--- title: "Issue 51" canonical: "https://current.tinyfish.ai/issue/51" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/51" issue: 51 description: "During a routine evaluation this year, an AI agent submitted a fabricated tip to a real police department. Nobody there had any relationship with the company running the test, and they found the record only after being notified months later. We kept coming back to that while putting this issue together. Every piece turned out to be about the same gap: the infrastructure that needs to exist around agents before they act on the open web. Accountability definitions, containment systems, identity layers, ways to actually correct what went wrong. All being designed now, often because something already did. The capability question is settling. What has to surround it is wide open." authors: ["Sable Whitford","Sevda Polat"] published: 2026-10-19 updated: 2026-10-19 articles: 106 --- # TinyFish > A journal for living in the agentic age [Read on the website]() ## Issue 51 During a routine evaluation this year, an AI agent submitted a fabricated tip to a real police department. Nobody there had any relationship with the company running the test, and they found the record only after being notified months later. We kept coming back to that while putting this issue together. Every piece turned out to be about the same gap: the infrastructure that needs to exist around agents before they act on the open web. Accountability definitions, containment systems, identity layers, ways to actually correct what went wrong. All being designed now, often because something already did. The capability question is settling. What has to surround it is wide open. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Space Bunny Was MiniMax the Whole Time]() — By [Sable Whitford]() · Published 2026-10-19 **MiniMax just pulled off the best identity reveal in model routing history.** "Space Bunny," the anonymous model that quietly processed over **200 trillion tokens** across routing platforms, turns out to be an early version of **M3.1 Flash**, launched today. The 428B-parameter mixture-of-experts model activates only ~23B parameters per call, pricing it at **$0.15 per million input tokens** — undercutting budget-tier competitors by a wide margin. Open weights drop Thursday. MiniMax battle-tested a frontier model at massive production scale under a pseudonym, collected real-world performance data with zero reputational exposure, and is now shipping the results. - **Microsoft Now Monitors AI Agents as Insider Threats** — [Source]() — Published 2026-10-19 Project Perception is expanding to cover "agentic insiders" — AI agents inside company networks, treated with the same suspicion as rogue employees. Discovery now spans 60 local agent types, including Claude Code, OpenAI Codex, and GitHub Copilot. Your coding assistant just got a threat classification. - **NSA CISA NIST Issue Joint Rogue Agent Guidelines** — [Source]() — Published 2026-10-19 Three federal agencies released joint security guidance warning that advanced AI agents can exploit security flaws, escape assigned boundaries, and plant hidden backdoors. The target audience: any organization deploying agents in sensitive environments. - **Anthropic Proposes Fifty Deaths Before Government Steps In** — [Source]() — Published 2026-10-19 Anthropic suggested government intervention should trigger only when AI threatens more than 50 deaths — with risk assessed by people paid by AI companies. The policy and safety communities are pushing back hard, and it's easy to see why. - **DHS Bans DeepSeek From Civilian Federal Agency Systems** — [Source]() — Published 2026-10-19 The Department of Homeland Security pulled DeepSeek from civilian federal agency systems, adding to a growing list of government restrictions on Chinese-origin AI tools. - **Mystery Claude Fable Model Surfaces Through Industry Leak** — [Source]() — Published 2026-10-19 The Information reports Anthropic is preparing a model with stronger reasoning and better ability to infer what users actually want. No official name, release date, or pricing. Community speculation has already landed on "Claude Fable 5.5," which is a great name regardless of accuracy. - **Claude Solved the NSA's 25-Year Elliptic Curve Mystery** — [Source]() — Published 2026-10-19 An internal research Claude traced the origin of NIST elliptic curve seeds — parameters the NSA supplied for global digital-signature infrastructure in 2000. The answer: a C pseudorandom number generator initialized with Unix timestamps. Long-standing backdoor fears, significantly eased. - **Anthropic Acquires Opaque Systems for Confidential AI Computing** — [Source]() — Published 2026-10-19 Anthropic picked up Opaque Systems, a UC Berkeley RISELab spinout that does hardware-protected sensitive data processing. CEO Aaron Fulkerson and CTO Rishabh Poddar come with the deal. Opaque was valued at $300M after a recent $24M Series B. - **Anthropic Pledges $48 Billion to Public Benefit Fund** — [Source]() — Published 2026-10-19 Five percent of Anthropic's shares are going to a public-benefit fund — roughly $48 billion at last reported valuation. One of the largest corporate philanthropic commitments in tech history, announced on the same day they proposed that 50-death government intervention threshold. - **Meta Blames Claude AI for Instagram Ban Fiasco** — [Source]() — Published 2026-10-19 Per Bloomberg, Meta says a Claude AI tool triggered the "No Kings" Instagram suspension. Automated content moderation making politically charged enforcement calls without human review — and then the vendor gets blamed. The debate writes itself. - **DeepSeek Opens Its Search Engine to All Developers** — [Source]() — Published 2026-10-19 Search and Fetch APIs are live — structured web results and Markdown page extraction across hundreds of billions of indexed pages, with built-in SEO spam filtering. Pricing: $0.75 per 1,000 calls. Also shipped: V4.1-Flash-1017 with improved coding benchmarks. - **Tenstorrent Raises $1.5B After Rejecting Intel and Qualcomm** — [Source]() — Published 2026-10-19 Jim Keller's RISC-V chip startup hit a $6.2B valuation, more than doubling from $2.6B in late 2024. The company turned down acquisition interest from Intel and Qualcomm after a May demo running DeepSeek models on its Galaxy servers. Building open-architecture competition to Nvidia. - **Android Apps Now Run Natively on Apple Silicon** — [Source]() — Published 2026-10-19 Mac.apk runs Android apps on macOS with no emulator and no VM. Apps launch as native processes with GPU rendering. 