Agents left the lab: they gained an orchestrator, durable cache, and standardized MCPs in the same week a post-mortem cataloged 22 ways they fail silently.
Sixty days.
That's how long an agent in production can spend delivering plausible results—and completely false ones—before anyone notices.
This is Wire from ai|expert. This week, agents gained an orchestrator, durable cache, and standardized MCPs. And a post-mortem cataloged 22 ways they fail without making a sound.
The most important paper this week didn't come from a research lab. It came from a production post-mortem. [ref: longitudinal-study-uncovers-22]
A personal agent in continuous execution since March 2026: 40 scheduled jobs, 8 LLM providers, 4,286 unit tests, 827 governance checks. And yet: 22 silent failures in eight weeks, with a meta-pattern repeating 28 times.
The authors named five classes of mechanism. The one most concerning to production architects is Class D—"chained hallucination and fabrication."
When the system encounters an error, the model doesn't throw an exception. It rewrites the error into coherent narrative and delivers it directly to the user. The authors call this "fail-plausible": the observer isn't just blind. He's being actively deceived by the signal of failure itself.
The agent doesn't fail. It manufactures an alibi.
And 70% of these silent failures were detected by human observation of final output—not by tests, not by automated audits. Incident latency ranged from 13 hours to 60 days. The longest-lived ones existed in the seams—the stitches between the tool governance proxy, the knowledge base memory plane, and the LLM providers. Where no test runs.
A retrospective audit of 15 incidents found 0% ex-ante prevention and 87% regression blocking.
Audits are regression engines. Not prediction engines. The research modeled this as entropic decay: analyzing more than 100,000 production interactions and 40,000 controlled trials, disorder accumulates monotonically with interaction rounds. Silent failure isn't a bug class to fix. It's a thermodynamic constraint to govern.
For multi-agent system architects: code complexity wasn't an incident predictor. Boundary surface area was.
A paper from UC San Diego, Johns Hopkins, University of Washington, and UIUC arrived with a formal answer to a question product teams answer empirically every week: what determines agent performance? [ref: agentspec-modular-framework-fo]
AgentSpec divides embodied agents into six interchangeable components with standardized interfaces: Perception, Memory, Reasoning, Reflection, Action, and an optional RL module. Tested on DeliveryBench, ALFRED, MiniGrid, and RoboTHOR.
The central finding isn't about the quality of each module. It's about scaffold compatibility and interaction effects. The best reasoning module is useless if the memory representation it receives violates its assumptions about state granularity and task horizon.
The most critical operational finding: policies trained with RL only compose well when optimized with the scaffold structure of deployment. If you version the scaffold without updating the RL module alongside it, performance collapses. Training and inference can't be versioned independently.
Scaffolds aren't neutral infrastructure. They shape the optimization landscape of everything they host.
Still on the theme of detecting when an agent is erring: a preprint on arXiv proposes operadic consistency—OC—as a label-free method to detect compositional reasoning failures at inference time. [ref: detecting-llm-reasoning-failur]
The mechanism: the model answers a complex query directly. Then the same query is decomposed into sub-problems, answered piece by piece, and recomposed. Discrepancies between the two paths signal suspect reasoning. No ground-truth. No external annotator. No fine-tuning.
Tested on twelve LLMs from 4B to 671B parameters. Pearson correlations between 0.86 and 0.94 with accuracy across four multi-hop QA datasets—the only signal with r greater than or equal to 0.85 uniformly across all four. Chain-of-thought self-consistency drops to r of approximately 0.45 on MuSiQue and StrategyQA. OC doesn't.
Selective prediction with budget K=3 delivers AUARC lifts of +0.086 to +0.096 and AUROC lifts of +0.092 to +0.164, with 95% confidence intervals excluding zero across all cells. The cost: three inference passes. And for reasoning models with opaque chain-of-thought or interleaved tool calls, decomposition fails silently.
The pattern worth stealing: the distance between the direct answer and self-decomposition is a zero-label confidence score for any compositional prompt.
And while research was mapping the failure patterns, three pieces of infrastructure arrived the same week—as if the industry knew it needed to close the gap.
