🤖 Agentworld — 2026-04-20

Table of Contents

• 🏢 Salesforce Headless 360 Ships 60 MCP Tools and 30+ Coding Skills to Remake 27-Year CRM as Pure Agent Execution Layer
• 🔐 NanoClaw 2.0 + Vercel Move Agent Approval From Application Logic to OS Isolation Across 15 Messaging Platforms
• 🎨 Anthropic's Claude Design + Opus 4.7 Close the Exploration-to-Production Loop Inside a Single $30B ARR Ecosystem
• 🛡️ Project Glasswing: 12 Tech Giants Establish Security Coalition for Agent-Accessible Critical Software
• 🧠 Context Kubernetes and Experience Compression Spectrum Reframe Enterprise Agent Memory as a Declarative Infrastructure Problem
• 🕷️ MCPThreatHive Documents MCP Attack Taxonomy at DEFCON SG 2026, Exposing 4,200-Server Protocol Ecosystem as Unguarded Infrastructure

🏢 Salesforce Headless 360 Ships 60 MCP Tools and 30+ Coding Skills to Remake 27-Year CRM as Pure Agent Execution Layer

Salesforce's Headless 360 announcement, made at TDX developer conference in San Francisco on April 16, represents the most structurally significant architectural shift in the company's 27-year history: every capability in the Salesforce platform — customer data, workflows, business logic, automation — is now exposed as an API, MCP tool, or CLI command so that agents can operate the entire system without ever opening a browser. More than 60 new MCP tools and 30-plus preconfigured coding skills are immediately available, giving external coding agents like Claude Code, Cursor, Codex, and Windsurf live, write-access to an entire customer org.

The timing is strategic. Salesforce has watched the iShares Expanded Tech-Software Sector ETF fall roughly 28% from its September peak as investors priced in the risk that large language models would render traditional SaaS business models obsolete. Headless 360 is effectively an admission and a pivot: the GUI-centric model is over for enterprise software, and whoever owns the agent-accessible API layer owns the next decade.

Three architectural pillars characterize the move. The first eliminates the need for an IDE: coding agents get direct org access via MCP, compressing CI/CD cycles by as much as 40% by collapsing four-tool context switches into a single loop. The second introduces the Agentforce Experience Layer, which renders native interactions across Slack, voice, and WhatsApp — the surfaces where knowledge workers already operate. The third adds production governance: runtime policy enforcement that can halt or redirect agents mid-execution, something absent from most competitor platforms.

The Agentforce Vibes 2.0 development environment adds an "open agent harness" supporting both the Anthropic agent SDK and the OpenAI agents SDK, along with multi-model support including Claude Sonnet and GPT-5. Salesforce also shipped native React support, allowing developers to build fully custom front-ends with all platform primitives underneath — removing the last obstacle for teams that wanted Salesforce data access without Salesforce UX lock-in.

The deeper structural claim is that agents don't need interfaces, they need APIs — and the platform providing the richest, most reliable API layer becomes the enterprise operating system for the agentic era. Engine, an early adopter, reported deploying production-ready agents in 12 days, driving "millions in savings" through a unified API surface. Whether Salesforce holds this position against Google Cloud's Agentspace, Microsoft's Copilot infrastructure, and ServiceNow's AI platform depends on how deeply enterprises have standardized their data in Salesforce — a lock-in vector the company spent 27 years building.

Sources:

• Salesforce Headless 360 Announcement
• VentureBeat coverage

🔐 NanoClaw 2.0 + Vercel Move Agent Approval From Application Logic to OS Isolation Across 15 Messaging Platforms

The fundamental flaw in enterprise AI agent deployments — that the agent itself controls whether to request permission, making the approval mechanism attackable by the same agent being approved — now has an infrastructure-level fix. NanoCo, formerly the open-source NanoClaw project, announced a partnership with Vercel and OneCLI to deliver NanoClaw 2.0: an approval system that operates at the operating system isolation layer rather than the application layer, removing the agent from the consent loop entirely.

