Agents
44 articles in this topic.
Agent memory is a product decision, not a database choice
The hard part of agent memory is deciding what deserves to persist, who can use it, and how a person can take it back.
Computer-use agents need permission ladders
A browser session should not hand an agent every power its logged-in human happens to possess.
Guardrails are runtime checks, not prompt instructions
A prompt can ask an agent to behave, but only a runtime check can stop an unsafe action.
Human-in-the-loop is a control plane, not a confirmation dialog
Useful human oversight decides when to interrupt an agent, what the reviewer needs to see, and how the decision changes the system.
MCP security after the hype cycle
MCP made agent integrations portable, which means the hard security question is now what each connection is allowed to do.
The injection you're not filtering: tool output
Tool output is data to your application, but it can look like instructions to the model, so protect the action boundary rather than only the user message.
MCP went stateless — what server authors have to change
The 2026-07-28 revision deleted the initialize handshake and the session header, replaced server-initiated requests with a retry pattern, and put Roots, Sampling and Logging on a twelve-month clock.
Token theft in AI agents is an architecture failure
Prompt injection gets the attention, but credentials turn a confused model into an authenticated attacker. The fix is to keep tokens out of model context and authorize every action at runtime.
Context engineering: why accumulated context can degrade your agent
For multi-step agents, context engineering complements prompt engineering by curating the smallest high-signal working set at each step. Accumulated or irrelevant context can degrade reliability even when it fits the window.
MCP is becoming the tool-integration boundary — now comes the hard part
MCP is becoming a common boundary for AI tools and data. The remaining work is making it trustworthy under real identity systems, retries, state, registries, optional UI, and long-running operations.
Prompt injection is the SQL injection of the AI era
Both attacks come from the same root cause — the system can't separate trusted instructions from untrusted data. In agents it becomes a confused-deputy problem, and a single filter won't save you.
Memory poisoning: when your agent remembers a lie
Persistent agent memory is a delayed-action injection vector. Untrusted content read in one session gets written to long-term memory and silently steers a clean session later — sometimes for a different user. Here is how the attack works, the 2024-2026 research, and why the only real fix is treating every memory write as untrusted input.
Why agents need permissions: the lethal trifecta and least privilege
Prompt injection has no reliable fix at the model layer. Simon Willison's lethal trifecta and OWASP's Excessive Agency say the same thing: agent security must be designed at the system layer, with least privilege.
MCP vs A2A vs ACP vs ANP: the agent protocol stack
Four acronyms, one stack. MCP connects an agent to its tools; A2A, ACP, and ANP connect agents to each other — differing only by how open the world is, from the enterprise intranet to the decentralized agentic web.
MCP isn't enough: who lets your agents talk to each other?
MCP solved the agent-to-tool problem and solved it well. But the moment one agent needs to hand work to another agent it does not own, MCP runs out of road — and that is exactly the gap A2A and ACP were built to fill.
The agentic web: how ANP wants to be the HTTP of agents
MCP, A2A, and ACP wire agents to tools and to each other inside the enterprise. ANP aims further: an open, decentralized network where any agent can find and trust any other across the internet, with no central authority — using W3C Decentralized Identifiers, the did:wba method, and schema.org self-descriptions.
The agent harness — the code around the model that actually makes an agent
The LLM is the engine, but the harness is the car. Most of an agent product's real value lives in the scaffolding wrapped around the model — the loop runner, tool dispatcher, context manager, permission gate, and the dozen other things that turn a stateless completion API into something that can work for twenty minutes unsupervised.
The supervisor-worker pattern: when one agent isn't enough
Anthropic's orchestrator-worker pattern is the only multi-agent topology that consistently ships. Here's how to recognise when you actually need it, what the LangGraph supervisor implementation looks like in practice, and the failure modes nobody warns you about.
Operator, Claude Computer Use, and Project Mariner: the browser agent shootout
Three browser agents shipped within twelve months — each with a different abstraction over the browser. Here's how the screenshot-and-click, DOM-and-accessibility-tree, and Chrome-extension approaches stack up on WebVoyager, OSWorld, latency, cost, and real-world reliability.
The three kinds of memory production agents actually use
Working memory, episodic memory, semantic memory — the cognitive science taxonomy that every agent memory startup borrows from. Here's what each one means in practice, what Letta, Mem0, and Zep actually ship, and why most production agents only need the cheapest one.
Why ReAct lost — and structured planning won
The 2023 ReAct paper defined an era of agent design. Its Thought-Action-Observation loop is also why so many agents burn tokens, loop in circles, and time out on long tasks. Here's how Plan-and-Solve, ReWOO, and LLMCompiler displaced it in production — and the concrete numbers that explain why.
Tool selection at 1000 tools: routing techniques that ship
Cramming hundreds of MCP tools into your system prompt destroys both latency and accuracy. Vector retrieval, hierarchical menus, RAG-on-tools, and code mode each take a different bet. Here are the numbers, the production deployments, and the pattern that's winning.
Browser agents in production: Manus, BrowserBase, and Stagehand
Headless browser agents looked like science fiction a year ago. Today they cost real money, fail real ways, and are mostly an infrastructure play, not a model play. Here's where they work, where they don't, and which layer of the stack is actually winning.
The eval loop that actually ships agents
Every team that ships AI agents reliably has built roughly the same eval system: a golden set kept honest by humans, an LLM-judge they don't fully trust, a regression dashboard that gates merges, and a culture of 'no win on the eval, no merge.' Here's what that loop actually looks like in practice.
