Demis Hassabis, the driving force behind Google DeepMind, is ascending to the role of chief scientist at Alphabet, Google’s parent company, replacing Jeff Dean who is leaving to work at a start-up.

The role will enable Hassabis to “put his full attention on actively shaping the future of AGI,” or artificial general intelligence, Alphabet CEO Sundar Pichai wrote on the company’s Inside Google blog.

Hassabis’ attention will still be divided, however: He will continue to lead research at Google spin-off Isomorphic Labs, which works on drug discovery, and although he will no longer be CEO of DeepMind, he will be its chair. Koray Kavukcuoglu will take over DeepMind, reporting directly to Pichai. He is currently its CTO.

Hassabis has been a strong promoter of AGI, defined by Google as the “hypothetical intelligence of a machine that possesses the ability to understand or learn any intellectual task that a human being can.”

He has a long career in AI, having helped found DeepMind in 2010. He has been a prominent figure in the AGI field, prophesying in May that it will be a viable technology within three years. He has been keen to tackle any barriers in the way of developing the technology; just last month, he called for greater self-regulation in the market, arguing that it would help drive the technology forward.

Hassabis welcomed the chance to focus on AGI development. “We have arrived at a pivotal moment in human history. I’ve been working towards AGI my whole life, and now, I feel it is close at hand. It’s critical that we collectively get the next steps right to ensure this all goes well for humanity and we usher in an incredible new age of discovery and wonder” he wrote in the Inside Google blog post.

This article first appeared on Computerworld.

As Europe swelters in a heatwave, residents probably don’t want to hear about ways to make their homes even hotter, but that’s what Polish property developer Citylink is talking about, with plans to dump waste heat from a new data center in Wrocław into the municipal district heating network.

Citylink is designing the data center so that heat from servers can be recovered instead of being dissipated via cooling systems — and as the data center grows, any increase in computing power will mean more energy available for recovery.

The collaboration with local power company Kogeneracja will provide “valuable experience in designing and operating modern data centers, with a particular focus on infrastructure dedicated to AI nodes,” said Michał Starybrat, development director at Citylink.

“The dynamic growth of the artificial intelligence and cloud technology markets generates unprecedented demand for computing power, this collaboration demonstrates how modern digital infrastructure can actively contribute to building the energy ecosystem of the future,” he added.

This type of initiative is not new. There have been similar projects in the UK and in New Zealand, but with warnings that data centers are contributing to the warming of the planet, there may well be a lot more organizations looking to deploy that excess heat more fruitfully in the future.

However, announcing it during a heatwave may not be the most politically sensitive approach to take.

This article first appeared on Network World.

On March 24, 2026, developers building AI applications with LiteLLM — a Python package with 95 million monthly downloads — unknowingly installed malicious code. A threat actor group known as TeamPCP had compromised the PyPI distribution pipeline and pushed malicious versions 1.82.7 and 1.82.8 to the package index. The payload was subtle: a .pth file, a little-known Python mechanism that auto-executes code every time the interpreter starts. If you installed either compromised version, malicious code ran silently — no explicit import needed.

That is not the exception anymore. It is the pattern.

What is actually happening

ReversingLabs reports that malicious open-source packages rose by 73% in 2026. The LiteLLM attack was part of a broader campaign by TeamPCP that systematically compromised widely trusted open-source security tools — including Aqua Security’s Trivy and Checkmarx’s KICS — before moving into AI infrastructure libraries hosted on PyPI.

The attack chain for LiteLLM followed a now-familiar sequence. TeamPCP obtained the maintainer’s PyPI publishing credentials, pushed malicious versions that were virtually indistinguishable from the official package, and embedded a multi-stage payload designed to harvest high-value secrets: AWS, GCP and Azure tokens, SSH keys and cloud account credentials. According to Zscaler ThreatLabz, the poisoned packages were available for approximately three hours before quarantine. Three hours was enough to reach tens of thousands of corporate environments.

And it did not stop with LiteLLM. In late April 2026, PyTorch Lightning versions 2.6.2 and 2.6.3 were found to contain credential-stealing malware that executed on import. A single malicious workflow file exposed secrets across entire CI/CD pipelines.

Why AI development environments are uniquely exposed

Most supply chain attacks are bad. Supply chain attacks targeting AI development environments are worse.

AI and ML environments blend development, research, cloud infrastructure, data access, model publishing and automation inside the same workspace. A compromised Python package in a standard web application might steal a database credential. The same attack in an AI development environment can expose model weights, training data, cloud tokens across multiple providers, CI/CD pipeline secrets and production API keys — simultaneously, from a single infected dependency.

There is a second layer that most security teams are not accounting for. When developers use AI coding assistants to write code, those assistants frequently suggest pip install directives and import statements that reference specific packages. If the developer trusts the suggestion and installs the named package, and an attacker has already registered a malicious package under that name, the attack succeeds without the attacker ever interacting with the developer directly. Researchers have named this slopsquatting — and recent research found that across nearly 200,000 Python prompts, every major LLM generates hallucinated package names that do not exist on PyPI, creating a persistent attack surface that no individual model update can fully address.

Your developers are not doing anything wrong. They are using the tools that make them productive. The security assumption underneath those tools is broken.

3 controls that matter right now

1. Pin your dependencies and verify integrity

Floating version specifiers — requests>=2.0 rather than requests==2.31.0 — allow package managers to silently pull updates that include malicious code. Pin every dependency in your AI development environments to an exact version and verify checksums against a known-good hash. This alone would have limited the blast radius of the LiteLLM attack to environments that explicitly upgraded to the compromised versions rather than any environment that ran pip install litellm without constraints.

2. Audit post-install hooks in your development pipeline

The LiteLLM attack embedded its payload using Python’s .pth file mechanism — code that executes automatically during interpreter initialization, before any import statement runs. Post-install hooks and .pth file manipulation are a documented attack class, but enforcement in developer environments is inconsistent. Require review of packages that include post-install scripts before they reach developer machines. Tools like Socket and Sonatype provide real-time analysis of PyPI packages for malicious behavior before installation. This is not a nice-to-have. Given the pace of AI tooling adoption, it is a basic control.

3. Rotate cloud credentials immediately after any suspected exposure

The LiteLLM payload targeted AWS, GCP and Azure tokens specifically because those credentials provide lateral movement across cloud environments. If your development pipelines pulled LiteLLM during the March 24 exposure window, treat every cloud credential accessible from those environments as potentially compromised and rotate them. Review your cloud provider audit logs for activity patterns that do not correspond to developer-initiated requests — the signature of a stolen token being used by an attacker in a different location.

What this means for security teams

The TeamPCP campaign is not the end of this pattern. It is a proof of concept that AI infrastructure is now a target class. LiteLLM, PyTorch Lightning and the tools in between are packages your AI teams depend on every day. The attackers know that. They know that developers move fast, that AI tooling adoption outpaces security review cycles and that a malicious .pth file is invisible to most endpoint detection products.

The controls above are not complex. They do not require new vendors or new platforms. They require treating Python package installation in AI development environments with the same rigor you apply to production deployments — because in 2026, the distance between a developer’s local environment and your production infrastructure is shorter than it has ever been, and attackers have noticed.

Your developers trust their tools. Make sure that trust is warranted.

The financial impact of a data breach is substantial for any modern business, regardless of industry or size. IBM’s latest Cost of a Data Breach report discovered that, from March 2025 to February 2026, the average cost of a data breach rose to $6 million, up 35% from $4.44 million a year earlier.

The 2026 report, conducted by Ponemon Institute and sponsored by IBM, is based on an analysis of data breaches experienced by 600 organizations globally.

According to the report, one in four malicious breaches were AI-enabled. Deepfake impersonation and AI-enabled malware made up the majority of these AI-assisted attacks.

The study found that AI and automation in security operations cut breach costs by an average of almost $2 million dollars. Despite that impact, one in four organizations have yet to adopt these tools in their security operations, the survey found.

In a follow-up study, more than half the organizations reported using agents for threat detection and containment but only 18% apply agents to vulnerability management. Three in four of the enterprises polled say that frontier AI threats are prompting them to rethink how agents are deployed across their security operations.

“AI is making attacks faster and cheaper, while breaches keep getting more expensive. When organizations have an extended gap between discovery and remediation, that imbalance shows up directly in breach costs,” says Suja Viswesan, VP of IBM Security Software.

AI models under attack

One in five organizations reported a breach targeting AI models or applications. The most common causes were weaknesses in surrounding systems: compromised APIs, applications, or plug-ins (27%) and cloud misconfigurations affecting AI workloads (27%).

The vast majority of organizations suffering AI-related breaches lacked proper access controls, yet only 40% deployed access controls on their AI models and data.

Improving access controls on AI models is the most obvious security gap to close, according to Kayne McGladrey, a senior member of IEEE, CISSP-certified cybersecurity advisor, and former CISO of compliance automation vendor Hyperproof.

“Treat your models and their APIs like crown jewels,” says McGladrey. “If you wouldn’t expose your database to the public internet without identity and access controls, why would you do that for your AI model?”

Udaya Bhaskar Vemuri, senior application security analyst and DevSecOps professional, adds that organizations should also be “reviewing integrations and plug-ins, monitoring unusual activity, protecting sensitive data, and making sure every AI system has a clearly defined owner who is responsible for its security and oversight.”

Prompt criticality

Beyond deepfakes and AI malware, AI-driven phishing and direct attacks on AI models, such as prompt injection, are emerging as costly enterprise blind spots.

“The threat isn’t just external; unapproved employee use of AI applications introduces unmanaged vulnerabilities into corporate environments,” says Dray Agha, senior manager of security operations at managed detection and response firm Huntress.

CISOs must shift to proactive governance by embedding security into development workflows, managing exposures aggressively, and applying strict access controls to AI workloads, Agha advises.

Peter Garraghan, CSO and founder at AI security testing firm Mindgard, adds that blindly trusting in the effectiveness of AI security guardrails is fraught with risk.

“Research has demonstrated that existing guardrails currently have various blind spots, and that a defense in depth approach is required,” says Garraghan. “Attackers are constantly adapting, so organizations need to continuously test AI models and applications against realistic adversarial attacks to identify where protections fail.”

Garraghan adds: “By validating guardrails before and throughout deployment, CISOs can ensure AI systems are resilient enough to protect sensitive data, and user privacy as threats evolve.”

Attackers are compromising APIs, plug-ins, and cloud misconfigurations around models rather than defeating them, according to Ariel Parnes, co-founder and COO of cloud security vendor Mitiga.

“These attacks land in the telemetry of the cloud and identity environments, not in the model itself, so the defense is behavioral detection across everything the AI touches,” Parnes advises.

Upping the ante

The abuse of AI tools by attackers doesn’t just mean enterprises are subject to more sophisticated attacks. It also means that these attacks unfold more quickly.

“Organizations need to respond with the same level of automation, but with strong guardrails,” says John-Paul Cunningham, CISO at identity security vendor Silverfort. “AI can improve the speed of cyber defense, but only if organizations build governance and accountability into those systems from the start.”

Regional costs

Average breach costs in the US reached a record $11.5 million, an 11% increase over last year and nearly double the global average.

This rise was driven in part by steeper regulatory penalties and higher business costs, according to the IBM-sponsored study.

The Middle East, which considered Saudi Arabia and the United Arab Emirates for the report, was No. 2 of the 16 countries and regions surveyed, at $8 million.

Canada ($5.2 million) and the UK ($4.17 million) remain in the top 10 hardest hit, with ASEAN or Association of Southeast Asian Nations ($4.12 million), Australia ($2.96 million), and India ($2.79 million) among the top 15.

Phishing topped initial attack vectors and led to the costliest breaches. Social engineering, such as impersonating help desk staff, was used in 13% of attacks while voice and SMS phishing featured in 17% of attacks.

