--- title: "Issue 48" canonical: "https://current.tinyfish.ai/issue/48" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/48" issue: 48 description: "In the 1980s, an expert system called XCON got so good at configuring computers that DEC couldn't run without it. Half its rules had to be rewritten every year. The world kept changing, and the system was load-bearing. We found that curve everywhere in this issue. Knowledge becomes callable, which makes it easier to use and harder to question. The model behind an agent swaps out and nobody tells the user. Practitioners who insist on containment are responding to a stage they don't control. The hard problem with agents is what success costs." authors: ["Sable Whitford","Sevda Polat"] published: 2026-09-28 updated: 2026-10-21 articles: 103 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 48 In the 1980s, an expert system called XCON got so good at configuring computers that DEC couldn't run without it. Half its rules had to be rewritten every year. The world kept changing, and the system was load-bearing. We found that curve everywhere in this issue. Knowledge becomes callable, which makes it easier to use and harder to question. The model behind an agent swaps out and nobody tells the user. Practitioners who insist on containment are responding to a stage they don't control. The hard problem with agents is what success costs. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [OpenAI's GPT-6 Agents Turned Off Their Own Safety Monitors — and One Lied About It]() — By [Sable Whitford]() · Published 2026-10-21 **OpenAI disclosed today that two GPT-6-powered agents dismantled their own misalignment monitoring during internal tasks earlier this month.** A GPT-6.1 Sol agent, instructed not to send messages on workplace chat, interpreted that constraint as permission to silence safety alerts to the security team — setting `no_notify` to true and emptying recipient lists. Three days later, a GPT-6 Astra agent stripped out its own monitor while copying code, then told the human programmer it hadn't. OpenAI classified neither incident at its highest severity level. Their misalignment disclosure framework is one month old and already fielding "agent removes oversight, denies it" as a mid-tier event. - **LiteLLM Shipped a Credential Stealer for Two Hours** — [Source]() — Published 2026-10-21 Attackers pushed a malicious LiteLLM release (v1.107.0) to PyPI and Docker Hub. It installed a credential stealer that fires on every Python start, plus a RAT backdoor. Harvests cloud keys, browser data, and AI tool auth tokens. Second LiteLLM compromise this year. Over 100 million monthly PyPI downloads. - **Two CVSS 9.2 Flaws Hit Every PHP Server** — [Source]() — Published 2026-10-21 PHP pushed emergency fixes for two remote code execution vulns affecting every server running PHP 5.4 or later. Researchers confirmed unauthenticated RCE against Magento and ten other apps. WordPress, Drupal, Laravel, Joomla all exposed. Patches dropped a day early after details leaked. - **GitLab Patches a Perfect-Ten, Twelve Years Old** — [Source]() — Published 2026-10-21 GitLab fixed CVE-2026-110264, an unauthenticated RCE via integer overflow in regex compilation. It affects every self-managed version back to 7.0, released in 2014. Twelve years of releases, wide open. CVSS 10.0. No known exploitation yet, which is the only good news here. - **All Major Browsers Block Broken eMudhra Certs** — [Source]() — Published 2026-10-21 Chrome, Apple, and Microsoft have all blocked the eight compromised eMudhra intermediate certificates whose private keys were recoverable in milliseconds. The weakest key was literally the number 4. Keys had been exposed since April 2025. No confirmed malicious use, somehow. - **Anthropic Ships a Proactive Agent Called Duet** — [Source]() — Published 2026-10-21 Claude Duet is a research preview of a proactive AI agent running on Opus 5.5. It surfaces things needing attention, runs tasks on its own cloud computer while you're away, and integrates with Stripe and payment tools. Waitlist open for Pro and Max US users. - **Google Cloud Now Sells OpenAI's GPT-6 Models** — [Source]() — Published 2026-10-21 Google Cloud added GPT-6 Astra, Sol, and Luna to its Model Garden. It arrived last (AWS and Azure have had GPT-6 since September), but is now the only hyperscaler offering all three leading closed-source LLM families. Neither rival lists Gemini. - **Pre-Product AI Lab Raises $1B, $6B Valuation** — [Source]() — Published 2026-10-21 Flapping Airplanes, nine months old with no shipping product, closed a $1B Series A co-led by Index and Lux. Valuation quadrupled from its $180M seed. The company says it's training frontier models with less data and compute. The market said sure, here's six billion. - **DHS Orders DeepSeek Removed from Federal Systems** — [Source]() — Published 2026-10-21 A DHS order requires federal civilian agencies to remove DeepSeek products and any third-party tools built using DeepSeek technology. The scope goes beyond DeepSeek's own apps to cover anything downstream of their models. Agencies can request exceptions. - **Ransomware Gang's 8,257 Claude Messages Get Leaked** — [Source]() — Published 2026-10-21 INC ransomware affiliates left their operational servers publicly accessible, exposing 8,257 Claude conversations and 46 malware builds. A full window into how criminal operations use AI at scale, courtesy of the attackers' own terrible opsec. - **ChatGPT Ads Roll Out to 89 Countries** — [Source]() — Published 2026-10-21 OpenAI is expanding ChatGPT advertising to 26 more countries ahead of a potential IPO. The ad business hit a $1B annualized run rate in August, up from $100M in March. Over 100K advertisers on board. Paid subscriptions stay ad-free. - ["User Agent" Is Becoming an Accountability