Evals that actually work: beyond the LLM-as-judge trap
LLM-as-judge evaluators are the second most popular eval pattern in 2026. They are also the most over-trusted. The eval pipelines at the teams shipping the fastest agents look almost nothing like the ones described in vendor blog posts — and the difference matters.
Self-correction without infinite loops: agent stopping criteria that actually work
Reflection loops promised agents that fix their own mistakes. In production they more often produce agents that 'improve' working code into garbage, or worse, loop forever. Here's what the teams shipping real agents do instead.
Claude Code, Cursor, and Aider — three answers to the same question
Three coding agents, three different bets on autonomy, context, and where the human belongs in the loop. The interesting part isn't which one wins — it's which assumptions each one refused to compromise on.
Replit Agent's architecture, two years in
Replit Agent launched in September 2024 and turned a nine-year-old IDE into a $150M-ARR business. The architecture is unfashionably explicit — plan, confirm, execute, checkpoint — and the bet that explicit checkpoints beat full autonomy is paying off. Here's how it actually works.
v0 by Vercel: how prompt-to-UI actually works
v0 makes 'build me a dashboard' produce real Next.js + shadcn/ui code that ships. The trick wasn't a smarter model — it was a narrow constraint, a streaming preview loop, and an opinionated component library acting as scaffolding. Here's the architecture, the competitive landscape, and why most clones missed the point.
AI SREs in production: Resolve.ai, Cleric, Parity
A new category of on-call agent is being shipped into real production environments — agents that watch alerts, gather evidence, and propose remediations. Most of them are deliberately read-only. The architecture is converging, the MTTR numbers are real, and PagerDuty is responding from the incumbent side. Here's what's actually working.
Why multi-agent swarms keep failing to ship
Two years after AutoGen and CrewAI promised teams of cooperating AI agents, the production scoreboard is brutal: orchestrator-workers ships, agent teams mostly don't. The reasons are structural, not stylistic — and they explain why every serious agent team has quietly converged on a much more boring shape.
Getting tool calling to 99% reliability in production
Most production agent failures are not model failures. They are tool-call failures — the model picked the right tool but wrote the wrong arguments, or hallucinated an argument that doesn't exist. The fix is unglamorous and mostly about schema design.
Voice agents at scale: the Vapi, Retell, Bland.ai engineering
Voice agents are the unsexy success story of the agent era. Underneath the marketing they're all the same five-box pipeline — STT, LLM, TTS, turn-taker, telephony — fighting for the same 500ms latency budget. Here's how the three biggest platforms actually build it, what each one optimizes for, and where the real cost goes.
Devin's architecture, anatomised
Cognition's launch demo promised a 'fully autonomous software engineer.' The product that actually ships is more interesting — a planner-executor split running in a sandboxed VM, with explicit memory windows, hard pruning rules, and a shockingly disciplined view of where the model is allowed to be creative.
Sierra's customer-service playbook
Bret Taylor and Clay Bavor built the highest-profile agent company by making three opinionated bets — every brand needs its own AI, agents must run inside the brand's workflows, and pricing should track outcomes. Two years on, the bets are paying off in ways the industry is still copying.
AutoGPT to 2026: what survived
Three years after AutoGPT briefly broke GitHub's star counter, almost nothing in its original form has shipped. The interesting question is what did survive — and it's a sharper, more honest answer than the discourse of 2023 ever got close to.
How Cursor's Composer actually works
Multi-file edits feel atomic in Cursor not because the model got smarter, but because the team built a stack of careful workarounds — speculative diffs, a separate Apply Model, and an indexer that stays one step ahead of you. Here's the engineering.
Sub-agents, handoffs, supervisors — pick exactly one
Three topologies dominate multi-agent systems in 2026, and teams keep mixing them in ways that break debuggability. Sub-agents are parallel scoped work that returns to a parent. Handoffs are baton-passing with no return. Supervisors are explicit central routers. They are not interchangeable. Here's the framework for picking, and the failure modes when you don't.
Long-horizon agent failure modes: context rot, drift, looping
An agent that handles ten turns gracefully will likely collapse at fifty. The reasons aren't bugs — they're emergent properties of how transformers handle growing context. Here's a field guide to how agents disintegrate, with the public failure stories that mapped the territory.
Coding agents in 2026: Cursor, Devin, Sweep, Aider, Claude Code compared
Two years after Devin launched and froze the term 'AI software engineer' in the popular imagination, here's where everyone actually landed. The dominant tools didn't converge — they specialized, and the ones that won did so by picking a workflow lane and dominating it.
Deep research agents explained: Perplexity, GPT Deep Research, Gemini Deep Research
Deep Research was OpenAI's first agent product to actually ship, and it landed in a market where Google had already been live for months and Perplexity had built the search-citation pipeline the others were chasing. The three converged on similar capabilities but radically different architectures.
Agentic data analysis: PandasAI, Hex Magic, Julius — and why it's harder than it looks
'Just talk to your data' has been the cleanest agentic AI demo for two years. The shipped reality is much narrower than the demos suggest, because the gap between answering a question and answering it cheaply, safely, and correctly is enormous. Here's where the production line lives.
The agent observability stack: LangSmith, Langfuse, Helicone, Arize
You can't ship agents without observability. The 2026 stack has settled into three layers — traces, evals, drift — and five vendors who each won by being unmistakably the best at one of them. Here's who picks which, and why.
Agents for legal, finance, healthcare — the high-stakes pattern
Three industries where hallucination is malpractice. The agent companies winning in legal, finance, and healthcare have converged on the same shape — scoped tasks, retrieval over generation, mandatory human checkpoints, audit logging by default. Here's what that pattern looks like in production at Harvey, Hebbia, Abridge, and Suki.