| Hey there 👋 I spent an hour yesterday reading Cloudflare's newest post twice, because the first time through I thought I had missed the part where it was a proposal. It was not a proposal. The date on it is September 15, which is to say it already happened, and if your agents fetch pages off the open web, it happened to you. Most of what shipped this week was like that. The headline was not a smarter model, it was wiring. Cloudflare changed the default rules for the web your agents read. IBM opened a way to govern agents built on other teams' platforms. LangChain gave a stalled tool call a spot for a human to step in. You could not cut a demo reel from any of it, and every piece changes something you should check before Friday. My bias, for what it is worth: the model was never going to be the interesting part for long. The interesting part is the plumbing around it, and this was a plumbing week.
The Big Thing Cloudflare turned the web's defaults against agent crawlers On September 15, Cloudflare flipped a default that touches a lot of agents at once. On any page that shows ads, crawlers it classes as Training or Agent are now blocked by default. Crawlers it classes as Search stay allowed. The new default lands on every domain that joins Cloudflare from here on, on new sites added under existing accounts, and on free-plan sites that never set their own bot rules. A site that already chose its rules keeps them, so this spreads as sites onboard and as defaults get inherited. Most coverage frames this as publishers versus AI. For a builder, the story is a dependency that shifted under you. A large share of the open web sits behind Cloudflare. If you run an agent that fetches, scrapes, or retrieves live pages during a task, some of those requests can come back forbidden, and nothing in your code changed to cause it. The break is upstream of you. The same day, Cloudflare shipped the softer half of the story. A new Accountable designation, built as a shared model with Apple, Google, and Microsoft, lets a crawler that does more than one job stay visible to search while being told no on training. A well-behaved bot gets a labeled path, as long as its operator declares how it uses what it reads. There is still a real toll gate here, through Cloudflare's pay-per-use program. The direction is hard to miss: reaching content with an agent is turning into something you declare, and sometimes pay for. Act on it now. This is not a product to deploy. It is a dependency to audit today. Pull the list of every agent or workflow you run that reaches out to the web. For each one, find out which bucket your fetcher lands in, Search, Agent, or Training, and test a few real target pages to see what now returns a 403. Where you own the publishing side, go set your bot policy on purpose instead of inheriting the default. The teams that get surprised by this will be the ones who assumed the web their agents read was a fixed thing. It stopped being fixed yesterday. Source: Cloudflare blog, "Have it both ways: stay discoverable in search while disallowing AI training," Sep 15 2026; policy first announced via TechCrunch, Jul 1 2026. Categories and effective date corroborated by Help Net Security and others.
Tour de Headlines 🏛️ IBM gave you one place to govern the agents you did not build. The newest watsonx Orchestrate release turns its AI Gateway into a way to find agents running on other platforms and pull them into a single control plane. Discovery and import of Amazon Bedrock agents is generally available now; Azure AI Foundry and Google Vertex AI are slated for the end of September. Two more pieces landed alongside it. Trace Inspector shows the full step-by-step path of an agent run, so you read where it went wrong instead of guessing. Custom LLM-as-a-Judge lets you write your own pass-or-fail criteria in plain language, because a claims agent and an onboarding agent are not "good" in the same way. The AgentOps agent, in preview last month, is now GA: it writes test cases, runs your agent through simulated conversations, does root-cause on failures, then rewrites instructions and verifies the gain before anything ships. It reaches external LangGraph agents through IBM's SDK this month. This rolled out across late August into September, so you can turn it on today. If you run Orchestrate, the govern-what-you-did-not-build piece is the part to try first. 🧩 LangChain dropped a human checkpoint inside a tool call. The MCP update wires elicitation to LangGraph interrupts. When an MCP server pauses mid-call because it needs input it does not have, the run now surfaces as an interrupt a person answers, and then it resumes from where it stopped. Before, that gap was an error path or a guess. The release also ships a first-party MCP adapter that turns any MCP server into tools you hand straight to create_agent, plus tighter error handling. It is open source and installable now. The pattern worth stealing, even if you never touch LangChain: treat "the tool needs more from a human" as a normal, resumable step your graph already knows how to pause for. 🧠 Microsoft made an agent's memory swappable. Agent Framework 1.18.0 adds shared vector-store abstractions with portable filters and an in-memory store, a generally available Azure AI Search implementation, generally available Redis stores, plus alpha connectors for Qdrant and for PostgreSQL with pgvector. It also converts MCP host-history, so a persisted conversation carries over instead of starting cold. Install it from pip or NuGet now. The point is small and useful: you can change where your agent's memory lives without rewriting the agent. Grade the alphas as alphas, and keep them out of anything you cannot babysit yet.
| Sponsor Your team's calls are full of signal. Measure it. RapportScore reads the calls your team already records and scores how your people communicate, then turns it into coaching they can use. Stop guessing whether a rep is building trust or talking past the buyer, and see it in the numbers. See your team’s score → |
Tool of the Day 🔧 n8n (September release) The low-code loom for MCP agents: wire, test, and scope agent workflows without frontier-model glue. If you are not running a frontier-lab stack, this is the most deploy-this-week item in the issue. n8n's September release turns on the instance-AI module by default, exposes agent test execution over MCP, and hands its assistant an MCP-registry-search tool so it can find servers for you. The piece I like most is the new OAuth consent scope picker: when an MCP client asks for access, you grant All, Read only, or a Custom set, instead of the old all-or-nothing yes. Self-host it or run it in n8n's cloud. Pick one workflow you still do by hand, point n8n at it, and let it drive the MCP calls while you watch the run trace. It is the shortest path from "I read about MCP agents" to "I have one running." Read the n8n changelog
Worth a Click - Cloudflare on accountable mixed-use crawlers. The September 15 change in Cloudflare's own words: the default block on ad pages, and the Accountable path, built with Apple, Google, and Microsoft, to stay searchable while disallowing training. (blog.cloudflare.com)
- IBM watsonx Orchestrate AI Gateway. Discover and govern agents built on other platforms from one control plane, with Trace Inspector, Custom LLM-as-a-Judge, and the now-GA AgentOps agent. (ibm.com)
- MCP in LangChain: elicitation and more. How the human-checkpoint pattern works under the hood: an MCP server's mid-call question becomes a LangGraph interrupt a person answers, then the run picks back up. (langchain.com)
This was a plumbing week. Strip the logos off everything that shipped and not one of them is a smarter model. Cloudflare changed the rules of the web your agents read. IBM gave you a single place to govern the agents other teams built. LangChain put a human back inside a tool call. Microsoft made an agent's memory something you can swap. n8n made the whole loom low-code enough to try tonight. The story keeps moving in the same direction, away from what the model can do and toward what the wiring around it is allowed to reach, and allowed to reach back. The builders who win the next year are the ones treating that wiring as the real product. This week it was. See you tomorrow.
— Ron |