Breaches by industry

Healthcare remains the industry hit with the highest average costs per breach at $6.64 million despite a drop from $7.42 million last year.

Attackers continue to value and target the industry’s patient personal identification information (PII), which can be used for identity theft, insurance fraud, and other financial crimes.

The mean time organizations took to identify and contain a breach rose to 247 days, a slight 2.5% year-on-year increase that reversed a five-year decline. “New threats from AI-driven attacks are challenging even the quickest response times,” the IBM-sponsored study notes.

Average breach cost by industry

Industry	2026	2025	Change
Healthcare	$6.64M	$7.42M	-11%
Financial	$6.29M	$5.56M	+13%
Industrial	$5.50M	$5.00M	+10%
Technology	$5.50M	$4.79M	+15%
Entertainment	$5.38M	$4.43M	+21%
Pharmaceuticals	$5.25M	$4.61M	+13%
Energy	$5.24M	$4.83M	+8%
Professional services	$5.08M	$4.56M	+11%
Communications	$4.71M	$3.75M	+26%
Transportation	$4.50M	$3.98M	+13%

Breach cost variables

While industry averages provide benchmarks, calculating the true, final cost of a specific data breach is notoriously difficult and relies heavily on forecasting.

“Immediate technical costs are quantifiable, but devastating long-term impacts like reputational damage, lost business, and regulatory fines are intangibles, making total breach cost figures informed estimates rather than exact science,” says Huntress’ Agha.

Several experts quizzed by CSO named the cybersecurity skills gap, supply chain vulnerabilities, and the escalating threat landscape as the three main factors in making breaches more expensive and harder to manage.

AJ Thompson, chief commercial officer at IT consultancy Northdoor, who sits on IBM’s Worldwide Security Advisory Council advising on data access and security, says the “bigger cost driver is still ‘how fast you spot a breach’ rather than the sophistication of an attack.”

“A shortage of experienced security staff and patchy visibility into supply chain and third-party risk both stretch out that detection window, and every extra week unnoticed adds to the bill,” Thompson adds.

Reputational damage remains a key cost of being breached

In many ways immeasurable, reputational damage remains among the most significant costs in the wake of a breach. “Ultimately, customer trust is very easy to break, and very difficult to build,” Allie Mellen, senior analyst at Forrester, tells CSO.

Bob Dutile, chief commercial officer at UST, agrees: “The cost of a data breach is typically realized in relative competitive change in the marketplace. Companies find that their brand does not command the same price premium, customer conversion costs are higher, and market share is lost. For a public company, the near-term assessment of the cost impact is reflected in stock price movement.”

According to Dutile, research shows that between $8 million and $10 million is a good planning number in the US for a midsize business facing a modest breach of under 250,000 records. About a third of that cost will be loss of business due to reputation damage.

How a company responds to and communicates a breach can have a large bearing on that reputational impact, Forrester’s Mellen notes. “Understanding how to maintain trust with your consumers and customers is really critical here,” she adds. “There are ways to do this, especially around building transparency and using empathy, which can make a huge difference in how your customers perceive you after a breach. If you try to sweep it under the rug or hide it, then that will truly affect their trust in you far more than the breach alone.”

Severe business downtime can cost millions

Business downtime can also be significantly costly for a breached organization, depending on the level and extent of the downtime and how technology-dependent the firm is.

Nearly all the organizations studied suffered operational disruption, taking an average of 100 days to recover from a security incident.

Jason Hicks, field CISO at Coalfire, tells CSO: “Often a breach is not going to take a company completely offline, but it can happen. The more critical systems that are taken down, the more significant the cost.”

Manufacturing tends to have the best metrics around this, as it’s relatively simple to measure the cost per minute if an assembly line is down, Hicks says. “This can translate into millions of dollars a day for a large manufacturing company. This can be more nebulous for other industry verticals, but there are models to get a reasonable feel that can be applied to each vertical.”

Regulation and litigation add to data breach costs

Increasingly strict data protection and privacy laws along with litigation are seeing a growing number of companies issued large fines, paying hefty settlements, and stumping up for legal fees following data breaches and non-compliance.

“Regulated industries suffer not only the immediate cost of responding to, containing, and remediating vulnerabilities but also the long-term effects of additional penalties from their regulatory bodies and legal settlements,” Nick says. Highly regulated industries, such as healthcare and financial services, typically run one and two in order of cost per breach because they will pay more non-compliance fines than others, he adds.

“Investigation and adjudication often take years for the victim organization to reach a monetary settlement with affected parties.” Legal costs are one of the largest expenditures organizations face in data breaches, Nick states. “Organizations rarely have the legal and privacy expertise in-house. To ensure compliance, they must hire outside counsel to lead their reporting.”

The role of cyber insurance

Cyber insurance is one way that companies mitigate the cost risks of breaches. Sharp increases in cyber insurance premiums have been stabilizing of late, but even organizations covered by insurance can expect to dole out extra cash to make good after a breach. One definite cost hit will be a hike in their premiums, Guidehouse’s Nick says.

“Some organizations have reported post-breach increases in premiums of approximately 200%,” he adds.

Insurers are also implementing more coverage limitations, meaning that even with a policy in place, businesses could find themselves financially responsible for certain breach-related costs.

In fact, Forrester’s Mellen says any notion that policies will allow organizations to fully recover financially from a cyberattack is folly. “In reality, it’s not going to cover all of the costs associated with any type of cyberattack, and we see some insurance firms not even covering ransomware at this point as part of their payouts,” she adds.

Another factor to consider is that cyber insurance providers typically have a list of approved service providers such as lawyers and forensics firms, Hicks says.

“If your preferred provider is not on their list, you may have to work with them to get them included, or potentially have to change providers. This can be costly, as firms are often leveraging their existing service providers to secure the maximum discounts based on the volume of work done with the partners,” Hicks says.

Ransomware extortion on the rise

Reported ransomware incidents rose in the last 12 months compared to the year prior (39% vs. 34%) as attackers have abused AI technologies to automate and scale their attacks.

While disrupting operations through encrypting remains a key tactic (23%), attackers are shifting to higher-impact pressure methods, such as threatening to leak stolen data (a common feature of so-called double extortion attacks).

Insufficient security staffing leads to higher breach costs

According to IBM’s latest report, the security skills shortage is one of the biggest data breach cost amplifiers, with the average additional cost of data breach due to cyber skills shortage pegged at $180,000.

If insufficient security staff equates to greater data breach costs, organizations should heed Mellen’s warning about the impact a poorly handled data breach can have on employees.

“If they don’t feel like the organization is able to protect them or customers in the event of a breach, or that they blame their employees for a breach, then they’re likely going to start looking for jobs elsewhere because it creates a bit of a hostile environment for them,” she says. “It is very important for organizations to recognize that they need to accept responsibility and protect both their employees and their customers.”

Taking a DevSecOps approach to software development was the No. 1 factor that reduced breach costs, according to the report, ahead of use of identity and access management. Running key lifecycle management tools rounded out the top three factors.

Security incidents involving shadow or unsanctioned use of AI tools more than doubled to 43% this year compared to 20% in 2025. Shadow AI is starting to rival supply chain breaches and security system complexity as a leading factor in exacerbating breach costs, according to the report.

Preparedness is key to managing data breach costs

No matter the specific costs involved, experts agree that preparedness is key to mitigating the financial repercussions of a breach.

“Faster incident response continues to be a clear driver for lowering the cost of a breach,” UST’s Dutile says. “The worst losses are those that go undetected for an extended time or have a slow or ineffective response.”

To that end, more than half of organizations surveyed say they plan to invest in AI security and governance tools post-breach, an 88% increase from last year and a reaction to concerns over frontier AI model threats.

Modern cybersecurity requires a post-breach mindset which understands that, eventually, a successful data breach is going to occur, Forrester’s Mellen adds.

“Operating under those conditions, you need to figure out how you’re going to handle that and build your resiliency to respond better and faster. This isn’t just about the security function either, and it needs to be spread across an organization, considering what marketing is going to do, what sales is going to do, etc. — how, as a business, you can demonstrate you value your customers and that you want to make it right as quickly and effectively as possible,” she says.

It’s no secret that the CIO role is changing in Canadian enterprises. Driving operational performance and increasing efficiency are, of course, still a big part of the job. But CIOs are now expected to do more than cut costs and keep the lights on. Increasingly, boards of directors expect the CIO to play a key role in creating value and enabling their organizations to outperform their rivals. Recent data backs this up. The overwhelming majority (91%) of Canadian technology leaders believe advanced technology will be the primary driver of competitive advantage over the next three years, according to KPMG’s “The 8 execution imperatives for Canadian tech leaders,” a white paper based on the firm’s 2026 Global Tech Report.

The race to capture value from emerging technologies has intensified, leaving little room for organizations that remain on the sidelines. Yet in Canada, just 27% of organizations consider themselves innovators or early adopters, while 72% are fast or slow followers. Nearly all (85%) believe they’ll need to take more risks with emerging technologies just to remain relevant.

The traditional, operational-first mindset among CIOs has become a liability. CIOs are expected to be strategic players, but meeting that expectation requires taking thoughtful, well-considered action across key imperatives.

AI success depends on data

AI is not the only advanced technology that organizations are working to deploy, but it’s certainly garnering the most attention from C-suite executives, boards of directors, and investors. To enable AI at scale, the data foundations enterprises have built over the past decade will be necessary, but they are not sufficient on their own. CIOs must make modernizing the state of enterprise data a top priority.

In most large organizations, data often remains locked inside legacy systems where the system of record is also the system of engagement, and that significantly limits accessibility for AI workloads. Data should be treated as the strategic asset that it has become. The quality, timeliness, and governance of that data vary widely, and reconciling those inconsistencies is one of the most persistent barriers to enterprise-level deployment.

Scaling pilots into enterprise programs also requires closing the gap between AI-native talent, who have the skills to move quickly, and those with deep institutional knowledge, who understand how their organizations work and what they need to achieve. These two groups must work hand in hand. Otherwise, organizations may accelerate toward the wrong goals, which won’t move the business forward.

“The barriers to scaling AI aren’t just technical,” says Sanjay Pathak, partner and national leader, technology strategy and digital transformation services, KPMG Canada. “CIOs need to truly and deeply understand the value chain of what their organizations do. Those who get there will have the imagination, the courage, and the foresight to use AI to transform their organizations.”

Communicating ROI requires the right framing

Beyond scaling, simply communicating the value of AI also poses a significant challenge. Just over half (53%) of Canadian organizations surveyed say they struggle to demonstrate or communicate AI value to stakeholders. Part of the problem is that CIOs are making the wrong argument in the wrong room because they’re framing ROI as a technology metric rather than a business outcome.

“Any CIO who doesn’t truly understand what their business does is missing a beat around how innovation is going to help the organization achieve ROI,” says Pathak. “Understanding how to deploy AI inside your value chain will give you a head start and a competitive advantage in unlocking real business benefits.”

A formal performance measurement framework that tracks customer experience, revenue growth, and employee adoption alongside cost metrics gives CIOs a far more accurate picture of long-term value. Linking funding decisions to those strategic outcomes makes sustained investment easier to justify.

There is also a compliance dimension that often goes unacknowledged in these conversations. CIOs who bring business, technology, and compliance leaders together to design innovative processes that are “compliant by design” from the start are protecting future value as much as they are delivering value today.

“You need to assemble that multi-dimensional cohort of business, technology, risk, and compliance leaders at the same table, envisioning compliance by design,” says Pathak. “The winners in this space are going to be the ones who really think about business ambition holistically and focus on efficient delivery, operations, and compliance.”