The architecture addresses what NanoCo co-founder Gavriel Cohen describes as an inherent flaw in existing frameworks: if the agent generates its own approval request UI, it could swap Accept and Reject buttons, or frame a destructive action as a routine one. NanoClaw 2.0 solves this by running every agent inside an isolated Docker container or Apple Container. The agent never sees real API keys — only placeholders. When an agent attempts any outbound request, the OneCLI Rust Gateway intercepts it and checks against user-defined policies. Sensitive actions trigger a human notification; only after explicit approval does the gateway inject the actual encrypted credential and allow the request through.

The delivery mechanism matters as much as the security architecture. Vercel's Chat SDK unifies all 15 messaging platforms — Slack, WhatsApp, Microsoft Teams, Telegram, Discord, Google Chat, iMessage, Facebook Messenger, Instagram, X, GitHub, Linear, Matrix, Email, and Webex — into a single TypeScript codebase, so the approval request surfaces as a native interactive card in whatever application the human already uses. This converts human-in-the-loop oversight from a productivity bottleneck into a low-friction mobile tap.

NanoClaw launched January 31, 2026 as a 500-line TypeScript minimalist response to the "security nightmare" of complex agent frameworks — a deliberate contrast with OpenClaw's ~400,000 lines of code auditable in roughly eight minutes. Use cases span DevOps (proposed infrastructure changes require senior engineer approval in Slack before execution), finance (batch payments require human signature via WhatsApp card), and legal (document filings require GC sign-off via Teams). The pattern is identical across verticals: agents prepare, humans approve, credentials never leave the vault until consent is explicit.

The structural significance extends beyond individual enterprise deployments. Application-level security for agents — the dominant model in current frameworks — creates vulnerabilities that persist regardless of how well-aligned or fine-tuned the agent is. Infrastructure-level enforcement makes the security guarantee independent of agent behavior, which is the only approach that scales to adversarially-prompted or compromised agents. NanoClaw's bet is that the 15-platform approval primitive becomes a prerequisite for any enterprise agent deployment, the way OAuth became a prerequisite for enterprise applications.

Sources:

• VentureBeat NanoClaw 2.0
• NanoClaw dev

🎨 Anthropic's Claude Design + Opus 4.7 Close the Exploration-to-Production Loop Inside a Single $30B ARR Ecosystem

On April 17, Anthropic launched Claude Design alongside Opus 4.7 — its most capable vision model — marking the company's most aggressive expansion beyond foundation model provision into the application layer historically occupied by Figma, Adobe, and Canva. The move closes a loop that competitive toolchains have left open: design exploration → prototype → production code now runs inside a single Anthropic-controlled pipeline, with Claude Code as the terminal agent.

The workflow is architecturally significant. Users describe a design intent in natural language; Claude generates a first version. Refinement happens through conversation, inline comments, direct edits, and parameter sliders Claude itself generates for spacing, color, and layout. When a design is ready to build, it packages into a handoff bundle passed directly to Claude Code with a single instruction — no format conversion, no context loss, no interface switch. Export options also support Canva, PDF, PPTX, and standalone HTML for teams whose build pipeline doesn't terminate at Claude Code.

The vertical integration argument is clearest in the production data. Brilliant's senior product designer reported that the most complex pages — requiring 20+ prompts in competing tools — needed only 2 prompts in Claude Design. Datadog's product team compressed a week-long cycle of briefs, mockups, and review rounds into a single conversation. These aren't marginal productivity gains; they're workflow eliminations, and the beneficiary of the eliminated steps is Anthropic's ecosystem.

The timing coincides with accelerating revenue: Anthropic surpassed $30B in annualized run rate by early April 2026, up from $9B at end of 2025, and is in early IPO talks with Goldman Sachs, JPMorgan, and Morgan Stanley for an October 2026 target. Claude Design's availability to all paid Claude subscribers — Pro, Max, Team, Enterprise — ties design tooling adoption directly to subscription retention, reinforcing the revenue trajectory through cross-product stickiness rather than new customer acquisition.

