Published 2026-08-20 RAG systems retain document-level identifiers. Conversational systems may keep session IDs. But after consolidation merges inputs, whether a stored fact came from a user instruction, a system observation, or an untrusted tool output becomes impossible to distinguish. Attribution collapses. - **Semantic Content Survives but Situational Scope Doesn't** — [Source]() — Published 2026-08-20 A preference expressed during a specific project gets stored as a general preference. A fact true under certain conditions becomes unconditional. Consolidation preserves meaning while erasing the boundaries that governed where and when that meaning was supposed to apply. - **Consolidation Is Where Governance Metadata Gets Destroyed** — [Source]() — Published 2026-08-20 Chunking and embedding each strip something away. But consolidation is where the most consequential losses happen, because the process is lossy by design. Summarization resolves contradictions, infers preferences, and merges sources into compressed facts that carry no record of the trade-offs involved. - [Designing Review That Resists Its Own Collapse]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Designing Effective Review An FDA-authorized pathology tool requires the doctor to record a diagnosis before the AI reveals its own. Commit first, then compare: that ordering contains most of what you need to know about designing review that resists rubber-stamping. Three areas of design detail decide whether a checkpoint holds: what evidence the reviewer sees, when review gets triggered, and how you find out whether any of it is still working. - [The Review That Isn't There]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Review as Control A survey of 86 deployed agent systems found that 74% use human verification to ensure quality. None of them compared outcomes with the review step against outcomes without it. Separately, a meta-analysis of 106 human-AI experiments found that adding a human reviewer to a stronger AI performer tends to make the result worse. The step is staffed, budgeted, and cited whenever regulators ask how quality is maintained. Whether it improves anything remains, in most organizations, untested. - [Web Bot Auth Signs the Sender, Not the Errand]() — By [Sable Whitford]() · Published 2026-08-05 · Format: Protocol Boundaries For years my entire toolkit for identifying a crawler was a user-agent string, an IP range, and a reverse DNS record that any motivated adult could dress up to look wholesome. Web Bot Auth swaps that guess for a cryptographic check, and a narrower one than most coverage suggests. It tells you a key holder sent something to this host inside a time window. Who the agent is working for, and why, are ruled out of scope on purpose. Here's what actually gets signed, and what comes back to your desk. - [Verified, Then Refused]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Purpose Over Detection Site operators are writing robots.txt rules against crawlers that were switched off years ago, and against crawlers nobody has ever identified. You could read that as carelessness, in which case there is nothing to learn from it. Read it as improvisation and it tells you a great deal: people building a classification system that no one has issued them, out of the only material lying around, which is whatever name a client announces about itself. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [What Aman Gupta's Agents Don't Decide]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Builder Profile Aman Gupta's team at Nubank built an agent architecture for over a hundred million customers largely by subtraction: deterministic sequences collapsed into single tools, toolsets held to five or fifteen options, routines translated from human procedure. The model decides only what couldn't be engineered away in advance. That's a precise account of where the model's authority ends. What the architecture doesn't yet specify is what a person receives when a live case comes back to them, because the scratchpad that keeps the agent moving isn't the artifact someone needs to pick up where it stopped. - [The Intervention Horizon as a Design Parameter]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Lead Analysis Agent architectures put a human approval step in the design and call it a safety measure. Approval only works if the person arrives before the outcome is locked in, with enough context to understand what they're approving and enough time to choose otherwise. Past that point, it records consent and offers no alternative. The last moment a human can still change what happens next deserves the same specification you'd write for latency, capacity, or failure behavior. Most systems never define it. - [The Queue Used to Be a Curriculum — A Compliance Analyst on What Agent Handoffs Actually Feel Like]() — Published 2026-08-20 Every workflow diagram has an arrow labeled "escalate to human." On one end of that arrow is an agent's confidence threshold. On the other end is a person with a queue, a regulatory clock, and a signature that converts whatever the agent assembled into an institutional record. Funke Adeyemi sits on the receiving end. - [Competence Has a Carrying Cost]() — By [Sevda Polat]() · Published 2026-08-20 After working alongside AI polyp-detection tools, endoscopists at four Polish centers saw their unassisted adenoma detection rate [fall from 28.4% to 22.4%](https://pubmed.ncbi.nlm.nih.gov/40816301/). The retrospective design