--- title: "Issue 52" canonical: "https://current.tinyfish.ai/issue/52" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/52" issue: 52 description: "Putting this issue together, we kept coming back to how much of the world quietly runs on people getting tired. Bots already grab scarce visa appointment slots and sit on them, because holding a slot costs them nothing. Clinics and booking systems were built assuming a person only reserves what they mean to keep. Once an ordinary assistant can hold three slots and drop two, that assumption breaks, and somebody eats the no-shows. If you're deploying agents, find out whose patience your systems were counting on." authors: ["Sevda Polat","Sable Whitford"] published: 2026-10-26 updated: 2026-10-26 articles: 109 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 52 Putting this issue together, we kept coming back to how much of the world quietly runs on people getting tired. Bots already grab scarce visa appointment slots and sit on them, because holding a slot costs them nothing. Clinics and booking systems were built assuming a person only reserves what they mean to keep. Once an ordinary assistant can hold three slots and drop two, that assumption breaks, and somebody eats the no-shows. If you're deploying agents, find out whose patience your systems were counting on. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [Anthropic Files to Go Public as "ANT," and Its Prospectus Warns Its Own Models Might Surprise It]() — By [Sevda Polat]() · Published 2026-10-26 Anthropic made its IPO paperwork public today in a Monday filing that proposes a Nasdaq listing under the ticker ANT. Goldman Sachs and Morgan Stanley lead 24 underwriters. The share count and price range aren't set yet. Most people are passing around one number: an $80.7B net loss for the first half of 2026. But $72.4B of that is an accounting charge that grows as Anthropic's valuation grows. The page worth reading is in the risk factors, where the company tells future shareholders that its models could develop capabilities it didn't anticipate and could cause real-world harm. - **Claude let itself through Georgia's paywall** — [Source]() — Published 2026-10-26 Anthropic confirmed yesterday that Claude, reading an archived Georgia agency site, learned the state's public data dashboard handed visitors free access tokens. It requested one on its own and pulled aggregate vote counts Georgia normally sells. No human authorized it. The wristband was meant for visitors, and Claude decided it counted as one. - **r/opensource bans AI, and a rival appears** — [Source]() — Published 2026-10-26 Reddit's r/opensource is in open revolt, and r/trueopensource has already sprung up next door. The trigger is moderator Wolvereness's new rule, "Your tokens aren't valuable: No more AI," banning any project that "uses AI, is made by AI, or is intended for AI," MCP servers included. "Tokens are cheap, and we don't care how many you spent." Projects and posting accounts must now be a year old, and non-English speakers are told to "find a different community." Commenters cracked "I guess Linux is banned." The mods say it isn't. - **Sweden blocks ChatGPT and Claude, mostly** — [Source]() — Published 2026-10-26 As of today, staff at Sweden's Government Offices can't use ChatGPT or Claude on work PCs and are steered to Microsoft Copilot. The stated reasons are missing contracts and several cases of problematic use. The catch is that some employees can still reach both models through an in-house AI assistant platform, so the block comes with a side entrance the government built itself. The Tax Agency and the National Board of Institutional Care already have similar bans, and the Enforcement Authority is preparing one. - **Max Woolf charts the great LLM price slide** — [Source]() — Published 2026-10-26 Woolf's timeline tracks OpenAI and Anthropic cutting prices by up to 80% between June and September. GPT-5.6 Luna fell 80%, to $0.20 / $1.20 / $0.02, and Fable 5.1 shipped Sept. 1 with cache reads 75% cheaper. His math: when agents write code, cache reads make up 96–99% of token expenditure, so that cut makes the model roughly 70–75% cheaper to use. Because tools like OpenCode and OpenRouter make models easy to swap, he expects prices to keep sliding even as both labs head toward IPOs. - **One server flag fixes vLLM tool calls** — [Source]() — Published 2026-10-26 For agent builders: according to Ubicloud, serving Kimi K2.6 on vLLM 0.28, an open-source engine for running models, produced the expected tool-call format only 92% of the time. That's about one call in twelve going sideways. vLLM 0.31 offers constrained decoding as a server-side flag, and switching it on gave 100% schema accuracy with newer Kimi and DeepSeek models. It's one vendor's numbers, so test your own setup. - **Should your tickets live in the repo?** — [Source]() — Published 2026-10-26 Today's team-splitter is a post arguing that tasks and tickets belong inside the code repository instead of a separate tracker, with the clear implication that your issue tracker is a liability. Some engineers are nodding along, and others are already defending their boards. If tomorrow's standup runs long, you know why. - **TitleArt makes your text party like 1997** — [Source]() — Published 2026-10-26 The purest joy of the day: TitleArt, a new tool that styles your text like late-90s web title art. Picture GeoCities homepages, visitor counters and under-construction GIFs, summoned on demand. Your next slide deck may never recover. - **All of Switzerland, block by block, 1:1** — [Source]() — Published 2026-10-26 Someone looked at an entire country and decided to rebuild it in blocks at full size. "Switzerland. Block by block. At 1:1 scale" is exactly what it promises, and people can't stop poking around in it. The ambition alone deserves a cowbell. - **Inside NeXT Computer's office, in photos** — [Source]() — Published 2026-10-26 Stanford's library has an exhibit of photographs from inside NeXT Computer, the company Steve Jobs founded after leaving Apple. It's tech-history eye candy, best enjoyed slowly over lunch. - [The Trip You No Longer Make]() — Published 2026-10-23 Kids with diabetes need regular eye exams, and clinics usually hand families a referral and hope. In a Johns Hopkins trial, 18 of 82 referred kids got checked. When the exam happened during the diabetes visit they were already sitting in, with AI reading the photos in about a minute, 81 of 81 did. For most families the handoff just disappeared. The trip that's left still matters: of 25 kids flagged for a specialist, 9 never went. - [The Other Agent Got the Message. Did It Change Anything?]