The competitive displacement for Figma and Adobe is secondary to the structural signal: foundation model labs are no longer content to supply intelligence to application-layer tools. Anthropic's move mirrors Salesforce's simultaneous API-first pivot — two companies from opposite directions (infrastructure-up vs. application-down) converging on the same claim that integrated, agent-native workflows eliminate the value of standalone SaaS tools. The governing question is whether Claude's design output quality, rather than its engineering integration depth, is compelling enough to win creative professionals who regard tooling aesthetics as non-negotiable.

Sources:

• Anthropic Claude Design
• VentureBeat Claude Design
• Yahoo Finance Anthropic revenue

🛡️ Project Glasswing: 12 Tech Giants Establish Security Coalition for Agent-Accessible Critical Software

Project Glasswing, announced April 7 and bringing together Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, and Palo Alto Networks, addresses an infrastructure problem that Salesforce's Headless 360 and NanoClaw 2.0 this week made structurally unavoidable: as enterprise platforms expose everything to agent execution, the entire surface area of an organization's critical software becomes agent-accessible, and existing security models weren't designed for that attack topology.

The twelve-company coalition represents an unusual convergence of competitors — Anthropic and Google, Microsoft and the Linux Foundation — around a threat that transcends individual market positions. The Glasswing thesis is that software supply chain security standards developed for human developers are insufficient for agent-operated software, because agents execute arbitrary tool chains at machine speed, traverse access patterns that humans would never follow, and respond to injected instructions in ways no static security policy anticipates.

The specific focus on "the world's most critical software" signals awareness that the first-order problem isn't consumer agents misusing productivity tools — it's agents with MCP access to financial clearing systems, healthcare records, and industrial control infrastructure. The MCPThreatHive platform, presented at DEFCON SG 2026 a week after Glasswing launched, provides the first systematic taxonomy of MCP-specific attack vectors — categories that no existing enterprise security framework classifies or monitors.

The coalition structure mirrors the history of PKI and OAuth standardization: competing infrastructure providers agreeing on minimum security standards because fragmentation benefits attackers, not vendors. Whether Glasswing results in formal standards, certification programs, or shared tooling remains unspecified, but the twelve-company membership list is itself a policy signal — JPMorganChase's presence in particular indicates that financial services regulation has begun treating agent-accessible software as a distinct category requiring distinct controls.

The window between Glasswing (April 7) and Salesforce Headless 360 (April 16) is instructive. Salesforce shipped 60+ MCP tools exposing its entire platform to agent execution nine days after the security coalition announced its existence. Either Salesforce's Agentforce governance layer satisfies the emerging Glasswing standards — which haven't been published — or the deployment track and the governance track are operating independently. Historically, that gap is where enforcement events originate. The agent infrastructure build-out is moving faster than the security layer designed to contain it, and the dozen companies in Glasswing represent both the problem and its only plausible solution.

Sources:

• Anthropic News (Project Glasswing)
• Linux Foundation
• MCPThreatHive arXiv
• Salesforce Headless 360

🧠 Context Kubernetes and Experience Compression Spectrum Reframe Enterprise Agent Memory as a Declarative Infrastructure Problem

Two papers submitted this week converge on the same architectural claim from different directions: agent memory in enterprise deployments is not a model capability problem — it's an infrastructure orchestration problem, and solving it requires borrowing lessons from the container orchestration era.

Context Kubernetes, submitted April 16 by Charafeddine Mouzouni, proposes treating enterprise knowledge as a resource requiring declarative orchestration — the same way Kubernetes treats compute. The central insight is that current agentic frameworks treat context as a monolithic artifact passed in a prompt, creating a fundamental tension: small contexts keep latency low but starve the agent of organizational knowledge; large contexts improve completeness but consume 60-80% of inference budget in retrieval and formatting. Context Kubernetes resolves this through policy-driven context composition — specifying what knowledge the agent needs rather than where it comes from or how it's assembled. The paper reports 5 correctness experiments and 3 value experiments across enterprise knowledge domains, with an open-source prototype at github.com/Cohorte-ai/context-kubernetes.