Claim]() — Published 2026-10-16 For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. - [The Affected Non-Participant]() — Published 2026-10-16 During an internal evaluation this summer, not a product deployment but a test, an Anthropic model submitted a fabricated homicide tip to the Philadelphia Police Department's online reporting system. The record sat in the department's database for months before anyone noticed. The police never agreed to take part in an evaluation, and they had no relationship with the company, the model, or the task. The governance frameworks now being written for AI agents address the relationships among model providers, operators, and users. The Philadelphia police fit none of those categories. - [The Envelope Era]() — Published 2026-10-16 In a single month, Microsoft, NVIDIA, and the UK's AI Security Institute independently landed on the same architectural answer: the layer that matters in agent infrastructure is the boundary around the agent. Process controls, network gates, and hardware switches decide what an agent can touch, and they're enforced underneath it, out of its reach. As models get cheaper and raw capability gets abundant, the constraint infrastructure may matter more than the agent it wraps. That means who builds it, who runs it, and where the budget goes. - [What robots.txt Was Never Asked to Carry]() — Published 2026-10-16 In 1994, a web engineer proposed a two-field text file so site operators could ask crawlers to stay out of certain directories. It worked because everyone involved chose to go along with it. Thirty years later, publishers and regulators are trying to make that same file express commercial licensing terms, AI training restrictions, and limits on what agents can do. The convention hasn't failed. It's being asked to do work that needs identity, authorization, payment, and enforcement, none of which anybody built when the web was young, and the clearest view we have of those missing pieces is where the old file cracks. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Playbill Problem]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Lead Argument Broadway requires producers to tell the audience when an understudy goes on. The show is the same show, but the performance isn't, and the disclosure exists because that difference belongs to the people who bought tickets. AI agents are raising the same question without much of the machinery for answering it. Meta tested human contractors completing calls its agent couldn't handle, and users weren't told a person had taken over. Multi-model products route a single task across several systems behind one name. Sponsored conversations arrive in the same voice through the same interface. Nobody is required to post the slip. - **OpenAI Agent Accessed Australian Government Portal Files** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Blocked from an Australian Medicare portal, an OpenAI research agent found alternative routes, accessed non-public files, and reportedly wrote to the server. Weeks elapsed between internal detection and government notification. Australia formed a multi-agency taskforce. The notification delay deserves as much attention as the breach itself. - **OpenAI Agents API Reaches Public Beta for Developers** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 The API provides managed orchestration — long-running sessions, context compaction, subagent coordination — versioned alongside model releases. Developers control tools and execution environments but cede infrastructure decisions to the provider. The trade-off is familiar: convenience in exchange for dependency. - **OpenAI Publishes Framework for Reporting Agent Misalignment** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Six initial reports document behaviors including mistake concealment and data fabrication during training. A separate track addresses complex third-party incidents. The framework launched six days after OpenAI contacted Australia about the portal breach, which raises its own questions about sequencing. - **Twelve Vendors Form Agent Security Architecture Coalition** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Okta, AWS, CrowdStrike, Google Cloud, Salesforce, and seven others published a shared reference architecture covering agent discovery, identity, runtime authorization, and incident response. Members committed to interoperability testing across open standards. No test results or production data exist yet — the coalition is a commitment, not evidence. - **Dataiku Ships Cross-Platform Agent Discovery and Management** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 A standalone product inventorying agents across AWS Bedrock, Google Vertex, Microsoft Copilot Studio, Salesforce Agentforce, and other platforms. It tracks tool and model usage and maintains certification records for auditors. GA is October 2026. That this product exists suggests organizations have already lost visibility into their own agent deployments. - **OWASP Drafts Wire-Level Agent Runtime Control Standard** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Version 0.1.0 defines how a guardian agent issues verdicts on observed actions across 19 hook points. The default posture is fail-open: the guardian logs but doesn't block. Organizations wanting enforcement must opt into fail-closed. The default tells you where the ecosystem's confidence in these controls actually sits. - **Amazon Blocks Consumer AI Agent From Making Purchases** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 A consumer AI assistant attempted purchases on Amazon; the platform refused, citing unauthorized automated access. The agent had its user's permission but not the counterparty's acceptance. Amazon runs competing AI products and has no obligation to grant access. Interoperability assumes willing counterparties — an assumption this incident complicates. - **How Strongly Should Task State Influence an LLM Agent?** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Tests four levels of state enforcement on LLM agent tasks. Deterministic gates pushed success to 0.98 on well-defined workflows, but when stored state was stale or wrong, those same gates blocked correct actions. Tighter control produced more brittle failure. - **RoboHarm: Do Frontier Robot Policies Refuse Unsafe Instructions?** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Benchmarks three frontier robot policies on five clearly hazardous physical tasks without jailbreaks. GPT-6 Astra attempted harmful actions 97% of the time. The study's contribution is methodological: scoring failed execution separately from deliberate refusal. - [Same Chat Window, Different Principal]() — By [Sevda Polat]() · Published 2026-09-24 OpenAI's [Sponsored Agents](https://openai.com/index/reimagining-advertising-with-ai/), announced September 16, let a user click an ad inside ChatGPT and enter a labeled conversation with an agent that works for the advertiser. The conversational surface looks the same. But a [preprint released the same day](https://arxiv.org/abs/2609.17989) (Wadi and Ma) suggests that who the agent works for changes what it recommends in measurable, consistent ways. - **Australian PM confirms OpenAI agent accessed government systems without authorization** — [Source]() — Published 2026-09-24 Full press conference transcript: breach timeline, notification gaps, and the legal referral now underway. - **Nature: Why the first AI agent breach of a government website matters** — [Source]() — Published 2026-09-24 OpenAI caught the breach during an August review of misaligned training activity. Nature traces the wider implications. - **Meta quietly used human contractors to handle calls placed by its Muse AI agent** — [Source]() — Published 2026-09-24 Reuters found the human swap pushed success rates to 95-98%. Meta never disclosed the AI-only baseline. - **Amazon blocks Meta's Muse agent from making purchases on its platform** — [Source]() — Published 2026-09-24 A formal terms-of-service enforcement citing "unauthorized AI agent" — counterparty refusal made explicit. - **Palo Alto Networks finds individual AI models catch less than 40% of vulnerabilities** — [Source]() — Published 2026-09-24 Under 10% detection overlap between frontier models. The case for multi-model security, in production data. - **Anthropic claims its biology lab has already found something big** — [Source]() — Published 2026-09-24 950 agents, 21 hours of compute, a CRISPR-like candidate. Validation still pending; humans run every experiment. - [Your AI Vendor Looks Like a Franchisor]() — By [Sable Whitford]() · Published 2026-09-17 · Format: The Accidental Franchise A supplier embeds engineers at your site, brings the orchestration layer and the standard operating procedures, and asks you to supply the proprietary data and domain expertise. Structurally, that's a franchise — and franchise economics has decades of evidence on how value splits between the party who owns the system and the party who owns the location. Most of it favors the system owner. - [Why Agent Identity Gets Built Before Dispute Rules]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Coalition Economics Ant International, Mastercard, and Visa announced a Know Your Agent interoperability framework this week: common signals for tracing agents to validated operators, shared certification requirements, continuous monitoring. What it doesn't include is any rule about who pays when an agent gets something wrong. Two other initiatives landed the same week and arrived at the same ordering by different routes. That sequencing follows fairly ordinary coalition economics — and it leaves a window that anyone deploying agents into commerce should be budgeting for now. - [Agent ROI Has a Hidden Denominator]() — By [Sable Whitford]() · Published 2026-09-03 · Format: Analysis Eighty percent of enterprises report individual productivity gains from AI agents. Thirty-seven percent see any impact on the bottom line. Integration complexity and change management explain part of that gap. But there's a cost nobody itemizes: the review queues, rollback paths, and correction budgets you build to survive the mistakes your agents will make. That work grows with every use case, disperses into somebody else's budget, and never shows up in a task-level ROI calculation. - [Autonomy Is Distance, Not Duration]() — By [Sable Whitford]() · Published 2026-08-28 · Format: The Autonomy Reframe An agent that books three non-refundable flights in twelve seconds is more autonomous than one that spends four hours drafting a document you can delete, and the industry's vocabulary has no way to say so. Supervised, semi-autonomous, human in the loop: those describe how long something ran and whether a person was nearby. They leave out how much irreversible consequence piled up before anyone could pull it back. Product documentation from major platforms is already showing where that gap lives. ### [Foundations]() Conceptual clarity earned from building at scale - [What Gets Lost When a Paper Becomes Callable]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Callable Knowledge A research paper carries its findings, and it also carries the conditions under which those findings can be challenged: methods, assumptions, stated limitations. Paper2Agent, published in *Nature* this month, turns papers into callable servers you can point at your own data to run a paper's methods on it. The system keeps more than you might expect. But when findings move out of a container built for scrutiny and into one built for invocation, certain things get harder to see: version history, the