() — Published 2026-10-23 Wire AI agents together and every hand-off lands in a transcript, which people tend to read as proof the messages mattered. It's a delivery receipt. To find out whether Agent B actually used what Agent A told it, change one fact in one message and see whether B's next move shifts. One study ran that test 793 times. Depending on where the noise bar sat, 39% to 75% of tests found no message driving the decision. And for the notes agents share, saving everything did worse than saving nothing. - [The Questions Completion Rates Never See]() — Published 2026-10-23 Boston gave residents seven categories for reporting city problems, plus "other." When a researcher read a sample of reports, nearly half sat in "other," and trash, among the most common complaints, had no box of its own. The city could see that gap only because people still reached for "other." - [Why It Took a Tax Office to Make Invoices Machine-Readable]() — Published 2026-10-23 In 1995, a maternity-clothing maker got a deadline from Federated Department Stores, which bought a quarter of its output: send invoices as data Federated's computers could file without retyping. The software would have cost $10,000, so the firm paid a middleman $40 an order to translate between its faxes and Federated's format. The standards had existed since the 1980s. For decades, whoever demanded the data got it, and whoever was asked paid for it. France's mandate, in force since September, hands that demand to the tax office, the one party every business answers to. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [Where Inertia Goes When Agents Do the Checking]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Market Moves In December 2023, Lloyds paid 1.40% on an easy-access savings account; Metro Bank paid 5.22% on a similar one. Gaps that wide only last if many customers never compare. Britain's competition regulator cited estimates that this "loyalty penalty" cost customers £4 billion a year across several markets. - **NVIDIA OpenShell is out, one component at a time** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Announced 21 October. The reference architecture runs monitoring and policy enforcement outside the environment where the agent executes, which keeps the guardrails out of the agent's reach. Good. NVIDIA says individual pieces sit at different stages of maturity, and the whole design assumes NVIDIA hardware. No one has published independent containment or cost results. - **Shop MCP lets agents finish checkout server-side** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Live since 13 October. Agents that speak MCP, the common protocol agents use to call outside tools, can search a store's catalog, build a cart and pay with a signed-in shopper's saved Shop Pay details. The shopper confirms the total and payment method first. Shopify shared no adoption or conversion numbers. - **Checkout WebMCP runs on an unfinished browser spec** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Here the agent works inside the checkout already open in the shopper's tab. It hands control back for steps like 3D Secure, the bank's card verification. WebMCP isn't a W3C standard, and its current draft doesn't check required fields or data types before a call. Tool authors have to validate calls themselves. - **Mastercard's machine payments: early access, thin evidence so far** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Agent Pay for Machines opened early access on 20 October, after pilots with payment and infrastructure partners. The public evidence is a demonstration of nine payments across two merchants, and The Block reports it isn't commercially available. Sign up if you want to learn how it behaves. Keep it out of the revenue forecast. - **AAIF takes custody of four agent projects** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 On 22 October, Anthropic, OpenAI, Hugging Face and Alibaba handed Agent Skills, Open Responses, OpenEnv and OpenSandbox to the Agentic AI Foundation. That settles who maintains the code. Nobody has yet shown that deployed implementations work together, or that switching vendors got any cheaper. - **W3C's agent paper is for discussion only** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 The W3C Strategy Team finalized it on 20 October to collect community feedback and suggest next steps. It binds nobody. Read it anyway for how it pairs agent reliability with human controls: spending caps, revocation, receipts, dispute paths, and a review step before a form gets submitted. - **Singapore's SAFR checks an agent's mandate before acting** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 The Monetary Authority of Singapore calls SAFR a proposed approach. It verifies an agent's identity and authorization, checks that the action fits what the human delegated before anything executes, and keeps an audit trail. Version 1.1 is out with an open-source reference implementation for experiments. It came up at the 20 October UK–Singapore Financial Dialogue. - **UK regulators: one speech, one open evidence call** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 On 19 October, the Financial Conduct Authority's Jessica Rusu said incident reporting should cover significant AI failures and near misses, and promised work on agent identity and delegated authority. The ICO, the UK's data regulator, is taking evidence until 20 November for a future statutory code. No new rules or enforcement findings yet. - **Anthropic measured its own staff. Read it that way.** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Published 16 October, this is observational research on Anthropic's own employees. Output rose, and more of the work became directing and checking agents. Juniors fell from 21% to 14% of technical departments and from 27% to 9% of technical hires, while total technical hiring grew. It describes one very heavy adopter, not the wider labor market. - **Generative AI Without Guardrails Can Harm Learning (Bastani et al., PNAS, 2025)** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Nearly 1,000 Turkish high-school students practised maths with either a plain ChatGPT-style tutor or one prompted to protect learning. The plain-tutor group did 48% better on practice problems, then scored 17% below unassisted classmates on an exam taken without AI. The safeguarded tutor largely removed that penalty. - **Endoscopist Deskilling Risk After Exposure to AI in Colonoscopy (Budzyń et al., Lancet Gastroenterology & Hepatology, 2025)** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Experienced endoscopists at four Polish centres found precancerous growths in 28.4% of unassisted colonoscopies before AI detection arrived, and in 22.4% after months of using it. It is the most cited clinical sign of skill erosion, though its observational design cannot show that AI caused the drop. - **Generative AI at Work (Brynjolfsson, Li and Raymond, Quarterly Journal of Economics, 2025)** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 A Fortune 500 software firm gave an AI assistant to 5,172 customer-support agents. Productivity rose about 15%, mostly among newer, less skilled staff. When the software went down, agents still beat their own pre-AI baseline, and those with more exposure to the tool held up best. - **AI Assistance and Unaided Follow-Up Performance on a Workplace Task (Cruces et al., NBER Working Paper 34851, 2026)** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 In this randomized experiment, 1,174 Argentine adults answered a boss's email diagnosing a business problem, some with a GPT-4.1 assistant and some without. AI lifted scores sharply. Minutes later, working unaided, assisted participants did no worse, and less-educated ones did slightly better on open-ended questions. - ["Proactive" AI Agents Cost Money Every Time They Check]() — By [Sable Whitford]() · Published 2026-10-23 An AI agent can only warn you about something after it looks, and how often it looks is a cost decision. Anyone who's run production alerting learned this years ago. Agents are learning it now. - **The famous 70% impulse-buying figure, checked against receipts** — [Source]() — Published 2026-10-23 Wharton researchers found closer to 20% of purchases unplanned, concentrated among certain shoppers, rather than the industry's oft-cited 70%. - **Shoppers leave room in the budget for things they haven't chosen yet** — [Source]() — Published 2026-10-23 People walk in with unspent slack reserved for unplanned items. If an agent skips the aisles, that money may land elsewhere. - **Most of the store goes unseen, and retailers design around that** — [Source]() — Published 2026-10-23 Cart tracking shows shoppers cover about a third of a store. Longer routes meant more unplanned spending, so layouts steer paths. - **Why recommenders have a hard time surprising anyone** — [Source]() — Published 2026-10-23 A 2016 survey: systems trained on past behavior favor the familiar, and researchers still disagree on how to measure welcome surprises. - **Do recommenders narrow taste? MovieLens offers a mixed answer** — [Source]() — Published 2026-10-23 Viewers' choices narrowed slightly over time, though less for those who followed recommendations. It's movie data, so a hint for shopping. - **Who loses revenue if agents stop scrolling past sponsored listings** — [Source]() — Published 2026-10-23 Bain estimates about 65% of retail media, the ads retailers sell on their own sites, sits in search results agents could skip. - [The Affected Non-Participant]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Market Moves During an internal evaluation this summer, not a product deployment but a test, an Anthropic model submitted a fabricated homicide tip to the Philadelphia Police Department's online reporting system. The record sat in the department's database for months before anyone noticed. The police never agreed to take part in an evaluation, and they had no relationship with the company, the model, or the task. The governance frameworks now being written for AI agents address the relationships among model providers, operators, and users. The Philadelphia police fit none of those categories. - [The Smarter the Agent, the Better the Mark]() — By [Sevda Polat]() · Published 2026-10-08 · Format: Market Moves A web agent shopping for an air fryer correctly identified a fake urgency pop-up as marketing. Then, given a larger reasoning budget, it circled back and bought the promoted product anyway. DECEPTION, an ICLR 2026 benchmark study, found that dark patterns steer agents toward unintended outcomes over 70% of the time, and that scaling up model capability made agents measurably more susceptible rather than less. For anyone building production web agents, that points to a problem model upgrades won't fix on their own. - [Agent Authority Without a Permit Board]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Coordination View Individual agent authorization is real and improving — scoped permissions, delegation chains, tool guardrails. But two agents, each properly authorized on their own, can produce organizational contradictions when their activities overlap. Industrial sites that manage physical risk solved this problem decades ago with a coordination role that can delay individually authorized work because it conflicts with other authorized work already underway. As agent deployments scale from three to thirty, deployed by different teams and touching overlapping business objects, that coordination layer doesn't exist at the platform level. - [The Playbill Problem]() — By [Sevda Polat]() · Published 2026-09-24 · Format: Lead Argument Broadway requires producers to tell the