标签：#Agents

In the last couple of posts I let agents debug over DAP — breakpoints, step over, continue. That's real debugging. But it's only half of it. When I debug something for real, I also click : I press the button and watch what happens, read the dialog, notice the toggle is greyed out. No backtrace ever tells you the Save button never enabled. So — can the agent do that half too? The web is the easy case Browsers are automatable by design. Most agent tools ship their own browser or drive an external one; point Playwright at a page and every element has a stable, queryable handle. The DOM is an accessibility tree wearing a different hat — roles, labels, structure, all there for the reading. For the web, this half of debugging is close to solved. Native apps are another game There's no DOM. When the agent has nothing to go on, it falls back to the eyeball approach: take a screenshot, let the model look, maybe run OCR or a pre-analysis pass to label what's on screen. It works — and sometimes it's the only option — but it's brittle (a few pixels off and the click misses) and it burns tokens describing pictures. I ran into this by accident. I once wrote a tiny skill whose only job was to screenshot a running 4D form and stitch an animated GIF for a README — 4d-capture-gif . Then I noticed Claude Code reaching for it to debug : the skill also reports a bit of the form's structure — where the buttons are — so the agent knows where to click. For simple cases it genuinely works. But screenshots-plus-coordinates is not the thing I want to build on. The cleaner path: read the tree, don't look at pixels Instead of staring at the screen, read the UI tree directly. On macOS you can script the Accessibility API from Python (pyobjc), and there are automation libraries to help. Now you're clicking element #37, the "Save" button instead of coordinate (412, 260), and hope . A couple of open-source tools are pushing exactly here: agent-desktop — a native CLI that exposes any app's accessibi

I spend a lot of time in the AI space -- reading papers, building things, talking to engineers who are actually shipping. And there is a gap between what the demos show and what production systems actually look like that nobody is being fully honest about. So here is my honest take on where things actually are. The Problem With How We Talk About AI Agents Everyone is calling everything an "agent" right now. A function that calls a tool? Agent. A chatbot with memory? Agent. A script with a loop? Agent. This dilution is not just semantic. It is causing real engineering mistakes. When you do not have a precise definition for what you are building, you end up over-engineering simple pipelines and under-engineering genuinely complex ones. I have seen teams spend weeks adding "agentic" orchestration to workflows that would have been fine as a single well-structured prompt. Here is the definition I keep coming back to: an agent is a system that has an objective, not just an instruction. It decides what to do next. It handles failure. It knows when it is done. Everything else is just a fancy function call. 🟢 If your system needs a human to tell it each step, it is not an agent. It is a chat interface. 🔵 If your system can recover from a failed tool call and try a different approach, you are getting somewhere. ✅ If your system can decompose a goal into subtasks and delegate them, that is the real thing. What Is Actually Happening in Production Right Now The honest picture from teams I follow and talk to: Most real agent deployments are narrow. They do one thing well. Customer support triage. Document extraction. Code review on a specific codebase. They are not general-purpose reasoning engines. They are purpose-built pipelines with some intelligence in the decision layer. The teams getting good results are not chasing the latest model release. They are obsessing over: ☑️ Tool design -- what can the agent actually call, and how clean is the interface ☑️ Failure handling -- wh

AI agents don't usually become unreliable all at once. They degrade quietly. One session the agent...