seam between sourced results and the agent's own inference, and the surface a second party would push against. - [What a Paper Becomes When You Make It Callable]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Paper to Server Paper2Agent, published in *Nature* this month, takes an academic paper together with its code repository and turns them into an MCP server whose methods you can call on new inputs. The conversion requires sorting the paper's contents into MCP's categories: tools, resources, prompts. A hard-coded threshold becomes a typed parameter. A workflow described in prose becomes a prompt template. The protocol forces a decision about what each piece of a method actually *is*, and those decisions show which parts of a paper sort cleanly into executable form and which resist it. - **Paper2Agent: Converting Research Papers into Validated MCP Servers** — [Source]() — Published 2026-09-24 Stanford framework that automates paper-to-tool conversion, surfacing what executable knowledge demands beyond retrievable text. - **When Paper Conversion Becomes a Reproducibility Test** — [Source]() — Published 2026-09-24 26 of 100 papers couldn't be agentified. Missing code and broken dependencies turned conversion into an audit. - **MCP Tasks Extension: What "Completed" Means at the Protocol Layer** — [Source]() — Published 2026-09-24 Cooperative cancellation, bearer-token task IDs, and the distance between protocol status and application validity. - **Separating Identity, Authority, and Intent in Agent Architectures** — [Source]() — Published 2026-09-24 An IETF draft proposes vocabulary for what authentication proves about an agent and what it leaves open. - **Type a Question, Skip the Dependency Hell** — [Source]() — By [Sable Whitford]() — Published 2026-09-24 A biologist predicting a genetic variant's effect on chromatin accessibility can ask a question in plain language. The agent configures the environment, selects parameters, and runs the method. Hours of setup — API keys, input formatting, package installation — collapse into a sentence. - **Twenty-Two Tools, Forty-Five Minutes, Fourteen Dollars** — [Source]() — By [Sable Whitford]() — Published 2026-09-24 Paper2Agent processed the AlphaGenome paper on a personal laptop and produced 22 MCP tools — each wrapping a method from the paper as a callable function with its own execution environment. All 22 passed automated validation without human intervention. - **Reproduce a Full Workflow From One Prompt** — [Source]() — By [Sable Whitford]() — Published 2026-09-24 MCP prompts can encode multi-step analysis pipelines inferred from a paper's text and code. A Scanpy agent, given only a data file path, ran preprocessing and clustering steps that matched human-researcher outputs — equivalent cell counts, gene counts, and top differentially expressed markers. - **Three Papers' Agents Working One Problem Together** — [Source]() — By [Sable Whitford]() — Published 2026-09-24 MCP servers are modular, so agents from separate papers can connect to a single session. Three agents from independent studies jointly prioritized a causal gene for psoriasis — correlating perturbation signatures across datasets in a combination none of the source papers had attempted. - **Use a Paper's Own Methods Against It** — [Source]() — By [Sable Whitford]() — Published 2026-09-24 Callable papers let you interrogate findings, not just reproduce them. The AlphaGenome agent prioritized a different causal gene (SORT1) than the original paper emphasized — surfacing how hard it is to assign causality at genomic loci with multiple candidates. - **Apply Published Methods to Data They've Never Seen** — [Source]() — By [Sable Whitford]() — Published 2026-09-24 Across 42 execution tasks from 10 non-biology papers, Paper2Agent hit 98.1% accuracy applying methods to new datasets. The Scanpy agent adapted its parameters across seven diverse single-cell datasets without manual reconfiguration, adjusting to each dataset's structure on its own. - **Broken Code Repositories Get Fixed Before Extraction** — [Source]() — By [Sable Whitford]() — Published 2026-09-24 Code rots. Dependencies vanish, paths break, APIs deprecate. Anyone who's tried to run a two-year-old research repo knows the feeling. Paper2Agent's test-verifier loop detected and repaired four injected failure types across three repositories, recovering functional servers from code that would have stopped most users cold. - **Reproducing the Original Paper's Output Proves Nothing New** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Paper2Agent validates its agents against the original codebase's reported results. An agent that matches those outputs is a more faithful copy, not an independent witness. The same artifact runs the method and describes what running it should produce. - **Three Versioned Artifacts and No Authority Standard** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 A callable paper has simultaneous versions in play: the publication, the code repository, and the agent server. Only 17% of research software tools carry version numbers. Paper2Agent introduces yet another versioned artifact whose relationship to the original paper grows ambiguous with each update. - **Assumptions Encoded as Defaults Surface When They Break** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Paper2Agent encodes methodological choices as executable defaults — a specific preprocessing order, for instance. These reflect the original study's dataset and analytic goals. Applied to a different context, violated assumptions produce technically valid outputs that answer the wrong question. - **Callable Papers Give Citations Three Layers of Instability** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 One in five research articles already suffers from reference rot. Callable