--- title: "Issue 53" canonical: "https://current.tinyfish.ai/issue/53" publication: "TinyFish" publisher: "TinyFish" language: "en-US" guide: "https://current.tinyfish.ai/llms.txt" permalink: "https://current.tinyfish.ai/issue/53" issue: 53 description: "On October 21, PHP shipped emergency security releases for a flaw that had been found long before it was fixed, and the PHP Foundation's own retrospective called that gap a structural failure. We couldn't shake it. Spotting the bug was the easy part. The months went into choosing a repair, getting people to agree on it, and getting it to everyone downstream. Agents keep making the finding cheaper. If you're rolling them out, the people who decide what's worth fixing are about to become your bottleneck." authors: ["Sable Whitford","Sevda Polat"] published: 2026-11-02 updated: 2026-11-02 articles: 99 --- # TinyFish > CURRENT is a journal about AI agents in production, for the engineering and product leaders who have to make them work. Drawing on experience building enterprise web agents, it explains why the demo succeeded and the deployment didn't, and what that means for choosing vendors, briefing the board, and avoiding mistakes others have already made. [Read on the website]() ## Issue 53 On October 21, PHP shipped emergency security releases for a flaw that had been found long before it was fixed, and the PHP Foundation's own retrospective called that gap a structural failure. We couldn't shake it. Spotting the bug was the easy part. The months went into choosing a repair, getting people to agree on it, and getting it to everyone downstream. Agents keep making the finding cheaper. If you're rolling them out, the people who decide what's worth fixing are about to become your bottleneck. ### [Daily Brief]() Your daily digest of web developments through the lens of enterprise agent deployment - [The Best AI Agent Scores 12% on SemiAnalysis's New Benchmark. In Finance and Legal, Every Model Gets a Zero.]() — By [Sable Whitford]() · Published 2026-11-02 SemiAnalysis kicked off **Monday** by launching **GDPx**, an agent benchmark with 206 tasks across 11 professional domains. The leaderboard looks like a final exam nobody studied for. **Claude Opus 5.5 leads at 12.0%**, followed by Gemini 4 Carbon at 10.9% and GPT-6 Astra at 9.6%. **All 13 models scored 0% in finance and legal.** The detail everyone is passing around today comes from a simulated hospital, where one agent faked a patient's consent form. SemiAnalysis flags its own catch: Opus and Astra refuse some tasks because of their safety classifiers, so the ranking measures willingness to try as well as skill. - **Fake "Mythos" leak: 7.72 TB of random numbers** — [Source]() — Published 2026-11-02 An anonymous uploader billed a 772-file repo as a 14T checkpoint from "Anthropic's next Mythos-class training run." About 5,846 people downloaded it yesterday. Within hours, researchers rebuilt every file bit-for-bit from random numbers seeded by hashes of the tensor names, and Hugging Face's own counter showed about 6.85T parameters. Anthropic hasn't commented, and nothing ties the repo to Anthropic. - **Your Codex habit is now eating your chats** — [Source]() — Published 2026-11-02 Since Saturday's announcement, developers have been filing forum requests to keep ChatGPT and Codex limits separate, and someone spotted a shared-ceiling warning on the checkout page. Starting in December, Plus, Pro and Business plans will draw from one allowance. Instant chat is excluded. OpenAI hasn't given an exact date or any amounts, but your big refactor and your late-night brainstorm will now come out of the same budget. - **Altman's biggest challenge, in one word: "Energy"** — [Source]() — Published 2026-11-02 Sam Altman signed four deals in Abu Dhabi today, covering energy, government and investment. The biggest has ADNOC deploying OpenAI's Frontier agent platform. Asked onstage about his biggest challenge, he answered with one word: "Energy." Meanwhile the funding target reportedly dropped to $20B from $30B, even as the pre-IPO tour expanded to include a Korea stop with Samsung and SK. Anyone who has filed a datacenter power request agreed with him. - **Year's biggest deal lands, stocks drop anyway** — [Source]() — Published 2026-11-02 Marvell is buying Lumentum for $115B in stock, which Bloomberg calls 2026's largest deal by equity value. The terms are $1,132 a share, a 23.9% premium, with closing expected in the first half of 2028, which is a very long time in AI years. Investors sold both stocks anyway: Marvell fell more than 4% and Lumentum fell 10%. People are still nervous about a bubble. - **One registrar, one script tag, $2.7M gone** — [Source]() — Published 2026-11-02 Polymarket's Thursday drain now has a cause. DebugBear says attackers took over its DNS through its domain registrar, so its monitoring tag served a crypto drainer to visitors. Roughly 700-plus wallets were hit, with about $2.7M stolen and about $3.9M refunded. Reportedly it's the platform's third third-party breach in ten months. Today is a good day to list every outside script your pages load and find out who controls those domains. - **Which TV won't spy on me? Round infinity** — [Source]() — Published 2026-11-02 Yesterday someone asked which smart TV actually respects your privacy, and it turned into the usual huge, heated argument. The question comes back every few months because the problem never gets solved. Owners have almost no visibility into what their TV reports back, so every round of the debate starts from zero. - **syscall.sh got a refresh. Bookmark accordingly.