Building disciplined innovation governance

An organization’s approach to governance makes an enormous difference in how quickly and confidently it can deploy and take advantage of advanced technologies. As noted above, almost three-quarters (72%) identify as fast or slow followers, and 85% say they need to move more aggressively to embrace new technologies. Canadian organizations aren’t lacking ambition. What they lack are the conditions required to innovate with confidence: clear ownership, defined risk thresholds, and shared accountability between technology, risk, and business teams.

“You can be an innovator, but if your innovation is not directly connected to strategic business ambition and safety guardrails such as risk management, governance, and compliance, you’re creating labware,” says Pathak. “Being an early adopter means you’re comfortable with the technology. To make it truly viable, you must embrace all dimensions of enterprise value.”

Strong governance does not slow innovation down but instead provides a structure that builds confidence and resilience at every level of the organization, from the board to project teams. A tiered governance approach that takes risk into account allows organizations to advance low-risk, incremental improvements and high-reward initiatives in parallel.

Expanding partnerships to accelerate innovation

Innovation isn’t a single-player game, and Canadian organizations know it. Ninety-seven percent of respondents say they plan to expand their external ecosystems. To date, a significant portion of those relationships have been transactional and focused on a specific capability or problem. But savvier organizations are moving toward multi-party innovation, where partners pool capabilities to share both risk and reward. This model requires a different kind of commitment because organizations are betting on a partner’s long-term viability, not just their current capability. Together, they must build the integration and governance infrastructure that makes these ecosystems work for all participants.

“Moving to multi-party innovation ecosystems is an investment in integration and data,” says Pathak. “If you’re going to look at best of breed and stitch those together, what must be true for that to work is the ability for those different ecosystems to integrate and interoperate. And that creates a much stronger need for safety and governance.”

Cybersecurity is another dimension that grows more important with every new partner added to the ecosystem. Security should be proactively built in, not imposed after a breach has already occurred.

“The more ecosystem-based partnerships you have, the more opportunity you create along with the threat you have to deal with,” says Pathak. “You expand the attack surface, and you become more of a target, so governance and cybersecurity must be designed in from the start, not bolted on later.”

Canadian government incentives, including Scientific Research and Experimental Development (SR&ED) tax credits and AI-focused clusters, offer a way to share some of the cost and risk, particularly during periods of economic uncertainty.

By leveraging these funding frameworks alongside robust ecosystem governance, forward-thinking organizations can safely scale their networks to turn shared risks into sustainable competitive advantages.

In closing

For organizations navigating this environment, KPMG Canada emphasizes that the most consequential decisions ahead are not purely, or even mostly, technical. They are about how CIOs choose to lead, partner, measure, and govern in a period that rewards both ambition and discipline in equal measure.

The data points are clear. CIOs who lead with both strategic ambition and disciplined execution will elevate their organizations above their competitors. By paying attention to the quality of their data, aligning technical priorities with critical business goals, and instituting strong governance and cybersecurity, they will set a higher standard for what Canadian competitiveness looks like in the years ahead.

To learn more, read the full whitepaper: The Top 8 Execution Imperatives for Canadian Tech Leaders.

Salesforce customers more than doubled their agentic workforces year on year, according to the company’s second annual Agentic Enterprise Index, which looks at trends in AI agent development and deployment over the past five quarters.

It compiled data from customers who had activated agents in production every month of the analysis period to determine how their use of the technology has evolved between February 2025 and April 2026, as well as incorporating data from May 2026 Salesforce research studies.

It found that businesses grew their agentic workforces from an average of five agents in February 2025 to 13 by April 2026, a 7% compound monthly growth rate (CMGR). In April 2026, it only took an average of 1.9 days to deploy an agent into production, a 53% decrease since the beginning of the report period.

Not only were agents deployed more quickly, they have been progressively taking on more work once in use; over the 15 months, the average number of actions per account had a CMGR of 31%.

“These agents are expanding beyond their initial scope to really become cross-functional,” said Caila Schwartz, Salesforce’s head of agentic commerce insights, during a media briefing.

Salesforce has attempted to measure how much work agents perform, rather than how many tokens they consume, creating its own Agentic Work Unit (AWU) metric, although analysts have criticized the measure as being unrelated to business outcomes. Nevertheless, Salesforce said that as of April, Agentforce agents had performed 734 million AWUs, a number growing at about 15% each month.

The research also showed that agents are acting across multiple cloud domains which, the company said, “underscores the practical necessity of a headless architecture. By decoupling the agent’s logic from traditional front-end user interfaces, agents can process tasks, execute actions, and trigger workflows anywhere.”

Within the company, Salesforce itself has seen explosive growth in AI agent use, said Joe Inzerillo, president of enterprise & AI technology at Salesforce, with a threefold increase in sessions between February 2025 and April 2026. He said that the AI agent in Slack, Slackbot, saves the average employee five hours per week, with 83% of the company having adopted it.

But Schwartz pointed out that different industries are approaching agentic AI in different ways, some more sophisticated than others. To measure that, Salesforce developed a Sophistication Index, a five-point scale scoring the cognitive complexity of an agent’s actions. Levels 1- 3  are assigned to tasks such as record lookups, drafting emails, or summarizing documents, while levels 4 and 5 include more complex functions such as updating database fields.

The data showed that manufacturing, financial services, and healthcare and life sciences have built more sophisticated agent networks than what it called traditional AI frontrunners such as technology and retail.

However, Inzerillo said, the most common use case industry wide, and the best place to start, is the service use case, which provides “far and away the best ROI to start with.”

He also noted that, as people have become more conscious of what agents can do, they are asking agents to perform tasks, rather than simply answer questions.

“Now what you’re starting to see people do is very action oriented. So instead of asking ’how do I file a form to request my vacation’ from our employee agent, they’re telling the employee agent, ‘hey I’m taking a vacation, you need to enter this form for me, and here’s the details,’” he said, adding that this bias towards action represents the evolution of agentic use.

There’s something very attractive about saying “we embed very closely with our customers and just figure it out with them”, especially since the company that started “forward deploying engineers” is growing 84% with $5B+ revenue. But “forward deployed engineer” is a vague term and means different things depending on the business you’re running.

I spent almost 5 years at Palantir as a forward-deployed software engineer, and Palantir’s version of an “FDE” does not make sense for most companies I now meet as an early-stage VC. Depending on the type of business you’re building, this role could broadly mean one of two things: “the product builder” or “the platform operator.” Clearly defining which bucket you fall into will make it easier to hire for this role and run your FDE org.

The product builder: The OG Palantir version

The north star is: do whatever it takes to actually solve the user’s problem. FDEs are not just responsible for making the platform work, but also discovering what to build and building it (actually creating software) in service of the customer.

The platform operator: Solutions + technical customer success

The north star is: make the product work for the customer – deploy and operationalize it. This is what most startups today really mean when they want FDEs. FDEs here configure the core platform, manage account relationships and drive adoption. This is not new – companies have always had solutions engineers, sales engineers, customer success etc., although the work looks different as FDEs are increasingly building prototypes, configuring evals and building MCPs.

Which FDE is right for you

For most situations, hiring product builder FDEs is a mistake.

At scale, the FDEs should be the platform operator. It’s hard to have FDEs build and maintain highly custom product features, especially as the company scales. Over time, the custom product surface area distracts from building the core product, even though AI coding tools make it easy to ship new features quickly and maintain them.

Many fast-growing AI startups recognize these constraints and structure the FDE role more like the platform operator. This also allows them to have 5-10 accounts per FDE, which is a much higher ratio than Palantir had (at least in 2023). Even the Palantir FDE role has evolved to look more like the platform operator.

There are, however, situations when your FDEs should be the product builder archetype.

1. You have very large customers (F500 scale)

Technical complexity: Large customers have complex environments with legacy infrastructure that often requires “out-of-platform” engineering work. I often encountered bespoke data infrastructure, privacy requirements, etc. at various Palantir customers that required me to build “out-of-platform” connectors, UIs and backends.

Organizational inertia and trust: Serving large enterprises is about building trust. In short time periods, overfitting product to a specific user/workflow is often what delivers the most value, builds trust and helps organizations get over the inertia of moving away from Excel and legacy software tools that are part of their day-to-day workflow. For AI-native startups, it’s arguably even more important to invest in doing “unscalable” development with engineering boots on the ground, as it helps solidify your right to exist and eventually expand the customer relationship.

2. You have many ICPs and workflows

If you have a broad range of ICPs and workflows that you serve, your product probably is not walk-up usable on day 1 of deployment. The short-term hacky things that product builder FDEs build to make the product work for these heterogeneous users/workflows will help you shape the product long-term.

Note: see Palantir Foundry’s architecture here.

This was a big reason why Palantir FDEs were more like product builders (and are still able to – see the Forward Deployed Software Engineer job profiles as an example). The vision for Foundry was to be the operating system for an enterprise’s critical decisions – inherently multiple industries, users and workflows. A lot of FDE-led development showed that solving many of these use cases required complex data integrations, which led to the early versions of Foundry being best-suited for complex data integrations and building a customer’s “Ontology”. Similarly, FDEs like myself built custom frontend applications for fraud analysis, pricing, etc. As certain patterns of what these applications required became more clear, they were centralized into an application-layer product.

Who you should hire

Platform operator: There is a much broader set of people you could hire, testing for technical fluency (e.g., being good at data analysis, complex Excel work, even SQL), product intuition and an inclination to build customer relationships. Backgrounds like technical customer success, solutions engineering, software engineering, product management and consulting are all strong fits.

Product builder: You want candidates that are high ownership and missionary software engineers, or technical PMs who want to ship products themselves.

Hiring for these profiles, especially product builders, is hard. It’s worth calling out two things that helped Palantir hire software engineers into what might be considered a less sexy role.

1. Culture of building at the edge: Strong engineers are motivated to build things. Palantir gave FDEs a lot of ownership to build products, which is why much of the core product leadership was former FDEs.
2. Cult built around mission: Internally, there was a cult-like devotion to the mission. Everyone always talked about why outcomes were far more important than software, and why most companies building tools had it wrong. I’ve never been at a company where people feel so closely bonded around a mission.

As founders building AI startups think about hiring FDEs, it’s worth being specific about your culture and asking: Am I just hiring people to support development teams, or am I hiring people to shape and build product? It’s hard to get software engineers (even today) to be excited about an FDE role that might just be technical customer success.

What FDEs should be doing (regardless of archetype)

You’ve hired the right people. How do you best leverage your team of FDEs?

FDEs were Palantir’s way of delivering outcomes rather than tools. AI-native startups can take this much further and FDEs can help in a few unique ways by leveraging their proximity to customers.

1. Find the most critical workflows: As AI lowers the cost of producing software, companies will face a lot more competition. FDEs at AI startups should be constantly finding ways to serve the most critical workflows for a customer and paying attention to how customers do work across newer and legacy tools. For example, FDEs at Harvey should pay attention to which workflows are in Westlaw, which ones are moving to ChatGPT/Claude, and how the Harvey product can stay ahead.
2. Build around nondeterminism: In more regulated environments, FDEs should be hyper-focused on making products reliable for specific use cases using evals and configs. Previously, product reliability lived with product and support. As companies provide outcomes instead of tools, configuring products appropriately and managing evals shifts towards FDE teams.

As enterprises look for ways to cut the cost of running AI models in production, AMD is betting that not every AI workload will be best served by a power-hungry general-purpose GPU.

AMD has agreed to buy Taalas, the Canadian designer of chips that permanently embed a trained AI model’s weights into custom silicon, instead of repeatedly loading them from memory during inference as conventional GPUs do.

Taalas says its approach reduces the time and power required to move model weights between memory and compute units, making things run faster and cheaper.

The result is a highly specialized inference processor optimized for one model, trading the flexibility of programmable hardware for substantially higher throughput and energy efficiency.

