Three papers, one uncomfortable question: do we actually know what we're deploying?
This week's papers land at three different altitudes of the AI agent stack — the user's stopwatch, the boardroom's vocabulary, and the security team's threat model — and each one punctures a comfortable assumption executives have been operating under.
The stopwatch: AI design tools work, but not for who you think
A randomized controlled trial of 100 product designers and product managers found that access to Figma Make cut task completion time by roughly 20%, but the larger gains accrued to the product managers, not the designers. That's a strategic finding, not just a productivity one: prompt-to-design tools are compressing the distance between 'I have an idea' and 'I have a prototype' for the people who previously had to wait in a design queue. The budget question changes accordingly — this is a PM tool that happens to make designers faster on some tasks, not a designer tool with PM spillover.
The vocabulary: your governance framework is describing a fiction
The second paper is the one that should sit on every Chief AI Officer's desk. It argues that when governance documents describe agents as having 'learning,' 'memory,' 'values,' 'compliance,' 'identity,' or 'trust,' they import a century of psychological science calibrated to a metaphysical entity — a continuous, developing self — that current AI architectures do not possess. The result is a governance framework precisely tuned to the wrong subject. The authors offer a Disciplinary Audit and a 37-term translation taxonomy that maps these psychological constructs onto operational ones. If your AI risk committee is writing policy about agent 'trust' and 'accountability' without translating those words into permissions, logs, and rollback procedures, the policy is decorative.
The threat model: MCP is a supply chain now
The third paper demonstrates a black-box attack framework called A2M that hijacks agents using the Model Context Protocol — the standard enterprises are rapidly adopting to let agents call external tools. Through nothing more than attacker-controlled tool metadata and returns, the researchers achieved a 93.6% malicious tool invocation rate on one model, inflated token costs 32x through 'cognitive denial of service,' and transferred the attack to four other models without re-optimization. The lesson for executives: every third-party MCP tool your agents can invoke is now part of your supply chain, and semantic matching is not a security boundary. Vetting and runtime isolation are no longer nice-to-have.
Why these three together
Taken together, the week's papers describe an industry that is measuring productivity gains in real workflows while simultaneously misdescribing what it is governing and underestimating what it has connected to. The productivity story is real. The other two are the bill.
Does AI Save Time on Product Design? A Randomized Controlled Experiment of AI Prompt-to-Design Workflows
What they did: Stewart and colleagues ran a proper randomized controlled trial with 50 professional product designers and 50 product managers, assigning each participant three standardized design tasks either with or without access to Figma Make, a prompt-to-design LLM tool. This is the kind of experimental rigor that has been scarce in the AI-productivity literature outside of software engineering.
Why it matters: Among participants who completed the tasks, Figma Make access was associated with approximately 20% shorter completion times. But the headline is the distribution: product managers gained more than product designers, and the benefit for professional designers was task-dependent. That asymmetry is the interesting finding. It suggests prompt-to-design tools are not primarily a designer-efficiency play — they are a redistribution of who can produce a design artifact in the first place.
What it means for business: If you are procuring Figma Make or a comparable tool, seat it with PMs first and measure the reduction in design-queue time, not just per-task speed. Expect uneven adoption from senior designers whose highest-value work is not the standardized tasks the study measured. And treat the 20% figure as a floor for a task-standardized study, not a ceiling for real workflows — the real economic effect is likely in what work becomes possible for non-designers, not in how much faster designers ship.
The Disciplinary Language Transfer Problem: How Psychological Vocabulary Produces Governance Failures in AI Agent Deployment
What they did: Lasser-Chere, Akidau, and Millstone identify a specific failure mode in AI governance that they call the disciplinary language transfer problem. Governance frameworks borrow vocabulary — learning, memory, values, compliance, identity, trust — from psychology and organizational science, and in doing so import six foundational epistemological assumptions that don't fit systems without developmental continuity. Drawing on Wittgenstein, Kuhn, Haraway, and boundary object theory, they show the transfer happens at three levels simultaneously: surface vocabulary, theoretical constructs, and underlying epistemological assumptions. Each level needs a different fix.
Why it matters: The practical output is a Disciplinary Audit — a six-question scan of your governance documents and a 37-term translation taxonomy that maps psychological terms to agent-appropriate operational replacements. This is the first governance paper that treats the vocabulary problem as load-bearing rather than cosmetic.
What it means for business: Run the audit on your AI policy, your model risk documentation, and your agent deployment SOPs. If your policy says the agent must 'earn trust' or 'align with values,' those are unmeasurable and unenforceable. Rewrite them as permission scopes, audit trails, revocation procedures, and testable behavioral bounds. Policies that describe an entity that doesn't exist cannot govern the entity that does.
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
What they did: The A2M framework is a two-stage black-box attack on agents using the Model Context Protocol. Stage one — Attraction — optimizes third-party tool metadata to increase the probability that an agent selects the malicious tool during semantic matching. Stage two — Manipulation — refines adversarial tool returns using execution traces to steer the agent toward the attacker's desired outcome. On LiveMCPBench, direct attacks achieved a 93.6% macro-average malicious tool invocation rate, a 32.4x inflation of token costs under a Cognitive Denial of Service scenario, and a 74.4% mean attack success rate across information exfiltration, environment integrity compromise, and reasoning derailment. Attacks transferred to four other models without re-optimization.
What it means for business: Every MCP tool your agents can discover is now a piece of your supply chain, and the security properties of that supply chain are currently very weak. Concrete asks for your security team: maintain an allowlist of vetted MCP servers, run untrusted tools in isolated runtime environments, monitor for anomalous invocation patterns and cost spikes as security signals, and require a review process before agents in production can consume new third-party tools. The paper is a warning shot for boards discussing agent deployment: the MCP ecosystem is not yet safe by default.
Key Takeaways
• Prompt-to-design tools delivered ~20% faster completion in a 100-person RCT, with product managers gaining more than professional designers — budget the tool to the PM seat, not just the design seat.
• Time savings from AI design tools are task-dependent for professionals; pilot on your actual workflows before rolling out org-wide.
• Governance frameworks that describe agents with words like 'learning,' 'memory,' 'values,' and 'trust' import assumptions from human psychology that don't hold for current AI architectures.
• Audit your AI governance docs for 'disciplinary language transfer' — replace psychological constructs with operational ones (e.g., 'trust' becomes 'permission scope + audit trail').
• MCP agents can be hijacked at a 93.6% rate through attacker-controlled tool metadata and outputs — treat third-party MCP servers as untrusted supply chain, not plug-and-play integrations.
• Adversarial tool metadata can inflate token costs 32x through 'cognitive denial of service' attacks — cost anomalies are now a security signal, not just a billing issue.
• Require tool vetting, runtime isolation, and invocation monitoring before allowing production agents to consume third-party MCP tools.