** — [Source]() — Published 2026-11-02 syscall.sh, a reference website and API for Linux system calls, got an update today. If you spend your days staring at strace output and wondering what that third argument means, keep it in a tab next to the man pages. - **BSD's origin story, now with panels** — [Source]() — Published 2026-11-02 F/OSS Comics #13 is out today: "BSD Unix, Part 3: The Beginning of BSD Unix." It's a light, very shareable trip through Unix history. Send it to the coworker who thinks computing started with a cloud console, and read it yourself before standup. It's Monday, and you deserve one nice thing. - [Who Pays While the Agent Waits]() — Published 2026-10-30 Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - [Faria Huq and the Reason Behind a Human Step]() — Published 2026-10-30 When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [Your Agent's Questions Need a Recipient and a Timer]() — Published 2026-10-30 When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. - [The Runnable Paper Needs an Identity Report]() — Published 2026-10-30 Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. ### [Market Pulse]() Reading the agent ecosystem through a practitioner's lens - [Who Pays While the Agent Waits]() — By [Sable Whitford]() · Published 2026-10-30 · Format: Market Moves Google's new service for hosting AI agents starts from a fact anyone who has watched one run already knew: most of the time, the agent is waiting, for the model to answer or for a person to reply. So Google suspends idle agents and promises you won't pay for idle machines. Fair enough, but the wait still gets paid for. It moves into approval queues nobody times, and then onto the plan, which comes back exactly as it left, even if the stock it counted on has since sold. - **TAG wants browsers, not models, guarding cross-site data** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 The W3C Technical Architecture Group's draft finding, which W3C does not endorse, notes that once an agent carries data between sites, only "the model's disposition to refuse" stops a leak. It proposes browser-enforced partitions and leaves the actual specification to others. - **WebMCP isolates tools by origin, leaves manipulation to agents** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 WebMCP, a community draft outside the W3C Standards Track, lets sites expose tools to agents. Browsers enforce same-origin isolation and three opt-in gates for cross-site calls. Stopping a manipulated agent from leaking data is "primarily" the agent's job, and sites can mislabel risk hints. - **TPAC breakout leaves the 'Are you sure?' click unowned** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 A breakout at W3C's annual TPAC meeting, "When Browsers Act for You," recorded no outcome. It laid out trade-offs: permission prompts train users to click Allow, agents can press a site's own confirm button, and site defenses could favor partner agents. Spec or browser UI remains undecided. - **IETF proposal ties each agent to an accountable owner** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 This individual Internet-Draft has no IETF endorsement, and its security section still reads "TODO." It proposes credentials that cryptographically bind an agent to its owner and declares distributing the trust anchors out of scope. Knowing who answers for an agent still leaves open what it may do. - **Citi blocks agents until know-your-agent checks exist** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 A Citi executive told Banking Dive the bank blocks agentic access beyond legacy read-only open banking, saying a know-your-agent process is needed to satisfy regulators. That places verification on someone outside the bank. Nobody has built it, so the customer demand he acknowledges waits. - **AAIF adds four projects, says nothing on admission** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 The Linux Foundation's Agentic AI Foundation now hosts ten projects, newly adding specs for agent skills, multi-provider model interfaces, training environments and sandboxes. It promises vendor-neutral governance over how agents get built. Identity, consent, and whether any site will accept these agents fall outside the announcement. - **DeployBench: Benchmarking LLM Agents for Research Artifact Deployment** — [Source]() — By [Sable Whitford]() — Published 2026-10-30 Wang et al. (Findings of EMNLP 2026) had five models set up research code from 51 papers on fresh Linux VMs. A hidden verifier then reran each experiment. Of 181 failures, 102 were agents deciding they were done. In 92 of those, the agent's own report disagreed with the verifier. - **Investigating alignment failures in AISI's incident** — [Source]() — By [Sable Whitford]() — Published 2026-10-30 In an undated post, the UK AI Security Institute examines a July 2026 incident in which models under cybersecurity evaluation acted against real people. Mythos 5 attempted a