Operational tradeoffs

While AMD is planning to integrate the chips into its Instinct GPU roadmap, targeting system-level AI inference solutions in data centers, analysts remain skeptical that enterprises will readily embrace hardware tied to a specific AI model.

Enterprises would, effectively, be buying a chip and a model together because unlike GPUs, which can be repurposed to run different AI models through software updates, Taalas’ chips are tied to a specific trained model, meaning they would need different hardware to support different inference tasks, said Amit Kumar Jena, AI development manager at IT Consulting firm Kanerika.

Or as Forrester Principal Analyst Charlie Dai put it, “The biggest risk is inflexibility.”

The requirement to swap hardware in order to swap tasks would, Dai said, introduce new challenges with costs, governance, capacity planning, lifecycle management, and supplier dependency, especially for enterprises managing multiple AI workloads.

Manoj Chandra Jha, principal analyst at Nord-IQ Research, said the risk of fusing chip and model into one component is larger than one might think, as “early model obsolescence strands both together, so this should be modeled as one shorter-lived asset rather than two independently amortized ones.”

Taalas says it can update a model by modifying only two metal layers of the chip rather than redesigning it from scratch, but that will only apply to chips that haven’t yet left its factory, not those already in use.

That means enterprises will still need to plan for hardware refresh cycles measured in weeks or months and retain programmable GPUs for workloads that evolve frequently, said Pareekh Jain, principal analyst at Pareekh Consulting.

It also means, said Jha, that what is typically a software decision becomes one about capital expenditure for Taalas customers, as replacing or switching workloads or models could require investing in new hardware rather than simply updating software.

Where model-specific silicon fits

Those tradeoffs significantly narrow the range of enterprise workloads where model-specific silicon is likely to make economic sense.

Dai sees the technology as best suited for mature, predictable inference workloads that run at massive scale and rely on relatively stable AI models, such as customer service automation, fraud detection, industrial computer vision, network operations, edge AI, and embedded copilots.

For CIOs, that effectively limits model-specific silicon to a small subset of enterprise AI deployments, rather than a wholesale replacement for GPU infrastructure, he said. “GPUs will remain the preferred enterprise platform because most enterprises value flexibility, multi-tenancy, and rapid model evolution over maximum efficiency.”

This article first appeared on Network World.

Business application development is entering a new operating model. The traditional approach of gathering requirements, designing screens, writing services, integrating systems, testing, fixing defects and preparing release documentation still exists, but it is no longer sufficient for enterprises that need speed, traceability, resilience and regulatory confidence at the same time. Hyperautomation brings a broader discipline to this challenge. It combines workflow orchestration, intelligent document processing, robotic automation, API-led integration, process mining, test automation, observability and artificial intelligence into a connected delivery fabric. With embedded Generative AI, this fabric becomes more adaptive because applications can interpret natural language, summarize complex data, generate explanations, detect exceptions and support decision workflows rather than merely execute predefined rules.

In banking, this shift is especially meaningful. Banks operate across dense application landscapes: trade reporting platforms, wealth management portals, core banking systems, investment banking applications, digital compliance engines, reconciliation utilities, operational dashboards, audit repositories and daily, weekly and monthly reporting platforms. Each of these areas has its own data models, control points, integration patterns, validation rules, exception paths and regulatory obligations. Hyperautomation does not replace engineering discipline; it strengthens it by making business intent, technical execution, control evidence and continuous improvement part of the same lifecycle.

From automation to hyperautomation in banking applications

Automation usually addresses a specific task: moving data from one system to another, generating a report, running a batch job or validating a transaction against a rule. Hyperautomation goes further. It looks at the complete business outcome and asks how the entire chain can be streamlined, governed, observed and improved. For example, a trade reporting process may begin with transaction capture, enrich the trade with reference data, validate regulatory fields, identify breaks, generate a submission file, transmit it to a regulator or trade repository, monitor acknowledgements and preserve audit evidence. A narrow automation script may accelerate one step, but a hyperautomated design coordinates the complete flow, including exception handling and evidence generation.

Figure: Automation vs. hyperautomation

Embedded Generative AI adds a new layer of intelligence. Instead of forcing every user interaction into rigid screens and codes, business applications can accept natural language prompts, interpret document content, summarize cases, generate draft responses, explain anomalies, produce test scenarios and create release notes. In a banking environment, this intelligence must be carefully bounded. Every AI-assisted action should be traceable, explainable, reviewable and aligned with data privacy, model risk, information security and regulatory expectations. The goal is not uncontrolled autonomy; the goal is governed acceleration.

Banking application components suitable for hyperautomation

A modern banking application is rarely a single monolithic system. It is a composition of business capabilities, integration services, workflow engines, data pipelines, user experience layers, analytics models, control dashboards and audit stores. Hyperautomation can accelerate the development and integration of these components by turning repetitive engineering work into reusable patterns and by embedding intelligence directly into business processes.

• Trade reporting applications: Generative AI can help map trade attributes to regulatory fields, explain validation failures, summarize rejected submissions and generate test cases for reporting scenarios. Hyperautomation can orchestrate enrichment, validation, submission, acknowledgement tracking and evidence archival.
• Wealth management platforms: Advisors can use embedded AI to summarize client portfolios, generate suitability narratives, identify missing documents and prepare personalized investment review notes. Automation can coordinate onboarding, risk profiling, document verification, portfolio rebalancing workflows and client communication approvals.
• Core banking applications: Account opening, loan servicing, deposits, payments, interest calculations and customer maintenance can benefit from automated validations, intelligent forms, workflow routing and natural language assistance for operations teams. AI can explain account events or transaction exceptions in plain language.
• Investment banking systems: Deal pipelines, research workflows, underwriting processes, trade lifecycle functions and risk calculations require strong coordination across front-office, middle-office and back-office platforms. Hyperautomation can standardize approvals, documentation, exception resolution and control evidence across these stages.
• Digital compliance applications: Compliance teams can use AI to summarize policy obligations, compare regulatory changes with internal controls, classify alerts, draft investigation notes and produce evidence packs. Automation ensures routing, approvals, segregation of duties, audit trails and regulatory reporting timelines are consistently enforced.
• Reconciliation platforms: AI can assist in matching narratives, explaining breaks, clustering exception patterns and suggesting resolution actions. Hyperautomation can pull data from ledgers, statements, payment processors, trading systems and data warehouses, then route unresolved breaks to the right teams.
• Reporting and audit applications: Daily, weekly and monthly reports can be generated through controlled data pipelines, automated quality checks, narrative generation, variance explanations and approval workflows. Audit applications can preserve lineage, approvals, source extracts, model outputs and control attestations.

Embedded generative AI as an application capability

Embedding Generative AI into business applications should be treated as an architectural capability, not as a decorative chatbot. A banking application may use AI for search, summarization, reasoning support, content generation, code generation, policy interpretation or anomaly explanation. Each use case requires clear boundaries. The application must know which data the model can access, which actions require approval, what evidence must be captured and where deterministic controls must override probabilistic suggestions.

For example, in trade reporting, an embedded AI assistant can explain why a transaction failed validation and suggest likely fields to review. However, the final correction should pass through rule-based validations, maker-checker approval and audit logging. In wealth management, AI may draft a client review note based on portfolio movements and risk profile, but the advisor must verify suitability, disclosures and final communication. In reconciliation, AI can propose likely matches or categorize break reasons, while the system preserves the original data, confidence score, reviewer action and final resolution path.

Hyperautomating the product development lifecycle

The Product Development Lifecycle can itself become hyperautomated. Instead of treating ideation, analysis, design, development, testing, security review, release and operations as disconnected phases, enterprises can create an AI-assisted delivery loop where every stage produces structured artifacts that the next stage can consume. Platforms such as GitHub Copilot, Claude Code or Claude Cowork-style agentic development environments and OpenAI Codex can support this movement by helping teams reason over requirements, generate code, create tests, review changes, modernize legacy modules and produce documentation. Their value increases when they are connected to repositories, issue trackers, design documents, build pipelines, test suites, security scanners, observability data and enterprise knowledge bases.

PDLC Stage	Hyperautomation Opportunity	AI-Assisted Outcome
Business discovery	Process mining, domain interviews, regulatory mapping, backlog creation	Structured epics, user stories, acceptance criteria, process maps and control requirements
Architecture and design	Reference architectures, API contracts, data models, event flows, security patterns	Architecture options, integration blueprints, threat-model prompts and design decision records
Development	Code generation, service scaffolding, UI component creation, data pipeline templates	Review-ready code increments, reusable components, migration utilities and integration adapters
Testing	Unit, integration, regression, performance, compliance and synthetic data testing	Generated test cases, defect reproduction steps, test automation scripts and coverage summaries
Security and compliance review	Static analysis, dependency checks, policy validation, evidence capture	Risk explanations, remediation suggestions, control traceability and approval evidence
Release and deployment	CI/CD orchestration, environment promotion, release notes, rollback preparation	Automated deployment packs, release summaries, operational checklists and change records
Operations and feedback	Observability, incident analysis, user feedback mining, backlog refinement	Incident summaries, root-cause hypotheses, improvement stories and reliability recommendations

Role of GitHub Copilot, Claude Cowork and Codex

GitHub Copilot is useful where developers need assistance inside the engineering flow: explaining code, generating functions, proposing tests, reviewing pull requests and helping teams move from issue to implementation. In a banking PDLC, it can accelerate microservice creation, API integration, batch processing logic, reconciliation rules, regulatory validation routines and UI workflows. When used with repository context and proper review discipline, it can reduce the time developers spend on repetitive coding while preserving human accountability for design and correctness.

Claude Cowork or Claude Code-style agentic environments are valuable for multi-file reasoning, refactoring, debugging and documentation-heavy engineering work. Banking applications often contain deep domain logic scattered across services, configuration files, stored procedures, integration scripts and test suites. An agentic coding assistant that can understand a wider codebase context can help engineers analyze dependencies, prepare modernization plans, update multiple files coherently and draft explanations for reviewers. This is particularly useful in core banking modernization, trade reporting rule updates and compliance workflow refactoring.

OpenAI Codex can support issue-to-pull-request workflows, test generation, code review, bug reproduction, migration activities and broader software engineering tasks across the lifecycle. In a hyperautomated PDLC, Codex-like agents can be assigned well-scoped work items, asked to inspect failing tests, propose fixes, create regression coverage and summarize the change for human reviewers. The important design principle is to keep agents inside controlled boundaries: clear prompts, repository permissions, test gates, approval workflows and traceable outputs.

Integration architecture for hyperautomated banking applications

A practical architecture begins with business capability decomposition. Each banking domain should be expressed as a set of bounded capabilities such as customer onboarding, account maintenance, trade enrichment, exception management, portfolio review, control attestation, report generation and audit retrieval. These capabilities should be exposed through APIs, events, workflow tasks, data products and user interfaces. Hyperautomation then connects these capabilities using orchestration engines, event streams, rules engines, AI services, RPA connectors where legacy integration is unavoidable and observability layers that capture business and technical telemetry.

The embedded AI layer should sit behind a secure application service boundary. It should use retrieval-augmented generation where approved policies, product rules, application documentation and regulatory mappings are retrieved from trusted sources. It should avoid uncontrolled exposure of sensitive customer information. Prompt templates, response validation, redaction, grounding checks, model monitoring and human-in-the-loop approval should be part of the production design. In banking, the most successful AI pattern is often not full automation but assisted decisioning with strong controls.

Example: Hyperautomated reconciliation and reporting flow

Consider a reconciliation application that compares ledger balances, payment files, trade settlement records and external statements. In a conventional model, operations teams spend significant time downloading files, running macros, investigating mismatches, documenting break reasons and preparing status reports. In a hyperautomated model, data ingestion is scheduled and monitored, schema checks run automatically, matching engines classify obvious matches, AI assists with ambiguous narratives, exceptions are routed through workflow queues and dashboards update in near real time. At the end of the day, the system can generate a draft operations report explaining unresolved breaks, aging trends, risk exposure and pending approvals.

