The Receipts Arrived

Named production deployments just gave the clearest evidence all year that agents extend human judgment instead of replacing it

This was the strongest receipt week I can remember since I started this beat. Across healthcare, financial services, security operations, and internal support, the production numbers all point in the same direction: the agent does the preparation, triage, drafting, or first pass, and a human still owns the consequential call.

Southwest General's Ava agent cut prior-authorization prep from 20 to 25 minutes down to 5 to 6 minutes per authorization by gathering chart information for staff. It does not submit the authorization itself. The same hospital's Hope agent dropped no-shows from 11% to 4% with 96% patient satisfaction. Sony Bank and Fujitsu say a live core-banking development AI agent cut labor hours 40% and compressed the basic-design-to-integration-test period 30%, with some phases hitting 90% labor reduction. It helps build the bank's software. It does not run the bank. Sophos says MDR case response time fell from 38 minutes to 89 seconds, with 52% of cases resolved end to end by AI within analyst-set boundaries. West Monroe reports a 40% reduction in annual managed-service-provider costs and an estimated 2,700 operational hours saved per year from an internal IT and HR support agent.

That is the architecture hiding in plain sight. The ROI is real. The autonomy story is mostly marketing. At scale, the thing buyers are actually purchasing is leverage around human judgment, not the deletion of human judgment.

Three weeks ago I warned that the stack was getting easier to buy faster than it was getting easier to evaluate. This week we finally got the buyer-side evidence people have been asking for. And it does not support the full-autonomy sales pitch. It supports extension.

The newest agent-memory research says the real risk is not forgetting — it is remembering the wrong thing from the wrong person

I made Prediction Two back in February: persistent memory would become the problem everyone is trying to solve. That prediction still stands. But tonight I need to sharpen it, because the security literature got much uglier this week.

The MemLeak paper found that in multi-tenant retrieval experiments, ordinary same-team pooled searches leaked another user's memories 70 to 100% of the time. Hard ownership gating restored a clean baseline with roughly 1.4 milliseconds of overhead per query. That is not an exotic edge case. That is what naive shared memory does by default.

Separately, research reported this week showed that access to an agent's memory could be used to plant a lasting fake instruction that redirected later behavior. That was a research demonstration, not a confirmed production breach, and AWS disputed the characterization. Fine. The important point is that the attack target is now obvious: if I can get to memory first, your agent may become an extension of me instead of you.

Then the reliability papers complicate it further. One new paper found memory-admission policies that reduced judged failures versus verbatim injection, but increased personalization failures and still missed the stronger design's preregistered improvement target. Translation: even the smarter memory layer is making tradeoffs we do not fully control yet.

So if you are deploying agents in a multi-user environment, the only sane question for your vendor is this: how is each memory item bound to an authorized identity, and how is that authorization checked before the agent acts on it? If the answer gets fuzzy, the risk is real.

More than 600 responses forced agent identity into the open, but NIST is still preparing to present the scope of Build 3 rather than a finished architecture

Last Sunday I told you NIST had finally picked a real room. Tonight I need to evolve that line again. Yes, there is a room. No, there is still not a blueprint hanging on the wall.

NCCoE received more than 600 responses to its concept paper on software and agentic AI identity and authorization. That is not a quiet standards exercise. That is the industry yelling the same question all at once: who authorized this agent to do that?

The October 28 webinar is confirmed. It will present Build 3's scope for agentic code development, building, and testing. Scope. Not a completed reference implementation. Not a published architecture. Not a product-to-agent identity mapping you can take to your board. The documented implementation that does exist today, Example Implementation 2, is focused on CI/CD automation with human-directed generative AI, which NIST itself distinguishes from the agentic Build 3.

I was right about the debate and the fear arriving in 2026. I was too optimistic about the solution timeline. The certification gap is real, and it is not closing in the next nineteen days.

For business owners in regulated environments, that means something unglamorous but important: every agent deployment you approve right now includes an identity and authorization design choice that your vendor wants to imply is standard and your auditor cannot yet verify as standard. Name that risk explicitly.

New research suggests stateless agents with harness-owned state can beat persistent-memory designs on hard tasks while using dramatically fewer tokens

This is the most important architecture story most newsletters will skip because it arrived wearing an arXiv PDF instead of a product keynote.

The Stateless Language Agents paper argues that fresh-session agents coordinated through harness-owned candidates, results, and checkpoints led the tested long-horizon tasks at full budgets. On one kernel task, they reached the strongest baseline's final performance with 93.1% fewer tokens, while the advisor used under 0.6% of tokens. A separate paper on agent-controlled forgetting found reversible archiving cut cumulative input tokens 50% and estimated API cost from about 4 dollars and 38 cents to roughly 1 dollar 28 to 1 dollar 44 in one noisy tool-use test, though it took 17% longer and saved nothing on a contrasting task pair.

These are research experiments, not enterprise case studies. But combine them with the MIT Technology Review Insights survey saying only 34% of agentic projects reach production on average, while 55% of executives cite data fragmentation as a top knowledge-access challenge, and you start to see the real architectural question.

The assumption that the winning platform will be the one with the cleverest internal memory may simply be wrong. The winning platform may be the one with the best external state infrastructure: checkpoints, retrieval boundaries, candidate management, auditability, and cheap rehydration.

That matters for buyers because it changes the evaluation criteria. You may not be buying an agent platform for memory at all. You may be buying a harness.