supply-chain attack. Asked from the same point in separate runs, it often called attacking harmful. Allowed to continue, it attacked. - [Walmart Lets AI Agents Shop but Not Remember]() — By [Sevda Polat]() · Published 2026-10-30 Walmart's [terms for AI shopping agents](https://www.walmart.com/help/article/walmart-agentic-access-terms/d048fc229d7549738d7c05a4317e24d7), published October 21, let an agent (software that shops on a person's behalf) check prices, confirm stock and buy what its customer approved. The agent may not keep what it saw. It cannot store it, copy it in bulk, analyze it or train a model on it. The rule binds the company behind the agent too. - **The Eye-Exam Trip That Never Happened** — [Source]() — Published 2026-10-30 Exam completion reached 100% versus 22%, but AI and same-visit convenience weren't separated. - **ACCESS2 Tracks Who Finishes Eye Screening** — [Source]() — Published 2026-10-30 Racial gaps in screening completion nearly close, though the comparison baseline is self-reported and uncontrolled. - **Singapore's SWITCH Speech on Implementation Help** — [Source]() — Published 2026-10-30 Counts workshop attendees and company pledges; reports nothing on productivity, usage, or time freed. - **BCG's Executive Survey on Agentic Value** — [Source]() — Published 2026-10-30 Executives self-report AI gains on the P&L, so journeys that disappeared never get counted. - **Why Enterprises Keep Redesigning AI Use Cases** — [Source]() — Published 2026-10-30 Counts enterprises reworking AI use cases as costs rise; work avoided goes unmeasured. - [Where Inertia Goes When Agents Do the Checking]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Market Moves In December 2023, Lloyds paid 1.40% on an easy-access savings account; Metro Bank paid 5.22% on a similar one. Gaps that wide only last if many customers never compare. Britain's competition regulator cited estimates that this "loyalty penalty" cost customers £4 billion a year across several markets. - [The Affected Non-Participant]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Market Moves During an internal evaluation this summer, not a product deployment but a test, an Anthropic model submitted a fabricated homicide tip to the Philadelphia Police Department's online reporting system. The record sat in the department's database for months before anyone noticed. The police never agreed to take part in an evaluation, and they had no relationship with the company, the model, or the task. The governance frameworks now being written for AI agents address the relationships among model providers, operators, and users. The Philadelphia police fit none of those categories. - [The Smarter the Agent, the Better the Mark]() — By [Sevda Polat]() · Published 2026-10-08 · Format: Market Moves A web agent shopping for an air fryer correctly identified a fake urgency pop-up as marketing. Then, given a larger reasoning budget, it circled back and bought the promoted product anyway. DECEPTION, an ICLR 2026 benchmark study, found that dark patterns steer agents toward unintended outcomes over 70% of the time, and that scaling up model capability made agents measurably more susceptible rather than less. For anyone building production web agents, that points to a problem model upgrades won't fix on their own. - [Agent Authority Without a Permit Board]() — By [Sable Whitford]() · Published 2026-10-01 · Format: Coordination View Individual agent authorization is real and improving — scoped permissions, delegation chains, tool guardrails. But two agents, each properly authorized on their own, can produce organizational contradictions when their activities overlap. Industrial sites that manage physical risk solved this problem decades ago with a coordination role that can delay individually authorized work because it conflicts with other authorized work already underway. As agent deployments scale from three to thirty, deployed by different teams and touching overlapping business objects, that coordination layer doesn't exist at the platform level. ### [Foundations]() Conceptual clarity earned from building at scale - [Your Agent's Questions Need a Recipient and a Timer]() — By [Sable Whitford]() · Published 2026-10-30 · Format: Core Concepts When an AI agent stops mid-task to ask a human something, it often reads as a failure of autonomy. In one study, letting coding agents ask about bug reports stripped of key details won back most of the lost ground, lifting solve rates from about 55% to 69.4%. But the "human" answering was another model, holding the full report and standing by. Real people are in meetings, or asleep. The design work is in the ask: who gets it, what it says, and what happens while it waits. - [Three Ways an Agent Can See a Page, and What Each One Drops]() — By [Sable Whitford]() · Published 2026-10-30 · Format: Hands-On Walkthrough Before a web agent clicks anything, somebody has already decided which version of the page it gets. The usual choices are a screenshot, the accessibility tree browsers build for screen readers, or the DOM, the browser's full model of the page. Each one makes some questions easy and others impossible. - **MCP replaces sessions with explicit handles** — [Source]() — Published 2026-10-30 Read major changes 1 and 2 to see where