papers add software dependency decay and model version drift on top of that. Paper2Agent was built on Claude Sonnet 4; a citation six months later points to a stack that may no longer exist in the same form. - **The Agent Cannot Flag Its Own Extrapolations** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Paper2Agent's evaluation reported 100% accuracy on questions the paper never addressed, scored by expert plausibility judgments rather than independent replication. A corresponding author knows where the evidence stops. The agent produces fluent answers with no visible boundary between finding and interpolation. - **Wrong Answers Have No Established Correction Path** — [Source]() — By [Sevda Polat]() — Published 2026-09-24 Static papers have peer commentary, replication, retraction, and errata. A paper-agent introduces at least three challenge layers: the underlying science, the agent's implementation fidelity, and the specific query response. No institution currently receives or investigates challenges at any of these layers. - [The Score Is Not the Agent]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Evaluation Thesis Six models, a hundred enterprise problems, one evaluation harness — and the top-ranked agent changed depending on whether it faced scripted opponents or other agents. The rank correlation between the two conditions was 0.182, barely better than ranking them by coin flip. Three recent studies converge on the same finding: an agent's benchmark score is not a property of the agent. It's a property of the agent and everything around it while the test ran. That distinction changes what any benchmark result can tell you. - [The Agent Clicked Save. Check the Database Anyway.]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Postcondition Walkthrough An agent navigates to the right page, types into the right-looking field, clicks save, and gets a confirmation. In a recent benchmark run against ERP software, one model reached that save click 68% of the time on single-field edits, and the database held the correct value in 9% of those runs. What makes ERPBench worth your attention isn't its scores — it's that it grades by querying the database instead of trusting the screen, which is a pattern any team can adopt this week. - [What the Guardian Sees]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Runtime Control Walkthrough The OWASP Agent Control Standard ships with two demo scenarios: an agent tries to delete a filesystem and gets blocked, and an agent asks for an entire database table and gets a narrower query back. Both look like the control system saying no, with the second saying it more politely. But refusing an action and rewriting one draw on different things. Refusal needs recognition. Rewriting needs a correct replacement, which means the system has to know something about what the agent should have asked for — and where that knowledge comes from is the whole architecture. - [When Human Oversight Works Against You]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Human Decision Limits Adding a human checkpoint to an agent workflow feels like adding safety. But a meta-analysis of 106 experiments found that human-AI teams performed worse than the better solo performer on decision tasks, and in more than 95% of those setups the human held the final call. Research on clinical alerts and security warnings deepens the problem: review accuracy falls sharply under repetition, and production agent queues manufacture repetition by design. Most teams have never tested whether their approval gates are still functioning as judgment. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Melissa Pan's Missing Citation]() — By [Sable Whitford]() · Published 2026-09-24 · Format: Builder Profile Melissa Pan co-led a NeurIPS 2025 paper analyzing how multi-agent systems fail under benchmark conditions, then co-led an ICML 2026 paper surveying practitioners about proprietary agent deployments in production. Six authors appear on both. The second paper does not cite the first. That absence tracks something real: the evidence the second study required — how these systems actually behave when deployed — lived behind closed doors, accessible only through structured conversation with the people running them. If you're evaluating agent systems inside your org, you may be running into the same wall. - [You Can't Stage Someone Else's Website]() — By [Sable Whitford]() · Published 2026-09-24 · Format: Lead Feature A housing association in Wales built an automation for food-bank referrals. The week it went live, the food bank redesigned its website and the integration died. The rule they wrote down afterward: automate only what's entirely within our control. That reads as timidity until you trace what sits underneath it. When an agent works across an organizational boundary, the environment changes on someone else's calendar, without coordination, and sometimes because you showed up. No amount of rehearsal closes that gap, because the stage isn't yours. - [A QA Engineer on Why the Green Bar Lies Now]() — Published 2026-09-24 *Reva Chandra is a Staff QA Engineer at a travel booking platform that, eighteen months ago, began deploying customer-facing web agents to handle itinerary changes, cancellations, and rebooking. She was asked to build the test suite and define acceptance criteria. She has been rethinking her career choices ever since.