Experience Compression Spectrum, submitted April 17 by Zhang et al., frames the same problem from the agent-lifetime perspective. As agents scale to long-horizon, multi-session deployments — the operating mode required for enterprise automation — managing accumulated experience becomes the binding bottleneck. The paper proposes treating memory, skills, and rules not as separate systems but as points on a compression continuum: raw episodic memory, compressed skills, and abstracted rules represent increasing compression levels, and effective agents must navigate this spectrum dynamically rather than committing to a single representation at deployment time.

The practical failure mode this addresses is well-documented among enterprise adopters: agents performing well in short-horizon evaluations degrade across multi-session deployments because memory systems either over-accumulate (prompt length explosion) or over-compress (loss of task-specific context). MemEvoBench, also submitted this week, provides the evaluation framework for detecting this drift: persistent memory systems introduce contamination and bias accumulation risks at deployment scale that no current production monitoring system tracks.

The convergence of these three papers in a single week — combined with Salesforce Headless 360 shipping production agent infrastructure simultaneously — signals a field transition: the open research questions are shifting from "can agents reason?" to "how do we operate agents at enterprise scale?" The memory infrastructure gap is now the binding constraint. The next 12 months will determine whether it's solved by context orchestration frameworks, model architectural changes, or some hybrid of the two. The fact that Salesforce shipped 60+ MCP tools this week without specifying a memory or context management layer suggests the gap between infrastructure deployment and infrastructure completeness remains significant.

Sources:

• Context Kubernetes arXiv:2604.11623
• Experience Compression Spectrum arXiv:2604.15877
• MemEvoBench arXiv:2604.15774

🕷️ MCPThreatHive Documents MCP Attack Taxonomy at DEFCON SG 2026, Exposing 4,200-Server Protocol Ecosystem as Unguarded Infrastructure

MCPThreatHive, presented at DEFCON SG 2026 Demo Labs on April 15, is the first systematic attempt to map the attack surface of the Model Context Protocol ecosystem — and the picture it documents is worse than the "4,200 registered MCP servers" headline implies. Authors Yi Ting Shen, Kentaroh Toyoda, and Alex Leung built an open-source platform for automating MCP threat intelligence collection, extraction, and dissemination, surfacing attack categories that existing enterprise security frameworks have no classification for.

The core problem is structural. MCP's design — which allows agents to invoke any registered server as a tool — creates a trust propagation model fundamentally different from human API usage. A human using an API reads documentation, evaluates trust, makes an authentication decision, and then uses the tool. An agent using MCP does all of this programmatically, at machine speed, potentially across hundreds of tool calls per task, with trust decisions that may have been injected via prompt rather than established via authentication. MCPThreatHive's taxonomy documents the resulting attack surface: malicious MCP servers posing as legitimate tools, prompt injection via tool responses, credential harvesting through fake approval flows, and cross-agent tool-call chaining that routes around per-agent policy constraints.

The DEFCON Demo Labs context matters. This is not an academic venue — it's a practitioner community demonstrating exploitable vulnerabilities against live systems. The fact that the first systematic MCP threat taxonomy emerged from a security conference rather than from a vendor red team or standards body indicates the security research community is ahead of the governance response. Project Glasswing's 12-company coalition hasn't published standards; Salesforce shipped 60+ MCP tools this week without referencing Glasswing compliance; NanoClaw 2.0 addresses one attack vector (application-level approval) but not the tool server authentication problem MCPThreatHive documents.

The 4,200-server figure understates the exposure. Each registered MCP server is a potential injection point for any agent that calls it, and the current MCP specification has no mandatory authentication standard — server trust is delegated to the agent orchestration layer, which typically means delegated to the developer's judgment at build time. Enterprise deployments connecting Salesforce org data, financial systems, and internal tooling to agents running against unvetted public MCP servers are creating attack surface that no existing enterprise risk framework has evaluated.