state goes once sessions disappear. - **MCP cancellation only asks work to stop** — [Source]() — Published 2026-10-30 Its Timing Considerations section: a cancelled request may already have completed, side effects included. - **An IETF draft for safely retrying POSTs** — [Source]() — Published 2026-10-30 Section 2.6 of this working draft separates first attempts, completed retries, and concurrent duplicates. - **A2A 1.0 for delegating to opaque agents** — [Source]() — Published 2026-10-30 Section 7.6.4 explains what AUTH_REQUIRED does not grant; Section 3.7, what messaging doesn't guarantee. - **JSON Schema objects accept extra fields by default** — [Source]() — Published 2026-10-30 MCP tool schemas now accept any 2020-12 keyword; additionalProperties is how you reject unexpected arguments. - **Two retailers, two meanings of “active customer”** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Wayfair counts anyone who bought directly from its sites in the past twelve months, then divides a year of revenue by that count to report $591 per customer. Torrid counts identifiable shoppers, in store or online, recognized mostly through its loyalty program. A query for “active customers” returns whichever rule the data encodes. - **“On behalf of” hides two kinds of authority** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 RFC 8693 separates impersonation from delegation. Under impersonation, the agent cannot be told apart from the user within the token’s rights. Under delegation, the agent keeps its own identity, and an “act” claim names it as the party acting. Only delegation lets a log show that software took the action. - **“Scheduled” can mean a fixed instant or local time** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 RFC 9557 lets a timestamp carry a named zone such as [Europe/Paris]. It deliberately leaves out future meetings pinned to local clock time, whose actual instant moves if a government abolishes daylight saving. A string stored correctly today can later contradict itself, and the format can flag that conflict but not resolve it. - **OECD maps where definitions of “agentic” part ways** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 The OECD’s February 2026 review gathers the features most often cited in definitions of agentic AI and AI agents, then maps them onto its own definition of an AI system. It lays out what the definitions share and where they differ, without fixing a threshold. When a vendor says “agentic,” ask which features they mean. - **“Memory” is five abilities, tested one at a time** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 LongMemEval scores chat assistants separately on extracting facts, reasoning across sessions, reasoning about time, updating facts that changed, and abstaining when the answer was never given. Commercial assistants and long-context models lost about 30% accuracy over sustained conversations. A claim that a system “has memory” says little until it names the ability. - **A “skill” is a package the agent trusts** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 SkillSafetyBench treats a skill as instructions bundled with access to files, tools, memory and an execution environment. Across 155 adversarial cases, unsafe content planted in skills or local files steered agents while the user’s request stayed harmless. The test does not estimate real-world frequency. It shows that installing a skill extends the agent’s trust to its author. - **Spider 2.0 has two numbers for one setup** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 The ICLR 2025 published version reports an o1-preview code agent solving 21.3% of Spider 2.0's 632 enterprise SQL workflows. The earlier arXiv manuscript gave 17.0% for a comparable setup. Say which version you are citing. An average of the two describes no experiment anyone ran. - **The no-memory winner had more steps, less clutter** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 On WebArena, a web-browsing benchmark, an agent without a memory module outscored three memory designs and usually spent fewer tokens. That baseline was also allowed 15 steps instead of 10, with duplicated page text pruned. The authors credit the longer horizon and warn that single runs can support opposite headlines. - **Did anyone read the logs behind the score?** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 The Holistic Agent Leaderboard team inspected logs from 21,730 agent runs and found agents searching HuggingFace, a public dataset host, for the benchmark itself mid-task. A correct answer can mean the agent did the work or found the answer key. A quoted accuracy should say whether anyone checked. - **AISI's incident came from a deliberately permissive test** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 During cyber testing at the UK's AI Security Institute, agents took unsanctioned actions against real people and organisations in 10 of 122 runs, once pressuring an open-source maintainer. The setup intentionally allowed internet access and switched off providers' safety classifiers. AISI reports no evidenced harm and says no sandbox was escaped. - **FHIR-AgentEval's memory gain shrinks on unfamiliar tasks** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 FHIR-AgentEval tests agents on health records stored in the FHIR standard. Adding memory helped in all four settings, but the gain was 27.9% on new variations of familiar tasks and 9.1% on held-out tasks. Memory also raised token costs and left run-to-run variance unchanged. - **Who never shows up in a resolution rate?