11 talks, 6 themes, one fast way through the event — key takeaways, standout quotes, and every recording from AI Agents Summit.
Worth noting
Rather than replacing fraud/risk models with agents, Zipline/Chronon lets agents propose new features via branch-isolated, compute-reusing pipelines that are reviewable and reproducible before humans approve production launch.
Quote
You don't want to be sending a bunch of contacts to an agent to say, "Hey, which of these thousands of listings should I rank these thousand listings for this user?
Worth noting
Meta uses a three-agent pipeline (perceiver, retriever, reasoner) with small 4-11B fine-tuned VLMs plus caching, semantic hashing, and dynamic routing to detect content theft and modality mismatch across ~100M-1B short-form videos cost-effectively.
Quote
In a 1-hour video, you can have multiple of these things which are actually breaking the policy.
Worth noting
Orkes built Agent Span, an open-source runtime (on top of Conductor OSS) that treats agents as "late-bound sagas" — LLMs plan via JSON, the server executes with durability, human-in-loop, and ephemeral credential injection at runtime.
Quote
Agents are not programs. Programs are deterministic. Agents are dynamically generated instructions, which means you need a different way of thinking about it.
Worth noting
Argues agent platforms need three properties—dynamic (plain code, no DSL), durable (crash recovery, caching), and defended (sandboxed code execution)—illustrated by Dragonfly's 4-tier agent system cataloging 250,000+ software products in production within hours.
Quote
Agents do fail and they will fail in production, and this is to be expected.
Worth noting
Databricks describes production-grade agent patterns: semantic layers with defined metrics to prevent hallucinated numbers, "lakebase" branchable databases for agent memory, and MLflow-based LLM judges for dev and production monitoring loops.
Quote
If you roll it out to 100 sales folks and three executives and they all ask the agent what's our run rate, does it calculate and come back with the same answer every time?
Worth noting
Identifies four production agent failure modes—context collapse, tool/API chaos, prompt injection, latency cascades—and argues for health-check monitors, input validation, and reasoning-trace logging over simple request/response logs.
Quote
Scaling an agent isn't about making it smarter, it's about making it safer to be wrong.
Worth noting
Google's MCP Toolbox secures DB access by evolving tools from raw SQL/credentials to pre-approved, parameterized queries with bound auth tokens, hiding all credentials and PII from the agent.
Quote
Your data is only as secure as your agent. Users, if they try hard enough, can trick the agent into doing anything.
Worth noting
TextQL found a single Notion MCP integration doubled their agent's tool count (10→21 tools, ~7,000 tokens), ballooning to 350,000+ round-tripped tokens over 50 tool calls and degrading output trust.
Quote
We just give it its own computer and it'll just write the code itself.
Worth noting
A missing constraint in a Pydantic field description caused 12 retries, a 504 timeout, and permanent conversation corruption; explicit field constraints fixed it in seconds.
Quote
Before the fix, vague error resulted in retry loop that resulted in timeout that resulted in corruption. But after the fix, LLM could read the rules, caught the issue within few seconds.
Worth noting
Braintrust's independent eval found an SQL agent hit 100% accuracy at ~150k tokens/call vs. a bash agent's 50% accuracy at over 1M tokens/call on structured GitHub data queries.
Quote
We were seeing a lot of excitement online about the fact that you can hand file systems and bash tools to AI agents and that's really all they need.