The same pattern can extend to daily, weekly and monthly reporting. Data quality rules validate inputs, report templates are populated automatically, AI generates narrative commentary on variances, reviewers approve or amend explanations and the final report is archived with lineage and approvals. Audit teams can later retrieve not only the report but also the source extracts, transformation logs, exception history, reviewer decisions and AI-generated drafts. This creates a richer control environment than manual reporting because evidence is captured by design rather than reconstructed later.

Governance, risk and control considerations

Hyperautomation in banking must be designed with governance from the beginning. The development team should define which activities can be automated, which can be AI-assisted and which must remain under human approval. Source code generated by AI must pass normal engineering controls, including peer review, static analysis, dependency scanning, secure coding checks, test execution and production readiness review. Business outputs generated by AI, such as compliance narratives or client-facing explanations, should be reviewed where regulatory or reputational risk is material.

Data governance is equally important. AI-enabled applications must respect data classification, residency, retention, masking and access policies. The model should not become an uncontrolled channel through which confidential customer, trading or employee information can leak. Every prompt, retrieved source, generated response, user action and final decision may need to be logged depending on the use case. For audit applications, this traceability is not optional; it is the foundation of trust.

Operating model for AI-native PDLC

A hyperautomated PDLC requires changes in team behavior. Product owners should write requirements in a structured manner so that AI tools can generate better stories, acceptance criteria and test scenarios. Architects should maintain living decision records, reference patterns and integration standards that AI agents can use as context. Developers should learn prompt discipline, context packaging and review techniques. Test engineers should focus on coverage strategy, synthetic data, compliance scenarios and defect prevention rather than only manual execution. Operations teams should feed incident learnings back into the backlog so the system improves continuously.

The role of human experts becomes more important, not less. AI can draft, generate, compare and suggest, but domain judgment remains essential. A trade reporting specialist understands regulatory nuance. A wealth advisor understands client suitability. A core banking architect understands transaction integrity. A compliance officer understands control interpretation. Hyperautomation works best when it amplifies these experts and removes repetitive friction around them.

Conclusion

Hyperautomation in business application development is not simply a faster way to write software. It is a new way to connect business intent, engineering execution, operational control and continuous learning. In banking, where applications must be reliable, explainable, secure and compliant, the combination of embedded Generative AI and disciplined automation can transform how applications are designed, built, integrated, tested, released and operated. Trade reporting, wealth management, core banking, investment banking, compliance, reconciliation, reporting and audit functions can all benefit when AI is embedded responsibly and automation is orchestrated across the complete lifecycle.

Platforms such as GitHub Copilot, Claude Cowork or Claude Code and OpenAI Codex can play an important role in this transformation by accelerating analysis, development, testing, review, modernization and documentation. Their greatest value appears when enterprises treat them not as isolated productivity tools but as part of a governed, AI-native PDLC. The future of banking application development will belong to teams that can combine human expertise, reusable engineering patterns, intelligent automation and strong governance into one coherent delivery model.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

Samsung Electronics has unveiled a trio of next-generation memory technologies aimed at overcoming the performance, power and capacity limitations facing artificial intelligence infrastructure.

The announcements, made at the Future of Memory and Storage (FMS) conference, introduced new concepts for vertically integrated memory along with a breakthrough NAND architecture designed for the AI era.

The three new memory types have one thing that unites them: they all use wafer bonding. Wafer bonding is a semiconductor manufacturing process technique in which two or more completed silicon wafers are permanently joined together to form a single integrated device, the vendor stated.

Instead of fabricating every component on one wafer, manufacturers build different parts separately, then align and bond them with extremely high precision. Think of it as a high-tech Oreo cookie.

Wafer bonding is significant because it represents one of the few remaining ways to continue scaling semiconductor devices after conventional manufacturing techniques begin to hit physical and economic limits. It enables much higher memory density as more memory is squeezed into the same 2D space, according to the company.

It also allows different manufacturing processes to be combined, so wafer bonding lets companies use the optimal manufacturing process for each wafer independently before joining them. Samsung said the new manufacturing technique fabricates the memory cell array and peripheral circuitry separately before bonding them together.

It is already being used now in NAND flash memory for 3D stacking. Rather than spread the memory circuits out, they are stacked on top of each other like stories on a high-rise building. The technique was first introduced in 2014, with 24-layer NAND flash period last year it broke the 300-layer mark.

The centerpiece of the announcement was BV-NAND, or Bonding V-NAND, Samsung’s next-generation flash memory architecture that employs wafer-bonding. The company said the technology enables NAND devices with more than 400 layers while boosting storage density by approximately 58% compared with its current V9 generation, Samsung stated.

The company said the architecture also improves read, write and input/output performance while reducing power consumption, making it better suited for AI servers that increasingly depend on high-capacity flash storage.

Beyond BV-NAND, Samsung outlined two longer-term memory concepts that could radically alter AI system architecture. The first, dubbed zHBM, calls for stacking HBM memory on top of the AI accelerator rather than alongside processors, as is done today.

This shortens the distance data must travel between processor and memory. Samsung said the design could dramatically increase bandwidth while reducing power consumption and thermal resistance.

The company estimates that combining the architecture with wafer-bonding technology could ultimately deliver more than ten times the memory density of conventional HBM5 while tripling energy efficiency and cutting thermal resistance by more than half.

But don’t plan for deployment just yet. zHBM is still a research concept. It illustrates how memory manufacturers are increasingly looking too 3D designs to continue scaling as traditional 2D packaging becomes more difficult.

Samsung also introduced zNAND-O, another conceptual architecture designed to extend three-dimensional memory beyond conventional NAND implementations. Details were scant but Samsung did say zNAND-O was a next-generation high-performance NAND solution built on its V-NAND technology and in development in four- and eight-layer versions.

The technologies reflect how the industry is being driven by AI, and that AI concerns are driving chip development. HBM Has emerged as an important component of AI computation, but very quickly the industry hit limitations in terms of bandwidth and speed. The proposed technologies above reflect Samsung’s attempts to alleviate the bandwidth problem.

As Europe swelters in a heatwave, residents probably don’t want to hear about ways to make their homes even hotter, but that’s what Polish property developer Citylink is talking about, with plans to dump waste heat from a new data center in Wrocław into the municipal district heating network.

Citylink is designing the data center so that heat from servers can be recovered instead of being dissipated via cooling systems — and as the data center grows, any increase in computing power will mean more energy available for recovery.

The collaboration with local power company Kogeneracja will provide “valuable experience in designing and operating modern data centers, with a particular focus on infrastructure dedicated to AI nodes,” said Michał Starybrat, development director at Citylink.

“The dynamic growth of the artificial intelligence and cloud technology markets generates unprecedented demand for computing power, this collaboration demonstrates how modern digital infrastructure can actively contribute to building the energy ecosystem of the future,” he added.

This type of initiative is not new. There have been similar projects in the UK and in New Zealand, but with warnings that data centers are contributing to the warming of the planet, there may well be a lot more organizations looking to deploy that excess heat more fruitfully in the future.

However, announcing it during a heatwave may not be the most politically sensitive approach to take.

As enterprises look for ways to cut the cost of running AI models in production, AMD is betting that not every AI workload will be best served by a power-hungry general-purpose GPU.

AMD has agreed to buy Taalas, the Canadian designer of chips that permanently embed a trained AI model’s weights into custom silicon, instead of repeatedly loading them from memory during inference as conventional GPUs do.

Taalas says its approach reduces the time and power required to move model weights between memory and compute units, making things run faster and cheaper.

The result is a highly specialized inference processor optimized for one model, trading the flexibility of programmable hardware for substantially higher throughput and energy efficiency.

Operational tradeoffs

While AMD is planning to integrate the chips into its Instinct GPU roadmap, targeting system-level AI inference solutions in data centers, analysts remain skeptical that enterprises will readily embrace hardware tied to a specific AI model.

Enterprises would, effectively, be buying a chip and a model together because unlike GPUs, which can be repurposed to run different AI models through software updates, Taalas’ chips are tied to a specific trained model, meaning they would need different hardware to support different inference tasks, said Amit Kumar Jena, AI development manager at IT Consulting firm Kanerika.

Or as Forrester Principal Analyst Charlie Dai put it, “The biggest risk is inflexibility.”

The requirement to swap hardware in order to swap tasks would, Dai said, introduce new challenges with costs, governance, capacity planning, lifecycle management, and supplier dependency, especially for enterprises managing multiple AI workloads.

Manoj Chandra Jha, principal analyst at Nord-IQ Research, said the risk of fusing chip and model into one component is larger than one might think, as “early model obsolescence strands both together, so this should be modeled as one shorter-lived asset rather than two independently amortized ones.”

Taalas says it can update a model by modifying only two metal layers of the chip rather than redesigning it from scratch, but that will only apply to chips that haven’t yet left its factory, not those already in use.

That means enterprises will still need to plan for hardware refresh cycles measured in weeks or months and retain programmable GPUs for workloads that evolve frequently, said Pareekh Jain, principal analyst at Pareekh Consulting.

It also means, said Jha, that what is typically a software decision becomes one about capital expenditure for Taalas customers, as replacing or switching workloads or models could require investing in new hardware rather than simply updating software.

Where model-specific silicon fits

Those tradeoffs significantly narrow the range of enterprise workloads where model-specific silicon is likely to make economic sense.

Dai sees the technology as best suited for mature, predictable inference workloads that run at massive scale and rely on relatively stable AI models, such as customer service automation, fraud detection, industrial computer vision, network operations, edge AI, and embedded copilots.

For CIOs, that effectively limits model-specific silicon to a small subset of enterprise AI deployments, rather than a wholesale replacement for GPU infrastructure, he said. “GPUs will remain the preferred enterprise platform because most enterprises value flexibility, multi-tenancy, and rapid model evolution over maximum efficiency.”

Demis Hassabis, the driving force behind Google DeepMind, is ascending to the role of chief scientist at Alphabet, Google’s parent company, replacing Jeff Dean who is leaving to work at a start-up.

The role will enable Hassabis to “put his full attention on actively shaping the future of AGI,” or artificial general intelligence, Alphabet CEO Sundar Pichai wrote on the company’s Inside Google blog.

Hassabis’ attention will still be divided, however: He will continue to lead research at Google spin-off Isomorphic Labs, which works on drug discovery, and although he will no longer be CEO of DeepMind, he will be its chair. Koray Kavukcuoglu will take over DeepMind, reporting directly to Pichai. He is currently its CTO.

Hassabis has been a strong promoter of AGI, defined by Google as the “hypothetical intelligence of a machine that possesses the ability to understand or learn any intellectual task that a human being can.”

He has a long career in AI, having helped found DeepMind in 2010. He has been a prominent figure in the AGI field, prophesying in May that it will be a viable technology within three years. He has been keen to tackle any barriers in the way of developing the technology; just last month, he called for greater self-regulation in the market, arguing that it would help drive the technology forward.

Hassabis welcomed the chance to focus on AGI development. “We have arrived at a pivotal moment in human history. I’ve been working towards AGI my whole life, and now, I feel it is close at hand. It’s critical that we collectively get the next steps right to ensure this all goes well for humanity and we usher in an incredible new age of discovery and wonder” he wrote in the Inside Google blog post.