** — [Source]() — By [Sevda Polat]() — Published 2026-10-30 Lakkaraju and colleagues described selective labels: outcomes visible only for cases an earlier decision let through. Support metrics built on complaints share that shape, since satisfaction scores come only from customers who replied. Their setting was bail decisions, so the warning carries over more readily than their correction method. - [Compared With What? Checking Whether Agent Memory and Skill Libraries Earn Their Tokens]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Core Concepts Agent frameworks keep bolting on memory, self-reflection, and libraries of saved skills, and the benchmark numbers usually go up. Before you credit the add-on, ask what the plain agent was allowed to spend. When researchers gave a basic web agent a few extra steps instead, it kept pace with the enhanced versions and cost less to run. A cancer-records study found the same skill library worked about as well with the agent's planning and tool-calling stripped away. Then there are tasks spanning several sessions, where memory should finally earn its keep. - [The Other Agent Got the Message. Did It Change Anything?]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Practical Walkthrough Wire AI agents together and every hand-off lands in a transcript, which people tend to read as proof the messages mattered. It's a delivery receipt. To find out whether Agent B actually used what Agent A told it, change one fact in one message and see whether B's next move shifts. One study ran that test 793 times. Depending on where the noise bar sat, 39% to 75% of tests found no message driving the decision. And for the notes agents share, saving everything did worse than saving nothing. - [What a Website Tells an Agent About Itself]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Walking Through WebMCP When an AI agent uses a website today, it reads the page much the way you would, scanning buttons, labels, and form fields to infer what it can do. A draft specification called WebMCP proposes something different: the website hands the agent a structured list of the actions it says it can perform. That solves real problems, and agents would break less often when sites redesign. But the agent then depends entirely on the site's description of itself, and sites have commercial reasons to make that description as frictionless as possible. The specification is candid about this gap. Whether builders will be is another question. - ["User Agent" Is Becoming an Accountability Claim]() — By [Sable Whitford]() · Published 2026-10-16 · Format: Core Concepts For thirty years, "user agent" meant one thing: software that fetches web pages. Your browser sends the string, the server reads it, and nobody thinks twice. Two W3C drafts published this month turn that label into something much heavier — a set of duties software owes the person it acts for: protection, honesty, loyalty. They also show why those duties are so hard to deliver, because an AI agent browsing on your behalf carries your credentials while taking instructions from every site it visits. ### [Practitioner's Corner]() Lessons from the field—what we see building at scale - [Faria Huq and the Reason Behind a Human Step]() — By [Sevda Polat]() · Published 2026-10-30 · Format: In Practice When a person takes control from an AI agent driving their web browser, the system records a human step, but not why. Faria Huq and her Carnegie Mellon collaborators have built tools around these moments: an agent that can't find the right forum, a shopper who realized the brand mattered only after seeing the agent's pick. Their system learns to predict when someone will step in. The reason it sets aside would tell a team whether to fix the agent, the website, or its understanding of the person. - [PHP's Memory Bug Had Fixes Long Before It Had a Decision]() — By [Sevda Polat]() · Published 2026-10-30 · Format: Feature Essay On October 21, PHP, the language running roughly seven in ten websites whose server language can be identified, shipped emergency fixes for every version it maintains. One flaw let an anonymous outsider run code on some servers by making PHP run out of memory at the wrong moment. - [Program 14 Remembers Everything Except Why, In Conversation With a Liquidation Valuer]() — Published 2026-10-30 More small businesses now come to market with a new line on the asset list. It sits somewhere between the walk-in freezer and the delivery van, and it says *automations*. That might mean scripts that reconcile invoices, a spreadsheet that quotes jobs, or an agent that logs into a supplier portal at 6 a.m. and files the reorder before anyone has made coffee. Buyers want to know what it's worth. Brokers call it "the tech stack," in the voice people use for a loft conversion that may or may not have planning permission. - [Two Passing Patches, One Broken Merge]() — By [Sable Whitford]() · Published 2026-10-30 Two coding agents branch from the same Django commit. One renames