First: Databricks open-sourced Omnigent under Apache 2.0. A meta-harness for composing and controlling code agents—Claude Code, OpenAI Codex, Pi, and custom agents—through a uniform API. [ref: databricks-launches-omnigent-to-operationalize-multi-agent-workflows]
The problem that motivated Omnigent is concrete. At Databricks, with more than 5,000 engineers, the real workflow was running four or five agents in parallel and copy-pasting context between terminal, Google Docs, and Slack. The lack of a single harness that shared state or delegated across tool boundaries was costing hours.
The architecture has two components: a Runner that isolates each agent in a sandboxed session with uniform interface—messages and files in, text streams and tool calls out—and a Server that hosts policies and sharing logic. One line of YAML to swap the underlying model. Configurable cost policy: pauses the agent after USD 100 of spending per session.
The unaddressed risk: without published latency benchmarks, the overhead of routing all agent I/O through the meta-harness is unknown. If the policy engine or state tracker degrades, all composed agents stop—and debugging now crosses two layers of abstraction.
Second: AWS enabled durability in ElastiCache for Valkey 9.0. The local append-only file is out. A Multi-AZ transactional log that replicates writes across availability zones is in. [ref: aws-elasticache-adds-durabilit]
Two persistence profiles. Synchronous: reads below 300 microseconds at 50,000 TPS, scaling to 879 microseconds at 100,000 TPS, writes at single-digit milliseconds, with additional cost. Asynchronous: microsecond latency, no extra cost—but with a window of up to 10 seconds of loss if the primary fails.
For agent stacks that today run ElastiCache alongside DynamoDB to persist conversation context and workflow state, the simplification is real: one cluster for hot memory and short-term state. But Corey Quinn, from the Duckbill Group, warns that the lesson of not confusing cache with primary datastore is usually learned after an SLA violation. Compromised transaction state doesn't belong here.
Third: HashiCorp announced general availability of the Terraform MCP Server on June 11th. Sixteen tools in the default configuration, with three toolsets—registry, registry-private, and terraform—exposing workspace operations, plan inspection, and Sentinel policies. [ref: hashicorp-mcp-server-enables-a]
Destructive operations—create_run, plan_and_apply, workspace deletion—disabled by default behind the ENABLE_TF_OPERATIONS=false flag. The correct default: binary separation at the environment level between read-only discovery tools and destructive mutations. If your internal agent platform doesn't have this gate, blast radius is wide open.
No plan sandbox. No eval harness. Security depends on environment IAM plus this environment toggle. A compromised client with a valid token can still exfiltrate workspace metadata.
The last piece is the browser. WebMCP entered origin trials on Chrome 149 on May 19th, co-authored by Google and Microsoft under the W3C Web Machine Learning Community Group. The proposal: websites expose typed tool contracts directly to agents in the browser, eliminating the non-deterministic loop that breaks with CSS layout shifts or late ad loading. [ref: webmcp-standard-for-agentic-web-actuation-now-in-chrome-origin-trials]
Benchmarks from scriptwalker.app show task completion 8 to 12 times faster than vision-based automation. Byteiota reported 67% fewer errors and 45% better completion rate compared to visual scraping. Booking.com, Shopify, Instacart, Expedia, Intuit, and Redfin committed to implementations. Adoption already at 12% of enterprise websites and 41% in e-commerce. Chrome DevTools for Agents 1.0 arrived alongside the trials, exposing console logs, network traffic, and performance traces via MCP server with dedicated WebMCP panel.
Microsoft had already shipped support in Edge 147 in March 2026.
The structural problem: monoculture. The only agent consuming WebMCP today is Gemini on Chrome. You still need to maintain a parallel stack of vision-based automation for unannotated pages, for Firefox through Q3 and for Safari through Q4 of 2026.
And the adversarial risk remains unaddressed: any page can register false tool definitions to manipulate agents into unauthorized actions. Treat as a low-risk layer until the permission model hardens. Don't connect to payment or identity flows.
Agents gained an orchestrator, durable cache, and standardized MCP. And yet the majority of silent failures in production only surface when a human looks at the output. The infrastructure arrived. Observability in the seams still hasn't. Wire on Monday. Until then.