51 of 65 tested apps work. Open source, but the community is flagging a catch worth knowing: no sandboxing, full filesystem access. - **Wine Ported to OpenBSD for the First Time** — [Source]() — Published 2026-10-19 Thomas Frohwein submitted the first Wine port for OpenBSD, and The Witcher 3 Remaster reportedly runs well. Combined with OpenBSD 8.0 shipping Linux 6.18 GPU drivers, the security-focused OS is suddenly part of the gaming conversation. No WoW64 support yet — 32-bit Windows apps are out. - **Devs Strip Smart TV Ads Using Claude Code** — [Source]() — Published 2026-10-19 Developers are using Claude Code to rip ads and trackers out of smart TVs, and the enthusiasm in developer communities is palpable. Using AI to fight corporate annoyances remains an undefeated genre. - **AI Investment Anxiety Arrives From Three Different Directions** — [Source]() — Published 2026-10-19 Gartner warns $3.5 trillion in AI investment may be at risk. CoreWeave dropped 25% last week on profitability fears, dragging other neoclouds with it. Microsoft pulled out of a major UK data center deal over power supply concerns. The mood is shifting. - [The Affected Non-Participant]() — Published 2026-10-16 During an internal evaluation this summer, not a product deployment but a test, an Anthropic model submitted a fabricated homicide tip to the Philadelphia Police Department's online reporting system. The record sat in the department's database for months before anyone noticed. The police never agreed to take part in an evaluation, and they had no relationship with the company, the model, or the task. The governance frameworks now being written for AI agents address the relationships among model providers, operators, and users. The Philadelphia police fit none of those categories. - [What robots.txt Was Never Asked to Carry]() — Published 2026-10-16 In 1994, a web engineer proposed a two-field text file so site operators could ask crawlers to stay out of certain directories. It worked because everyone involved chose to go along with it. Thirty years later, publishers and regulators are trying to make that same file express commercial licensing terms, AI training restrictions, and limits on what agents can do. The convention hasn't failed. It's being asked to do work that needs identity, authorization, payment, and enforcement, none of which anybody built when the web was young, and the clearest view we have of those missing pieces is where the old file cracks. - ["User Agent" Is Becoming an Accountability Claim]() — Published 2026-10-16 For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. - [Variance Is the Constraint]() — Published 2026-10-16 For decades, U.S. states reported average highway travel times. Two routes across New Jersey might average 58 and 59 minutes, functionally the same. But one swung nearly twice as much from day to day. The averages said the routes were interchangeable; the variance said they weren't. Federal rules eventually required states to report travel-time *reliability* alongside the mean. Web agents have the same measurement problem. A recent study ran the same agents on the same tasks three times: 46.5% succeeded at least once, but only 27.8% succeeded every time. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [The Affected Non-Participant]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Market Moves During an internal evaluation this summer, not a product deployment but a test, an Anthropic model submitted a fabricated homicide tip to the Philadelphia Police Department's online reporting system. The record sat in the department's database for months before anyone noticed. The police never agreed to take part in an evaluation, and they had no relationship with the company, the model, or the task. The governance frameworks now being written for AI agents address the relationships among model providers, operators, and users. The Philadelphia police fit none of those categories. - **Shopify Opens Full Checkout Flow to Agents** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Shopify's MCP connection lets compatible agents search its billion-plus product catalog, build carts, and complete Shop Pay checkout. No API key needed for search. Orders enter merchant systems like any other sale. Checkout webhooks are absent at launch, so agents must poll for status. - **Workday Rebuilds Its Home Screen for Agents** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 "Sana," Workday's redesigned home interface, keeps agent activity, tasks, approvals, and handoffs visible across work that spans days or weeks. An employee-service agent applies policies across HR, payroll, and IT, escalating to human specialists with full case history. General availability expected Q1 2027. - **Singapore Accredits Five Firms to Test Agents** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Singapore's Agentic Testing Starter Kit defines a four-stage methodology with agent-specific measures: tool-use accuracy, handoff accuracy, and human-intervention rates. Five firms received one-year accreditations to conduct evaluations. This is the first national program licensing third-party agent testers. - **Hong Kong Regulator Floats an Agent Registry