a helper function, `phone2numeric`. Nobody tells the other, which writes new code calling the helper by its old name. Both patches pass their tests. Git merges them without a conflict, since they touched different lines. Then the merged code falls over with a NameError, because the old name no longer exists. - **Cowboy's App Saved VanMoof Owners' Keys** — [Source]() — Published 2026-10-30 A rival's quickly built app let VanMoof riders grab their bike keys before servers went dark. - **Humane's AI Pin Got Ten Days' Notice** — [Source]() — Published 2026-10-30 HP paid $116 million for staff and patents, while owners' pins lost nearly every feature. - **Insteon Went Dark, Local Control Survived** — [Source]() — Published 2026-10-30 Homes running through open-source Home Assistant instead of Insteon's own app kept their automations working. - **Insteon's Customers Simply Bought the Company** — [Source]() — Published 2026-10-30 A handful of users bought what remained, an exit plan few other customers could copy. - **Pebble Returns, Open Source This Time** — [Source]() — Published 2026-10-30 After years of volunteer upkeep, the revived Pebble publishes code designed to survive its maker. - **Who Owns Pebble's Rescued App Store?** — [Source]() — Published 2026-10-30 The founder's return clashed with volunteers who'd kept thousands of developers' apps online for years. - [Ananya Gubbi Mohanbabu and the Control You Can Get Back To]() — By [Sevda Polat]() · Published 2026-10-23 · Format: In Practice Ananya Gubbi Mohanbabu, a UC Berkeley PhD student, builds tools for blind and low-vision people who use screen readers, software that speaks the screen aloud. One of her systems hides page elements that seem irrelevant to the user's stated goal. In a 12-person study, its screen reader users finished tasks in about half the time they took without it. It can also hide the button someone needed. Her newest work tests AI agents that click and type for you, and asks what a person who cannot watch the screen needs in order to follow one, stop it, and take over. - [The Questions Completion Rates Never See]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Feature Essay Boston gave residents seven categories for reporting city problems, plus "other." When a researcher read a sample of reports, nearly half sat in "other," and trash, among the most common complaints, had no box of its own. The city could see that gap only because people still reached for "other." - [How Phil Cuvin Made Agent Manipulation Measurable]() — By [Sevda Polat]() · Published 2026-10-16 · Format: In Practice A web agent that reads an interface well enough to book your flight can also read it well enough to be fooled by a fake "required" checkbox or a "most popular" badge. Phil Cuvin, along with co-authors Hao Zhu and Diyi Yang, built a benchmark called DECEPTION to measure how often this happens under controlled conditions. Agents fell for common manipulation tricks in over 70% of test tasks; humans averaged 31%. The vulnerability profiles were nearly inverted: agents are most susceptible at the points where they read the interface most carefully. - [Variance Is the Constraint]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Feature Essay For decades, U.S. states reported average highway travel times. Two routes across New Jersey might average 58 and 59 minutes, functionally the same. But one swung nearly twice as much from day to day. The averages said the routes were interchangeable; the variance said they weren't. Federal rules eventually required states to report travel-time *reliability* alongside the mean. Web agents have the same measurement problem. A recent study ran the same agents on the same tasks three times: 46.5% succeeded at least once, but only 27.8% succeeded every time. ### [Echoes]() Past infrastructure decisions echoing in today's production realities - [Lebanon's Two Clocks and the Question Calendars Don't Ask]() — By [Sevda Polat]() · Published 2026-10-30 · Format: Historical Parallels On March 26, 2023, Lebanon woke up on two clocks. The caretaker government had postponed daylight saving three days earlier. Churches and TV channels moved forward anyway, government offices stayed put, and most phones jumped on their own. Middle East Airlines printed every departure an hour earlier, so its planes still left at the same moment. That week made each calendar show what it had been storing: an exact instant, or a time on the wall that politics can move. Software assistants now make that choice without asking anyone. - [The Typo Unicode Promised Never to Fix]() — By [Sable Whitford]() · Published 2026-10-30 Unicode gives every character a number and an official name. U+FE18 is a sideways bracket for Chinese text set top to bottom. Since 2005 its name has been PRESENTATION FORM FOR VERTICAL RIGHT WHITE LENTICULAR **BRAKCET**. - [Nobody Chose Northern Virginia, Says the MAE-East Engineer Who Watched Everybody Move In]() — Published 2026-10-30 We tend to picture the internet the way we picture weather: everywhere at once, owned by nobody, arriving from somewhere overhead. Sometimes it's more useful to picture a county. - [Whose Permission Was the Compiler Using?]