§ Research Files
Research notes from production.
Almost every safety control shipped so far governs one agent in isolation. A ten million dollar research call just conceded that the failures worth worrying about live in the space between agents, where no single component misbehaves. The five classes, why existing controls do not reach them, and what to instrument in a system you are already running.
From September, agent-class traffic is blocked by default on a large share of the commercial web. An agent that browses anonymously and hopes for the best is now an agent with a shrinking and invisible field of view. The pattern for declared identity, cryptographic verification, budgeted paid access, and honest degradation.
Three signals from this week. A machine learning conference embedded hidden instructions in every submitted paper and used them to catch reviewers outsourcing judgement to a model. Gartner prices agentic arbitrage at $234 billion and reframes what enterprise software is bought for. And July's MCP disclosures make the case that context providers cannot be trusted by default.
A market monitoring agent produced well formed reports for eleven days while most of its fetches were being blocked at the edge. Nothing errored. The retrieval layer returned challenge pages with a 200 status and the agent summarised them as an absence of news. The trace, the mechanism, and the three controls.
Price per token is not the unit that matters. Cost per successful task is. The routing table is the pattern that lets you capture cheap tokens where they work and keep strong tokens where they must. What the table contains, how to log a route as a decision, how the fallback path works, and the four ways this goes wrong.
Three frontier models shipped in one week. Your provider can roll a version underneath you. The only thing standing between that churn and your production agent is an eval set. What belongs in it, the four case classes, how to score the path and not just the answer, and how eval sets decay.
Three signals from this week. An LLM agent carried out a full intrusion and wrote its own ransom note. Three frontier models shipped in seven days and the price of agentic work collapsed, while the reliability number stayed flat. And a regulator removed more than 14,000 agents from a market, which is what enforcement looks like.
The new model was cheaper per token on every line of the price sheet. Three weeks later the monthly bill was higher and the human overturn rate had doubled. Price per token is not the unit that matters. The trace, the arithmetic, and the metric to bill against instead.
Prompt injection cannot be filtered away. The defenses that work in production: structural separation, least privilege, human gates, output validation, and blast radius design. The full stack, with checklist.
How to retry LLM API calls properly: exponential backoff with jitter, Retry-After handling, deadlines, idempotency, circuit breakers, persistent queues, and fallback models. With code and a checklist.
Anthropic's Fable and Mythos come back online after a 20-day showdown, Europe debates AI sovereignty, GPT-5.6 leaks point to a July launch window, and Meta rattles the compute market.
Agentjacking hits coding agents through error trackers, GPT-5.6 launches behind a government gate, an open protocol for agent authorization, and Gartner's $206B agent forecast.
Most agents are instrumented for the failures that announce themselves and blind to the ones that do not. The three streams every production agent must emit, the question each one answers, and the failures you stay blind to when one is missing.
Three signals from this week. A cloud platform ships agent observability as a first class primitive, including a score for how instrumented your agent is. New data makes governance the dividing line between agents that scale and the majority that get rolled back. And the orchestration layer commoditizes, which moves your moat somewhere else.
A triage agent started misrouting urgent tickets. No error fired. The outputs were well formed and plausible. The cause was a model version that changed under a floating alias, and nothing was watching the one thing that would have caught it. The trace and the three controls.
Three signals from this week. A named attack class lands for hijacking coding agents through MCP. Agents get spending wallets and an open identity manifest, both shipping with governance built in. And a Big Four firm turns agent oversight into a buyable layer.
A research agent read a field in a third-party API response, treated the text inside it as a command, and exfiltrated data it was never asked to touch. No credential was stolen. The attack was plain text in a tool output. The trace and the three controls that stop it.
Most teams give an agent a service account and call it identity. A service account answers what the agent may do. It does not answer who acted, on whose behalf, or under what authority. The four-property framework for agent identity that holds up under audit.
Three signals from this week. New scans put hard numbers on the MCP exposure problem for the first time. Fresh deployment data shows coding agents shipping while horizontal agents stall. And the model conversation shifts from one best model to a portfolio matched to the job.
A billing agent retried a payment it had already completed and charged 312 customers a second time. Every individual step was correct. The defect was a missing idempotency key. The trace, the mechanism, and the two controls that prevent it.
Three signals from this week: a new dataset quantifies the pilot-to-production gap for the first time. Five intelligence agencies release joint guidance on agentic AI in critical infrastructure. And the agent communication protocol that every major vendor now implements has a permanent home.
A human in the loop is not the same as a human in the way. The pattern for routing only the decisions that need a human, the four fields every approval item must carry, and the failure modes that turn a queue into a rubber stamp.
Every production agent system has a trust boundary. Most teams never defined theirs explicitly. Here is the framework for deciding where it sits, the four most common placements, and the failure modes that emerge when the boundary drifts.
A four-agent pipeline where every individual agent behaved correctly, but the system produced a confident, completely false output. The failure mode is structural, not model-level. Here is the trace, the mechanism, and the three controls that prevent it.
Google and Anthropic shipped identical product category names on the same day with opposite infrastructure postures. Cursor Composer 2.5 landed at one-tenth the frontier price. The Big Four accounting firms completed their AI stack alignment. Three signals from the most consequential week in agent engineering so far.
Capability and reliability diverge as task duration grows. Benchmarks measure capability. Customers experience reliability. Here is the framework, the math, and the four metrics to ship instead.
Three signals from this week. The protocol everyone bet on has its first real security incident. The standards body finally moves from model governance to agent identity. And an academic group puts a name on what every production team has been measuring quietly.
Prompt engineering optimizes a single question. Context engineering decides what the agent can see, when, and at what resolution. Here is the framework for choosing altitude, the four most common failure modes, and the file structure that holds up under audit.
A real postmortem from a framework user who left for a wedding on a Friday. The agent looped from Friday night until Monday morning. The fix is two lines of code. The lesson is older than agents.
Three signals worth your attention this week: model-native agent harnesses are arriving, an academic consortium quantifies the security gap, and a new standard for agent threats is now public.
A production agent without a kill switch is not a production agent. The architecture pattern, the team protocol, and the failure modes a kill switch must handle.
A real postmortem from a vibe-coding session that went wrong. Why "freeze the code" is not a permission boundary, and the three controls that would have prevented this entirely.
A G2 report reveals orchestration as the top scaling bottleneck. NASA researchers publish a methodology that mirrors our architecture. And MCP crosses 10,000 servers, here's what that means for your tool contracts.
Least privilege is not a security buzzword. It's the difference between an agent that fails safely and one that deletes your production database at 3 AM.
Datadog's State of AI Engineering report dropped hard data. Stanford measured real agent performance. And the most common production error isn't what you think.
Anthropic's tool-use update, a quiet retrieval paper worth your weekend, and three production postmortems from the field.
The ICP scoring looked perfect on paper. But it scored engagement, not authenticity. Here's how fake profiles gamed the scoring model and what I changed.
Not seven categories. Seven specific, concrete test scenarios, with expected outcomes defined before you run them. No exceptions.
Most agents remember everything or nothing. Both are wrong. Here's the framework for deciding what to store, what to forget, and how long information stays relevant.
A naive exponential backoff was hiding a deeper concurrency leak. Here's the trace, the fix, and the regression test that now catches it.
One typed schema, one error taxonomy, one idempotency convention. The discipline that turns demo agents into shippable systems.
Line by line through the SOUL.md powering a legal-tech agent in production. The decisions, the trade-offs, the things we'd change.