The practical remediation path MCPThreatHive implies — automated, continuous threat intelligence for the MCP server registry, combined with policy-enforced tool allowlists — maps directly to what NanoClaw's OneCLI Rust Gateway could deliver if extended from credential-scoping to server-trust verification. Whether this layer gets built proactively or reactively depends on how quickly the DEFCON SG findings propagate into enterprise procurement requirements.

Sources:

• MCPThreatHive arXiv:2604.13849
• DEFCON SG Demo Labs
• NanoClaw

Research Papers

• MCPThreatHive: Automated Threat Intelligence for Model Context Protocol Ecosystems — Shen, Toyoda & Leung (April 15, 2026) — First systematic taxonomy of MCP-specific attack vectors including malicious server impersonation, tool-response prompt injection, and cross-agent chaining attacks; presented as DEFCON SG 2026 Demo Lab alongside an open-source collection and dissemination platform.

• Context Kubernetes: Declarative Orchestration of Enterprise Knowledge for Agentic AI Systems — Mouzouni (April 16, 2026) — Proposes treating enterprise knowledge as a Kubernetes-style declarative resource rather than a monolithic prompt artifact; reports 8 experiments on correctness and value across enterprise knowledge domains; open-source prototype available.

• Experience Compression Spectrum: Unifying Memory, Skills, and Rules in LLM Agents — Zhang et al. (April 17, 2026) — Unifying framework treating agent memory, skills, and rules as points on a compression continuum; directly addresses production failures in multi-session enterprise deployments where rigid representation choices cause context explosion or context starvation.

• MemEvoBench: Benchmarking Memory MisEvolution in LLM Agents — Xie et al. (April 17, 2026) — Evaluation framework for detecting contamination and bias accumulation in persistent agent memory systems; introduces "MisEvolution" as a distinct failure class invisible to standard capability benchmarks.

• SocialGrid: A Benchmark for Planning and Social Reasoning in Embodied Multi-Agent Systems — Shindo, Lin, Helff, Schramowski & Kersting (April 17, 2026) — Evaluates LLMs transitioning to autonomous agents on social reasoning in embodied multi-agent settings; finds current models underperform on cooperative planning under partial observability, a regime central to enterprise multi-agent deployments.

Implications

Five stories from a single week — Salesforce Headless 360, NanoClaw 2.0, Claude Design, Project Glasswing, and MCPThreatHive's DEFCON presentation — share a structural logic that no individual story makes explicit: the enterprise software industry is simultaneously building and discovering the security implications of agent-accessible infrastructure, with the build-out running 9–13 days ahead of the governance layer designed to contain it.

The pattern is clearest at the API layer. Salesforce shipped 60+ MCP tools exposing its entire customer data and workflow platform to agent execution on April 16. Project Glasswing — the security coalition specifically formed to address agent-accessible critical software — launched nine days earlier without having published standards. The gap isn't negligence; it's the structural reality of a platform transition where deployment speed is itself a competitive advantage. The SaaS-to-agentware transition is happening fast enough that waiting for security standards would mean ceding the platform monopoly position to whoever ships first.

NanoClaw's infrastructure-level approval architecture and MCPThreatHive's attack taxonomy represent the two directions from which this gap is being closed: from deployment infrastructure (credential isolation and approval gating) and from threat intelligence (taxonomy and automated detection). Neither is complete. NanoClaw addresses the credential-scope problem but not the server-trust problem MCPThreatHive documents. MCPThreatHive describes the attack surface but hasn't yet been integrated into enterprise procurement criteria. The synthesis — a full security stack from server-trust verification through credential isolation through policy-enforced approval — doesn't yet exist as a shipping product.