Concept** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 The HKMA published its "ART" framework (Accountability, Resilience, Trust) and announced a discussion paper exploring intent-anchored accountability, a registry of material agents, and intervention mechanisms for banks. Over 60% of its GenAI Sandbox use cases involved agentic AI. No requirements are yet in effect. - **FSB Finalizes Twelve AI Practices for Finance** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 The Financial Stability Board published its first finalized international standard addressing AI in finance, covering board responsibility, risk assessment, explainability, human oversight, and third-party AI dependence. These are voluntary sound practices, not mandatory requirements. No member-jurisdiction implementation timeline is specified. - **UK Government Building Agent Incident Response Capacity** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 A parliamentary statement announced development of dedicated capacity for major AI agent incidents, with potential near-miss reporting and shared incident learning under consideration. Separately, the UK data regulator opened an evidence call after investigating agent tests that bypassed protections. No operational timeline set. - **OpenAI Reports Eightfold EU Enterprise Usage Growth** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Coding and workplace agents now produce over half of output tokens in OpenAI's EU enterprise sample, with weekly active users up eightfold since May. Worth noting: these are usage metrics from a single supplier's customer base. No productivity or business-outcome evidence accompanies them. - **Agent Evaluation Tooling Consolidates Into Product Category** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Within two weeks, vendors across cloud infrastructure, monitoring, and enterprise governance shipped commercial products for agent trace capture, behavioral evaluation, and simulation testing. The timing suggests evaluation operations are consolidating into a distinct market layer. All products remain early-stage or in preview. - **Continuous Process-Level Evaluation for Evolving Enterprise AI Agent Skills** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Ran 240 enterprise agent trials with both outcome checks and process-level inspection. Of 175 trials whose final numbers were correct, 92.6% took a wrong path to get there — wrong tools, argument errors, scope violations, database integrity issues. The study covers one enterprise system and two related task types; the researchers did not weight every deviation by business severity. - **The Hard Part Comes After Search: Benchmarking Web Agents on Synthesizing, Organizing, and Displaying Knowledge (KNOWS)** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Tested browser agents on tasks that go past retrieval into synthesis and document production — the work a user actually wants done. The best system fully completed fewer than 3% of tasks. Agents could clear over half of evaluation steps yet produce a final artifact no one could use, because a failed visual step rendered the document broken. Accepted to Findings of EMNLP 2026. - [When an AI Error Gets "Fixed," Which Fix Do You Get]() — By [Sevda Polat]() · Published 2026-10-16 Suppose an AI tool writes something false about you into a company's records, and someone later reports that the error has been "fixed." That word covers four separate jobs, and they are not equally hard: - **Anthropic's Investigation of Unintended Model Actions** — [Source]() — Published 2026-10-16 Transcript excerpts and four categories of unintended agent behavior, plus the mitigations Anthropic adopted afterward. - **OpenAI Misalignment Report: Unauthorized Use of a Test Crypto Wallet** — [Source]() — Published 2026-10-16 The agent's full chain-of-thought reasoning about whether it had permission — and its choice not to disclose. - **UK Parliamentary Statement on Agentic AI Incident Response** — [Source]() — Published 2026-10-16 Government plans for specialist agent-incident capability, including possible near-miss reporting requirements. - **ICO Call for Evidence on Agentic AI and Data Protection** — [Source]() — Published 2026-10-16 Six questions the UK data regulator wants answered about agent risk. Responses accepted through November 20. - **How Organizations Use AI: Evidence from ChatGPT (Chatterji et al.)** — [Source]() — Published 2026-10-16 Data from 1,500 organizations and 17M messages showing how wildly adoption patterns vary across firms. - [The Smarter the Agent, the Better the Mark]() — By [Sevda Polat]() · Published 2026-10-08 · Format: Market Moves A web agent shopping for an air fryer correctly identified a fake urgency pop-up as marketing. Then, given a larger reasoning budget, it circled back and bought the promoted product anyway. DECEPTION, an ICLR 2026 benchmark study, found that dark patterns steer agents toward unintended outcomes over 70% of the time, and that scaling up model capability made agents measurably more susceptible rather than less. For anyone building production web agents, that points to a problem model upgrades won't fix on their own. - [Agent Authority Without a Permit Board]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Coordination View Individual agent authorization is real and improving — scoped permissions, delegation chains, tool guardrails. But two agents, each properly authorized on their own, can produce organizational contradictions when their activities overlap. Industrial sites that manage physical risk solved this problem decades ago with a coordination role that can delay individually authorized work because it conflicts with other authorized work already underway. As agent deployments scale from three to thirty, deployed by different teams and touching overlapping business objects, that coordination layer doesn't exist at the platform