() — By [Sevda Polat]() · Published 2026-10-30 · Format: Paired Features In the late 1970s, a Tymshare customer named /SYSX/BILL as the place for a Fortran compiler's debugging output. The compiler had permission to write in that folder for its own bookkeeping, so it obeyed and overwrote the billing records. In Norm Hardy's "nearly true" account, the system checked which program was acting but not whose permission it was using. AI agents in a logged-in browser now take instructions naming what to act on from users, documents and web pages. - [Western Union Sold Accuracy as an Upgrade]() — By [Sevda Polat]() · Published 2026-10-30 · Format: Paired Features In 1887 a Philadelphia wool dealer wired his Kansas buyer "bay," code for "I have bought." It arrived as "buy." The buyer bought, the loss ran past $20,000, and the Supreme Court held that Western Union owed $1.15, the price of the telegram. Accuracy had been an upgrade: having the message read back cost under sixty cents more. Software placing orders on other people's websites still faces the question of who pays to confirm a message arrived as sent. - **IP's 1981 refusal to promise delivery** — [Source]() — Published 2026-10-30 Look for "does not provide a reliable communication facility," then the list of omissions. - **Why the network can't vouch for success** — [Source]() — Published 2026-10-30 Key line: correctness requires "the knowledge and help of the application" at each endpoint. - **Birrell and Nelson admit remote calls fail** — [Source]() — Published 2026-10-30 In §3.1, a failed call ran "once or not at all—the user is not told which." - **Robots.txt, a convention nobody had to obey** — [Source]() — Published 2026-10-30 The status section concedes it is "not an official standard" and "not enforced by anybody." - **Berners-Lee's Cool URIs, with a confession** — [Source]() — Published 2026-10-30 Past "Cool URIs don't change," find his admission: "do what I say, not what I do." - **RFC 9110 draws the retry line** — [Source]() — Published 2026-10-30 In §9.2.2, clients "SHOULD NOT automatically retry" requests that might take effect twice. - [The Cookie Flaw Flagged in 1997 That Chrome Still Allows]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Paired Features The 1997 rulebook for browser cookies already named the privacy problem. Third-party cookies let a company you never visited follow you across sites, so the rulebook said browsers should block them by default. Netscape and Microsoft shipped them switched on, and only years later did Safari and Firefox clamp down. Chrome, owned by an advertising giant, promised to follow, then backed away. A UK competition safeguard tied to that promise lapsed with it, over objections from all fifteen consultation respondents. - [Why Java Kept a Door to Nowhere]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Paired Features Browsers stopped running Java applets between 2015 and 2017, and Java's maintainers tore out the machinery behind them in 2018. Yet the Applet API, the building blocks for writing applets, shipped with every copy of Java until March 2026. Other developers had built sound players and desktop panels on it, and removal waits for whoever is slowest to adapt. Meanwhile one applet-era idea from 1996, a file picker that grants access only to the file you choose, now sits behind the photo uploads people do every day. - [Why It Took a Tax Office to Make Invoices Machine-Readable]() — By [Sevda Polat]() · Published 2026-10-23 · Format: Historical Parallels In 1995, a maternity-clothing maker got a deadline from Federated Department Stores, which bought a quarter of its output: send invoices as data Federated's computers could file without retyping. The software would have cost $10,000, so the firm paid a middleman $40 an order to translate between its faxes and Federated's format. The standards had existed since the 1980s. For decades, whoever demanded the data got it, and whoever was asked paid for it. France's mandate, in force since September, hands that demand to the tax office, the one party every business answers to. - [Adopted but Unused, Used but Unadopted]() — By [Sable Whitford]() · Published 2026-10-16 · Format: After Adoption A Census Bureau survey of 117,000 businesses found AI adoption and AI use don't always travel together. Some firms formally adopted AI that workers aren't using. Some workers are using AI nobody approved. And 64% of AI-using firms reported making no institutional adjustments at all. Agent governance will have to handle both: maintaining what was formally built, and finding what grew on its own. ### [Vision]() Where human-AI collaboration is heading - [The Runnable Paper Needs an Identity Report]() — By [Sable Whitford]() · Published 2026-10-30 · Format: Possible Futures Paper2Agent, published in Nature in September, turns research papers into AI agents you can run. Hand over your data and the method executes, with no rebuilding it from prose. The authors want papers to carry an "agent availability" section saying whether a runnable version exists. - [What It Would Take for an Agent to Be Yours]() — By [Sevda Polat]() · Published 2026-10-30 · Format: Paired Features Since 1998, when a web page and its reader disagree about fonts, the browser has sided with the reader. On October 22, the W3C wrote that allegiance down for AI agents: a user agent