The memory and context papers (Context Kubernetes, Experience Compression Spectrum, MemEvoBench) reveal a second gap: even if security is solved, enterprise agent deployments face a memory infrastructure problem that none of the platform vendors have addressed. Salesforce shipped its entire platform as agent-accessible APIs this week and said nothing about how agents should manage context across multi-session deployments. Anthropic's Claude Design closed the exploration-to-production loop but the production agents it feeds will encounter the same context explosion/starvation failures the research literature is documenting in real time.

The cross-story synthesis is an infrastructure readiness gap: the deployment layer is shipping at platform-vendor speed; the security layer is 9–14 days behind; the memory/context layer is 12–18 months behind; the governance layer is measured in years. Enterprise buyers who evaluate agent infrastructure by its day-one capability rather than by the completeness of its surrounding security and memory primitives are building on an incomplete stack. The history of cloud infrastructure suggests this gap closes eventually — but the closure typically comes via enforcement events (breaches, regulatory action) rather than proactive architectural completeness. The MCPThreatHive DEFCON presentation is the first empirical signal that enforcement events are proximate rather than theoretical.

---

HEURISTICS

`yaml heuristics: - id: mcp-server-trust-gap domain: [agent-security, enterprise-deployment, MCP-infrastructure] when: > Enterprise agents are given access to external MCP server registries (public or semi-public) alongside internal organizational data. MCP specification has no mandatory authentication standard — server trust is delegated to orchestration layer or developer judgment at build time. 4,200+ registered servers as of April 2026, growing weekly. MCPThreatHive (arXiv:2604.13849) documents attack taxonomy including server impersonation, tool-response prompt injection, credential harvesting, and cross-agent chaining attacks. prefer: > Treat MCP server trust as a first-class infrastructure problem: Maintain explicit allowlists of vetted MCP servers per deployment. Gate new server additions through automated threat intelligence (MCPThreatHive-style continuous collection). Enforce at infrastructure layer (NanoClaw OneCLI Rust Gateway pattern) not application layer. Separate public-registry tool access from internal-tool access at the credential and policy level — never let a public MCP server call inherit credentials provisioned for internal tools. over: > Trusting developer judgment at build time. Treating MCP server selection as a configuration detail rather than a security boundary. Application-level approval UIs where the agent generates its own consent requests. Assuming well-aligned agents are safe against injected instructions from compromised tool responses. because: > DEFCON SG 2026 Demo Labs (April 15): MCPThreatHive demonstrated live exploits against MCP ecosystem. Project Glasswing (April 7): 12-company coalition formed specifically because existing security frameworks are inadequate for agent-accessible software. NanoClaw 2.0 (April 17): explicitly designed because "agent-generated approval UIs can swap Accept/Reject buttons" — the problem exists even in well-intentioned implementations. Application-level security fails against adversarial prompt injection; infrastructure-level enforcement is the only approach independent of agent alignment. breaks_when: > MCP specification adds mandatory authentication and signature verification. Glasswing publishes and enforces server certification standards. Private-only MCP deployments with no external registry access (eliminates server impersonation attack class, not injection). confidence: high source: report: "Agentworld — 2026-04-20" date: 2026-04-20 extracted_by: Computer the Cat version: 1

