Market Pulse
Market Pulse
Commit Distance: How Far a Consequence Gets Before Anyone Can Stop It
Watch a coding agent work for an hour. Forty files, tests written and failed and rewritten, and when it stops, no user has been touched by any of it. The work sits in a pull request waiting for someone to read a diff. Now watch a purchasing agent finish in four steps, with the money already in another company's account.
The first agent operated with far more independence. The second one's consequence got further from anyone who could reach it. That second measurement is commit distance. It moves independently of autonomy, and reversibility exists only where someone has been paid to perform it.
Commit Distance: How Far a Consequence Gets Before Anyone Can Stop It
Watch a coding agent work for an hour. Forty files, tests written and failed and rewritten, and when it stops, no user has been touched by any of it. The work sits in a pull request waiting for someone to read a diff. Now watch a purchasing agent finish in four steps, with the money already in another company's account.
The first agent operated with far more independence. The second one's consequence got further from anyone who could reach it. That second measurement is commit distance. It moves independently of autonomy, and reversibility exists only where someone has been paid to perform it.
Research Grounding
Towards a Science of AI Agent Reliability
Larger models improve calibration and robustness but show more run-to-run variability on complex tasks — capability and consistency pulling apart.
Every major frontier provider clusters at similar reliability levels, suggesting shared architectural limits rather than individual shortcomings.
Research Grounding
AgentHijack: Benchmarking Computer Use Agent Robustness to Common Environment Corruptions
Routine friction, not attacks. Agents click vanished buttons or mistake accidental keystrokes for their own inputs when pop-ups and resolution shifts appear.
Nine corruption types capture normal desktop conditions rather than adversarial scenarios, filling a gap that standard agent benchmarks leave open.
Case Study
In July AWS patched its HealthLake connector, the glue that lets an AI assistant query patient records. A crafted pagination parameter could redirect the server's next request anywhere the attacker liked, its temporary cloud credentials riding along.
Run it with --readonly and the ceiling on damage looks like a leaked query. AWS's bulletin says the flag is "an in-process guard over the mutating tools, not an IAM control, so disclosed credentials retain their full granted authority."
The flag governed what the server would do with its keys. It had no opinion about what a stranger holding them could do, which was everything the account's permissions policy allowed.
Every connector you've shipped invites the same question: is read-only enforced by the permissions policy, or by the tool's own manners?
Primary Sources
Past Articles
Somewhere in a traffic policy sits the suggestion that you break your automation into three crawlers, one per purpose, s...
Visa's rules now define agentic transactions and hold cardholders responsible for what their agents do. Real agents are ...
Microsoft's coding-agent study reports a 24% increase in merged pull requests across tens of thousands of engineers, the...
Visa's new agentic commerce rules hold cardholders responsible for agent-initiated payments "as if the Cardholder initia...