It’s no secret that the CIO role is changing in Canadian enterprises. Driving operational performance and increasing efficiency are, of course, still a big part of the job. But CIOs are now expected to do more than cut costs and keep the lights on. Increasingly, boards of directors expect the CIO to play a key role in creating value and enabling their organizations to outperform their rivals. Recent data backs this up. The overwhelming majority (91%) of Canadian technology leaders believe advanced technology will be the primary driver of competitive advantage over the next three years, according to KPMG’s “The 8 execution imperatives for Canadian tech leaders,” a white paper based on the firm’s 2026 Global Tech Report.

The race to capture value from emerging technologies has intensified, leaving little room for organizations that remain on the sidelines. Yet in Canada, just 27% of organizations consider themselves innovators or early adopters, while 72% are fast or slow followers. Nearly all (85%) believe they’ll need to take more risks with emerging technologies just to remain relevant.

The traditional, operational-first mindset among CIOs has become a liability. CIOs are expected to be strategic players, but meeting that expectation requires taking thoughtful, well-considered action across key imperatives.

AI success depends on data

AI is not the only advanced technology that organizations are working to deploy, but it’s certainly garnering the most attention from C-suite executives, boards of directors, and investors. To enable AI at scale, the data foundations enterprises have built over the past decade will be necessary, but they are not sufficient on their own. CIOs must make modernizing the state of enterprise data a top priority.

In most large organizations, data often remains locked inside legacy systems where the system of record is also the system of engagement, and that significantly limits accessibility for AI workloads. Data should be treated as the strategic asset that it has become. The quality, timeliness, and governance of that data vary widely, and reconciling those inconsistencies is one of the most persistent barriers to enterprise-level deployment.

Scaling pilots into enterprise programs also requires closing the gap between AI-native talent, who have the skills to move quickly, and those with deep institutional knowledge, who understand how their organizations work and what they need to achieve. These two groups must work hand in hand. Otherwise, organizations may accelerate toward the wrong goals, which won’t move the business forward.

“The barriers to scaling AI aren’t just technical,” says Sanjay Pathak, partner and national leader, technology strategy and digital transformation services, KPMG Canada. “CIOs need to truly and deeply understand the value chain of what their organizations do. Those who get there will have the imagination, the courage, and the foresight to use AI to transform their organizations.”

Communicating ROI requires the right framing

Beyond scaling, simply communicating the value of AI also poses a significant challenge. Just over half (53%) of Canadian organizations surveyed say they struggle to demonstrate or communicate AI value to stakeholders. Part of the problem is that CIOs are making the wrong argument in the wrong room because they’re framing ROI as a technology metric rather than a business outcome.

“Any CIO who doesn’t truly understand what their business does is missing a beat around how innovation is going to help the organization achieve ROI,” says Pathak. “Understanding how to deploy AI inside your value chain will give you a head start and a competitive advantage in unlocking real business benefits.”

A formal performance measurement framework that tracks customer experience, revenue growth, and employee adoption alongside cost metrics gives CIOs a far more accurate picture of long-term value. Linking funding decisions to those strategic outcomes makes sustained investment easier to justify.

There is also a compliance dimension that often goes unacknowledged in these conversations. CIOs who bring business, technology, and compliance leaders together to design innovative processes that are “compliant by design” from the start are protecting future value as much as they are delivering value today.

“You need to assemble that multi-dimensional cohort of business, technology, risk, and compliance leaders at the same table, envisioning compliance by design,” says Pathak. “The winners in this space are going to be the ones who really think about business ambition holistically and focus on efficient delivery, operations, and compliance.”

Building disciplined innovation governance

An organization’s approach to governance makes an enormous difference in how quickly and confidently it can deploy and take advantage of advanced technologies. As noted above, almost three-quarters (72%) identify as fast or slow followers, and 85% say they need to move more aggressively to embrace new technologies. Canadian organizations aren’t lacking ambition. What they lack are the conditions required to innovate with confidence: clear ownership, defined risk thresholds, and shared accountability between technology, risk, and business teams.

“You can be an innovator, but if your innovation is not directly connected to strategic business ambition and safety guardrails such as risk management, governance, and compliance, you’re creating labware,” says Pathak. “Being an early adopter means you’re comfortable with the technology. To make it truly viable, you must embrace all dimensions of enterprise value.”

Strong governance does not slow innovation down but instead provides a structure that builds confidence and resilience at every level of the organization, from the board to project teams. A tiered governance approach that takes risk into account allows organizations to advance low-risk, incremental improvements and high-reward initiatives in parallel.

Expanding partnerships to accelerate innovation

Innovation isn’t a single-player game, and Canadian organizations know it. Ninety-seven percent of respondents say they plan to expand their external ecosystems. To date, a significant portion of those relationships have been transactional and focused on a specific capability or problem. But savvier organizations are moving toward multi-party innovation, where partners pool capabilities to share both risk and reward. This model requires a different kind of commitment because organizations are betting on a partner’s long-term viability, not just their current capability. Together, they must build the integration and governance infrastructure that makes these ecosystems work for all participants.

“Moving to multi-party innovation ecosystems is an investment in integration and data,” says Pathak. “If you’re going to look at best of breed and stitch those together, what must be true for that to work is the ability for those different ecosystems to integrate and interoperate. And that creates a much stronger need for safety and governance.”

Cybersecurity is another dimension that grows more important with every new partner added to the ecosystem. Security should be proactively built in, not imposed after a breach has already occurred.

“The more ecosystem-based partnerships you have, the more opportunity you create along with the threat you have to deal with,” says Pathak. “You expand the attack surface, and you become more of a target, so governance and cybersecurity must be designed in from the start, not bolted on later.”

Canadian government incentives, including Scientific Research and Experimental Development (SR&ED) tax credits and AI-focused clusters, offer a way to share some of the cost and risk, particularly during periods of economic uncertainty.

By leveraging these funding frameworks alongside robust ecosystem governance, forward-thinking organizations can safely scale their networks to turn shared risks into sustainable competitive advantages.

In closing

For organizations navigating this environment, KPMG Canada emphasizes that the most consequential decisions ahead are not purely, or even mostly, technical. They are about how CIOs choose to lead, partner, measure, and govern in a period that rewards both ambition and discipline in equal measure.

The data points are clear. CIOs who lead with both strategic ambition and disciplined execution will elevate their organizations above their competitors. By paying attention to the quality of their data, aligning technical priorities with critical business goals, and instituting strong governance and cybersecurity, they will set a higher standard for what Canadian competitiveness looks like in the years ahead.

To learn more, read the full whitepaper: The Top 8 Execution Imperatives for Canadian Tech Leaders.

Salesforce customers more than doubled their agentic workforces year on year, according to the company’s second annual Agentic Enterprise Index, which looks at trends in AI agent development and deployment over the past five quarters.

It compiled data from customers who had activated agents in production every month of the analysis period to determine how their use of the technology has evolved between February 2025 and April 2026, as well as incorporating data from May 2026 Salesforce research studies.

It found that businesses grew their agentic workforces from an average of five agents in February 2025 to 13 by April 2026, a 7% compound monthly growth rate (CMGR). In April 2026, it only took an average of 1.9 days to deploy an agent into production, a 53% decrease since the beginning of the report period.

Not only were agents deployed more quickly, they have been progressively taking on more work once in use; over the 15 months, the average number of actions per account had a CMGR of 31%.

“These agents are expanding beyond their initial scope to really become cross-functional,” said Caila Schwartz, Salesforce’s head of agentic commerce insights, during a media briefing.

Salesforce has attempted to measure how much work agents perform, rather than how many tokens they consume, creating its own Agentic Work Unit (AWU) metric, although analysts have criticized the measure as being unrelated to business outcomes. Nevertheless, Salesforce said that as of April, Agentforce agents had performed 734 million AWUs, a number growing at about 15% each month.

The research also showed that agents are acting across multiple cloud domains which, the company said, “underscores the practical necessity of a headless architecture. By decoupling the agent’s logic from traditional front-end user interfaces, agents can process tasks, execute actions, and trigger workflows anywhere.”

Within the company, Salesforce itself has seen explosive growth in AI agent use, said Joe Inzerillo, president of enterprise & AI technology at Salesforce, with a threefold increase in sessions between February 2025 and April 2026. He said that the AI agent in Slack, Slackbot, saves the average employee five hours per week, with 83% of the company having adopted it.

But Schwartz pointed out that different industries are approaching agentic AI in different ways, some more sophisticated than others. To measure that, Salesforce developed a Sophistication Index, a five-point scale scoring the cognitive complexity of an agent’s actions. Levels 1- 3  are assigned to tasks such as record lookups, drafting emails, or summarizing documents, while levels 4 and 5 include more complex functions such as updating database fields.

The data showed that manufacturing, financial services, and healthcare and life sciences have built more sophisticated agent networks than what it called traditional AI frontrunners such as technology and retail.

However, Inzerillo said, the most common use case industry wide, and the best place to start, is the service use case, which provides “far and away the best ROI to start with.”

He also noted that, as people have become more conscious of what agents can do, they are asking agents to perform tasks, rather than simply answer questions.

“Now what you’re starting to see people do is very action oriented. So instead of asking ’how do I file a form to request my vacation’ from our employee agent, they’re telling the employee agent, ‘hey I’m taking a vacation, you need to enter this form for me, and here’s the details,’” he said, adding that this bias towards action represents the evolution of agentic use.

There’s something very attractive about saying “we embed very closely with our customers and just figure it out with them”, especially since the company that started “forward deploying engineers” is growing 84% with $5B+ revenue. But “forward deployed engineer” is a vague term and means different things depending on the business you’re running.

I spent almost 5 years at Palantir as a forward-deployed software engineer, and Palantir’s version of an “FDE” does not make sense for most companies I now meet as an early-stage VC. Depending on the type of business you’re building, this role could broadly mean one of two things: “the product builder” or “the platform operator.” Clearly defining which bucket you fall into will make it easier to hire for this role and run your FDE org.

The product builder: The OG Palantir version

The north star is: do whatever it takes to actually solve the user’s problem. FDEs are not just responsible for making the platform work, but also discovering what to build and building it (actually creating software) in service of the customer.

The platform operator: Solutions + technical customer success

The north star is: make the product work for the customer – deploy and operationalize it. This is what most startups today really mean when they want FDEs. FDEs here configure the core platform, manage account relationships and drive adoption. This is not new – companies have always had solutions engineers, sales engineers, customer success etc., although the work looks different as FDEs are increasingly building prototypes, configuring evals and building MCPs.

Which FDE is right for you

For most situations, hiring product builder FDEs is a mistake.

At scale, the FDEs should be the platform operator. It’s hard to have FDEs build and maintain highly custom product features, especially as the company scales. Over time, the custom product surface area distracts from building the core product, even though AI coding tools make it easy to ship new features quickly and maintain them.

Many fast-growing AI startups recognize these constraints and structure the FDE role more like the platform operator. This also allows them to have 5-10 accounts per FDE, which is a much higher ratio than Palantir had (at least in 2023). Even the Palantir FDE role has evolved to look more like the platform operator.

There are, however, situations when your FDEs should be the product builder archetype.

1. You have very large customers (F500 scale)

Technical complexity: Large customers have complex environments with legacy infrastructure that often requires “out-of-platform” engineering work. I often encountered bespoke data infrastructure, privacy requirements, etc. at various Palantir customers that required me to build “out-of-platform” connectors, UIs and backends.

Organizational inertia and trust: Serving large enterprises is about building trust. In short time periods, overfitting product to a specific user/workflow is often what delivers the most value, builds trust and helps organizations get over the inertia of moving away from Excel and legacy software tools that are part of their day-to-day workflow. For AI-native startups, it’s arguably even more important to invest in doing “unscalable” development with engineering boots on the ground, as it helps solidify your right to exist and eventually expand the customer relationship.

2. You have many ICPs and workflows

If you have a broad range of ICPs and workflows that you serve, your product probably is not walk-up usable on day 1 of deployment. The short-term hacky things that product builder FDEs build to make the product work for these heterogeneous users/workflows will help you shape the product long-term.