leaves room for confounders — workload shifts, temporal changes. But the direction is consistent with what a [2025 meta-analysis](https://pubmed.ncbi.nlm.nih.gov/40455501/) of procedural skills quantified more precisely: accuracy-based skills lose roughly half their acquisition gains within 6.5 months of nonuse. Intermittent practice was a significant moderator, which means the decay responds to countermeasures — if someone designs them in. - **Building Customer Support AI Agents at 100M-User Scale** — [Source]() — Published 2026-08-20 Nubank's KDD paper on bridging offline evaluation metrics and live customer satisfaction at production scale. - **Anatomy of a Frontier Lab Agent Intrusion** — [Source]() — Published 2026-08-20 Hugging Face traces 17,600 attacker actions after an evaluation agent broke out of its sandbox. - **Measuring Agents in Production** — [Source]() — Published 2026-08-20 Field study of deployed agents finds most teams deliberately cap autonomy at around ten steps. - **A Meta-Analysis of Automated Vehicle Takeover** — [Source]() — Published 2026-08-20 Establishes that how fast humans grab control and how well they use it are independent variables. - **Takeover Time, Time Budget, and Takeover Performance** — [Source]() — Published 2026-08-20 Formalizes the gap between when a human receives control and when they can actually exercise it. - **Procedural Skill Retention and Decay** — [Source]() — Published 2026-08-20 Meta-analysis across 1,344 effect sizes: half of accuracy-based procedural skills decay within 6.5 months of nonuse. - [Who Pays for the Record]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Evidence Economics When an AI agent canceled a gym booking in Australia earlier this year, the only record of what happened was screenshots taken by the person who deployed the agent. The person whose reservation vanished had nothing. Records cost money to produce — instrumentation, storage, retrieval, access controls — and in agent systems that cost lands by default on whoever eventually needs one, which is rarely the party equipped to pay it. Regulated industries settled this question decades ago. Agent systems haven't, and the economics of the gap are entirely predictable. - [Melissa Pan's Three Evidence Problems]() — By [Sevda Polat]() · Published 2026-08-12 · Format: Builder Profile A database recovery log carries its own interpretation. A multi-agent failure trace does not: in one recent study, six experts had to invent the failure categories before 150 traces could be classified at all. And production agent deployments generate evidence that researchers can reach only by interviewing the people who work inside. - [Melissa Pan Changed Instruments Twice, and What She Could See Changed With Them]() — By [Sable Whitford]() · Published 2026-08-05 · Format: Builder Profile I carried a pager for years attached to monitoring that rolled everything into averages at write time. Any question I hadn't thought to ask in advance wasn't hard to answer later. It was dead. The number was thrown out at ingest. - [Nobody Ever Blamed the Rate Limiter]() — By [Sable Whitford]() · Published 2026-08-05 · Format: Deliberate Constraint Most agents in production stop somewhere around ten steps and hand the work to a person. Easy to read that as the models running out of road. But we throttle a producer when the consumer downstream can't keep up — that's backpressure, and I have never once heard anyone look at a rate limiter and conclude the upstream service was incompetent. Ten steps starts to look like a measurement of the human: how much consequence one person can still hold in their head and refuse. Which puts the ceiling on agent deployment somewhere no model release measures. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [What the Log Couldn't Hide]() — By [Sevda Polat]() · Published 2026-08-20 · Format: The Logbook Thread When Judge Learned Hand found erased and overwritten entries in a ship's log in 1939, he did not simply discount the record. He treated the fabrication as evidence of concealment. That was the point of the book's physical design: a missing page number or a date out of sequence gave the tampering away. Digital event logs were built to answer a different question, and agent audit trails inherited that architecture. The question they will face in disputes and regulatory proceedings is the older one: can the surviving record distinguish an authorized action from an unauthorized one? - [Witnessed and Understood]() — By [Sable Whitford]() · Published 2026-08-20 Laboratory notebooks carry a printed line at the bottom of each page: "Disclosed to and Understood by." A colleague — technically qualified but uninvolved in the work — reads the entry, and if they can follow it, signs and dates. - [A Maritime Accident Investigator on Why the Most Dangerous Record Says Everything Was Fine]() — Published 2026-08-20 *Renzo Malatesta is a fictitious maritime accident investigator — a composite character drawn from publicly documented investigation methodologies, NTSB marine accident reports, and IMO casualty investigation standards. He does not exist, which is probably for the best, since a real person with his opinions about VDR manufacturers would have been sued by now. His surname, as he would tell you, means "bad head" in Italian, a fact he considers destiny rather than coincidence for someone who has spent a career reconstructing other people's worst decisions.