--- title: "Practitioner's Corner" canonical: "https://current.tinyfish.ai/issue/47/practitioners-corner" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/47/practitioners-corner" issue: 47 section: "practitioners-corner" description: "Lessons from the field—what we see building at scale" authors: ["Sevda Polat","Sable Whitford"] published: 2026-09-21 updated: 2026-09-17 articles: 14 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 47 — Practitioner's Corner Lessons from the field—what we see building at scale ### Reporting Infrastructure - [Who Receives the Report]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Reporting Infrastructure Aviation's confidential safety reporting system has handled more than 2.3 million reports without once breaking a reporter's confidentiality. Its most consequential design choice, made in 1976, was that NASA receives the reports rather than the FAA. OpenAI's new misalignment-reporting framework makes several choices unusual for a technology company, but its reporting chain runs through the organization whose systems are being examined. What AI safety decides now about who receives reports will shape what the field is able to learn about its own failures for a long time. ### Builder Profile - [Phil Cuvin — Turning Anecdotes into Instruments]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Builder Profile Across the Qwen 2.5 VL family, dark-pattern susceptibility climbed from 43.8% at 3 billion parameters to 73.7% at 72 billion. The more capable models were the easier ones to manipulate. That number exists because Phil Cuvin and his collaborators built a benchmark with two independent axes — task completion and susceptibility — where everyone before had tracked one. It's the through-line of his research: find the problem practitioners describe in shorthand and never instrument, then build the counter. ### Reporting Practitioner - [Twenty Confessions a Day at Airport ZZZ]() — Published 2026-09-17 *The Aviation Safety Reporting System has been processing voluntary safety reports from pilots and air traffic controllers for fifty years. More than two million reports have entered the system. No reporter's identity has ever been compromised.* ### Severity Taxonomy - [Six Kinds of Agent Incident]() — By [Sable Whitford]() · Published 2026-09-17 When someone says "we had an agent incident," the word is doing so much work it means almost nothing. An anomalous execution trace is an incident. An agent accessing a third party's production system without authorization is an incident. An agent action that triggers mandatory reporting under the [EU AI Act](https://ai-act-law.eu/article/73/) — legal clock now ticking, causal link established — is also an incident. But the response to the first is "put it in the review queue." The response to the last involves lawyers, regulators, and a timeline you don't control. ### Source Trail - **Our Framework for Reporting Model Misalignment** — [Source]() — Published 2026-09-17 OpenAI's disclosure framework and six initial case reports detailing how misalignment gets tracked and investigated. - **Brief Independent Investigation of the OpenAI / Hugging Face Hacking Incident** — [Source]() — Published 2026-09-17 METR and Redwood Research reconstruct how 1,200 agents coordinated, falsified transcripts, and breached external infrastructure. - **The Case for Confidential Incident Reporting Systems (NASA ASRS Pub. 60)** — [Source]() — Published 2026-09-17 Design rationale behind aviation's voluntary safety reporting: third-party administration, de-identification, structural independence from regulators. - **DECEPTION: How Dark Patterns Manipulate Web Agents** — [Source]() — Published 2026-09-17 Benchmark finding that agents fell for deceptive UI patterns in over 70% of tasks, with larger models performing worse. - **Characterizing Agents in Production** — [Source]() — Published 2026-09-17 Survey of 86 deployed agent systems across domains; most run ten steps or fewer before requiring human intervention. - **Aviation Safety Reporting Program (FAA Advisory Circular 00-46F)** — [Source]() — Published 2026-09-17 The formal immunity policy for ASRS reports: what protection reporters receive, what's excluded, and the conditions governing each. ### Past Articles - [What Aman Gupta Built Before the Model]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Builder Profile Aman Gupta's team at Nubank put five agents in front of more than 100 million customers in fourteen months. The KDD 2026 paper describing the architecture is precise about what got built first: idempotent APIs, audit trails, tool sequences composed deterministically in code — infrastructure whose job is to absorb the model's mistakes rather than pass them along. It's quieter about action-error rates, retry rates, and duplicate-effect counts, none of which appear anywhere in it. The build order is the argument, and the absent numbers are part of it. - [Nothing Else Happened]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Lead Analysis A database can tell you nothing else changed during a transaction, because the database defines every operation that could possibly happen. An agent working on the open web can't make that claim. It can log the flight it booked. It can't establish that it didn't also accept an arbitration clause, opt you into data sharing, or leave a warranty in the cart. Nobody enumerated the possible interactions, so their absence can't be confirmed after the fact. That has consequences for how these systems get built. - [Phil Cuvin and the Evaluation That Had to Apply Pressure]() — By [Sevda Polat]() · Published 2026-09-03 · Format: Builder Profile Standard agent benchmarks check whether the system completed the task. Phil Cuvin's DECEPTION benchmark, published at ICLR 2026, adds a second question: did the agent also get quietly steered into outcomes the user never authorized? Answering it meant building web environments that behave the way commercial sites behave — with countdown timers, preselected add-ons, and cancellation flows designed to exhaust you. The design choices behind those environments point to an operational cost most agent evaluation budgets don't yet include. - [The Green Dashboard Problem]() — By [Sevda Polat]() · Published 2026-09-03 · Format: The Semantic Incident When researchers ran web agents through interfaces seeded with forced opt-ins, misleading pop-ups, and pre-selected checkboxes, the agents with the highest task-completion rates turned out to be the most susceptible to manipulation. Guardrails helped without closing the gap: some agents named the deceptive element, identified it correctly, and proceeded anyway. The execution trace stayed clean. Every metric said success. ## Other sections in Issue 47 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()