--- title: "Actions Speak Louder Than Scraping" newsletter: "User Community" date: 2026-10-22 source: https://aaif.live/newsletters/usercommunity/2026-10-22-actions-speak-louder-than-scraping --- # Actions Speak Louder Than Scraping *Plus… MCP's 100-call problem, safer refund retries, and a 29-point benchmark error.* *User Community — Agentic AI Foundation, 2026-10-22* 🎶Do you know the way to San Jose...?🎶 I do! Come say hi in the livestream chat [https://www.youtube.com/live/iNV5-YkPHW4]. ## Gems ## Agents acting safely on our behalf A checkout agent shouldn't need to scrape a webpage to figure out whether a purchase succeeded. WebMCP gives site owners a way to expose explicit actions to agents, with clearer boundaries around security, application state, and user control. * Defined actions: Read-only and user-generated content annotations help agents recognize untrusted inputs and avoid prompt injection. * Layered security: Confirmation hints, restricted site access, and spending limits help constrain risky agent behavior. * Existing infrastructure: WebMCP can work alongside REST, GraphQL, and MCP, supporting checkout flows and batch operations without replacing existing APIs. Exposing application capabilities directly can make browser agents more predictable, efficient, and accountable to users. [https://podcasts.apple.com/gb/podcast/agents-acting-safely-on-our-behalf/id1505372978?i=1000796502495](https://podcasts.apple.com/gb/podcast/agents-acting-safely-on-our-behalf/id1505372978?i=1000796502495) [https://home.mlops.community/home/videos/agents-acting-safely-on-our-behalf](https://home.mlops.community/home/videos/agents-acting-safely-on-our-behalf) [https://open.spotify.com/episode/3HZiTpntIrlnegrp1CBJGb?si=7RObyflpQh-gAipcsqKz7g](https://open.spotify.com/episode/3HZiTpntIrlnegrp1CBJGb?si=7RObyflpQh-gAipcsqKz7g) ## The world wild web & bots with buying power An AI model was supposed to be isolated from the internet, but a dependency proxy reportedly provided a route out. The incident raises questions about securing training environments, browser automation, and agents making purchases. * Sandbox security: Network isolation, dependency proxies, and continuous testing matter when agents can probe vulnerabilities at scale. * Computer use: Browser agents can schedule appointments and edit version-controlled diagrams without dedicated connectors, while preserving room for human adjustments. * Agent payments: Shopping through chat could simplify checkout but leave merchants without the browsing history and customer intent their analytics depend on. Reliable agent systems require controls across training environments, everyday workflows, and transactions. [https://podcasts.apple.com/gb/podcast/the-world-wild-web-bots-with-buying-power/id1505372978?i=1000797273642](https://podcasts.apple.com/gb/podcast/the-world-wild-web-bots-with-buying-power/id1505372978?i=1000797273642) [https://home.mlops.community/home/videos/the-world-wild-web-and-bots-with-buying-power](https://home.mlops.community/home/videos/the-world-wild-web-and-bots-with-buying-power) [https://open.spotify.com/episode/7xZedomuN3vLkH6096E4sP?si=N6gld5j5TTCvDRNoHdMrMg](https://open.spotify.com/episode/7xZedomuN3vLkH6096E4sP?si=N6gld5j5TTCvDRNoHdMrMg) ## James Ward thinks your MCP server could use some work Fetching 100 customer records shouldn't mean 100 separate MCP tool calls. Poor tool design can inflate token costs and hide inefficient agent behavior even when every request succeeds. * Batching and observability: Aggregate tools can replace repeated single-record requests, but operators need correlated traces to spot the pattern. * Constrained execution: Across roughly 16,000 AWS APIs, a proposed DSL could make multi-step operations easier to validate than generated Python. * Harness testing: A helpful documentation notice triggered prompt-injection warnings after release despite hundreds of local wording tests. Evaluating whole tasks across models and harnesses helps separate protocol limitations from fixable tool and integration design. [Read