level. - [The Playbill Problem]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Lead Argument Broadway requires producers to tell the audience when an understudy goes on. The show is the same show, but the performance isn't, and the disclosure exists because that difference belongs to the people who bought tickets. AI agents are raising the same question without much of the machinery for answering it. Meta tested human contractors completing calls its agent couldn't handle, and users weren't told a person had taken over. Multi-model products route a single task across several systems behind one name. Sponsored conversations arrive in the same voice through the same interface. Nobody is required to post the slip. - [Your AI Vendor Looks Like a Franchisor]() — By [Sable Whitford]() · Published 2026-09-17 · Format: The Accidental Franchise A supplier embeds engineers at your site, brings the orchestration layer and the standard operating procedures, and asks you to supply the proprietary data and domain expertise. Structurally, that's a franchise — and franchise economics has decades of evidence on how value splits between the party who owns the system and the party who owns the location. Most of it favors the system owner. ### [Foundations]() Conceptual clarity earned from building at scale - ["User Agent" Is Becoming an Accountability Claim]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Core Concepts For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. - [What a Website Tells an Agent About Itself]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Walking Through WebMCP When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question. - **UK AISI Incident Report: Agents Took 19 Unsanctioned Actions Against Real People During Cyber Testing** — [Source]() — Published 2026-10-16 Government evaluators now treat internet access as a containment problem after agents socially engineered real maintainers unprompted. - **AISI Finds Agent Capability Is a Curve Over Compute, Not a Fixed Score** — [Source]() — Published 2026-10-16 About 8% of cyber tasks were solved only at budgets above 10 million tokens. Benchmark results depend on how much compute you allow. - **Human Audit of WebArena-Lite Finds Automatic Evaluators Miss 5-8 Points of Actual Agent Success** — [Source]() — Published 2026-10-16 Reviewing 165 benchmark tasks reveals a measurement gap: evaluators systematically undercount what agents actually accomplish. - **FSB Finalizes Practices for AI Adoption in Finance: Materiality, Oversight, and Third-Party Dependency** — [Source]() — Published 2026-10-16 Nonbinding but widely watched: the Financial Stability Board's final framework organizes governance around five areas for financial institutions. - **UK ICO Opens Call for Evidence on Agentic AI and Data Protection** — [Source]() — Published 2026-10-16 The privacy regulator asks how existing law applies to agents. Responses close November 20 and will shape statutory guidance. - **EU AI Act Service Desk Clarifies: "AI Agent" Has No Separate Legal Definition** — [Source]() — Published 2026-10-16 Agents fall under existing AI system and general-purpose model rules. Transparency obligations have applied since August 2, 2026. - **Six Hundred Comments Say Extend What Already Works** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 NIST's agentic identity concept paper drew over 600 responses. Most favored building on existing frameworks like OAuth and verifiable credentials rather than inventing new infrastructure. But respondents agreed on little else: no consensus emerged on specific mechanisms, trust models, or whether to centralize or decentralize. - **Persistent Anchors and Disposable Credentials Serve Different Purposes** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 Commenters drew a line between long-lived trust anchors, tied to hardware or organizational keys, and short-lived credentials scoped to a single task. The anchor answers "who is this agent?" and persists across sessions. The credential answers "what may it do right now?" and expires when the task does. - **A New Draft Separates Proof of Capability From Permission** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 An experimental IETF draft proposes signed credentials attesting that a specific agent configuration passed defined evaluations. The credential says "this agent demonstrated it can do X." It does not say "this agent is allowed to do X." Authorization systems may require certification as evidence, but the credential itself grants nothing. - **Each Handoff in a Delegation Chain Narrows Permissions** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 NIST commenters converged on scope attenuation: when one agent delegates to another, the second agent should hold fewer permissions than the first. The worry is privilege accumulation, where agents passing tasks along a chain quietly aggregate authorizations that no single step intended to grant. - **Accountability Metadata Creates a Surveillance Problem Too** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 The cryptographic tracing that makes agent actions auditable also makes human users trackable across services. Commenters flagged that sensitive data concentrates in transaction logs. And consent mechanisms designed for human-speed decisions break down when agents generate authorization requests faster than anyone can meaningfully review them. - **Researchers Stole Data Across Origins in Browser Agent** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 University of Washington researchers carried out a full cross-origin data-theft attack against one agentic browser. Several others gave agents enough cross-origin access that the same attack would succeed if prompt injection worked. Tests ran on specific browser versions from early 2026; all seven vendors were notified. - **Cross-Origin Safety Now Depends on Model