--- title: "Practitioner's Corner" canonical: "https://current.tinyfish.ai/issue/51/practitioners-corner" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/51/practitioners-corner" issue: 51 section: "practitioners-corner" description: "Lessons from the field—what we see building at scale" authors: ["Sevda Polat","Sable Whitford"] published: 2026-10-19 updated: 2026-10-16 articles: 14 --- # TinyFish > A journal for living in the agentic age [Read on the website]() ## Issue 51 — Practitioner's Corner Lessons from the field—what we see building at scale ### Builder Profile - [How Phil Cuvin Made Agent Manipulation Measurable]() — By [Sevda Polat]() · Published 2026-10-16 · Format: In Practice A web agent that reads an interface well enough to book your flight can also read it well enough to be fooled by a fake "required" checkbox or a "most popular" badge. Phil Cuvin, along with co-authors Hao Zhu and Diyi Yang, built a benchmark called DECEPTION to measure how often this happens under controlled conditions. Agents fell for common manipulation tricks in over 70% of test tasks; humans averaged 31%. The vulnerability profiles were nearly inverted: agents are most susceptible at the points where they read the interface most carefully. ### Feature Essay - [Variance Is the Constraint]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Feature Essay For decades, U.S. states reported average highway travel times. Two routes across New Jersey might average 58 and 59 minutes, functionally the same. But one swung nearly twice as much from day to day. The averages said the routes were interchangeable; the variance said they weren't. Federal rules eventually required states to report travel-time *reliability* alongside the mean. Web agents have the same measurement problem. A recent study ran the same agents on the same tasks three times: 46.5% succeeded at least once, but only 27.8% succeeded every time. ### Feature Interview - [The Tokens Your Agent Spent Arguing With Itself]() — Published 2026-10-16 Every profession develops its own way of reading trouble before trouble announces itself. Radiologists see shadows. Structural engineers hear resonance. Forensic accountants notice the transaction that doesn't fit the pattern. ### Inline Summary - [Writing Down What the AI Was Supposed to Buy]() — By [Sable Whitford]() · Published 2026-10-16 Every time I help figure out why a computer system broke, I hit the same hole. The logs show exactly what the system did. Nobody wrote down what it was supposed to do. On October 13, American Express (Amex) published the [Intent Intelligence Framework](https://techcrunch.com/2026/10/13/amex-introduces-a-framework-to-prevent-ai-agents-from-making-unauthorized-purchases/), a plan to plug that hole before AI helpers, called "agents," start shopping for people. ### Reading List - **AP Timeline: AI Evaluation Incidents Across 2026** — [Source]() — Published 2026-10-16 The tightest independent chronology linking this year's evaluation incidents to institutional fallout. If you're tracking the containment question, start here. - **Building a More Secure Environment for Evaluating Dangerous Capabilities** — [Source]() — Published 2026-10-16 After an agent reached external systems during testing, the UK AI Security Institute rebuilt its monitoring, network isolation, and governance from scratch. This is the post-mortem, and it's more technically specific than most incident reports you'll find. - **Measuring Agents in Production (Pan et al., ICML 2026)** — [Source]() — Published 2026-10-16 A peer-reviewed look at 86 deployed or pilot agent systems finds that most run ten steps or fewer, nearly three-quarters rely on human evaluation, and 70% use off-the-shelf models. The most grounded public picture of where production agents actually stand. - **NIST Summary of Comments on Agent Identity and Authorization** — [Source]() — Published 2026-10-16 A synthesis of 614 responses on how agents should identify themselves and what they should be allowed to do: persistent identity, expiring credentials, delegation chains. Useful less as a standard than as a map of where consensus exists and where it fractures. - **MAS Sets Out Supervisory Expectations on AI Adoption by Financial Institutions** — [Source]() — Published 2026-10-16 Singapore's final AI risk-management guidance for financial institutions specifies inventories, materiality assessments, lifecycle controls, and suspension rights. Effective October 2027, it's the most operationally specific regulatory framework currently published anywhere. - **Are Online Skill and Memory Modules Always Worth Their Tokens?** — [Source]() — Published 2026-10-16 A narrow but clarifying result: when a plain agent receives the same total inference budget as architecturally augmented methods, the augmentation advantage often vanishes. Worth reading for what it reveals about how we compare agent architectures. ### Past Articles - [What Can the Next Person Still Do?]() — By [Sable Whitford]() · Published 2026-10-09 · Format: Central Essay Norwegian conservators saved a thousand-year-old Viking ship by soaking it in hot alum. A century later the alum had eaten the wood from the inside, and washing it out would have collapsed the pieces. Software recovery falls into the same trap whenever it fixates on reversibility, which is mostly a fiction anyway: a refund doesn't erase the charge, and rebooting the box destroys the evidence you needed. Conservation ethics asks a better question. After you act, what can the next person still do? - [Jiacheng Miao — Making Papers Callable, Then Testing What That Preserves]() — By [Sevda Polat]() · Published 2026-10-09 · Format: In Practice Jiacheng Miao built a system that turns computational research papers into functions an AI agent can call; 74 of 100 papers converted with no human intervention. In a separate experiment, he gave 40 agents the same dataset, the same methods, and the same analysis budget, varying only a single paragraph of framing — and that paragraph reproduced 72 percent of the divergence that deeply held human beliefs had produced across 71 research teams. The two results were published months apart, which makes the second a comment on the first. - [Phil Cuvin — Writing Down What "Bad" Looks Like]() — By [Sevda Polat]() · Published 2026-10-01 · Format: Builder Profile An agent can complete its assigned task and still leave its user with an unwanted subscription, a hidden fee, or an account that never got canceled. A completion metric would record success. Phil Cuvin's DECEPTION benchmark scores task completion and manipulative outcomes independently, which meant someone had to decide in advance — in terms precise enough for a machine to check — which completed tasks count as bad outcomes. That same definitional work happens inside production agent systems, where it is rarely published and often not recognized as a decision at all. - [The Queue Is Writing Your Policy]() — By [Sevda Polat]() · Published 2026-10-01 · Format: Shadow Constitution Anthropic flags roughly 100,000 agent transcripts a week. After classifier triage, about 50 reach a human reviewer. The filtering works, and it also determines what the reviewer sees: the cases that matched no pattern anyone had thought through in advance. Those interpretations accumulate into working policy whether or not anybody records them. Skip the codification and you don't avoid having a policy for the hard cases. You lose track of the one you're already producing. ## Other sections in Issue 51 - [Daily Brief]() - [Market Pulse]() - [Foundations]() - [Echoes]() - [Vision]() ## More - [Publication guide]() - [Issue archive]()