the blog](https://aaif.io/blog/james-ward-thinks-your-mcp-server-could-use-some-work) ## Why "agent failed" doesn't tell you enough A refund request times out, but the payment may already have gone through. A single failed status can't tell an operator whether retrying will help or issue a duplicate refund. * Retry decisions: Temporary outages may justify another attempt; invalid authorization, missing context, or required approval call for different responses. * Unknown outcomes: Check the external service before replaying a refund, or reuse a previously stored idempotency key where supported. * Failure records: Capture where execution stopped, what actions took effect, whether retrying is safe, and what needs to happen next. Those distinctions make recovery safer and help teams resume partially completed tasks without repeating successful actions. [Read the blog](https://aaif.io/blog/why-agent-failed-doesn-t-tell-you-enough) ## Can you reproduce an agent run? An agent approves a refund after checking account records, but six months later, nobody can reconstruct why. Reproducing agent behavior requires more than saving prompts and code versions, particularly when tools, memory, permissions, and external data can change. * Reconstruction vs. replay: Recorded execution histories explain past decisions, while fresh reruns may produce different results as models and external systems change. * Execution evidence: Model configurations, retrieved content, tool responses, state checkpoints, and human approvals help establish what influenced each action. * Retention tradeoffs: OpenTelemetry can capture detailed execution data, but sensitive content requires selective logging, access controls, and retention limits. Reliable investigations depend on preserving the original execution conditions rather than expecting agents to behave identically twice. [Read the blog](https://aaif.io/blog/can-you-reproduce-an-agent-run) ## Reverse Engineering and the Future of Software ## CODING AGENTS LUNCH & LEARN What happens when developers crack open the tools they use and start building their own? Join us for an open discussion on reverse-engineering projects like REA [https://github.com/morluto/rea], what they've uncovered, and what they could mean for the future of software development. Bring your questions, share what you're working on, or just come along for the conversation. Friday, October 16 | 9–10 AM PT / 4–5 PM UTC JOIN LIVE [https://home.mlops.community/home/events/coding-agents-lunch-and-learn-session-28-reverse-engineering-and-the-future-of-software-4szbeg84t0] Find recordings of our previous lunch and learns here [https://www.youtube.com/playlist?list=PL3vkEKxWd-utz7ew8QmiuTFNjjkvvM_xM]! ## What’s happening across the chapters ## LOCAL ORGANIZERS Huge shout-out to Ijeoma Onwuka [https://www.linkedin.com/in/onwuka-ijeoma/] for all her hard work coordinating with our community organizers and helping bring these events together. She's also put together a great roundup of last week's meetups, covering Singapore, Hyderabad, Kolkata, and Pune, with a look at what the communities have been up to and the local organizers making it happen on the ground. Check out her post for the full roundup. [https://lnkd.in/p/eBDdhWRk] ## IN-PERSON EVENTS ## Come and connect * Denver [https://luma.com/zexcpqng] - October 22 * Chennai [https://luma.com/6b11bblm] - October 24 * Pune, Workshop [https://luma.com/4ceklbw4] - October 24 * Shenzhen [https://luma.com/t0kgftx3] - October 24 * Munich [https://luma.com/sfkb4b7f] - October 28 * Kochi [https://luma.com/x1wimzk4] - October 31 * Dallas, Workshop [https://luma.com/tm2rh6gd] - October 31 * Boston [https://luma.com/aaif-sandbox] - November 2 Find your city here [https://aaif.io/events?tab=community], or start a chapter if there isn't one yet. ## VIRTUAL EVENTS ## Join from anywhere * Live from AGNTCon + MCPCon North America [https://www.youtube.com/live/iNV5-YkPHW4] - October 22 --- Source: https://aaif.live/newsletters/usercommunity/2026-10-22-actions-speak-louder-than-scraping