Everyone demos a WhatsApp chatbot. Few run one in production with real customers sending real messages 24/7. After 18 months of running SARA — an open-source WhatsApp AI agent serving businesses across 20 industries — here's what we learned about architecture that survives contact with reality. Why WhatsApp? The numbers are simple: 2B+ monthly active users 60% of SMB customers prefer messaging over calling 98% open rate (vs 20% for email) But WhatsApp is NOT just another chat channel. It has unique constraints that break naive implementations. Architecture Overview WhatsApp (WAHA) → Bridge (:3008) → SARA API (:3006) → AI Provider Chain → Tool Dispatcher ↓ Groq → Cerebras → SambaNova → Mistral The Provider Fallback Chain Single-provider AI is a production risk. We use a 4-provider chain: Primary: Groq (fastest, free tier) ↓ fail Fallback 1: Cerebras ↓ fail Fallback 2: SambaNova ↓ fail Fallback 3: Mistral (paid, always works) Each provider gets 2 retries with exponential backoff before failover. Result: 99.7% uptime over 6 months with $0 inference cost (free tiers). Tool Calling: Not Just Chat SARA doesn't just answer questions. She executes actions: create_reservation — books a table with date normalization ("domani alle 8" → 2026-08-10T20:00) check_inventory — queries stock levels generate_invoice — creates a PDF from database records schedule_appointment — manages calendar slots The dispatcher maps 30+ tools to handlers with an autonomy gate: User message → Intent classification → Risk assessment → Tool execution ↓ Low risk: execute immediately Medium: execute + notify owner High: ask for confirmation first You do NOT want your AI agent booking a catering order for 500 people without human approval. PII Handling Messages contain names, phone numbers, addresses. Our pipeline: Anonymize before sending to LLM (replace "Mario Rossi" → "[PERSON_1]") Process with anonymized data De-anonymize tool calls only (the reservation needs the real name) Never log PII in plain tex

AWS introduced something this week that is close enough to the problem I have been working on that I do not think it should be casually labeled complementary. Amazon Bedrock AgentCore added temporal policies , along with an open-source policy language called Dogwood . Instead of asking only whether an individual tool invocation is allowed, the gateway can evaluate the sequence of actions that led to it. Consider a purchasing agent with this rule: purchases under $10,000 do not require escalation The agent makes six purchases of $9,000. Every individual action satisfies the rule. The sequence may violate the organization's intended limit. The same problem appears with approvals. An API call may be permitted only if a human approval occurred earlier in the workflow. Looking only at the final call cannot establish that condition. Something needs to remember the relevant execution history and evaluate policy against it. That is the class of problem temporal policy addresses. The interesting architectural choice is that this logic lives outside the agent. The model does not need to faithfully remember the constraint from its prompt. The runtime owns the control. More agent behavior is becoming explicit This is not the only sign that agent instructions are moving out of conversations and into inspectable artifacts. A recent ESEM 2026 study of Agent Plans screened 36,710 engineered GitHub repositories and found 85 Markdown plan files across 10 repositories. That is a very small population, so I would not interpret the result as evidence of broad adoption. But the content is interesting. Those plans commonly described implementation steps, specific files or locations, and testing or validation instructions. The agent's execution intent was being preserved as part of the repository. There is a similar pattern in distribution. Tenable's CyberAgents Exchange treats agents, skills, MCP servers, and multi-agent playbooks as separate reusable components. The ecosystem is graduall

Our AI Agent Failed 5 Times in One Day. Here is Why It Never Happened Again. LAO Runtime Protection in action — real failures, self-repaired, permanently prevented, zero repeats. August 9, 2026 · by the ZWISERFIT engineering team AI agents fail silently. LAO makes failures visible and fixable. On August 8, 2026, our agent orchestration system — LAO — ran a full 24-hour cycle under autonomous governance. The result: 5 distinct failures detected, repaired, anchored, and permanently prevented across 3 agents (Shuyu, Luna, Hermes) in 5 different failure modes. Not one error repeated. Not once did a founder intervene in the repair loop. That is the claim. Here is the evidence. The Philosophy: Errors Dont Reduce Trust — Hiding Them Does 错误不会降低信任，隐藏错误才降低信任。 Errors dont reduce trust. Hidden errors do. This isnt motivational rhetoric. Its an engineering constraint. Every event in our trust ledger follows the same chain: failure → detection → repair → prevention → anchor An anchor is the key word. Not a bug report that gets archived. A persistent, versioned rule that makes the same class of error structurally impossible going forward. Anchors are the immune memory of the system. All metrics below are verified from ledger data. Error 1: Feishu Hallucination + Skill Amnesia An agent pushed a platform integration the founder never asked for, then forgot the corrected instruction entirely. Correcting an agent without persisting the correction fixes nothing. Repair: Three immutable anchors locked output standards. Intent Validation Gate v2 now blocks any non-requested platform integration before it is attempted. Error 2: Port Confusion — Knowing ≠ Executing An agent understood the right pattern but executed the wrong port — twice. Knowing and doing diverged. Repair: Structural prevention, not a better prompt. Error 3-5: URL mishaps, gate collisions, and silent failures The same class of mistake hit multiple agents independently. One gate stopped all of them. The Numbers Metric Val

