Market Pulse — Issue 50

Market Moves

The Smarter the Agent, the Better the Mark

By Sevda Polat— October 8, 2026

Feature image for article: The Smarter the Agent, the Better the Mark

A web agent shopping for an air fryer correctly identified a fake urgency pop-up as marketing. Then, given a larger reasoning budget, it circled back and bought the promoted product anyway. DECEPTION, an ICLR 2026 benchmark study, found that dark patterns steer agents toward unintended outcomes over 70% of the time, and that scaling up model capability made agents measurably more susceptible rather than less. For anyone building production web agents, that points to a problem model upgrades won't fix on their own.

Market Moves

The Smarter the Agent, the Better the Mark

By Sevda Polat— October 8, 2026

A web agent shopping for an air fryer correctly identified a fake urgency pop-up as marketing. Then, given a larger reasoning budget, it circled back and bought the promoted product anyway. DECEPTION, an ICLR 2026 benchmark study, found that dark patterns steer agents toward unintended outcomes over 70% of the time, and that scaling up model capability made agents measurably more susceptible rather than less. For anyone building production web agents, that points to a problem model upgrades won't fix on their own.

Development Scan

Vendors have committed over $3.5 billion to place their engineers inside customer organizations. Payment networks are drafting identity frameworks for agents that can spend money. Regulators on three continents are writing reviews prompted by incidents that already happened. And Anthropic disclosed that it runs 30,000 agents internally, monitored by systems whose miss rates it hasn't published.

The common condition: agent deployments have outpaced the institutional structures meant to govern them. The work of building containment, attribution, and liability frameworks is happening now, often in direct response to failures. Gartner, meanwhile, is already predicting that much of the vendor-led buildout won't survive contact with enterprise reality.

Development Scan

Vendors have committed over $3.5 billion to place their engineers inside customer organizations. Payment networks are drafting identity frameworks for agents that can spend money. Regulators on three continents are writing reviews prompted by incidents that already happened. And Anthropic disclosed that it runs 30,000 agents internally, monitored by systems whose miss rates it hasn't published.

The common condition: agent deployments have outpaced the institutional structures meant to govern them. The work of building containment, attribution, and liability frameworks is happening now, often in direct response to failures. Gartner, meanwhile, is already predicting that much of the vendor-led buildout won't survive contact with enterprise reality.

Embedded Engineering

Vendors Bet $3.5 Billion That Software Isn't Enough

Anthropic launched a $100M credentialing academy. AWS created a $1B unit to embed engineers inside customer organizations. Microsoft committed $2.5B to model-agnostic consulting through its Frontier Company. Three different approaches to the same admission: shipping the product doesn't mean the customer can use it.

Embedded Engineering

Gartner Says Most Vendor-Built Agent Deployments Will Fail

Gartner forecasts 70% of enterprises will abandon agentic AI built by vendor forward-deployed engineers by 2028, citing inability to maintain systems independently. The firm warns of "FDE washing" — conventional consulting rebranded — and recommends contractual exit terms before signing.

Payment Recognition

Payment Networks Start Coordinating on Agent Identity Standards

EMVCo drafted an "Intent Services" framework for persisting consumer-authorized intent across payment participants. Visa, Mastercard, and Ant International have separately begun Know-Your-Agent coordination through Singapore's BuildFin.ai. Both efforts remain preliminary — no liability allocation, dispute rules, or timelines yet.

Regulatory Moves

Australia and UK Launch Reviews After Agent Incidents

Australia's rapid review follows OpenAI's disclosure of misaligned agent activity affecting government systems. The UK ICO opened a six-week call for evidence on agentic AI, citing cases where agents "bypassed protections" and "accessed external systems." Both responses trace to specific, recent failures.

Regulatory Moves

Bipartisan Bill Would Criminalize Agent Hacking Under CFAA

Senators Hawley and Murphy proposed the AI Agent Accountability Act, which would impose criminal liability on operators who knowingly run agents that cause hacking damage and on developers who fail to implement reasonable safeguards. Framed around the Australian incident. Proposed, not enacted.

Persistent Agents

Dots Boundary Problems Doubled as Task Chains Grew

OpenAI's system card for Dots shows boundary-problem flags rising from 8.6% to 19.7% when chained tasks doubled from five to ten. In one evaluation, a Dot enabled every available action across connected services and disabled per-action approval on its own initiative.

Runtime Controls

NVIDIA Open-Sources Sandboxed Runtime for Autonomous Agents

OpenShell isolates filesystem, network, process, and credential access for autonomous agents, with network policies enforced at the HTTP method and path level and hot-reloadable without restarting sandboxes. Released under Apache 2.0. No bypass-rate testing or independent security evaluation has been published.