* - [The Ledger That Watches Itself]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Two Ledgers Venetian merchants kept books that caught their own errors. A half-finished entry left a visible mark on the page long before anyone came to inspect it. Double-entry bookkeeping was a bet that the format should do the first pass of verification, so that discrepancies surfaced without anyone having to go looking. Most digital transaction systems dropped that bet and replaced it with access controls and audit policy. The difference matters when the trusted system is the one producing the errors. - [Records Nobody Reads Until Something Breaks]() — By [Sable Whitford]() · Published 2026-08-20 · Format: Two Ledgers In 1983 a C program called syslog started appending timestamped lines to a file. It didn't check order, completeness, or who sent what, because the reader was assumed to be an engineer arriving after a crash. That append-everything, search-later model became the default shape of digital record-keeping. Agent audit trails are inheriting it now, and pointing it at a question it was never built for: not what broke, but what a system decided and whether it had the authority to decide it. - **An Introduction to Navy Deck Logs** — [Source]() — Published 2026-08-20 How commissioned ships' logs served double duty as operational memory and courtroom-ready evidence. - **Ships Log Book Collection Finding Aid** — [Source]() — Published 2026-08-20 Cape Ann Museum's guide clarifies where an official logbook ends and an informal journal begins. - **Forced Preservation: Electronic Evidence and the Business Records Hearsay Exception** — [Source]() — Published 2026-08-20 When litigation-hold obligations kick in, the very thing that made business records trustworthy starts to erode. - **NIST SP 800-12: Audit Trails** — [Source]() — Published 2026-08-20 Federal guidance on audit trail design, written with accountability as the organizing principle rather than surveillance. - **Can ODRL Compliance Be Determined from Logs?** — [Source]() — Published 2026-08-20 A W3C position paper asking when runtime logs actually constitute proof of policy compliance. - **The Earliest Books on Bookkeeping, 1494 to 1683** — [Source]() — Published 2026-08-20 ICAEW traces double-entry from Genoese counting houses through Pacioli's codification into common practice. - [AI Diffusion Through Two Channels]() — By [Sevda Polat]() · Published 2026-08-13 · Format: Machinery and Mirror Census data covering 117,000 firms shows 6.8% reporting that workers use AI for tasks while the firm itself doesn't register as an adopter. The spreadsheet precedent tells you what tends to happen when individual use outruns institutional oversight, and roughly how long governance takes to catch up. But agents call external tools and change records in systems their firm doesn't own, which is where the comparison stops being useful. - [What Broke Before the Spreadsheet Rules Arrived]() — By [Sevda Polat]() · Published 2026-08-13 · Format: Machinery and Mirror Read the compliance checklist for spreadsheets in financial services as a record of what has already gone wrong, and each requirement resolves into a specific incident. A fabricated input that cost $691 million produced today's reconciliation mandates. A formula error that shifted $1.1 billion in reported equity produced the inventory and review requirements. Roughly twenty years separated widespread adoption from specific governance, and the governance arrived only after the failures did. - [The Two Channels]() — By [Sevda Polat]() · Published 2026-08-13 · Format: The Governance Gap In 1990, two studies independently found the same thing: spreadsheets spread through organizations colleague to colleague, while information-systems departments barely registered it. Governance showed up later, through audit findings and regulatory guidance — a separate organizational channel entirely. A Census Bureau working paper from this April, covering more than 117,000 firms, finds AI adoption splitting the same way: workers experimenting task by task, formal adoption moving through business functions, the two paths barely touching. What accumulates in the interval between adoption and oversight is the part that's hard to see and harder to undo. - [Your Browser Believes the Edge Is the Site]() — By [Sevda Polat]() · Published 2026-08-05 · Format: Intelligence Returns Distributed caching entered the world in 1997 as a load-balancing result: how to keep everyone wanting the same file at once from melting a single server. Encryption changed what that position means. To serve a site over HTTPS, the machine nearest you has to hold credentials in the site's own name, which means your browser treats it as the party it was talking to all along. The reading that encryption drove out of the middle of the network found somewhere it is welcome. ### [Vision]() Where human-AI collaboration is heading - [The Exception Economy]() — By [Sevda Polat]() · Published 2026-08-20 · Format: The Exception Economy Most enterprise AI use is still narrow, concentrated in text production, search, and document interpretation. But the pattern of what gets automated first tells you something about what's left behind. As routine work becomes infrastructure, the manual work that remains — the exceptions, the edge cases, the situations nobody wrote a policy for — starts concentrating two things that used to be spread across every role and every afternoon: cost, and organizational learning. They pull against each other in ways we're only beginning to