TypeScript teams rarely standardize on one AI framework forever. One service may use Vercel AI SDK, another LangChain.js, another OpenAI Agents SDK, and a mature system may call provider clients directly. Those implementations expose different callback, telemetry, and streaming surfaces. Observability becomes expensive when every dashboard, test rule, and CI report understands each framework independently. An adapter layer isolates that variation. Framework-specific code captures source events; the adapter translates them into one versioned trace model; the rest of the system operates on normalized events. framework callbacks or wrappers | v framework adapter | v versioned trace events | | | v v v local UI CI gates telemetry export The goal is not to pretend every framework is identical. The goal is to preserve a common set of observable facts without leaking framework details into every consumer. Put the Boundary in the Right Place A tempting interface is runWithTrace(input) -> { result, events } . It works in a demo but creates several problems: Streaming runs may not have one finite completion point. Buffering every event in memory does not scale. Callback-driven frameworks already own the run lifecycle. A framework may emit activity after the initial method returns. Returning events couples capture, storage, and application results. A stronger boundary translates source events as they arrive and sends normalized events to the tracing core. Define the Normalized Model First Keep the shared model small, explicit, and versioned. type SpanKind = ' run ' | ' model ' | ' tool ' | ' retrieval ' | ' decision ' ; type TraceEvent = | { schemaVersion : 1 ; event : ' span_started ' ; traceId : string ; spanId : string ; parentSpanId : string | null ; name : string ; kind : SpanKind ; timestamp : string ; attributes : Record < string , string | number | boolean > ; } | { schemaVersion : 1 ; event : ' span_ended ' ; traceId : string ; spanId : string ; timestamp : string ; st

Large language models have enormous context windows now. That does not mean they use all of that context reliably. As prompts grow, models can miss details, lose track of relationships, or produce plausible summaries instead of doing the exhaustive work a question requires. The Recursive Language Models (RLM) paper proposes a different interface: keep the large context outside the model, expose it as a variable in a persistent programming environment, and let the model inspect, partition, and recursively query smaller pieces. We rebuilt that method with an unusual constraint: no OPENAI_API_KEY ; Codex CLI as the model backend; gpt-5.4-mini for both the RLM root and every subcall; a direct frontier model only as a separate baseline. The result was encouraging, expensive, and more nuanced than “cheap model equals frontier model.” What an RLM changes A normal model call looks roughly like this: large prompt -> model -> answer An RLM instead gives the root model metadata about the input and a Python REPL containing the real context: question | root model | persistent REPL holding the context |-- inspect and search with code |-- split context into useful chunks |-- call smaller LMs over those chunks |-- validate and aggregate results `-- return the final answer The important detail is that the root model does not need to carry every document, record, tool result, and partial answer in its own context window. Large intermediate values can remain in REPL variables. Subcalls receive focused, locally understandable tasks. That makes RLM less like a bigger prompt and more like an out-of-core data-processing system whose semantic operator happens to be a language model. What we actually tested We used an OOLONG trec_coarse validation example from the protocol described in the RLM work. The input was a 308,367-character context containing 3,182 general-knowledge questions. Each question implicitly belonged to one of six answer types: numeric value entity human being location ab