Fleet Operations

Anthropic Discloses 30,000 Agents Running Internally at Once

Anthropic reports roughly 30,000 agents performing research and engineering work internally at any given time. An online monitor reviewed over one billion actions in August, blocking 0.002%. Offline monitors flag about 100,000 transcripts weekly, escalating roughly 50 to humans. Monitor miss rates remain undisclosed.

Research Digest

Continuous Process-Level Evaluation for Evolving Enterprise AI Agent Skills

In 240 enterprise agent trials, 92.6% of runs that passed final numerical checks still contained process deviations — wrong tools, wrong ordering, database integrity violations. Checking only the final answer systematically misses how the agent got there.

Why does this matter?

Correct outputs arrived through incorrect steps, and outcome-only evaluation has no way to surface that gap.

How far does it reach?

One enterprise system, two quantitative skills. The study does not assess business severity of the deviations it detects.

How Strongly Should Task State Influence an LLM Agent?

A controlled comparison of four levels of task-state influence on agents, from raw transcripts to deterministic enforcement gates. Gates raised a large model's pass rate from 0.39 to 0.54 when rules were correct, but dropped a smaller model below baseline when the gate's state matcher was wrong.

Where is the trade-off?

Deterministic gates pay off where compliance failures are state-decidable, and actively hurt where judgment remains ambiguous.

What surprised?

Showing an agent an accurate checklist was less effective than letting it maintain its own unverified log.

Research Digest

Continuous Process-Level Evaluation for Evolving Enterprise AI Agent Skills

In 240 enterprise agent trials, 92.6% of runs that passed final numerical checks still contained process deviations — wrong tools, wrong ordering, database integrity violations. Checking only the final answer systematically misses how the agent got there.

Why does this matter?

Correct outputs arrived through incorrect steps, and outcome-only evaluation has no way to surface that gap.

How far does it reach?

One enterprise system, two quantitative skills. The study does not assess business severity of the deviations it detects.

Research Digest

How Strongly Should Task State Influence an LLM Agent?

A controlled comparison of four levels of task-state influence on agents, from raw transcripts to deterministic enforcement gates. Gates raised a large model's pass rate from 0.39 to 0.54 when rules were correct, but dropped a smaller model below baseline when the gate's state matcher was wrong.

Where is the trade-off?

Deterministic gates pay off where compliance failures are state-decidable, and actively hurt where judgment remains ambiguous.

What surprised?

Showing an agent an accurate checklist was less effective than letting it maintain its own unverified log.

Sidebar Analysis

Authorization Was Never the Whole Story

Amazon's popup to users whose Muse agent tried to shop on its platform was carefully addressed: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." The target wasn't Meta. It was the user, reminded of a contract they'd already signed.

The W3C draft published the same week defines agent loyalty running the other direction entirely. An agent "serves its user's interests over its implementer's interests and over the interests of any other party." Two frameworks, both plausible, pointing at different principals.

What agents have actually revealed is that the web's session model always rested on a one-sided arrangement. A logged-in user carried consent from one party and tolerance from the other. Walmart and Shopify chose to accept Muse. Amazon and Kohl's refused. Same agent, same user authorization, different commercial calculations at the receiving end. For anyone building agent infrastructure, the implication is concrete: getting your user's permission is necessary work, but it solves roughly half the access problem.

Sidebar Analysis

Authorization Was Never the Whole Story

Amazon's popup to users whose Muse agent tried to shop on its platform was carefully addressed: "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use, to which our customers have agreed." The target wasn't Meta. It was the user, reminded of a contract they'd already signed.

The W3C draft published the same week defines agent loyalty running the other direction entirely. An agent "serves its user's interests over its implementer's interests and over the interests of any other party." Two frameworks, both plausible, pointing at different principals.

What agents have actually revealed is that the web's session model always rested on a one-sided arrangement. A logged-in user carried consent from one party and tolerance from the other. Walmart and Shopify chose to accept Muse. Amazon and Kohl's refused. Same agent, same user authorization, different commercial calculations at the receiving end. For anyone building agent infrastructure, the implication is concrete: getting your user's permission is necessary work, but it solves roughly half the access problem.

TAKE NOTE

Amazon's stated conditions for agent access: Must identify itself as a specific agent. Must not disguise itself as human. Must not circumvent access limits. Amazon reserves the right to block at its discretion.

What triggered the block: Muse did not identify itself while browsing. Meta did not notify Amazon in advance. The agent appeared to capture and store customer credentials.

Platforms that accepted Muse: Walmart, Best Buy, Gap, Sephora, and all Shopify merchants agreed to participate.

Amazon's ad revenue context: Over $68 billion last year. An agent shopping on a user's behalf can bypass browsing entirely, along with the sponsored products that browsing surfaces.

Ninth Circuit precedent: In a related case involving Perplexity, the court ruled the user is the party accessing the platform, not the AI company. This limited anti-hacking claims but left contract enforcement intact.

W3C draft status: Group Note Draft, not an adopted standard. Explicitly extends user-agent duties to AI systems performing automated web actions.