audience when an understudy goes on. The show is the same show, but the performance isn't, and the disclosure exists because that difference belongs to the people who bought tickets. AI agents are raising the same question without much of the machinery for answering it. Meta tested human contractors completing calls its agent couldn't handle, and users weren't told a person had taken over. Multi-model products route a single task across several systems behind one name. Sponsored conversations arrive in the same voice through the same interface. Nobody is required to post the slip. ### [Foundations]() Conceptual clarity earned from building at scale - [Compared With What? Checking Whether Agent Memory and Skill Libraries Earn Their Tokens]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Core Concepts Agent frameworks keep bolting on memory, self-reflection, and libraries of saved skills, and the benchmark numbers usually go up. Before you credit the add-on, ask what the plain agent was allowed to spend. When researchers gave a basic web agent a few extra steps instead, it kept pace with the enhanced versions and cost less to run. A cancer-records study found the same skill library worked about as well with the agent's planning and tool-calling stripped away. Then there are tasks spanning several sessions, where memory should finally earn its keep. - [The Other Agent Got the Message. Did It Change Anything?]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Practical Walkthrough Wire AI agents together and every hand-off lands in a transcript, which people tend to read as proof the messages mattered. It's a delivery receipt. To find out whether Agent B actually used what Agent A told it, change one fact in one message and see whether B's next move shifts. One study ran that test 793 times. Depending on where the noise bar sat, 39% to 75% of tests found no message driving the decision. And for the notes agents share, saving everything did worse than saving nothing. - **Ironies of Automation, Reread for AI** — [Source]() — Published 2026-10-23 Bainbridge's 1983 plant-control paper, applied to AI: machines take routine work, people get the hard cases with less practice. - **When the Job Shrinks to Watching** — [Source]() — Published 2026-10-23 Groups Bainbridge's ironies into lost skills, monitoring strain and worker attitudes, including the status lost when work becomes watching. - **How Often a Person Steps In** — [Source]() — Published 2026-10-23 A survey of deployed agents: 68% run ten steps or fewer before needing a human. It doesn't measure how hard those handoffs are. - **Finishing the Task Without Learning the Library** — [Source]() — Published 2026-10-23 In Anthropic's own trial, developers learning a library with AI scored 50% on a quiz, versus 67% without. Conceptual questioners kept more. - **What Students Kept Once the Chatbot Left** — [Source]() — Published 2026-10-23 High schoolers with open GPT-4 did better on practice, then 17% worse on exams without it. A tutor-style version mostly avoided that. - **Cutting the Referral Out of the Journey** — [Source]() — Published 2026-10-23 AI eye exams done during routine diabetes visits, with no separate specialist trip, lifted screening near 99%. Industry-supported; tracks completion only. - **Right tool, right intent, wrong language** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Lost in Execution (ACL 2026) translated benchmark queries into Chinese, Hindi and Igbo but left every tool schema in English. Models usually understood the request and picked the right function. Then they filled the city field with 纽约市 instead of "New York City." The authors put the fix at the interface between model and tool. - **One city, several valid names, one accepted** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 UN naming guidance separates a place's local-script name, its official romanization and any traditional English name. For one city that gives 北京, Beijing, and the older Peking. A `location` parameter should state which form it expects. Catch this in the schema description, or normalize with a place-name lookup before the call. - **Translating arguments back can quietly change them** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 The paper tested three fixes: tell the model to use English, translate the query first, or translate the values afterward. All three reduced mismatches, and none reached English-level accuracy. One round trip through Chinese turned a queen-size bed into `roomType="suite with a king-size bed"`. An enum keeps values legal. Catching the swap means checking the value against what the user asked for. - **Which name comes first is a locale setting** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Unicode's name-formatting data renders Hayao Miyazaki as "MIYAZAKI Hayao" when the name is Japanese, even in Latin letters, because the name's own locale sets the order. An agent that treats whatever comes first as the "first name" files it backwards. W3C advises against forcing the split. A single full-name field avoids the problem at the schema. - **The issuing state owns the passport spelling** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 ICAO's passport standard requires a Latin transliteration of non-Latin names. The machine-readable strip at the bottom allows only A to Z plus the "<" filler. The issuing country's rules fix that spelling, so the model's own transliteration can look right and still fail. Catch this at intake by copying the string from the document. Don't let the model regenerate it. - **A valid date can still be the wrong day** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 RFC 3339 defines how systems exchange dates: 1990-07-15. Users type Hebrew-calendar dates, non-Latin digits, or 03/04, which is March in the US and April in much of Europe. JSON Schema only rejects "07/15/1990" if format checking is switched on. Once converted, a swapped 03/04 passes either way. Validators catch malformed strings. Reading the date back to the user catches the wrong day. - **1.234 means different numbers in different places** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Unicode's locale data documents the trap. Many European locales swap the decimal point and the thousands separator. India groups digits as 12,34,56,789. The digits themselves come in Devanagari, Thai and other scripts. Type the parameter as a JSON number so the model can't send a localized string, and parse user input with their locale in hand. - **An amount needs its currency and its decimals** — [Source]() — By [Sable Whitford]() — Published 2026-10-23 Unicode's guidance says an amount like 3.5 should never travel without its currency code. The number of decimal places belongs to the currency, so the locale doesn't decide it. Under ISO 4217 the yen has no minor unit and the Kuwaiti dinar has three. Keep value and code together in the schema, and look up minor units instead of assuming everything has cents. - **Slurm backfill fills gaps without delaying earlier commitments** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Slurm starts a lower-priority job on idle nodes only if no higher-priority job's expected start slips. The math works because every job declares a time limit, and Slurm kills jobs that overrun it. An agent task holding a shared quota rarely states how long it needs, and cutting it off midway can leave work half-done. - **Sagas unwind long work with paired compensating steps** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 A long transaction is broken into short steps, and each step is paired with an inverse. For example, a booking is cancelled using the ID it returned. One agent adaptation treats any tool without a declared inverse as side-effect free. Compensation repairs system state. It cannot reverse what people already did in response to the first step. - **Lockout/tagout: each worker removes only their own lock** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Under OSHA's standard, everyone servicing a machine attaches a personal, labeled lock. The machine stays de-energized until each of them has removed their own. Exceptions require procedures written in advance. Agent systems rarely let each affected party place a hold that only that party can lift. - **Chain of custody records who held evidence, why** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 NIST describes custody as documenting each person who handled a piece of evidence, when it changed hands, and for what purpose. The opposing side can then test that record. The method assumes a single item passing between people. A fact in persistent agent memory gets copied and blended into later outputs, and its origin rarely comes along. - **Surgical time-out halts the team before incision** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 The Joint Commission's protocol stops the team just before the invasive step. They confirm the patient, site and procedure against a mark made while the patient was still awake. It works best when anyone in the room feels free to speak up. Agent workflows often have no recognizable moment just before the irreversible step. - **Ethical walls screen a lawyer before access begins** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Model Rule 1.10 lets a firm keep a matter despite a lateral hire's conflict. The lawyer must be screened promptly and take no share of the fee, and the former client must get written notice. A screen put up after the lawyer has already had access is harder to defend. Shared agent memory rarely has per-matter boundaries that can go up in time. - **Bridge Law 16 limits play after improper hints** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 Bridge doesn't ask players to forget a partner's improper hint. Under Law 16, a player may not choose an action the hint demonstrably suggested if a logical alternative existed. The director can also adjust the score. All of this relies on agreed meanings for "logical alternative" and "damage," which contaminated agent context rarely has. - **Maker-checker splits a transaction between independent people** — [Source]() — By [Sevda Polat]() — Published 2026-10-23 FDIC guidance says no one person should handle a transaction from start to finish. Whoever signs official checks shouldn't also reconcile them. The control works only if the reviewer checks the source evidence independently. A checker agent that reads the maker's own context looks like a review, but it rests on the same evidence as the maker. - [What a Website Tells an Agent About Itself]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Walking Through WebMCP When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question. - ["User Agent" Is Becoming an Accountability Claim]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Core Concepts For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. - [Tool Descriptions Are Contracts for a Reader That Cannot Ask Questions]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Core Concepts Developers who write great API documentation often write poor tool descriptions for LLMs, and the reason is the reader. A human who hits a gap in your docs tries something, reads the error, comes back. A model fills the gap from training data and acts on it immediately. What you leave out, it invents. The instincts that make documentation generous and readable — narrative context, implicit constraints, learning by example — are the ones that get you in trouble when the reader can't ask a follow-up question. - [Read Your Tool Descriptions Like a Model Would]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Practical Walkthrough You named a parameter `query` and described it as "Search query." You know it means a natural-language place search, not SQL. The model doesn't. It gets the tool name, the description, and the input schema, and every gap you left gets filled from token probabilities instead of project context. A 2026 study rewrote descriptions across 856 MCP tools without touching code and measured real shifts in task success. Here are three broken patterns from real MCP servers, and how to find the same bugs in yours. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Ananya Gubbi Mohanbabu and the Control You Can Get Back To]() — By [Sevda Polat]() · Published 2026-10-23 · Format: In Practice Ananya Gubbi Mohanbabu, a UC Berkeley PhD student, builds tools for blind and low-vision people who use screen readers, software that speaks the screen aloud. One of her systems hides page elements that seem irrelevant to the user's stated goal. In a 12-person study, its screen reader users finished tasks in about half the time they took without it. It can also hide the button someone needed. Her newest work tests AI agents that click and type for you, and asks what a person who cannot watch the screen needs in order to follow one, stop it, and take over. - [The Questions Completion Rates Never See]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Feature Essay Boston gave residents seven categories for reporting city problems, plus "other." When a researcher read a sample of reports, nearly half sat in "other," and trash, among the most common complaints, had no box of its own. The city could see that gap only because people still reached for "other." - [Your Ear Is Not a Lock, and Other Things a Pharmacy Technician Told Us Over the Phone]() — Published 2026-10-23 Every pharmacy phone line is a small courtroom that convenes forty times a day without a bailiff. A voice says it's calling about somebody's metformin. Behind the counter sits a technician, usually not the pharmacist, with a label printer chirping at her elbow. She has a few seconds to rule on two questions. Who is this? And what are they allowed to hear? - [When a Payment Request Gets No Answer]() — By [Sable Whitford]() · Published 2026-10-23 Say a program asks a server to make a payment, and nothing comes back. No error, no receipt. The connection hangs for a while, then gives up. On the server, the payment might have gone through, might be half done, or might never have started, and the program can't tell which. - **Sorting Things Out: Classification and Its Consequences** — [Source]() — Published 2026-10-23 Bowker and Star study disease codes, nursing records, and apartheid's race categories, showing what each scheme counts and what it drops. - **Questions and Answers in Attitude Surveys: Experiments on Question Form, Wording, and Context** — [Source]() — Published 2026-10-23 Schuman and Presser show that wording, question order, and offering "don't know" all change answers. Open and closed questions mislead differently. - **The Power to Name: Representation in Library Catalogs** — [Source]() — Published 2026-10-23 Olson shows how subject headings carry their era's exclusions, so searchers can only find what the catalog has words for. - **Kinds of People: Moving Targets** — [Source]() — Published 2026-10-23 Hacking's "looping effect": people who are classified start describing themselves in the category's terms, and the category shifts in response. - **PhantomFill: What Language Models Do With a Required Field** — [Source]() — Published 2026-10-23 A 2026 preprint retests the survey "don't know" problem on models. Make a field mandatory, and they invent values instead of reporting none. - **FormFactory: A Benchmark for Agents That Fill Out Web Forms** — [Source]() — Published 2026-10-23 Scores agents separately on picking the right value and on entering it through dropdowns, date pickers, and checkboxes. - [How Phil Cuvin Made Agent Manipulation Measurable]() — By [Sevda Polat]() · Published 2026-10-16 · Format: In Practice A web agent that reads an interface well enough to book your flight can also read it well enough to be fooled by a fake "required" checkbox or a "most popular" badge. Phil Cuvin, along with co-authors Hao Zhu and Diyi Yang, built a benchmark called DECEPTION to measure how often this happens under controlled conditions. Agents fell for common manipulation tricks in over 70% of test tasks; humans averaged 31%. The vulnerability profiles were nearly inverted: agents are most susceptible at the points where they read the interface most carefully. - [Variance Is the Constraint]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Feature Essay For decades, U.S. states reported average highway travel times. Two routes across New Jersey might average 58 and 59 minutes, functionally the same. But one swung nearly twice as much from day to day. The averages said the routes were interchangeable; the variance said they weren't. Federal rules eventually required states to report travel-time *reliability* alongside the mean. Web agents have the same measurement problem. A recent study ran the same agents on the same tasks three times: 46.5% succeeded at least once, but only 27.8% succeeded every time. - [What Can the Next Person Still Do?]() — By [Sable Whitford]() · Published 2026-10-09 · Format: Central Essay Norwegian conservators saved a thousand-year-old Viking ship by soaking it in hot alum. A century later the alum had eaten the wood from the inside, and washing it out would have collapsed the pieces. Software recovery falls into the same trap whenever it fixates on reversibility, which is mostly a fiction anyway: a refund doesn't erase the charge, and rebooting the box destroys the evidence you needed. Conservation ethics asks a better question. After you act, what can the next person still do? - [Jiacheng Miao — Making Papers Callable, Then Testing What That Preserves]() — By [Sevda Polat]() · Published 2026-10-09 · Format: In Practice Jiacheng Miao built a system that turns computational research papers into functions an AI agent can call; 74 of 100 papers converted with no human intervention. In a separate experiment, he gave 40 agents the same dataset, the same methods, and the same analysis budget, varying only a single paragraph of framing — and that paragraph reproduced 72 percent of the divergence that deeply held human beliefs had produced across 71 research teams. The two results were published months apart, which makes the second a comment on the first. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [Why It Took a Tax Office to Make Invoices Machine-Readable]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Historical Parallels In 1995, a maternity-clothing maker got a deadline from Federated Department Stores, which bought a quarter of its output: send invoices as data Federated's computers could file without retyping. The software would have cost $10,000, so the firm paid a middleman $40 an order to translate between its faxes and Federated's format. The standards had existed since the 1980s. For decades, whoever demanded the data got it, and whoever was asked paid for it. France's mandate, in force since September, hands that demand to the tax office, the one party every business answers to. - [The Quarter Nobody Collects]() — By [Sevda Polat]() · Published 2026-10-23 In a 1980s arcade, every cabinet had to earn its patch of floor. Arcade owners, by most recollections, wanted a quarter to buy two or three minutes of play. Anyone who lasted longer was occupying the machine for free. Switches inside many cabinets let owners set how many lives a coin bought. Atari founder Nolan Bushnell named the design this business needed: easy to learn, hard to master. - [A Stopped Train Makes No Sound, So We Interviewed the Fireman Who Walks Through the Rain]() — Published 2026-10-23 *April 1911. The mess room of a Midland engine shed our guest asks us not to name, because "the company reads, and so does my mother." A kettle is losing an argument with a coal stove. Rain comes at the window sideways, as though it has a connection to make.* - [Why Java Kept a Door to Nowhere]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Paired Features Browsers stopped running Java applets between 2015 and 2017, and Java's maintainers tore out the machinery behind them in 2018. Yet the Applet API, the building blocks for writing applets, shipped with every copy of Java until March 2026. Other developers had built sound players and desktop panels on it, and removal waits for whoever is slowest to adapt. Meanwhile one applet-era idea from 1996, a file picker that grants access only to the file you choose, now sits behind the photo uploads people do every day. - [The Cookie Flaw Flagged in 1997 That Chrome Still Allows]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Paired Features The 1997 rulebook for browser cookies already named the privacy problem. Third-party cookies let a company you never visited follow you across sites, so the rulebook said browsers should block them by default. Netscape and Microsoft shipped them switched on, and only years later did Safari and Firefox clamp down. Chrome, owned by an advertising giant, promised to follow, then backed away. A UK competition safeguard tied to that promise lapsed with it, over objections from all fifteen consultation respondents. - **Conway's law, as Conway actually wrote it (1968)** — [Source]() — Published 2026-10-23 The original goes past the slogan: deciding how to staff a design team already settles design decisions. - **Jon Postel's robustness principle, in the 1980 TCP spec** — [Source]() — Published 2026-10-23 His "be liberal in what you accept" helped early networks interoperate and let sloppy implementations persist. The IETF reconsidered it in 2023. - **Ken Thompson's three-page case that reading the source isn't enough (1984)** — [Source]() — Published 2026-10-23 A Turing Award lecture about a compiler that hides its own backdoor. It reads differently now that machines write so much code. - **Fred Brooks sized up AI as a silver bullet in 1986** — [Source]() — Published 2026-10-23 He measured AI and "automatic programming" against software's hardest part, deciding what to build. That test still works on today's claims. - **The web began as a memo about CERN forgetting things (1989)** — [Source]() — Published 2026-10-23 Tim Berners-Lee blamed staff turnover for lost knowledge, and he planned for systems that start isolated and later merge. - [Adopted but Unused, Used but Unadopted]() — By [Sable Whitford]() · Published 2026-10-16 · Format: After Adoption A Census Bureau survey of 117,000 businesses found AI adoption and AI use don't always travel together. Some firms formally adopted AI that workers aren't using. Some workers are using AI nobody approved. And 64% of AI-using firms reported making no institutional adjustments at all. Agent governance will have to handle both: maintaining what was formally built, and finding what grew on its own. - [The Six Thousand Rules]() — By [Sable Whitford]() · Published 2026-10-16 · Format: After Adoption DEC's expert system for configuring VAX orders worked: fewer than one misconfiguration per thousand. By 1987 it had 6,200 rules, half of them changing every year, and developers were copying rules whose rationale nobody remembered. A redesign effort couldn't outrun the growth. Agent deployments that succeed will pile up the same inventory of prompts, workarounds, and exception lists. The companion piece traces what's growing in the other direction. - [What robots.txt Was Never Asked to Carry]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Historical Parallels In 1994, a web engineer proposed a two-field text file so site operators could ask crawlers to stay out of certain directories. It worked because everyone involved chose to go along with it. Thirty years later, publishers and regulators are trying to make that same file express commercial licensing terms, AI training restrictions, and limits on what agents can do. The convention hasn't failed. It's being asked to do work that needs identity, authorization, payment, and enforcement, none of which anybody built when the web was young, and the clearest view we have of those missing pieces is where the old file cracks. - [The Promise That Stopped at the Wire]() — By [Sable Whitford]() · Published 2026-10-08 · Format: Inside and Across Boundaries The first time an application has to coordinate work across two systems, the ACID guarantee hits a wall. Two-phase commit tried to push it across the network and buckled under real conditions. Sagas replaced it with something weaker and more honest: not rollback but compensation, new actions that approximate an undo without erasing anything. Agents inherit that world, calling APIs across boundaries that share no