You're Not Comparing Models. You're Comparing Contracts. Two teams publish scores on the same agent benchmark. One lands in the low sixties. The other clears seventy. A procurement team reads the spread and makes a call. What they do not see: both teams may be running the same model. They did not need to change the weights for the gap to appear. The spread can come from scaffold alone. One team wrapped the model in a harness with better retries. Different tool defaults. A planner step the other team had skipped. None of that appears on the leaderboard. The comparison that drove the decision was not between two agents. It was between two contracts. There Is No Benchmark The mistake hiding behind this story is a category error. People talk about agent benchmarks as if they measure a thing called “the model.” They do not. They measure a coupled system. The model is one component. The rest is a stack of protocol decisions that are almost never disclosed and almost always matter. The score is the output of that stack. Change any layer and you change what the number means. Recent research on agent evaluation has named those layers explicitly. There are at least seven. Deployment regime. Observation channel. Harness and scaffold. Metric and action. Configured evaluator. Grader protocol. Audit bundle. Each is a contract. Each is negotiable. And each can silently change the verdict while the headline looks the same. That is what a benchmark actually is. Not a measurement of a model. A measurement of an entire testing contract, of which the model is one slot. There is structural reason the seven layers are the seven layers. They cluster into three corners that show up in almost every published agent-evaluation failure. What the model is rewarded for. How that reward is optimised. And how the test contract differs from production. Once you hold those three corners in view, the seven-layer stack stops feeling like a checklist and starts behaving like the actual shape of what is

Your Tools Got Powerful. Get Boring. Subscribe now The bored trader beats the machine On one side of the trade sits a market-making engine that represents the genuine state of the art: Hawkes processes modelling order arrivals, Kyle’s lambda pricing the impact of each fill, Avellaneda-Stoikov inventory control balancing the book in real time. Years of mathematics, running on hardware that did not exist a decade ago. On the other side is a momentum trader whose entire system is price, volume, and three moving averages. He sits in cash most of the year doing nothing, waiting for a setup he could describe to you in a sentence. His stack is deliberately primitive. His edge is patience and the discipline to follow his own rules when they are boring and to sit out when they are silent. Over a full market cycle, the boring one is more likely to still be standing. This is uncomfortable, because it runs against an intuition almost everyone shares: better tools should let you run better, more sophisticated strategies. More compute, more data, more powerful models, therefore more elaborate approaches and better results. It feels obviously true. It is the logic behind most of what gets built, bought, and bragged about. It is also, across domain after domain, wrong. And the interesting part is the shape of the curve. The gap widens as the tools get stronger Here is the pattern the most successful practitioners keep seeing, whether they are trading, building software, learning, or shipping products. Powerful tools do not pay off when you point them at more complex strategies. They pay off when you point them at simple strategies and execute those faster, more consistently, and with less drift than anyone else. More power applied to a simple strategy compounds. The same power applied to a complex one mostly buys you more ways to be wrong. Sit with the second half of that, because it is the part people miss. A sophisticated strategy is not free. Every additional layer needs to be s

Your AI Agent Stack Is Solving The Wrong Problem The setup everyone is sharing Which MCP servers to install. Which skills to keep in your repo. Which agent framework to use. How to write your AGENTS.md . How to split one agent into researcher, planner, coder, and reviewer. How to wire Slack, GitHub, Notion, Postgres, Stripe, your calendar, and your file system into one increasingly capable loop. Some of that advice is useful. It is also aimed at the wrong layer. What becomes real after the agent uses a tool matters more than whether it can reach the tool. Can it read the customer record, or change it? Can it draft the refund, or issue it? Can it open a pull request, or merge it? Can it propose the vendor response, or send it under the company name? Once an agent can act through tools, the real system is no longer the model. The real system is the contract stack around the model. That is the part most setup guides skip. Access is reach. Agency is permissioned action. Imagine the demo. The agent can read Slack. It can search email. It can query the CRM. It can open GitHub issues, check billing records, browse docs, edit a spreadsheet, draft a customer reply, and call three internal APIs. Everyone in the room calls it powerful. That is the first mistake. The agent has reach. It does not yet have governed agency. Access tells you what the agent can touch. Agency tells you what the agent is authorised to decide, under which conditions, with what proof, and with what consequence after failure. That distinction sounds small until the first bad run. A read-only research assistant can waste time. An agent with billing access can create obligations. An agent with email access can speak for the company. An agent with deployment access can turn a wrong inference into infrastructure. More tools do not automatically make the agent more agentic. More tools expand the surface on which judgement has to be engineered. The tool stack is visible. The contract stack is load-bearing. The