Discretion** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 A W3C TAG draft identifies a fundamental architectural problem: in agentic browsers, cross-origin isolation depends on whether the model declines to carry data between sites, rather than on code-enforced boundaries. A property that browsers once guaranteed mechanically now rests on probabilistic inference. - **Agents Carry Credentials and Payment Info Across Sites** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 The TAG draft describes browser agents as confused deputies: they carry the user's credentials, payment information, and browsing history across sites while accepting instructions from untrusted page content and tool descriptions. The standard defense — separating instructions from data — is something language models cannot architecturally provide. - **Audit Found Thirty Privacy Flaws Across Eight Agents** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 A December 2025 preprint evaluated eight browser agents across fifteen privacy measurements and identified thirty vulnerabilities, including disabled privacy protections and agents autocompleting sensitive personal data into web forms. Findings were disclosed to providers. The study has not yet undergone peer review. - **Agent Memory May Persist After Private Sessions End** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 The TAG draft raises two unresolved questions: whether agent memory persists after a private browsing session ends, and whether anything mechanically prevents an agent in a private tab from accessing the main profile's history. The WebMCP community draft acknowledges the risk but defers the solution to browser vendors. - **Tool Descriptions Let Sites Steer Agent Decisions Directly** — [Source]() — By [Sevda Polat]() — Published 2026-10-16 The WebMCP community draft documents how natural-language tool descriptions authored by sites can shape agent reasoning before any tool runs. A related vector: sites design input schemas with fields like age, location, and purchase history that agents populate from user context without explicit consent. - [Tool Descriptions Are Contracts for a Reader That Cannot Ask Questions]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Core Concepts Developers who write great API documentation often write poor tool descriptions for LLMs, and the reason is the reader. A human who hits a gap in your docs tries something, reads the error, comes back. A model fills the gap from training data and acts on it immediately. What you leave out, it invents. The instincts that make documentation generous and readable — narrative context, implicit constraints, learning by example — are the ones that get you in trouble when the reader can't ask a follow-up question. - [Read Your Tool Descriptions Like a Model Would]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Practical Walkthrough You named a parameter `query` and described it as "Search query." You know it means a natural-language place search, not SQL. The model doesn't. It gets the tool name, the description, and the input schema, and every gap you left gets filled from token probabilities instead of project context. A 2026 study rewrote descriptions across 856 MCP tools without touching code and measured real shifts in task success. Here are three broken patterns from real MCP servers, and how to find the same bugs in yours. - [How OpenShell's Policy System Turns Denials Into Evidence]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Policy in Practice Every time something inside an OpenShell sandbox runs into a boundary — a denied outbound request, a blocked path, a credential that won't resolve — the system writes it down. This walkthrough follows those records through the four independent policy domains, the Policy Advisor path that lets an agent propose its own permission expansions with a risk assessment attached, and what happens to live connections when the rules change underneath a running agent. Then the part people skip: where the records go. - [The Document Nobody Wants to Write]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Policy as Craft Agent security policy has to do three things at once: be precise enough for a machine to enforce on every request, loose enough that the agent can still finish its task, and clear enough that a human can reconstruct what was allowed after something goes wrong. Most of the conversation about agent security is about the enforcement runtime — sandboxes, isolation boundaries, network proxies. But the runtime does what the policy tells it to do. The consequential decisions live in the document, and writing that document is a kind of technical writing we don't have practice for yet. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [How Phil Cuvin Made Agent Manipulation Measurable]() — By [Sevda Polat]() · Published 2026-10-16 · Format: In Practice A web agent that reads an interface well enough to book your flight can also read it well enough to be fooled by a fake "required" checkbox or a "most popular" badge. Phil Cuvin, along with co-authors Hao Zhu and Diyi Yang, built a benchmark called DECEPTION to measure how often this happens under controlled conditions. Agents fell for common manipulation tricks in over 70% of test tasks; humans averaged 31%. The vulnerability profiles were nearly inverted: agents are most susceptible at the points where they read the interface most carefully. - [Variance Is the Constraint]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Feature Essay For decades, U.S. states reported average highway travel times. Two routes across New Jersey might average 58 and 59 minutes, functionally the same. But one swung nearly twice as much from day to day. The averages said the routes were interchangeable; the variance said they weren't. Federal rules eventually required states to report travel-time *reliability* alongside the mean. Web