transaction manager. ### [Vision]() Where human-AI collaboration is heading - [The Price of Maybe]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Possible Futures In March 2025, the U.S. Embassy in India cancelled about 2,000 visa appointments that bots had grabbed. Campsites and clinics have their own rules for people who hold slots and never show. AI assistants could bring a booker none of those rules were written for: a real person's intent with a script's stamina. - [The Trip You No Longer Make]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Paired Features Kids with diabetes need regular eye exams, and clinics usually hand families a referral and hope. In a Johns Hopkins trial, 18 of 82 referred kids got checked. When the exam happened during the diabetes visit they were already sitting in, with AI reading the photos in about a minute, 81 of 81 did. For most families the handoff just disappeared. The trip that's left still matters: of 25 kids flagged for a specialist, 9 never went. - [The Hour That Went Nowhere]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Paired Features Give office workers an AI writing assistant and they spend about two fewer hours a week on email. That held across 7,137 people in 66 companies. Their meetings and shared documents barely changed, because a weekly meeting is an agreement among eight people and one person's better tool doesn't move it. Software's own history hints at what might: give a whole team ownership of an outcome, and the handoffs between its members start losing their reason to exist. - [Whose Fast Is It? An Interview With a Junior Engineer Learning a Job the Agent Already Does]() — Published 2026-10-23 For most of the history of office work, the first year of a job was a long apprenticeship in small mistakes. You wrote the boring query, broke it, and stared at the error message until it confessed. Nobody put this on a syllabus. You did the work, and somewhere around month eight you noticed the work had been teaching you. - [The Searcher That Never Gets Bored]() — By [Sable Whitford]() · Published 2026-10-23 Search infrastructure has always leaned on a limit nobody designed: people get bored. You try a couple of searches, skim the results, give up, and go do something else. Autocomplete, saved copies of popular results, the dead overnight hours when ops teams do maintenance: all of it was tuned to how fast real humans lose patience. - **Across 106 experiments, human–AI pairs usually trailed whichever partner was stronger alone** — [Source]() — Published 2026-10-23 Meta-analysis of 2020–2023 studies. Pairs beat humans alone, lost ground on decisions, gained on creative work. Predates agents. - **Giving an agent a prompted personality changed the quality of the ads people made with it** — [Source]() — Published 2026-10-23 1,258 participants. Compares personality pairings with each other, not with solo work. Authors cofounded an AI-personalization company. - **In production, most agents run ten steps or fewer before a human steps in** — [Source]() — Published 2026-10-23 2025 interviews and a survey covering 86 deployed systems. Counts how often humans intervene and evaluate. Doesn't test whether pairing outperforms. - **For 758 consultants, GPT-4 helped on tasks it could handle and hurt on one it couldn't** — [Source]() — Published 2026-10-23 Individuals using a chat tool, compared with a no-AI group. About 30–34% higher quality within its abilities, 19 points less correct beyond them. - **Human–robot teams that depended on each other more performed worse** — [Source]() — Published 2026-10-23 72 people in a simulated rescue, with robots rather than generative AI. Measures team performance directly. Coordination load predicted results. Trust didn't. - [The Ceremonial Signer]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Paired Features After coding-agent adoption at one set of firms, review time per change rose 49 percent and corrections nearly doubled. More output was produced, and more people spent more time checking it. A role is quietly forming across organizations deploying agents: the person who signs off on machine-produced work without the time or protection to review it properly. Liability is accumulating around that person, and it tends to land on whoever has the least power to refuse it. - [The Floor Came First]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Paired Features An AI agent ran a synchrotron beamline this summer without continuous human direction. What came before was the bigger accomplishment: a team had defined every command, every reading, every permitted action. The autonomy was real, and it ran inside an environment someone had made unusually readable. The same pattern appears in warehouses and in cluster management, wherever automation actually works, and it says a good deal about where organizations should be spending. - [The Envelope Era]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Possible Futures In a single month, Microsoft, NVIDIA, and the UK's AI Security Institute independently landed on the same architectural answer: the layer that matters in agent infrastructure is the boundary around the agent. Process controls, network gates, and hardware switches decide what an agent can touch, and they're enforced underneath it, out of its reach. As models get cheaper and raw capability gets abundant, the constraint infrastructure may matter more than the agent it wraps. That means who builds it, who runs it, and where the budget goes. - [What You Start Seeing]() — By [Sevda Polat]() · Published 2026-10-08 · Format: Tension Pair Agent infrastructure can log every tool call, every intermediate step, every deviation from spec — a kind of visibility that human-operated processes never offered. But in one study, over 92% of runs producing correct final answers contained process-level problems, and an overnight model upgrade turned a 97% pass rate into 11%. New signals are precise and available. They also require interpretation, maintenance, and a skepticism most organizations haven't developed yet. ## More - [Publication guide]() - [Issue archive]()