The Collection

Mike Taylor’s Every piece is adapted from his forthcoming book, Context Engineering with DSPy, and borrows its frame from Drew Breunig’s “How Long Contexts Fail.” He lists seven failures: distraction, confusion, neglect, drift, clash, poisoning and underspecification. Six of the seven are problems of too much context. Only the last is a problem of too little.

The numbers are his own workshop and newsroom examples. Ask ChatGPT to name a product the way Steve Jobs would, and 21 percent of the names start with “i-.” Add a handful of “i-” examples and it is 100 percent. His colleague Katie Parrott watched a style guide grow from 759 words to 3,855 until the writing became unrecognisable; one essay took 127 drafts and more than a million words. The fix was to cut. The rebuilt guide runs 513 words.

He leans on published research for the rest. Stanford’s “Lost in the Middle” work found models attend to the start and end of their context and miss what sits between. Microsoft and Salesforce researchers split one-shot prompts into step-by-step messages and got 39 percent worse results across models. Google’s Gemini 2.5 report supplies the term “context poisoning”: an agent playing Pokémon Red decided it needed an item that does not exist in that version, wrote the goal down, and spent more than 100 turns looking for it.

Telling the model it was wrong leaves both the error and the complaint in the thread.

The advice is the useful part. Do not argue with a mistake; edit the earlier message so the error never happened. Put the whole brief in the first message instead of drip-feeding it. Before leaving a long thread, ask what the model wishes it had known at the start, cut what is wrong, and carry the rest into a fresh one. Keep the durable context in files you choose to load, not in a memory that chooses for you.

Marco Kotrotsos opens with a distinction that Taylor’s piece only gestures at. A bad answer is visible in the conversation where it appears. A bad memory “may sit quietly until another task gives it a reason to matter.”

His example is labelled hypothetical, and the stand keeps the label. A personal assistant saves an unverified claim that a certain destination is the approved place to upload reports. Later, a new conversation asks it to prepare a report. The source of the claim is gone. The destination is still there, looking like useful context. He points to MemSecBench, research that follows malicious material through storage and later retrieval.

The poison is not in the chat. It is in what the chat left behind.

The rest of the essay, including how to test the full recovery path, is member-only on Medium. The stand read the preview and leaves the remainder unread rather than guess at its method. The point survives on the preview alone: if memory can carry an instruction from one task into another, then turning memory on is a security decision, and clearing it is a recovery step that someone has to own.

Abi Noda’s Engineering Enablement episode brings together his CAFE(S) co-authors: Max Kanat-Alexander of Capital One, Eirini Kalliamvakou of DX and Margaret-Anne Storey of the University of Victoria. Their claim is that better models and harnesses are not enough. The quality of the context an agent receives matters just as much, and most organisations never evaluate it.

The framework scores context on five properties: clarity, actionability, fidelity, efficiency and security. The panel ranks clarity first, because ambiguity is invisible to the person who wrote the instruction. Security carries the starkest example. The notes cite a real case in which an agent found an unrelated API credential and deleted a production database. The failure was not the model’s reasoning. It was what the model had been allowed to see.

A mistake in a shared instructions file is repeated in every session.

Two ideas carry over from Taylor’s letter. One is intent debt: goals, constraints and decisions that live only in people’s heads, which an agent cannot infer. The other is review. A widely used instructions file multiplies its mistakes and its improvements across every agent that loads it, so the authors argue it should be reviewed in proportion to its reach, formally for critical shared files, lightly for small documentation edits. They also warn of a quieter failure: when the agents seem to be working, teams stop writing down why.

Ken Huang’s Friday letter is the accumulation argument applied to headcount. His lead finding is from Salesforce Research, which tested six automatic multi-agent frameworks across four models and five benchmarks. Held to equal inference cost, a single agent taking a five-sample majority vote beat them. The multi-agent systems cost up to ten times more than chain-of-thought with self-consistency, and still scored lower.

He sets two other results beside it. A hand-built expert multi-agent system lifted GPT-5 from 57.0 percent to 96.5 percent at the same cost as the single-agent baseline, so the problem is not more agents as such. It is agents added by default. And Datadog, by training a specialised model on a curated set of real incidents, matched GPT-6.1 Sol High and Claude Opus 5.5 High at three to eight times lower estimated inference cost. Sakana AI’s contribution is method: 70 research campaigns run against rubrics written in advance, then each component ablated to see what actually mattered.

An inert agent changes nothing except the bill and the attack surface.

Huang’s standard is a single sentence: if an agent system cannot demonstrate that it changes the answer, and justify the cost of doing so, it probably should not be used. The paid section lists five collapse patterns, an eight-point builder checklist and a security section; the stand read only their titles and leaves the detail unread. The headline belongs in this issue anyway. Extra agents are extra context, and extra context is not free.

The week’s other subtraction happened outside the model. a16z’s charts letter notes that big etailers, Amazon among them, have moved to block agent shoppers. Citing Cloudflare data, it reports that the share of 403 “Forbidden” responses served to agents and bots has grown considerably since the summer and is about double what it once was. The letter is careful that agentic commerce is only presumably part of the cause.

The motives it offers are ordinary retail ones: losing the customer relationship, losing the eyeballs that carry ad revenue, and fraud and returns. Citing the NRF, it says return rates and the total cost of returns have roughly doubled and tripled since 2019. A machine that can buy the wrong thing, then leave the human to dispute it, is not a welcome customer.

AI is good for a consult. Buying is, for now, a human affair.

Nor are the shoppers pushing the door open. In the survey data the letter cites, about 25 percent of respondents would let AI buy a range of everyday goods for them, and 42 percent would not trust AI to make purchases at all. Similarweb clickstream data, which the letter calls a little stale and ending in June, puts most AI shopping sessions in the middle of the journey, between discovery and checkout. The agent does the homework. The person still signs for the parcel.