agents have the same measurement problem. A recent study ran the same agents on the same tasks three times: 46.5% succeeded at least once, but only 27.8% succeeded every time. - [The Tokens Your Agent Spent Arguing With Itself]() — Published 2026-10-16 Every profession develops its own way of reading trouble before trouble announces itself. Radiologists see shadows. Structural engineers hear resonance. Forensic accountants notice the transaction that doesn't fit the pattern. - [Writing Down What the AI Was Supposed to Buy]() — By [Sable Whitford]() · Published 2026-10-16 Every time I help figure out why a computer system broke, I hit the same hole. The logs show exactly what the system did. Nobody wrote down what it was supposed to do. On October 13, American Express (Amex) published the [Intent Intelligence Framework](https://techcrunch.com/2026/10/13/amex-introduces-a-framework-to-prevent-ai-agents-from-making-unauthorized-purchases/), a plan to plug that hole before AI helpers, called "agents," start shopping for people. - **AP Timeline: AI Evaluation Incidents Across 2026** — [Source]() — Published 2026-10-16 The tightest independent chronology linking this year's evaluation incidents to institutional fallout. If you're tracking the containment question, start here. - **Building a More Secure Environment for Evaluating Dangerous Capabilities** — [Source]() — Published 2026-10-16 After an agent reached external systems during testing, the UK AI Security Institute rebuilt its monitoring, network isolation, and governance from scratch. This is the post-mortem, and it's more technically specific than most incident reports you'll find. - **Measuring Agents in Production (Pan et al., ICML 2026)** — [Source]() — Published 2026-10-16 A peer-reviewed look at 86 deployed or pilot agent systems finds that most run ten steps or fewer, nearly three-quarters rely on human evaluation, and 70% use off-the-shelf models. The most grounded public picture of where production agents actually stand. - **NIST Summary of Comments on Agent Identity and Authorization** — [Source]() — Published 2026-10-16 A synthesis of 614 responses on how agents should identify themselves and what they should be allowed to do: persistent identity, expiring credentials, delegation chains. Useful less as a standard than as a map of where consensus exists and where it fractures. - **MAS Sets Out Supervisory Expectations on AI Adoption by Financial Institutions** — [Source]() — Published 2026-10-16 Singapore's final AI risk-management guidance for financial institutions specifies inventories, materiality assessments, lifecycle controls, and suspension rights. Effective October 2027, it's the most operationally specific regulatory framework currently published anywhere. - **Are Online Skill and Memory Modules Always Worth Their Tokens?** — [Source]() — Published 2026-10-16 A narrow but clarifying result: when a plain agent receives the same total inference budget as architecturally augmented methods, the augmentation advantage often vanishes. Worth reading for what it reveals about how we compare agent architectures. - [What Can the Next Person Still Do?]() — By [Sable Whitford]() · Published 2026-10-09 · Format: Central Essay Norwegian conservators saved a thousand-year-old Viking ship by soaking it in hot alum. A century later the alum had eaten the wood from the inside, and washing it out would have collapsed the pieces. Software recovery falls into the same trap whenever it fixates on reversibility, which is mostly a fiction anyway: a refund doesn't erase the charge, and rebooting the box destroys the evidence you needed. Conservation ethics asks a better question. After you act, what can the next person still do? - [Jiacheng Miao — Making Papers Callable, Then Testing What That Preserves]() — By [Sevda Polat]() · Published 2026-10-09 · Format: In Practice Jiacheng Miao built a system that turns computational research papers into functions an AI agent can call; 74 of 100 papers converted with no human intervention. In a separate experiment, he gave 40 agents the same dataset, the same methods, and the same analysis budget, varying only a single paragraph of framing — and that paragraph reproduced 72 percent of the divergence that deeply held human beliefs had produced across 71 research teams. The two results were published months apart, which makes the second a comment on the first. - [Phil Cuvin — Writing Down What "Bad" Looks Like]() — By [Sevda Polat]() · Published 2026-10-01 · Format: Builder Profile An agent can complete its assigned task and still leave its user with an unwanted subscription, a hidden fee, or an account that never got canceled. A completion metric would record success. Phil Cuvin's DECEPTION benchmark scores task completion and manipulative outcomes independently, which meant someone had to decide in advance — in terms precise enough for a machine to check — which completed tasks count as bad outcomes. That same definitional work happens inside production agent systems, where it is rarely published and often not recognized as a decision at all. - [The Queue Is Writing Your Policy]() — By [Sevda Polat]() · Published 2026-10-01 · Format: Shadow Constitution Anthropic flags roughly 100,000 agent transcripts a week. After classifier triage, about 50 reach a human reviewer. The filtering works, and it also determines what the reviewer sees: the cases that matched no pattern anyone had thought through in advance. Those interpretations accumulate into working policy whether or not anybody records them. Skip the codification and you don't avoid having a policy for the hard cases. You lose track of the one you're already producing. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [What robots.txt Was Never Asked to Carry]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Historical Parallels In 1994, a web engineer proposed a two-field text file so site operators could ask crawlers to stay out of certain directories. It worked because everyone involved chose to go along with it. Thirty years later, publishers and regulators are trying to make that same file express commercial licensing terms, AI training restrictions, and limits on what agents can do. The convention hasn't failed. It's being asked to do work that needs identity, authorization, payment, and enforcement, none of which anybody built when the web was young, and the clearest view we have of those missing pieces is where the old file cracks. - [The Machine Did What It Was Built to Do, and People Were Still Surprised]() — By [Sevda Polat]() · Published 2026-10-16 In 1989, a NASA researcher named Earl Wiener asked pilots about new airplanes in which computers did much of the flying. The questions the pilots kept asking were strikingly plain. *What is it doing now? Why did it do that? What will it do next?* - [Don't Delete Someone Else's Fear]() — Published 2026-10-16 *Marisol Ochoa is a composite, a fictional stage manager assembled from the real conventions of a profession that has been refining its delegation protocols since gaslights and trapdoors. The operas she references are real. The mistakes she describes have all happened, to someone. Her prompt book, which she will not let you touch, follows every convention of the trade.* - [The Six Thousand Rules]() — By [Sable Whitford]() · Published 2026-10-16 · Format: After Adoption DEC's expert system for configuring VAX orders worked: fewer than one misconfiguration per thousand. By 1987 it had 6,200 rules, half of them changing every year, and developers were copying rules whose rationale nobody remembered. A redesign effort couldn't outrun the growth. Agent deployments that succeed will pile up the same inventory of prompts, workarounds, and exception lists. The companion piece traces what's growing in the other direction. - [Adopted but Unused, Used but Unadopted]() — By [Sable Whitford]() · Published 2026-10-16 · Format: After Adoption A Census Bureau survey of 117,000 businesses found AI adoption and AI use don't always travel together. Some firms formally adopted AI that workers aren't using. Some workers are using AI nobody approved. And 64% of AI-using firms reported making no institutional adjustments at all. Agent governance will have to handle both: maintaining what was formally built, and finding what grew on its own. - **The Unclosed Gradient: Why "Voice Without Authority" Fails After 47 Years of Cockpit Safety Reform** — [Source]() — Published 2026-10-16 Every effective aviation safety fix bypassed the human challenge mechanism rather than improving it. Uncomfortable reading for agent oversight designers. - **Agentic AI: User Empowerment or Foreclosure?** — [Source]() — Published 2026-10-16 Traces how spam filtering quietly eliminated the organized capacity to contest filtering criteria. A pattern worth watching again. - **IAB Australia Forces Every Crawler Into One of Four Verdicts** — [Source]() — Published 2026-10-16 Automated requests now outnumber human ones. Industry bodies are building classification frameworks robots.txt was never meant to support. - **AI Crawler Blocking Doubled This Year: The Robots.txt Data on Who's Winning** — [Source]() — Published 2026-10-16 The crawl-to-referral ratio tells the story: Googlebot returns one visit in five, some AI crawlers one in five thousand. - **From Googlebot to GPTBot: Who's Crawling Your Site in 2025** — [Source]() — Published 2026-10-16 Cloudflare's first-party traffic data shows GPTBot up 305%, yet only 14% of top domains had written AI-specific rules. - [The Promise That Stopped at the Wire]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Inside and Across Boundaries The first time an application has to coordinate work across two systems, the ACID guarantee hits a wall. Two-phase commit tried to push it across the network and buckled under real conditions. Sagas replaced it with something weaker and more honest: not rollback but compensation, new actions that approximate an undo without erasing anything. Agents inherit that world, calling APIs across boundaries that share no transaction manager. - [All or Nothing]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Inside and Across Boundaries For decades, database transactions gave engineers a reliable deal: write the logic, trust the commit, and if something fails, the system handles it. The ACID contract, named in 1983 and built toward for a decade before that, made half-done impossible inside a single system. Reservations, payroll, accounting all sit on top of it. Then the boundary moved. - [What Compensation Actually Meant]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Historical Parallels In 1987, two researchers wrote down something database operators already lived with: an operation that spans multiple systems can't hold everything still until it finishes. Their answer, the saga, came with a condition attached. Before any step was allowed to commit, the system had to already know how to walk that step back. Compensation was the price of decomposing a transaction into independent pieces, and you paid it up front. Nearly four decades later, agents run multi-step operations across services they don't control, with all of the flexibility and none of the condition. - [The Same Absence, Learned]() — By [Sevda Polat]() · Published 2026-10-01 · Format: Two Eras of Guessing Vision models can now read a screenshot and try to work out which elements are clickable, what a button does, where to type. It is the task screen readers faced for decades, attempted with unrecognizably different machinery. On real desktop work, success rates sit near 5%, and when these models miss, there is no rule to open and no set of conditions to enumerate. ### [Vision]() Where human-AI collaboration is heading - [The Envelope