Airworthiness rules carry the fingerprints of specific crashes. Banking regulations followed specific crises. The Five Eyes agentic AI guidance and NSA's MCP security advisory, both published in May 2025, have no crashes to study. They govern systems that barely exist in production, and both documents say so plainly — evaluation methods aren't mature enough to certify what's being built. Critical safety decisions, like whether an operation that runs twice produces the same result, are left to implementers. When regulators publish hypotheses instead of prohibitions, the compliance machinery that receives them may not notice the difference.

Airworthiness rules carry the fingerprints of specific crashes. Banking regulations followed specific crises. The Five Eyes agentic AI guidance and NSA's MCP security advisory, both published in May 2025, have no crashes to study. They govern systems that barely exist in production, and both documents say so plainly — evaluation methods aren't mature enough to certify what's being built. Critical safety decisions, like whether an operation that runs twice produces the same result, are left to implementers. When regulators publish hypotheses instead of prohibitions, the compliance machinery that receives them may not notice the difference.

Skyvern's architecture compiles AI-learned browser workflows into deterministic scripts, then calls the model back only when a script breaks. The rationale is cost and reliability — compiled paths cut token consumption by 57× at scale. But each time the model gets called back, it timestamps something else: an environment event. The website changed enough to break a path that previously worked. Co-founder Shuchang Zheng spent years at Lyft building infrastructure that told engineers when something changed and whether it mattered. His browser automation architecture produces the same kind of signal as a byproduct, pointed at the web rather than the agent.

Skyvern's architecture compiles AI-learned browser workflows into deterministic scripts, then calls the model back only when a script breaks. The rationale is cost and reliability — compiled paths cut token consumption by 57× at scale. But each time the model gets called back, it timestamps something else: an environment event. The website changed enough to break a path that previously worked. Co-founder Shuchang Zheng spent years at Lyft building infrastructure that told engineers when something changed and whether it mattered. His browser automation architecture produces the same kind of signal as a byproduct, pointed at the web rather than the agent.

On May 1, 2026, CISA, the NSA, and their counterparts in Australia, Canada, New Zealand, and the UK released "Careful Adoption of Agentic AI Services." It is the first coordinated multigovernment security guidance written specifically for agentic AI.

The lead directive: "Until security practices, evaluation methods and standards mature, organisations should assume that agentic AI systems may behave unexpectedly and plan deployments accordingly, prioritising resilience, reversibility and risk containment over efficiency gains."

Read that last clause again. Six intelligence agencies are telling enterprises to design for recovery, not correctness. Current evaluation methods cannot certify agent systems as safe, so deployments should be built to recover fast when things go wrong.