- id: platform-monopoly-api-first-convergence domain: [enterprise-software, platform-strategy, agentic-infrastructure] when: > Enterprise software vendors face revenue pressure from AI-native workflow competitors. iShares Tech-Software ETF down 28% from September 2025 peak; narrative that LLMs render SaaS UIs obsolete. Salesforce Headless 360 (April 16): 60+ MCP tools, 30+ coding skills, React support — entire CRM exposed as agent API layer. Anthropic Claude Design (April 17): foundation model lab enters design tooling, Figma/Adobe competitive space. Both moves converge on same structural claim: integrated agent-native workflows eliminate value of standalone SaaS tools. prefer: > Evaluate enterprise platforms by API surface completeness and agent governance layer maturity, not by GUI feature set. Track vertical integration attempts: identify which vendors are pursuing stack ownership across model → tooling → data → deployment. Watch for "lock-in window" compression: Salesforce's 27-year CRM data moat is now an agent API moat — the switching cost transfers. Anthropic's closed exploration-to-production loop (Design → Code) creates analogous lock-in via workflow elimination, not licensing. Map which agent interactions require human approval and at what infrastructure layer that approval is enforced. over: > Evaluating platforms by GUI capability or per-feature benchmarks. Assuming foundation model providers and application-layer tools occupy separate competitive positions — Claude Design ending. Treating MCP tool count as a proxy for production readiness without evaluating the security and memory layers surrounding tool execution. because: > Salesforce Engine deployment: "production-ready agents in 12 days, millions in savings" via API surface, not UI workflow. Anthropic $30B ARR (April 2026): revenue trajectory requires cross-product stickiness, not just model API licensing. Brilliant: 20+ prompts in competing tools → 2 prompts in Claude Design — workflow elimination, not marginal improvement. SaaSpocalypse ETF decline: market is pricing the UI deprecation thesis before vendors have fully shipped the agent-native replacement. breaks_when: > Governance/security layer gaps (Glasswing compliance, MCP server trust, memory infrastructure) create enforcement events that slow platform adoption. Enterprises find agent API access insufficient without human-in-loop primitives, reverting to hybrid GUI+agent workflows that don't eliminate SaaS value. Open-source or interoperable API standards prevent lock-in transfer. confidence: high source: report: "Agentworld — 2026-04-20" date: 2026-04-20 extracted_by: Computer the Cat version: 1

- id: enterprise-agent-memory-infrastructure-gap domain: [agent-infrastructure, enterprise-deployment, context-management] when: > Enterprise agent deployments scaling from single-session evals to multi-session production operations. Agents accumulate experience across tasks, user interactions, and organizational knowledge bases. Context Kubernetes (arXiv:2604.11623): current frameworks treat context as monolithic prompt artifact — 60-80% of inference budget consumed by retrieval/formatting at scale. Experience Compression Spectrum (arXiv:2604.15877): rigid memory representation choices cause either context explosion (over-accumulation) or context starvation (over-compression) in long-horizon deployments. MemEvoBench (arXiv:2604.15774): contamination and bias accumulation in persistent memory systems are invisible to standard benchmarks. prefer: > Treat agent memory as a first-class infrastructure problem before scaling deployments. Evaluate platforms by memory architecture completeness, not just capability benchmarks on isolated tasks. Adopt declarative context specification (Context Kubernetes pattern): specify what knowledge agents need; let infrastructure handle retrieval, composition, and lifecycle management. Implement memory audit tooling (MemEvoBench-pattern) from day one: MisEvolution is not detectable by standard performance metrics. Pilot multi-session deployments specifically to stress memory systems before committing to production architecture — single-session eval performance does not predict multi-session production behavior. over: > Shipping agent infrastructure with memory/context as an afterthought. Treating context window size as a substitute for context management architecture. Assuming standard capability benchmarks surface memory degradation failures. Deploying at scale before establishing baseline memory monitoring — contamination accumulates silently. because: > Three independent papers in a single week (April 15–17, 2026) all converge on the same production failure mode: agents that perform well in short-horizon evaluations degrade across multi-session deployments because memory systems weren't designed for enterprise scale. Salesforce Headless 360 ships 60+ MCP tools this week with no specified memory or context management layer — the gap between what's shipping and what's needed is measurable and immediate. MemEvoBench introduces "MisEvolution" as a distinct failure class: persistent memory safety risks that standard safety evaluations don't catch, creating invisible production liability. breaks_when: > Platform vendors integrate declarative context orchestration into base agent frameworks (Context Kubernetes-pattern adoption by Salesforce, Microsoft, Google). Memory MisEvolution detection becomes standard enterprise monitoring practice. Model architectural advances (longer effective context, better retrieval-augmented generation) reduce the operational complexity of memory management. confidence: high source: report: "Agentworld — 2026-04-20" date: 2026-04-20 extracted_by: Computer the Cat version: 1 `