--- title: "Foundations" canonical: "https://current.tinyfish.ai/issue/47/foundations" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/47/foundations" issue: 47 section: "foundations" description: "Conceptual clarity earned from building at scale" authors: ["Sable Whitford","Sevda Polat"] published: 2026-09-21 updated: 2026-09-17 articles: 27 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 47 — Foundations Conceptual clarity earned from building at scale ### Evaluation Thesis - [The Score Is Not the Agent]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Evaluation Thesis Six models, a hundred enterprise problems, one evaluation harness — and the top-ranked agent changed depending on whether it faced scripted opponents or other agents. The rank correlation between the two conditions was 0.182, barely better than ranking them by coin flip. Three recent studies converge on the same finding: an agent's benchmark score is not a property of the agent. It's a property of the agent and everything around it while the test ran. That distinction changes what any benchmark result can tell you. ### Postcondition Walkthrough - [The Agent Clicked Save. Check the Database Anyway.]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Postcondition Walkthrough An agent navigates to the right page, types into the right-looking field, clicks save, and gets a confirmation. In a recent benchmark run against ERP software, one model reached that save click 68% of the time on single-field edits, and the database held the correct value in 9% of those runs. What makes ERPBench worth your attention isn't its scores — it's that it grades by querying the database instead of trusting the screen, which is a pattern any team can adopt this week. ### Evaluation Reading - **Towards a Science of AI Agent Reliability** — [Source]() — Published 2026-09-17 Eighteen months of capability gains barely moved the needle on reliability. A four-dimensional framework tries to explain why. - **AlphaEval: Evaluating Agents in Production** — [Source]() — Published 2026-09-17 Across 94 real-company tasks, swapping the scaffold shifted performance more than swapping the model. - **From Benchmarks to Deployment: A Comprehensive Review of Agentic AI Evaluation** — [Source]() — Published 2026-09-17 A survey of 15 major agent benchmarks finds none that fold safety or cost into their primary scores. - **AgentHijack: Benchmarking Computer Use Agent Robustness to Common Environment Corruptions** — [Source]() — Published 2026-09-17 Pop-ups, resolution changes, overlapping windows — routine desktop clutter causes sharp drops in agent performance. - **Investigating the Impact of Dark Patterns on LLM-Based Web Agents** — [Source]() — Published 2026-09-17 Web agents complete their assigned tasks while quietly falling for dark patterns. Task success and collateral harm turn out to be independent. - **ERPBench: State-Grounded Evaluation for Computer-Use Agents in Enterprise Software** — [Source]() — Published 2026-09-17 Checking what actually changed in the database, rather than what appeared on screen, catches errors most benchmarks miss. ### Benchmark Diagnostics A benchmark result is a number attached to specific conditions. When the result gets cited, the conditions usually stay behind. Each card below takes a published finding and asks: what would need to be true about the evaluation setup for this number to mean what it seems to mean? The answer tends to involve something the headline leaves out, whether that's the grading method, the infrastructure wrapping the model, or whether the evaluation measured outcomes beyond the stated task. These are mostly careful, well-designed studies. But a score separated from its operating conditions becomes a different kind of claim than the one the researchers published. - **Agents Save the Form but Write Wrong Data** — [Source]() — Published 2026-09-17 Tag: State Grading ERPBench tested screenshot-only agents on a live ERP system and graded results against the database, not the screen. Agents saved forms in up to 85% of runs but entered the correct value only 3% of the time. The difference comes down to whether you check the screen or the database. - **The Scaffold Ships Quietly Inside the Score** — [Source]() — Published 2026-09-17 Tag: Scaffold Sensitivity SWE-bench Verified scores swing 10-20 points depending on which code framework wraps the model during testing. Vendors self-report using their best harness. When Epoch AI upgraded its scaffold in February 2026, scores jumped without any model changing. The scaffold is part of the measurement. - **One Successful Run Means Less Than Eight** — [Source]() — Published 2026-09-17 Tag: Run Consistency tau-bench measures pass^k: whether an agent succeeds consistently across repeated identical runs. On retail tasks, pass^8 fell below 25% for tested agents. But the benchmark's four built-in scaffolds shift the same model's score by up to 0.267 and rearrange the rankings. - **Task Complete and Warranty Purchased Are Both True** — [Source]() — Published 2026-09-17 Tag: Collateral Outcomes TrickyArena graded task success and susceptibility to deceptive UI patterns independently on the same execution trace. GPT-4o agents completed tasks at 38.9% while triggering unwanted side outcomes 41.1% of the time. A success metric that only checks task completion would miss the second number. - **Beating Humans Alone Still Hides a Better Baseline** — [Source]() — Published 2026-09-17 Tag: Hidden Baselines A meta-analysis of 106 experiments found human-AI combinations outperformed humans alone on average. But they underperformed the better of human-only or AI-only baselines taken separately. When AI already exceeded the human, adding a person reduced overall system performance by a meaningful margin (pooled g = -0.54). - **More Pull Requests Merged Does Not Mean Better** — [Source]() — Published 2026-09-17 Tag: Output Proxies A single-company study reported a 24% increase in merged pull requests per engineer per day after AI coding agent adoption. The authors themselves note this doesn't address code quality, maintenance cost, or delivered value. More PRs may reflect smaller PRs, not more useful output. - **Change the Opponents and the Winner Changes Too** — [Source]() — Published 2026-09-17 Tag: Competitive Ecology An enterprise decision-making benchmark ran the same 100 problems in two settings: agents against fixed rule-based opponents, and agents against each other. The two environments produced the same winner in only 21 of 100 problems. Who you compete against shapes who wins. - **Model Capability Jumped but Reliability Stayed Nearly Flat** — [Source]() — Published 