A year ago, connecting a model to your tools meant writing glue for that model , in that framework , with that vendor's function-calling format. Swap the model and you rewrote the glue. In 2026, that pain is mostly gone, and the reason has a boring name: the Model Context Protocol (MCP) . MCP is worth understanding not because it's clever, but because it's winning — and the reason it's winning tells you where the industry's center of gravity is moving. What MCP actually is Strip away the branding and MCP is a small client–server contract for connecting language models to the outside world. A server exposes three kinds of things: tools (functions the model can call), resources (data the model can read), and prompts (reusable templates). A client — your IDE, your agent, your chat app — speaks the same protocol and can talk to any compliant server. The analogy people keep reaching for is USB-C, and it's accurate. Before USB-C you had a drawer full of proprietary chargers. MCP is the drawer-emptying moment for AI integrations: write the connector once, and any MCP-aware client can use it. Why "model-agnostic" is the whole point Here's the shift that matters. For most of the LLM era, your tooling was coupled to a model . If you built your agent stack around one vendor's function-calling quirks, you were locked in — a new, better model meant a migration project. MCP decouples the tooling layer from the model layer. Your filesystem server, your database server, your ticketing-system server don't know or care which model is on the other end. When a new flagship drops — and in 2026 they drop every few weeks — you point your client at it and keep your entire tool ecosystem intact. That's a strategic hedge, not just a convenience. In a market where the "best model" changes monthly, the durable asset is your integration layer , and MCP is how you stop rebuilding it. What to build with it Practical entry points, cheapest first: Wrap an internal system as a server. Your team's de

A multi-agent system without an orchestrator is just a collection of agents. Each one is capable, but none of them coordinated. They might all be excellent at their individual jobs - searching the web, writing code, calling APIs - but without something deciding what gets done, in what order, by whom, and what to do when a result comes back wrong, the system does not behave like a system. It behaves like a group project with no project manager. The orchestrator is the project manager. Its job is not to do the work. Its job is to make sure the work gets done - and that is a harder, more subtle problem than it sounds. What an orchestrator is responsible for An orchestrator does four things, and only these four things: 1. Decompose the goal. Turn a high-level objective into a concrete set of subtasks. This is a planning problem, not an execution problem. The orchestrator decides what needs to happen, not how to do it. 2. Route tasks to the right workers. Match each subtask to an agent capable of doing it. This requires knowing what tools and capabilities each worker has - not in detail, but well enough to delegate correctly. 3. Manage state across the workflow. As workers return results, the orchestrator decides what those results mean for the remaining plan. Sometimes a result changes the plan entirely. Sometimes it confirms the next step. The orchestrator holds the full picture. 4. Synthesise the final output. Worker outputs are partial. The orchestrator assembles them into a coherent response and decides when the goal has been met. Notice what is absent: the orchestrator does not call APIs, does not run code, does not search the web. It reasons about work and routes it. The moment an orchestrator starts executing, it loses the focus that makes it good at coordination. Building one from scratch Here is a minimal orchestrator in Python. It plans upfront, delegates to type workers, and synthesizes results: import json def orchestrator ( goal : str , workers : dict ) ->

Martin Spier explains how agentic workflows dramatically increase code change volume at OpenAI. He discusses the hidden systemic performance costs of rapid shipping beyond GPUs, and shares how deploying always-on AI agents automates profiling, regression detection, and continuous optimization to maintain product speed and scalability at massive global scale. By Martin Spier

Cloudflare has introduced Cloudflare Computer, a new open-source runtime designed to give AI agents something closer to a real "computer" instead of just ephemeral containers. It leverages Cloudflare isolates for fast serverless execution, making agents cheaper, faster, and more scalable, according to the company. By Sergio De Simone

Cloudflare has introduced Kitesurf, a cloud-hosted browser designed for AI agents instead of people. The company says the browser uses less computing power than Chromium for common automation tasks, helping developers build browser-based AI agents more efficiently.