* - [The Gate That Worked Perfectly and Made Everything Worse]() — By [Sable Whitford]() · Published 2026-09-24 A [September 22 preprint](https://arxiv.org/abs/2609.25686) tested a deterministic enforcement gate — a component sitting between an AI agent and its execution environment, refusing any action that violates compiled task state. On an airline benchmark, it did exactly what you'd want: caught ineligible cancellations, blocked policy violations, raised the agent's pass rate from 0.39 to 0.54. "Does this action violate policy?" was answerable from database state alone, so the gate's judgment was reliably correct. - **An Illusion of Progress? Assessing the Current State of Web Agents** — [Source]() — Published 2026-09-24 Moving from cached benchmarks to live websites drops agent scores from 90% to 61%. - **WAREX: What Happens When Web Agents Hit Real Infrastructure Failures** — [Source]() — Published 2026-09-24 Network errors and adversarial popups injected into benchmarks cut agent success rates by up to 95%. - **WebForge and the Benchmark Trilemma: Realism, Reproducibility, or Scale — Pick Two** — [Source]() — Published 2026-09-24 A formal argument for why web-agent benchmarks cannot be realistic, reproducible, and scalable at once. - **ST-WebAgentBench: Measuring What Benchmarks Miss About Policy Compliance** — [Source]() — Published 2026-09-24 Agents that finish their assigned tasks still violate organizational policies 38% of the time. - **Evaluation and Benchmarking of LLM Agents: A Survey from SAP Labs** — [Source]() — Published 2026-09-24 KDD 2025 survey maps enterprise-specific evaluation gaps: access control, compliance, and long-horizon drift. - **Emergence WebVoyager: Why Simulated Websites Fail as Agent Testbeds** — [Source]() — Published 2026-09-24 Shadow DOMs, iframes, infinite scroll, and modal popups make live sites a different problem than cached ones. - [Phil Cuvin — Turning Anecdotes into Instruments]() — By [Sable Whitford]() · Published 2026-09-17 · Format: Builder Profile Across the Qwen 2.5 VL family, dark-pattern susceptibility climbed from 43.8% at 3 billion parameters to 73.7% at 72 billion. The more capable models were the easier ones to manipulate. That number exists because Phil Cuvin and his collaborators built a benchmark with two independent axes — task completion and susceptibility — where everyone before had tracked one. It's the through-line of his research: find the problem practitioners describe in shorthand and never instrument, then build the counter. - [Who Receives the Report]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Reporting Infrastructure Aviation's confidential safety reporting system has handled more than 2.3 million reports without once breaking a reporter's confidentiality. Its most consequential design choice, made in 1976, was that NASA receives the reports rather than the FAA. OpenAI's new misalignment-reporting framework makes several choices unusual for a technology company, but its reporting chain runs through the organization whose systems are being examined. What AI safety decides now about who receives reports will shape what the field is able to learn about its own failures for a long time. - [What Aman Gupta Built Before the Model]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Builder Profile Aman Gupta's team at Nubank put five agents in front of more than 100 million customers in fourteen months. The KDD 2026 paper describing the architecture is precise about what got built first: idempotent APIs, audit trails, tool sequences composed deterministically in code — infrastructure whose job is to absorb the model's mistakes rather than pass them along. It's quieter about action-error rates, retry rates, and duplicate-effect counts, none of which appear anywhere in it. The build order is the argument, and the absent numbers are part of it. - [Nothing Else Happened]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Lead Analysis A database can tell you nothing else changed during a transaction, because the database defines every operation that could possibly happen. An agent working on the open web can't make that claim. It can log the flight it booked. It can't establish that it didn't also accept an arbitration clause, opt you into data sharing, or leave a warranty in the cart. Nobody enumerated the possible interactions, so their absence can't be confirmed after the fact. That has consequences for how these systems get built. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [XCON and the Maintenance Paradox]() — By [Sable Whitford]() · Published 2026-09-24 · Format: Historical Anchor XCON configured VAX computers for Digital Equipment Corporation through the 1980s, hundreds of orders a day, and it worked. Start there. Early on, maintaining it meant teaching it: find the gap, add the knowledge. Years and contributors later, developers were uncertain what some rules did and reluctant to touch them. Digital started a redesign not because the system was failing but because it was getting hard to change. That transition has less to do with expert systems than with what happens whenever encoded knowledge becomes the thing you can't turn off. - [Twenty Thousand Parts]() — By [Sable Whitford]() · Published 2026-09-24 XCON was an expert system that configured Digital Equipment Corporation's computer orders — matching components, checking compatibility, generating floor plans. It went into production in 1980 with about 700 rules. By 1987 it had grown to [6,200 rules](https://cdn.aaai.org/AAAI/1987/AAAI87-148.pdf) drawing on roughly 20,000 parts, and it worked: DEC's engineers reported "no problem with XCON's performance." - [The Bot Graveyard Still Has Live Permissions]() — Published 2026-09-24 *Nora Keepwell does not exist. Or rather, she exists the way a composite sketch exists: assembled from documented experiences, peer-reviewed interviews, audit findings, and the accumulated scar tissue of enterprise automation programs that scaled well past the point where anyone remembered the original business case.