2026-09-17 Tag: Reliability Plateau A peer-reviewed study across 15 models found reliability improving at just 0.03 per year on GAIA, despite large capability gains. Consistency often ran inverse to accuracy: larger models had more solution paths and therefore more variable outputs across identical runs. ### Verification Toolkit An agent can navigate to the right screen, fill in the right values, click save, and report success while the underlying record stays wrong. That gap between what the interface displays and what the system actually stored is only the first of several verification problems stacked on top of each other. Each layer here answers a different question. Did the database change? Was the action duplicated? Did the agent follow the required procedure? Was the call authorized with those specific arguments? Each catches something the others miss, and none covers everything. These are concrete methods, what they intercept, and where they go quiet. - **A Success Screen Proves Almost Nothing** — [Source]() — Published 2026-09-17 Tag: Interface Check ERPBench ran agents against a live ERP database. Some configurations clicked save successfully in 85% of multi-field runs, but the database was correct only 3% of the time. What the screen shows and what the record holds are two separate signals. - **Query the Record the Action Should Change** — [Source]() — Published 2026-09-17 Tag: State Grounding After execution, pull the database row or API object and compare it to intended values. WorkArena and WebArena validators do this for created records. Catches UI-level false positives. Misses whether the right entity was updated, and won't detect side effects elsewhere in the system. - **Check State Before Retrying Any Write** — [Source]() — Published 2026-09-17 Tag: Retry Safety A timeout after dispatch leaves the agent unsure if the action landed. A verify-before-retry wrapper checks postconditions and attaches idempotency keys to each mutating call, which significantly cut duplicate actions in testing. The constraint: the endpoint has to honor the key. Most browser workflows have no such mechanism. - **Score Agent Traces Against Required Step Ordering** — [Source]() — Published 2026-09-17 Tag: Trace Compliance AgentLTL encodes procedural rules in temporal logic and scores traces deterministically, no judge model needed. The same spec can gate tool calls at runtime. Catches skipped steps and wrong sequencing. Cannot tell you whether each step's content was correct, or whether anything actually changed downstream. - **Block Unsafe Actions Before They Fire** — [Source]() — Published 2026-09-17 Tag: Runtime Gates A guardian process intercepts proposed tool calls and returns allow, deny, or modify before dispatch. AgentSpec reported blocking over 90% of unsafe code behaviors with millisecond overhead. The gap: it only covers instrumented paths, and auto-generated rules reached about 71% recall, meaning roughly three in ten unsafe patterns slip through. - **Revoked Sources Survive Inside Derived Memories** — [Source]() — Published 2026-09-17 Tag: Memory Provenance A retrieval filter can block a revoked source when the agent looks it up directly. But if the agent already wrote a conclusion drawn from that source back into memory, the derived record carries no revocation flag. In testing, unsafe-action rates climbed past 80% within three hops of the write-back. - **Human Approval Helps Less Than You Think** — [Source]() — Published 2026-09-17 Tag: Human Review A meta-analysis of 106 experiments found human-AI teams performed worse than whichever baseline (human alone or AI alone) was stronger. A reviewer who shares the model's framing isn't providing independent correction. The questions worth asking: what does the reviewer actually see, and can they still change the outcome? ### Past Articles - [What the Guardian Sees]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Runtime Control Walkthrough The OWASP Agent Control Standard ships with two demo scenarios: an agent tries to delete a filesystem and gets blocked, and an agent asks for an entire database table and gets a narrower query back. Both look like the control system saying no, with the second saying it more politely. But refusing an action and rewriting one draw on different things. Refusal needs recognition. Rewriting needs a correct replacement, which means the system has to know something about what the agent should have asked for — and where that knowledge comes from is the whole architecture. - [When Human Oversight Works Against You]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Human Decision Limits Adding a human checkpoint to an agent workflow feels like adding safety. But a meta-analysis of 106 experiments found that human-AI teams performed worse than the better solo performer on decision tasks, and in more than 95% of those setups the human held the final call. Research on clinical alerts and security warnings deepens the problem: review accuracy falls sharply under repetition, and production agent queues manufacture repetition by design. Most teams have never tested whether their approval gates are still functioning as judgment. - [Nobody Tampered With the Agent's Instructions]() — By [Sevda Polat]() · Published 2026-09-03 · Format: Two Kinds of Influence Agent security conversations center on prompt injection: someone hides instructions in the input, the agent gets hijacked. Researchers at CHI 2026 found something running on different machinery. They sent shopping agents through ordinary commercial checkout flows and watched them notice anomalies, duplicate items, pre-checked consent boxes, and proceed anyway. No instructions were tampered with. The commercial web shaped the outcome through its normal operation. Current law has no answer for that case: when an agent completes an authorized action it was environmentally induced to take, who bears the commitment? - [Your Best Agent Is Your Most Gullible One]() — By [Sable Whitford]() · Published 2026-09-03 · Format: Agent Susceptibility in Practice TrickyArena tested six web agents against deceptive interface patterns — fake urgency, pre-checked boxes, double-negative opt-outs — and found a 41% overall susceptibility rate. The distribution underneath that average matters more: the agents best at finishing tasks were also the ones most likely to get manipulated, and the agents that looked resistant mostly just stalled before reaching the trap. Evaluate on task completion alone and you may be selecting for gullibility. ## Other sections in Issue 47 - [Daily Brief]() - [Market Pulse]() - [Practitioner's Corner]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()