AI Architecture Updates: July 23, 2026

1. Production Agents Are Mostly Deterministic Software That Calls a Model Sparingly

ByteByteGo. The piece argues that agents which survive real traffic depend on the language model far less than demos suggest, with most behavior running through conventional deterministic code that consults the model at only two or three points where genuine judgment is needed. It lays out four design areas: deliberate context pruning over large histories, deterministic control flow with hard limits on loop iterations and timeouts, external serializable state held in databases rather than model memory to enable pause, resume, and crash recovery, and narrow single-purpose agents with human handoffs treated as first-class steps. The throughline is that reliable agents are mostly deterministic systems with a model wired in at a few deliberate points. Source

2. Virtual Tools and Registries to Move Agents Past 1970s BASIC

Jake Mannix, via InfoQ. The talk argues that most agent code resembles monolithic 1970s BASIC and proposes an intermediate protocol layer of virtual tools that are versioned and encapsulated, so tools can be renamed, reprojected, and re-described without changing upstream implementations. It pairs this with runtime taint tracking that dynamically removes dangerous tool combinations based on data classification to defuse the lethal trifecta of untrusted content, external write access, and sensitive internal data. A central registry of tool definitions, agent configs, schemas, and evaluation packs then lets tool owners, agent authors, and security teams work independently while governance runs through static and dynamic checks rather than prompts. Source

3. Anthropic Contains Agents With Deterministic Environment Limits, Not Model Judgment

Anthropic, via InfoQ. Anthropic details a containment strategy that places deterministic limits on an agent’s filesystem, network, and execution environment rather than relying on the model to recognize harmful intent. Claude.ai runs in ephemeral gVisor containers with no local filesystem, Claude Code uses OS-level sandboxes that permit workspace writes but deny network access by default, and Claude Cowork isolates execution in a virtual machine while keeping the agent loop on the host. A notable lesson is that domain allowlists proved insufficient because attackers exploited allowlisted APIs, so the fix used a proxy that accepts only provisioned session tokens. Source