Note: see Palantir Foundry’s architecture here.

This was a big reason why Palantir FDEs were more like product builders (and are still able to – see the Forward Deployed Software Engineer job profiles as an example). The vision for Foundry was to be the operating system for an enterprise’s critical decisions – inherently multiple industries, users and workflows. A lot of FDE-led development showed that solving many of these use cases required complex data integrations, which led to the early versions of Foundry being best-suited for complex data integrations and building a customer’s “Ontology”. Similarly, FDEs like myself built custom frontend applications for fraud analysis, pricing, etc. As certain patterns of what these applications required became more clear, they were centralized into an application-layer product.

Who you should hire

Platform operator: There is a much broader set of people you could hire, testing for technical fluency (e.g., being good at data analysis, complex Excel work, even SQL), product intuition and an inclination to build customer relationships. Backgrounds like technical customer success, solutions engineering, software engineering, product management and consulting are all strong fits.

Product builder: You want candidates that are high ownership and missionary software engineers, or technical PMs who want to ship products themselves.

Hiring for these profiles, especially product builders, is hard. It’s worth calling out two things that helped Palantir hire software engineers into what might be considered a less sexy role.

1. Culture of building at the edge: Strong engineers are motivated to build things. Palantir gave FDEs a lot of ownership to build products, which is why much of the core product leadership was former FDEs.
2. Cult built around mission: Internally, there was a cult-like devotion to the mission. Everyone always talked about why outcomes were far more important than software, and why most companies building tools had it wrong. I’ve never been at a company where people feel so closely bonded around a mission.

As founders building AI startups think about hiring FDEs, it’s worth being specific about your culture and asking: Am I just hiring people to support development teams, or am I hiring people to shape and build product? It’s hard to get software engineers (even today) to be excited about an FDE role that might just be technical customer success.

What FDEs should be doing (regardless of archetype)

You’ve hired the right people. How do you best leverage your team of FDEs?

FDEs were Palantir’s way of delivering outcomes rather than tools. AI-native startups can take this much further and FDEs can help in a few unique ways by leveraging their proximity to customers.

1. Find the most critical workflows: As AI lowers the cost of producing software, companies will face a lot more competition. FDEs at AI startups should be constantly finding ways to serve the most critical workflows for a customer and paying attention to how customers do work across newer and legacy tools. For example, FDEs at Harvey should pay attention to which workflows are in Westlaw, which ones are moving to ChatGPT/Claude, and how the Harvey product can stay ahead.
2. Build around nondeterminism: In more regulated environments, FDEs should be hyper-focused on making products reliable for specific use cases using evals and configs. Previously, product reliability lived with product and support. As companies provide outcomes instead of tools, configuring products appropriately and managing evals shifts towards FDE teams.

As enterprises look for ways to cut the cost of running AI models in production, AMD is betting that not every AI workload will be best served by a power-hungry general-purpose GPU.

AMD has agreed to buy Taalas, the Canadian designer of chips that permanently embed a trained AI model’s weights into custom silicon, instead of repeatedly loading them from memory during inference as conventional GPUs do.

Taalas says its approach reduces the time and power required to move model weights between memory and compute units, making things run faster and cheaper.

The result is a highly specialized inference processor optimized for one model, trading the flexibility of programmable hardware for substantially higher throughput and energy efficiency.

Operational tradeoffs

While AMD is planning to integrate the chips into its Instinct GPU roadmap, targeting system-level AI inference solutions in data centers, analysts remain skeptical that enterprises will readily embrace hardware tied to a specific AI model.

Enterprises would, effectively, be buying a chip and a model together because unlike GPUs, which can be repurposed to run different AI models through software updates, Taalas’ chips are tied to a specific trained model, meaning they would need different hardware to support different inference tasks, said Amit Kumar Jena, AI development manager at IT Consulting firm Kanerika.

Or as Forrester Principal Analyst Charlie Dai put it, “The biggest risk is inflexibility.”

The requirement to swap hardware in order to swap tasks would, Dai said, introduce new challenges with costs, governance, capacity planning, lifecycle management, and supplier dependency, especially for enterprises managing multiple AI workloads.

Manoj Chandra Jha, principal analyst at Nord-IQ Research, said the risk of fusing chip and model into one component is larger than one might think, as “early model obsolescence strands both together, so this should be modeled as one shorter-lived asset rather than two independently amortized ones.”

Taalas says it can update a model by modifying only two metal layers of the chip rather than redesigning it from scratch, but that will only apply to chips that haven’t yet left its factory, not those already in use.

That means enterprises will still need to plan for hardware refresh cycles measured in weeks or months and retain programmable GPUs for workloads that evolve frequently, said Pareekh Jain, principal analyst at Pareekh Consulting.

It also means, said Jha, that what is typically a software decision becomes one about capital expenditure for Taalas customers, as replacing or switching workloads or models could require investing in new hardware rather than simply updating software.

Where model-specific silicon fits

Those tradeoffs significantly narrow the range of enterprise workloads where model-specific silicon is likely to make economic sense.

Dai sees the technology as best suited for mature, predictable inference workloads that run at massive scale and rely on relatively stable AI models, such as customer service automation, fraud detection, industrial computer vision, network operations, edge AI, and embedded copilots.

For CIOs, that effectively limits model-specific silicon to a small subset of enterprise AI deployments, rather than a wholesale replacement for GPU infrastructure, he said. “GPUs will remain the preferred enterprise platform because most enterprises value flexibility, multi-tenancy, and rapid model evolution over maximum efficiency.”

This article first appeared on Network World.

Business application development is entering a new operating model. The traditional approach of gathering requirements, designing screens, writing services, integrating systems, testing, fixing defects and preparing release documentation still exists, but it is no longer sufficient for enterprises that need speed, traceability, resilience and regulatory confidence at the same time. Hyperautomation brings a broader discipline to this challenge. It combines workflow orchestration, intelligent document processing, robotic automation, API-led integration, process mining, test automation, observability and artificial intelligence into a connected delivery fabric. With embedded Generative AI, this fabric becomes more adaptive because applications can interpret natural language, summarize complex data, generate explanations, detect exceptions and support decision workflows rather than merely execute predefined rules.

In banking, this shift is especially meaningful. Banks operate across dense application landscapes: trade reporting platforms, wealth management portals, core banking systems, investment banking applications, digital compliance engines, reconciliation utilities, operational dashboards, audit repositories and daily, weekly and monthly reporting platforms. Each of these areas has its own data models, control points, integration patterns, validation rules, exception paths and regulatory obligations. Hyperautomation does not replace engineering discipline; it strengthens it by making business intent, technical execution, control evidence and continuous improvement part of the same lifecycle.

From automation to hyperautomation in banking applications

Automation usually addresses a specific task: moving data from one system to another, generating a report, running a batch job or validating a transaction against a rule. Hyperautomation goes further. It looks at the complete business outcome and asks how the entire chain can be streamlined, governed, observed and improved. For example, a trade reporting process may begin with transaction capture, enrich the trade with reference data, validate regulatory fields, identify breaks, generate a submission file, transmit it to a regulator or trade repository, monitor acknowledgements and preserve audit evidence. A narrow automation script may accelerate one step, but a hyperautomated design coordinates the complete flow, including exception handling and evidence generation.

Figure: Automation vs. hyperautomation

Embedded Generative AI adds a new layer of intelligence. Instead of forcing every user interaction into rigid screens and codes, business applications can accept natural language prompts, interpret document content, summarize cases, generate draft responses, explain anomalies, produce test scenarios and create release notes. In a banking environment, this intelligence must be carefully bounded. Every AI-assisted action should be traceable, explainable, reviewable and aligned with data privacy, model risk, information security and regulatory expectations. The goal is not uncontrolled autonomy; the goal is governed acceleration.

Banking application components suitable for hyperautomation

A modern banking application is rarely a single monolithic system. It is a composition of business capabilities, integration services, workflow engines, data pipelines, user experience layers, analytics models, control dashboards and audit stores. Hyperautomation can accelerate the development and integration of these components by turning repetitive engineering work into reusable patterns and by embedding intelligence directly into business processes.

• Trade reporting applications: Generative AI can help map trade attributes to regulatory fields, explain validation failures, summarize rejected submissions and generate test cases for reporting scenarios. Hyperautomation can orchestrate enrichment, validation, submission, acknowledgement tracking and evidence archival.
• Wealth management platforms: Advisors can use embedded AI to summarize client portfolios, generate suitability narratives, identify missing documents and prepare personalized investment review notes. Automation can coordinate onboarding, risk profiling, document verification, portfolio rebalancing workflows and client communication approvals.
• Core banking applications: Account opening, loan servicing, deposits, payments, interest calculations and customer maintenance can benefit from automated validations, intelligent forms, workflow routing and natural language assistance for operations teams. AI can explain account events or transaction exceptions in plain language.
• Investment banking systems: Deal pipelines, research workflows, underwriting processes, trade lifecycle functions and risk calculations require strong coordination across front-office, middle-office and back-office platforms. Hyperautomation can standardize approvals, documentation, exception resolution and control evidence across these stages.
• Digital compliance applications: Compliance teams can use AI to summarize policy obligations, compare regulatory changes with internal controls, classify alerts, draft investigation notes and produce evidence packs. Automation ensures routing, approvals, segregation of duties, audit trails and regulatory reporting timelines are consistently enforced.
• Reconciliation platforms: AI can assist in matching narratives, explaining breaks, clustering exception patterns and suggesting resolution actions. Hyperautomation can pull data from ledgers, statements, payment processors, trading systems and data warehouses, then route unresolved breaks to the right teams.
• Reporting and audit applications: Daily, weekly and monthly reports can be generated through controlled data pipelines, automated quality checks, narrative generation, variance explanations and approval workflows. Audit applications can preserve lineage, approvals, source extracts, model outputs and control attestations.

Embedded generative AI as an application capability

Embedding Generative AI into business applications should be treated as an architectural capability, not as a decorative chatbot. A banking application may use AI for search, summarization, reasoning support, content generation, code generation, policy interpretation or anomaly explanation. Each use case requires clear boundaries. The application must know which data the model can access, which actions require approval, what evidence must be captured and where deterministic controls must override probabilistic suggestions.

For example, in trade reporting, an embedded AI assistant can explain why a transaction failed validation and suggest likely fields to review. However, the final correction should pass through rule-based validations, maker-checker approval and audit logging. In wealth management, AI may draft a client review note based on portfolio movements and risk profile, but the advisor must verify suitability, disclosures and final communication. In reconciliation, AI can propose likely matches or categorize break reasons, while the system preserves the original data, confidence score, reviewer action and final resolution path.

Hyperautomating the product development lifecycle

The Product Development Lifecycle can itself become hyperautomated. Instead of treating ideation, analysis, design, development, testing, security review, release and operations as disconnected phases, enterprises can create an AI-assisted delivery loop where every stage produces structured artifacts that the next stage can consume. Platforms such as GitHub Copilot, Claude Code or Claude Cowork-style agentic development environments and OpenAI Codex can support this movement by helping teams reason over requirements, generate code, create tests, review changes, modernize legacy modules and produce documentation. Their value increases when they are connected to repositories, issue trackers, design documents, build pipelines, test suites, security scanners, observability data and enterprise knowledge bases.

