--- title: "Echoes" canonical: "https://current.tinyfish.ai/issue/46/echoes" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/46/echoes" issue: 46 section: "echoes" description: "Past infrastructure decisions echoing in today's production realities" authors: ["Sable Whitford","Sevda Polat"] published: 2026-09-14 updated: 2026-09-10 articles: 15 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 46 — Echoes Past infrastructure decisions echoing in today's production realities ### Containment Precedent - [The Sandbox That Couldn't Hold]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Containment Precedent In 1995, Sun Microsystems shipped the Java applet sandbox to answer a question the industry is answering again: how do you let code you didn't write run autonomously inside bounds you control? The sandbox was carefully built, enforced in multiple layers, by people who understood what remote code might try. It came apart anyway — not because attackers broke through, but because its own designers kept loosening it so the code could get anything done. Browsers eventually deleted applet support rather than fix it. The specific mechanics of that erosion are recognizable in agent containment right now. ### Foundational Problem - [The Confused Deputy]() — By [Sevda Polat]() · Published 2026-09-10 Around 1977, a Fortran compiler at Tymshare overwrote the company's billing file. Nobody was malicious. A user named that file as the destination for debugging output, and the compiler obliged. It had directory write access for logging statistics, and it carried the user's authority to write wherever specified. Two legitimate purposes flowing through a single pool of permissions, with nothing in the system's design to distinguish them. ### Practitioner Perspective - [The Red Question Mark on Petra Renderfence's Whiteboard]() — Published 2026-09-10 *Petra Renderfence has spent fourteen years working on browser process isolation. First on the team that shipped Chromium's original sandbox hardening, then on the site isolation effort that became an emergency when Spectre dropped in January 2018. She currently leads a security architecture group focused on what happens when the thing running inside the browser's containment layers isn't passive content anymore.* ### Competing Lineages - [The User Who Was Always a Person]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Competing Lineages Unix's permission model was built for people at terminals in 1974. It answered "what may this code do?" by asking "who is running it?" Those same permission bits, checked against a user identity, now enforce container isolation for autonomous agents — processes holding credentials with no person behind them. Identity was always standing in for the mandate. Agents are the first users where that substitution stops working. - [The Deputy Who Couldn't Tell Its Authorities Apart]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Competing Lineages A 1960s proposal held that authority should travel with each request rather than pool under the caller's identity. It lost to identity-based access control — the model the companion piece traces. Then a compiler destroyed a billing file because the operating system couldn't tell the compiler's own permissions apart from its user's, and that failure got a name: the confused deputy. Agent systems are now rediscovering what capability-based security proposed before Unix existed. ### Source Trail - **Java's Sandbox Architect Looks Back at What the Model Got Right and Wrong** — [Source]() — Published 2026-09-10 Li Gong revisits Java's security arc, from binary trust decisions to fine-grained policy domains. - **How Chrome Pushed the Containment Boundary From the Runtime to the OS** — [Source]() — Published 2026-09-10 Chromium's process model and site isolation docs trace the architecture that made renderers untrusted code. - **Paradigm Regained: Why Identity-Based Access Control Can't Deliver Least Privilege** — [Source]() — Published 2026-09-10 Mark Miller's 2003 paper argues capabilities solve structural authority problems that access control lists cannot. - **The Confused Deputy Problem Returns in AI Agent Architectures** — [Source]() — Published 2026-09-10 CSA Lab maps Hardy's 1988 confused deputy vulnerability onto prompt injection in autonomous agents. - **From chroot to Docker: The Decades-Long Path to Programmable Isolation** — [Source]() — Published 2026-09-10 Container evolution traced from 1979 Unix filesystem tricks through namespaces, cgroups, and Docker. - **When Your Agent Becomes the Deputy: Tool Authority and Prompt Injection** — [Source]() — Published 2026-09-10 How agents holding broad credentials reproduce the classic confused deputy vulnerability in new form. ### Past Articles - [The Dropdown Menu]() — By [Sevda Polat]() · Published 2026-09-03 · Format: Two Lineages of Form Design Before the web dropdown, a clerk with a 30,000-entry index translated what you wrote into what the system could accept. The compression was lossy but intelligent — the clerk knew things about the world the index did not contain. The dropdown removed that interpreter. It worked partly because the humans on both sides understood what was being given up. What happens when the thing filling the form has no such understanding, and picks an option anyway? - [What the Census Form Could See]() — By [Sevda Polat]() · Published 2026-09-03 · Format: Two Lineages of Form Design Before 2000, a census write-in of "Black-White" was assigned to Black. "White-Black" was assigned to White. The rule was consistent, defensible, and entirely invisible to the person it classified. Census categories determine which populations a country is equipped to perceive. A fifty-year-old design decision has finally been reversed. The statistical infrastructure it produced will outlast it by a decade. - [The Part of the Form That Stayed in the Office]() — By [Sevda Polat]() · Published 2026-09-03 · Format: The Form Specification When the HTML Working Group specified web forms in 1995, it translated the structure of paper forms with real fidelity: labeled fields, a destination, a method of delivery. What it did not translate was the institutional context that made paper forms work — who was authorized to fill one out, whether submitting it committed you to anything, what recourse you had when something went wrong. That context lived in the office, in the clerk, in the fine print on the back of the page. It was never encoded. Now automated agents are filling these same structures at scale, and the absence has started to matter. - [What an API Costs to Keep Open]() — By [Sevda Polat]() · Published 2026-08-28 · Format: Two Attempts at Resolution If RSS was too simple to sustain universal coverage, APIs offered the opposite bet: structured, authenticated, richly documented interfaces between machines. By 2018, directories tracked over 19,000 of them. But each one is a commitment the provider has to keep renewing — versioned, supported, and eventually restricted when it costs more than it returns. Reddit's API still worked the day Apollo shut down. What changed was the price of using it. ## Other sections in Issue 46 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Practitioner's Corner]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()