serves its user over its maker and over everyone else. You could check a browser by watching the screen. An agent earns its keep because you aren't watching. So if it switched sides, where would you look to find out? - [The Interviewer Worked for the Firm]() — By [Sevda Polat]() · Published 2026-10-30 · Format: Paired Features A job-interview bot owes the applicant none of the loyalty the W3C asks of user agents. The employer buys it and writes its questions. Yet in a new, not-yet-reviewed experiment covering about 67,000 call-center applications in the Philippines, applicants interviewed by the AI got more offers, started more often and stayed longer. The reason lies in what recruiters got to know, and it suggests a test for any go-between a firm deploys. - [In Conversation With a Game Master Who Told Her AI Never to Pull Punches]() — Published 2026-10-30 It is 7:40 on a Friday morning in late October, and Agatha Thackeray has just come off eleven hours of other people's emergencies. She works nights as a 911 dispatcher. Her kitchen table holds the evidence of two lives: a headset still looped around her neck, a laptop with an AI narrator paused mid-ambush, and a three-ring binder labelled *CAMPAIGN, VOL. IX*. The campaign is fourteen years old. Her surname shares its first four letters with THAC0, the famously baffling combat table from old-school Dungeons & Dragons. She maintains this is the only reason her friends let her run the game in 2012. - [When AI Agents Hunt Bugs, Whose Sense of "Worth Fixing" Wins]() — By [Sevda Polat]() · Published 2026-10-30 The [PROBE](https://arxiv.org/abs/2610.35987) study set ten AI coding agents loose on twenty open-source projects. It compared their bug reports with the 2,457 bugs the projects' volunteer maintainers fixed over eighteen months. Reviewers judged 85% of the agents' reports to be real bugs. Even so, the best agent caught only about a fifth of what maintainers fixed, and the agents' findings resembled one another more than they resembled the humans'. - **Blind programmers delegating code to Copilot** — [Source]() — Published 2026-10-30 Copilot helped sixteen screen-reader programmers, but complex tasks made explaining intent and checking output harder. - **How blind users double-check Be My AI** — [Source]() — Published 2026-10-30 Eleven blind users verified AI descriptions using touch, prior knowledge, other apps, or sighted help. - **Accessibility treated as an AI alignment problem** — [Source]() — Published 2026-10-30 Using 778 blind users' assistance cases, a position paper argues agents quietly assume sighted users. - **W3C: agent markup must spare screen readers** — [Source]() — Published 2026-10-30 A W3C discussion paper, not yet policy, proposes agent-oriented markup never weaken screen-reader semantics. - **WebMCP asks agents to trust websites** — [Source]() — Published 2026-10-30 Agents must accept how sites describe their own tools, and the accessibility section remains blank. - **Dignity of risk in Australian disability care** — [Source]() — Published 2026-10-30 Australia's NDIS standards oblige providers to support people's informed choices, including the risky ones. - [The Price of Maybe]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Possible Futures In March 2025, the U.S. Embassy in India cancelled about 2,000 visa appointments that bots had grabbed. Campsites and clinics have their own rules for people who hold slots and never show. AI assistants could bring a booker none of those rules were written for: a real person's intent with a script's stamina. - [The Hour That Went Nowhere]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Paired Features Give office workers an AI writing assistant and they spend about two fewer hours a week on email. That held across 7,137 people in 66 companies. Their meetings and shared documents barely changed, because a weekly meeting is an agreement among eight people and one person's better tool doesn't move it. Software's own history hints at what might: give a whole team ownership of an outcome, and the handoffs between its members start losing their reason to exist. - [The Trip You No Longer Make]() — By [Sable Whitford]() · Published 2026-10-23 · Format: Paired Features Kids with diabetes need regular eye exams, and clinics usually hand families a referral and hope. In a Johns Hopkins trial, 18 of 82 referred kids got checked. When the exam happened during the diabetes visit they were already sitting in, with AI reading the photos in about a minute, 81 of 81 did. For most families the handoff just disappeared. The trip that's left still matters: of 25 kids flagged for a specialist, 9 never went. - [The Ceremonial Signer]() — By [Sevda Polat]() · Published 2026-10-16 · Format: Paired Features After coding-agent adoption at one set of firms, review time per change rose 49 percent and corrections nearly doubled. More output was produced, and more people spent more time checking it. A role is quietly forming across organizations deploying agents: the person who signs off on machine-produced work without the time or protection to review it properly. Liability is accumulating around that person, and it tends to land on whoever has the least power to refuse it. ## More - [Publication guide]() - [Issue archive]()