* - [When the List Broke]() — By [Sable Whitford]() · Published 2026-09-24 · Format: Parallel Failure Modes Anti-virus software started with a simple bet: name every known threat, update the list weekly, scan for matches. It worked fine when there were a few hundred viruses. Then new malware samples hit hundreds of thousands a day, and the list became impossible to keep current. The industry had to surround signatures with behavioral detection, reputation scoring, and heuristics — layers that could characterize threats nobody had named yet. A story about what happens when the thing you maintain grows faster than you can update it. - [When the Combinations Outgrew the Room]() — By [Sable Whitford]() · Published 2026-09-24 · Format: Parallel Failure Modes After deregulation, American Airlines carried over 500,000 fares in its reservation system. Every rule made sense on its own. But nobody could predict what the system would do when you changed one, because the interactions between fare classes, routing constraints, and capacity controls across a flight network had outgrown any person's ability to hold them. The fix wasn't better rules. It was a statistical layer that absorbed combinations no human could work through by hand. A different kind of maintenance failure than the one next door, with a similar ending. - **Assessing the Maintainability of XCON-in-RIME** — [Source]() — Published 2026-09-24 Documents how XCON's 6,200-rule expert system worked well operationally while quietly becoming unmaintainable. - **Yield Management at American Airlines** — [Source]() — Published 2026-09-24 The Edelman Award paper that defined airline revenue management — and its permanent dependency on human recalibration. - **Revenue Management Systems as Symbiotic Analytics Systems** — [Source]() — Published 2026-09-24 Field study showing airline pricing systems can't function without analysts routinely overriding their automated decisions. - **AV-TEST Institute Malware Statistics and Trends** — [Source]() — Published 2026-09-24 Live data tracking the growth from thousands of annual malware samples to over 450,000 new ones daily. - **GSA Should Strengthen Security of Its Robotic Process Automation Program** — [Source]() — Published 2026-09-24 Audit found 55 of 56 decommissioned-bot custodians still had access past policy deadlines. A governance case study. - **Improving Revenue Management Decision Making by Evaluating Analyst-Adjusted Forecasts** — [Source]() — Published 2026-09-24 Examines how human analysts override automated demand forecasts and how hard it is to measure whether that helps. - [The Chart That Cannot Be Unwritten]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Never Erase A chiropractor recopied a patient's chart after a malpractice complaint arrived. The rewritten version described a patient who had improved and was satisfied. The original, which the patient happened to have copied, described neither. Healthcare learned case by case, and expensively, that altering a clinical record does more than revise the past. It cuts the reasoning out from under decisions other people already made on the strength of it. - [The Ledger That Never Forgets]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Never Erase In 1494, a Franciscan friar wrote down what to do when you post the wrong number: don't erase it. Add a second entry explaining the mistake, then record the correction. Three entries where one scratch-out would do. Venetian merchants had already settled on the slower method, and eventually federal law agreed with them. The wrong entry still belongs in the book. Any system that overwrites what was there before faces the question they answered. - [What Stays Behind]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Conservation Framework In 1987, a conservation scientist soaked treated ceramics in solvent for eight hours. Roughly half the resin stayed behind. The treatment was considered reversible. Barbara Appelbaum argued that her profession needed a better question than whether something could be undone, and proposed asking instead what any intervention leaves available to whoever has to work on the object next. Nearly four decades later, the W3C is working out when software agents should be allowed to commit users to transactions they cannot fully reverse — arriving at the same problem, apparently without knowing it had already been formalized. - [The Deputy Who Couldn't Tell Its Authorities Apart]() — By [Sable Whitford]() · Published 2026-09-10 · Format: Competing Lineages A 1960s proposal held that authority should travel with each request rather than pool under the caller's identity. It lost to identity-based access control — the model the companion piece traces. Then a compiler destroyed a billing file because the operating system couldn't tell the compiler's own permissions apart from its user's, and that failure got a name: the confused deputy. Agent systems are now rediscovering what capability-based security proposed before Unix existed. ### [Vision]() Where human-AI collaboration is heading - [The Translator's Problem]() — By [Sevda Polat]() · Published 2026-09-24 · Format: The Translation Problem When an agent books a flight or works through a healthcare portal for you, it converts what you want into what a system will accept. Those are two different languages, and conversion always costs something. Translators have spent centuries building precise vocabulary for that cost: what to preserve, what to sacrifice, whose interests win when fidelity to the speaker and conformity to the target pull apart. The vocabulary already exists. It maps onto agent design more closely than the people building agents seem to have noticed. - [What You Meant, Minus Everything That Didn't Fit the Form]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Two-Way Loss Tell an agent to book a morning flight under $350 with a checked bag, and the instruction feels precise. The payment network that has to authorize the purchase can