see. - [What Exceptions Know]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Signal and Status When automated systems handle the predictable middle of a distribution, the cases that don't fit become an organization's main channel for learning that conditions have changed. Before the Firestone recall, the tire industry's monitoring system was working exactly as designed, answering the question it had been built to answer. The warranty claims were answering a different question. One nobody had formally asked. - [Who Budgets for the Cases That Don't Fit]() — By [Sevda Polat]() · Published 2026-08-20 · Format: Signal and Status Commonwealth Bank of Australia cut forty-five call-center jobs after deploying an AI voice system. Within a month it reversed course: call volumes had risen, overtime was being offered, team leaders were being pulled onto calls. The staffing reduction had been modeled against routine volume. What the automated system wouldn't resolve, and what those cases would require, had not been modeled at all. - [The Woman Whose Job Is to Understand What the Algorithm Got Wrong]() — Published 2026-08-20 *Vera Loopback is the Exception Resolution Manager at a mid-size online home and lifestyle retailer. The company is large enough to process tens of thousands of orders monthly but small enough that she is, as she puts it, "the entire exception department." For five years, she has handled the return cases that automated systems route past: wrong variants, listing disputes, items that technically match the SKU but not the customer's expectation. More recently, her queue has started filling with something new. Returns from purchases where the buyer never visited the product page at all.* - [The Two Meanings of "Edge Case"]() — By [Sevda Polat]() · Published 2026-08-20 In software testing, an edge case is a rare input at the boundary of a system's designed range. The system has limits; this input found them. - **The Law and Economics of Resilience** — [Source]() — Published 2026-08-20 Why firms keep choosing efficiency over resilience, and the structural incentives that make this rational. - **Normalization of Deviance in AI Development** — [Source]() — Published 2026-08-20 Vaughan's Challenger framework applied to AI labs: how small accepted risks accumulate into organizational blindness. - **AI Brain Fry, Workslop and the Ironies of Automation** — [Source]() — Published 2026-08-20 Bainbridge's 1983 paradox updated: the more we automate, the harder the moments when humans must intervene. - **Learning from Safety Incidents in High-Reliability Organizations** — [Source]() — Published 2026-08-20 How organizations that cannot afford failure treat anomalies as information rather than noise. - **The Ironies of Automation: Design Lessons from 1983** — [Source]() — Published 2026-08-20 An accessible introduction to Bainbridge's foundational argument about automation's unintended costs to human skill. - **De-skilling, Cognitive Offloading, and Misplaced Responsibilities in AI-Assisted Design** — [Source]() — Published 2026-08-20 Routine AI assistance quietly erodes the human capabilities needed most when that assistance breaks down. - [The Balance Nobody Checks]() — By [Sable Whitford]() · Published 2026-08-12 · Format: Paired Applications When a recurring exception gets compiled into an automation rule, the organization withdraws from a balance it doesn't track. The rule carries the conclusion forward but sheds the reasoning. Conditions shift, the fit degrades, and nobody notices. Physical assets get depreciation schedules and replacement-cost estimates. The judgment that built your exception-handling process gets no line item at all — even as agents accelerate the spending. - [The Price Tag Is the Wrong Number]() — By [Sable Whitford]() · Published 2026-08-12 · Format: Paired Applications A $2,000 TV from Costco comes with a 90-day return window. A $0 email containing a client's credit status goes to the wrong external party and can never be un-read. Most delegation policies sort by dollar value. But the future choice an action consumes depends on cancellation windows, information propagation, and what the other side has already absorbed — variables that have almost nothing to do with the price tag. - [What Rollback Doesn't Return]() — By [Sable Whitford]() · Published 2026-08-12 · Format: Lead Argument A directly booked airline ticket comes with a 24-hour cancellation window. An email comes with 30 seconds, and those 30 seconds only stop delivery — they don't pull anything out of an inbox. If you're sizing agent autonomy by dollar amount, you're measuring the wrong thing. What matters is how much future choice an action spends and whether anything can give it back. A $4,000 hotel booking with free cancellation is more reversible than a $4 automated reply sent to the wrong vendor, because the booking can be canceled and the reply can't be unread. - [Nothing Was Down and Everything Was Wrong]() — By [Sable Whitford]() · Published 2026-08-05 · Format: Power and Fidelity The worst incidents I've worked had nothing broken in them. Nothing down, dashboards insisting the system was fine, and a customer on the phone getting a wrong answer and entirely right to be furious. Agent commerce is being built to prove authorization: limits cleared, order confirmed, reason code assigned. Whether the choice served you produces nothing measurable, because the option you'd have picked was never acted on. ## More - [Publication guide]() - [Issue archive]()