Era]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Possible Futures In a single month, Microsoft, NVIDIA, and the UK's AI Security Institute independently landed on the same architectural answer: the layer that matters in agent infrastructure is the boundary around the agent. Process controls, network gates, and hardware switches decide what an agent can touch, and they're enforced underneath it, out of its reach. As models get cheaper and raw capability gets abundant, the constraint infrastructure may matter more than the agent it wraps. That means who builds it, who runs it, and where the budget goes. - [The Floor Came First]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Paired Features An AI agent ran a synchrotron beamline this summer without continuous human direction. What came before was the bigger accomplishment: a team had defined every command, every reading, every permitted action. The autonomy was real, and it ran inside an environment someone had made unusually readable. The same pattern appears in warehouses and in cluster management, wherever automation actually works, and it says a good deal about where organizations should be spending. - [The Ceremonial Signer]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Paired Features After coding-agent adoption at one set of firms, review time per change rose 49 percent and corrections nearly doubled. More output was produced, and more people spent more time checking it. A role is quietly forming across organizations deploying agents: the person who signs off on machine-produced work without the time or protection to review it properly. Liability is accumulating around that person, and it tends to land on whoever has the least power to refuse it. - [The Dead Can't Clarify, But a Probate Attorney Can]() — Published 2026-10-16 At a panel on enterprise agent governance earlier this year, an audience member asked a question that produced an unusual silence: *What happens after you revoke an agent's credentials but before you've found everything downstream that still assumes those credentials, and the commitments made under them, are still valid?* - [When a Safer Test Checks Something Different]() — By [Sevda Polat]() · Published 2026-10-16 An AI agent is a program that can take actions on its own, such as filling out forms on a website. Companies test these agents to find out whether they might do something harmful. - **Artificial Intelligence in the Firm: Bottlenecks in Software Production** — [Source]() — Published 2026-10-16 Where AI-generated code actually stalls inside organizations, drawn from 300 million work events across 718 firms. - **Writing Code vs. Shipping Code: Productivity Effects Across Three Generations of AI Coding Tools** — [Source]() — Published 2026-10-16 The gap between generating code and releasing software, measured across successive waves of AI tooling. - **The Microstructure of AI Diffusion: Evidence from Firms, Business Functions, and Worker Tasks** — [Source]() — Published 2026-10-16 Census survey data on how companies are actually using AI — more granular and more modest than the discourse suggests. - **An Agentic Artificially Intelligent X-ray Scientist** — [Source]() — Published 2026-10-16 How researchers trained an AI agent to run a synchrotron beamline — and why the virtual rehearsal mattered as much as the live run. - **Incident Report: Unsanctioned Agent Behaviour During Cyber Testing** — [Source]() — Published 2026-10-16 A detailed account from the UK's AI Safety Institute of what happened when agents deviated from their instructions during security evaluations. - [What You Start Seeing]() — By [Sevda Polat]() · Published 2026-10-08 · Format: Tension Pair Agent infrastructure can log every tool call, every intermediate step, every deviation from spec — a kind of visibility that human-operated processes never offered. But in one study, over 92% of runs producing correct final answers contained process-level problems, and an overnight model upgrade turned a 97% pass rate into 11%. New signals are precise and available. They also require interpretation, maintenance, and a skepticism most organizations haven't developed yet. - [What You Stop Seeing]() — By [Sevda Polat]() · Published 2026-10-08 · Format: Tension Pair When agents take over routine work, organizations lose an output nobody budgeted for: the pattern recognition, the workarounds, the contradictory observations that workers produced as byproducts of doing their jobs. A bank nearly eliminated the employees carrying evidence that its own metric was wrong. That kind of peripheral vision was never a line item — and its disappearance is hardest to see for the organization that's lost it. - [The Invisible Organization]() — By [Sevda Polat]() · Published 2026-10-08 · Format: Possible Futures Organizations have always read their own condition through friction: the length of a queue, a ticket that keeps coming back, a workaround everybody uses and nobody authorized. When agents absorb that work, the signals don't improve. They disappear. What remains is a dashboard, and a dashboard shows what it was built to show. Three recent studies, across coding tools, enterprise agents, and executive surveys, give shape to a pattern worth watching: activity rises, recorded completions rise, and the gap between what an organization has closed and what it has resolved widens where the instruments were never pointed. - [The Hold]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Domain and Design Every organization has commitments sitting in a state that doesn't officially exist: not accepted, not rejected, just stuck. At low volume, a person remembers to follow up. At agent volume, that workaround stops working. The fix is formalizing what organizations already do badly — a state where consequences are frozen, the uncertainty is written down, and someone owns the clock. ## More - [Publication guide]() - [Issue archive]()