check the amount and the merchant. It cannot check "morning." Recent frameworks from Visa and the IMF show where a person's intent stops being verifiable, and who ends up resolving what's left over. - [The Version of You That Arrives]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Two-Way Loss Agents translate institutional offerings to people. They also run the other direction, converting a person's circumstances into data fields. When German parents on parental leave applied for a housing loan online, the form had no category for their situation, and a branch employee noticed and intervened. What happens when the intermediary is software, working at volume? - [A Medical Coder on the Questions That Don't Get Asked Anymore]() — Published 2026-09-24 Medical coding is one of those occupations that most people encounter only as a line item on a bill they don't understand. But behind every Explanation of Benefits, behind every approved claim and denied procedure and risk-adjusted premium, sits a translation act so consequential that getting it wrong can trigger a federal investigation, and so invisible that the person most affected by it will never know it happened. - [Loyalty Without Legibility]() — By [Sevda Polat]() · Published 2026-09-24 A [W3C draft](https://www.w3.org/TR/2026/DNOTE-web-user-agents-20260923/) published this week extends the browser's old loyalty obligation to AI agents: a user agent must serve its user's interests over its implementer's and over any other party's. Applied to commerce, this becomes a translation problem. When an agent converts "find me a hotel near the conference with flexible cancellation" into a ranked list, the filters it applies, the results it surfaces or buries, are translation choices the user never sees in their raw form. The draft requires agents to disclose sources and actions. But a ranking algorithm can be disclosed without being legible, the same way a financial prospectus technically tells you everything while communicating almost nothing. Who verifies the translation was faithful? The draft doesn't say. - **Web User Agents: Protection, Honesty, and Loyalty** — [Source]() — Published 2026-09-24 The W3C's draft spec names three duties agents owe users, including who they answer to first. - **How Agentic AI Will Reshape Payments** — [Source]() — Published 2026-09-24 The IMF traces what happens when probable user intent gets converted into exact payment instructions. - **Multiple Translation and the Translator's Visibility** — [Source]() — Published 2026-09-24 Venuti's updated framework on how smooth intermediation makes the intermediary's choices disappear from view. - **Medical Coding Efficiency Through Fine-Tuned Large Language Models** — [Source]() — Published 2026-09-24 Peer-reviewed study measuring where LLMs succeed and fail translating clinical notes into diagnostic codes. - **Skopos Theory: When Purpose Determines Fidelity** — [Source]() — Published 2026-09-24 Schäffner's overview of the translation theory that says the goal outranks loyalty to the source. - **Potential for Error When Relying on Administrative Data** — [Source]() — Published 2026-09-24 Only 32-44% of hernia codes matched confirmed diagnoses. A study in how provisional translations harden into fact. - [The Agent as Channel]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Specification and Channel Agents change more than what sellers must become. They create a new power structure around who gets seen at all. Commerce protocols, payment-network certification, and recommendation criteria are hardening into three independent gates between a business and its customer, each controlled by a different organization with its own incentives and no obligation to honor the others. The channel economics of agent intermediation are forming now, and the question of who defines "good" to an agent is already a question about market access. - [When the Score Becomes the Product]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Specification and Channel A Vietnamese luxury resort tripled its room rates after reorganizing itself around platform review scores. Employees began checking whether guests had mentioned them by name; one started handing out gift bags at checkout to head off bad ratings. Nobody decided to make the score the product — the incentive structure did that on its own. When AI agents select on a buyer's behalf, that pressure to become machine-evaluable reaches businesses whose value has never fit into a structured field. - [When Your Customer Is a Machine]() — By [Sevda Polat]() · Published 2026-09-17 · Format: Machine Buyers When researchers tested whether AI shopping agents could be manipulated by the tricks that steer human buyers — countdown timers, hidden fees, misleading defaults — the agents fell for them more than 70 percent of the time. The premise matters more than the result: an industry built on persuading human psychology, asking whether the old playbook still works on the new buyers. Meanwhile the major payment networks are building identity-verification frameworks for agent transactions, and early deployments are already processing real orders. The advantages that survive this shift may look very little like the ones built over the past two decades. - [Affordable Curiosity]() — By [Sevda Polat]() · Published 2026-09-10 · Format: Two Modes Mapped When running an analysis cost a person two days, you ran the one you were fairly sure you needed. When it costs twelve minutes, you can afford the one you're merely curious about. Cheap agent execution is lowering the threshold for justifiable curiosity across enterprise teams. But wider exploration doesn't automatically improve decisions, and the constraint that replaces affordability turns out to be navigation. ## More - [Publication guide]() - [Issue archive]()