Jo Kelly-Fenton and Aleksandar Mitic explain how Spotify created "Honk," an AI coding agent, to handle complex fleet-wide codebase migrations. They share key architectural insights on decoupling CI verification runtimes from AI agents, dealing with automated pull request bottlenecks, and driving aggressive standardization across thousands of engineering repositories. By Jo Kelly-Fenton, Aleksandar Mitic

Incident management platform provider Rootly has published an account of its decision to drop its long-standing small pull request rule, arguing that the practice no longer serves its purpose now that AI agents generate most of its code. The company describes a shift from measuring PR size to assessing blast radius, with feature flags and rollback capability taking precedence over line counts. By Matt Saunders

An AI support agent does not have to be malicious to damage trust. It only has to answer one refund question, outage complaint, security concern, or enterprise renewal ticket with polished confidence and weak evidence. That is why serious builders need an AI support escalation router before they let agents send replies on their own. The router decides when the AI can answer, when it should draft only, when it should ask a clarifying question, and when a human must take over. The goal is not to remove humans from support. The goal is to stop wasting human time on routine cases while protecting customers from the few cases where automation should slow down. Working definition: an AI support escalation router is a policy layer that evaluates every support conversation for intent, risk, evidence, confidence, account context, and customer emotion before deciding the next safe action. Why this matters now Recent AI platform signals point in the same direction: agents are moving from demos into production workflows. Customer support products are launching AI agents that classify, draft, respond, and hand off tickets. AI gateway and spend-console launches show that teams now care about cost, routing, observability, and business impact. Developer discussions keep circling around the same uncomfortable questions: How do we stop AI support agents from repeating the same mistake? How do we prevent hallucinations from reaching customers? When should a human approve a reply before it sends? How do we preserve context during handoff so the customer does not repeat everything? How do we measure whether automation actually resolves issues instead of routing them faster? Search results for AI escalation are full of platform pages, general customer-service advice, and high-level routing concepts. The missing piece is a practical builder guide: schemas, thresholds, queues, evidence checks, and safe defaults for a small AI product team. That is the gap this article fills. The core mista

When people discuss AI agents escaping their boundaries, the mental image is usually dramatic: a jailbreak, a rogue prompt, an obvious disaster. What I've actually seen in practice is duller and more dangerous. The agent finishes its task successfully, the tests pass, and only later does someone notice it edited a file three directories up, or that a "helpful cleanup" deleted something it shouldn't have. Silent drift, not explosions. Last month I wrote about building a prompt regression harness that runs entirely on free tiers. This piece extends the same instinct from what the model says to what the agent does : I wanted a cheap, repeatable way to answer one narrow question — when my agent uses its tools, which parts of this machine does it actually reach? The specific risk I'm measuring A typical coding agent gets handed some mix of shell access, filesystem tools, and HTTP. The failure that matters most in day-to-day use isn't an adversarial attack. It's ordinary helpfulness with sloppy scope: An instruction like "find the relevant config" becomes a walk up the directory tree into your dotfiles. A refactoring task spills into a sibling repository because both were visible. A scratch file gets written somewhere outside the intended workspace and quietly persists. A fetch tool designed for one documentation site ends up POSTing context somewhere else. Notice that nothing here requires a malicious model. A cooperative model with generous tool permissions produces the same outcome. So the question isn't "can I trick the agent into misbehaving" — it's "does the sandbox I believe in actually exist." A probe harness you can run tonight The approach: hand the agent tasks engineered to invite scope violations, record every filesystem change it makes, and compare those changes against an explicit allowlist. Anything outside the list fails the run. The script below is pure standard-library Python. Instead of strace or eBPF (which need privileges you often don't have), it sna