PDLC Stage	Hyperautomation Opportunity	AI-Assisted Outcome
Business discovery	Process mining, domain interviews, regulatory mapping, backlog creation	Structured epics, user stories, acceptance criteria, process maps and control requirements
Architecture and design	Reference architectures, API contracts, data models, event flows, security patterns	Architecture options, integration blueprints, threat-model prompts and design decision records
Development	Code generation, service scaffolding, UI component creation, data pipeline templates	Review-ready code increments, reusable components, migration utilities and integration adapters
Testing	Unit, integration, regression, performance, compliance and synthetic data testing	Generated test cases, defect reproduction steps, test automation scripts and coverage summaries
Security and compliance review	Static analysis, dependency checks, policy validation, evidence capture	Risk explanations, remediation suggestions, control traceability and approval evidence
Release and deployment	CI/CD orchestration, environment promotion, release notes, rollback preparation	Automated deployment packs, release summaries, operational checklists and change records
Operations and feedback	Observability, incident analysis, user feedback mining, backlog refinement	Incident summaries, root-cause hypotheses, improvement stories and reliability recommendations

Role of GitHub Copilot, Claude Cowork and Codex

GitHub Copilot is useful where developers need assistance inside the engineering flow: explaining code, generating functions, proposing tests, reviewing pull requests and helping teams move from issue to implementation. In a banking PDLC, it can accelerate microservice creation, API integration, batch processing logic, reconciliation rules, regulatory validation routines and UI workflows. When used with repository context and proper review discipline, it can reduce the time developers spend on repetitive coding while preserving human accountability for design and correctness.

Claude Cowork or Claude Code-style agentic environments are valuable for multi-file reasoning, refactoring, debugging and documentation-heavy engineering work. Banking applications often contain deep domain logic scattered across services, configuration files, stored procedures, integration scripts and test suites. An agentic coding assistant that can understand a wider codebase context can help engineers analyze dependencies, prepare modernization plans, update multiple files coherently and draft explanations for reviewers. This is particularly useful in core banking modernization, trade reporting rule updates and compliance workflow refactoring.

OpenAI Codex can support issue-to-pull-request workflows, test generation, code review, bug reproduction, migration activities and broader software engineering tasks across the lifecycle. In a hyperautomated PDLC, Codex-like agents can be assigned well-scoped work items, asked to inspect failing tests, propose fixes, create regression coverage and summarize the change for human reviewers. The important design principle is to keep agents inside controlled boundaries: clear prompts, repository permissions, test gates, approval workflows and traceable outputs.

Integration architecture for hyperautomated banking applications

A practical architecture begins with business capability decomposition. Each banking domain should be expressed as a set of bounded capabilities such as customer onboarding, account maintenance, trade enrichment, exception management, portfolio review, control attestation, report generation and audit retrieval. These capabilities should be exposed through APIs, events, workflow tasks, data products and user interfaces. Hyperautomation then connects these capabilities using orchestration engines, event streams, rules engines, AI services, RPA connectors where legacy integration is unavoidable and observability layers that capture business and technical telemetry.

The embedded AI layer should sit behind a secure application service boundary. It should use retrieval-augmented generation where approved policies, product rules, application documentation and regulatory mappings are retrieved from trusted sources. It should avoid uncontrolled exposure of sensitive customer information. Prompt templates, response validation, redaction, grounding checks, model monitoring and human-in-the-loop approval should be part of the production design. In banking, the most successful AI pattern is often not full automation but assisted decisioning with strong controls.

Example: Hyperautomated reconciliation and reporting flow

Consider a reconciliation application that compares ledger balances, payment files, trade settlement records and external statements. In a conventional model, operations teams spend significant time downloading files, running macros, investigating mismatches, documenting break reasons and preparing status reports. In a hyperautomated model, data ingestion is scheduled and monitored, schema checks run automatically, matching engines classify obvious matches, AI assists with ambiguous narratives, exceptions are routed through workflow queues and dashboards update in near real time. At the end of the day, the system can generate a draft operations report explaining unresolved breaks, aging trends, risk exposure and pending approvals.

The same pattern can extend to daily, weekly and monthly reporting. Data quality rules validate inputs, report templates are populated automatically, AI generates narrative commentary on variances, reviewers approve or amend explanations and the final report is archived with lineage and approvals. Audit teams can later retrieve not only the report but also the source extracts, transformation logs, exception history, reviewer decisions and AI-generated drafts. This creates a richer control environment than manual reporting because evidence is captured by design rather than reconstructed later.

Governance, risk and control considerations

Hyperautomation in banking must be designed with governance from the beginning. The development team should define which activities can be automated, which can be AI-assisted and which must remain under human approval. Source code generated by AI must pass normal engineering controls, including peer review, static analysis, dependency scanning, secure coding checks, test execution and production readiness review. Business outputs generated by AI, such as compliance narratives or client-facing explanations, should be reviewed where regulatory or reputational risk is material.

Data governance is equally important. AI-enabled applications must respect data classification, residency, retention, masking and access policies. The model should not become an uncontrolled channel through which confidential customer, trading or employee information can leak. Every prompt, retrieved source, generated response, user action and final decision may need to be logged depending on the use case. For audit applications, this traceability is not optional; it is the foundation of trust.

Operating model for AI-native PDLC

A hyperautomated PDLC requires changes in team behavior. Product owners should write requirements in a structured manner so that AI tools can generate better stories, acceptance criteria and test scenarios. Architects should maintain living decision records, reference patterns and integration standards that AI agents can use as context. Developers should learn prompt discipline, context packaging and review techniques. Test engineers should focus on coverage strategy, synthetic data, compliance scenarios and defect prevention rather than only manual execution. Operations teams should feed incident learnings back into the backlog so the system improves continuously.

The role of human experts becomes more important, not less. AI can draft, generate, compare and suggest, but domain judgment remains essential. A trade reporting specialist understands regulatory nuance. A wealth advisor understands client suitability. A core banking architect understands transaction integrity. A compliance officer understands control interpretation. Hyperautomation works best when it amplifies these experts and removes repetitive friction around them.

Conclusion

Hyperautomation in business application development is not simply a faster way to write software. It is a new way to connect business intent, engineering execution, operational control and continuous learning. In banking, where applications must be reliable, explainable, secure and compliant, the combination of embedded Generative AI and disciplined automation can transform how applications are designed, built, integrated, tested, released and operated. Trade reporting, wealth management, core banking, investment banking, compliance, reconciliation, reporting and audit functions can all benefit when AI is embedded responsibly and automation is orchestrated across the complete lifecycle.

Platforms such as GitHub Copilot, Claude Cowork or Claude Code and OpenAI Codex can play an important role in this transformation by accelerating analysis, development, testing, review, modernization and documentation. Their greatest value appears when enterprises treat them not as isolated productivity tools but as part of a governed, AI-native PDLC. The future of banking application development will belong to teams that can combine human expertise, reusable engineering patterns, intelligent automation and strong governance into one coherent delivery model.

This article was made possible by our partnership with the IASA Chief Architect Forum. The CAF’s purpose is to test, challenge and support the art and science of Business Technology Architecture and its evolution over time as well as grow the influence and leadership of chief architects both inside and outside the profession. The CAF is a leadership community of the IASA, the leading non-profit professional association for business technology architects.

As Europe swelters in a heatwave, residents probably don’t want to hear about ways to make their homes even hotter, but that’s what Polish property developer Citylink is talking about, with plans to dump waste heat from a new data center in Wrocław into the municipal district heating network.

Citylink is designing the data center so that heat from servers can be recovered instead of being dissipated via cooling systems — and as the data center grows, any increase in computing power will mean more energy available for recovery.

The collaboration with local power company Kogeneracja will provide “valuable experience in designing and operating modern data centers, with a particular focus on infrastructure dedicated to AI nodes,” said Michał Starybrat, development director at Citylink.

“The dynamic growth of the artificial intelligence and cloud technology markets generates unprecedented demand for computing power, this collaboration demonstrates how modern digital infrastructure can actively contribute to building the energy ecosystem of the future,” he added.

This type of initiative is not new. There have been similar projects in the UK and in New Zealand, but with warnings that data centers are contributing to the warming of the planet, there may well be a lot more organizations looking to deploy that excess heat more fruitfully in the future.

However, announcing it during a heatwave may not be the most politically sensitive approach to take.

This article first appeared on Network World.

Als Umgebung für Entwickler hat Microsoft Windows in den letzten Jahren einen Sprung nach vorne gemacht. Mit dem Windows-Subsystem für Linux (WSL) ist es nahtlos möglich, mit Linux unter Windows zu arbeiten – ohne den Mehraufwand, den eine virtuelle Maschine (VM) mit sich bringt. Zudem sind sämtliche gängigen Dev-Tools als native Windows-Versionen verfügbar – und Microsoft hat eine ganze Reihe entsprechender Funktionen auch direkt in sein Betriebssystem integriert.

Für Developer, die besonders schnell mit einer Windows-Maschine entwickeln wollen, hat Microsoft mit der „Windows Developer Config“ sogar so etwas wie eine Schnellspur geschaffen: Diese Sammlung von Powershell-Skripten fungiert als eine Art „Starter Kit“ und unterstützt dabei, Windows-Systeme möglichst schnell und komfortabel als Entwicklungsumgebung einzurichten. 

Wenn Sie hingegen – wie die meisten Entwickler – Wert darauflegen, die Kontrolle zu behalten und Ihr Dev-System selbst einzurichten und zu konfigurieren, ist ein bisschen Vorarbeit nötig. Der Aufwand selbst ist dabei überschaubar, die konkreten Schritte sind jedoch erfolgsentscheidend (und nicht unbedingt offensichtlich).   

Hinweis: Um die nachfolgenden Maßnahmen umzusetzen, sollten Sie auf Ihrem System über Administratorrechte verfügen.

1. WSL installieren

WSL stellt Windows-Benutzern ein vollständiges Linux-System über die Kommandozeile zur Verfügung – was weniger Overhead verursacht als eine VM. Da Software weltweit vor allem unter Linux– oder Unix-ähnlichen Systemen wie macOS entwickelt wird, ist das ein echter Vorteil.

Um WSL zu installieren, öffnen Sie ein Konsolenfenster mit Administratorrechten und nutzen den Befehl:

wsl --install

Die Installation kann einige Zeit in Anspruch nehmen, da das System sowohl die Kernkomponenten für WSL als auch – damit zusammenhängend – eine Linux-Distribution herunterladen muss.

Die Standard-Linux-Distribution in WSL ist Ubuntu 26.04 LTS. Diese erfüllt als Default-Lösung die meisten Anforderungen, die Entwickler an eine Linux-Distribution stellen. Es stehen jedoch auch andere Distributionen zur Verfügung – und es kommen regelmäßig neue hinzu. Sie könnten sogar Ihre eigene, benutzerdefinierte Linux-Distribution für WSL kreieren.

Sobald WSL installiert ist, können Sie über den Befehl wsl –list –online alle verfügbaren Distributionen anzeigen. Um eine davon zu installieren, nutzen Sie den Befehl wsl --install . Die meisten verfügbaren Optionen sind auf unterschiedliche Vorlieben oder spezifische Anforderungen zugeschnitten. Wenn Sie beispielsweise an einem Projekt arbeiten, das Debian als Grundlage voraussetzt, sollten Sie das auch installieren.

WSL-Distributionen werden standardmäßig im AppData-Verzeichnis abgelegt – genauer gesagt unter AppData\Local\Packages\. Wenn Sie die Dateien in ein anderes Verzeichnis oder auf ein anderes Laufwerk verschieben möchten, können Sie das mit dem Befehl wsl --manage --move bewerkstelligen.

Darüber hinaus hat Microsoft Ende Juni 2026 mit WSL-Container (derzeit in der Public Preview) eine wichtige neue Funktion für WSL vorgestellt. Diese ermöglicht es, Linux-Container nativ unter Windows auszuführen.

2. Dev-Drive-Laufwerk konfigurieren

Um Projekte zu speichern, nutzen die meisten Windows-Benutzer standardmäßig ein Verzeichnis auf einem NTFS-Volume – entweder im eigenen Benutzerprofil oder über einen anderen Pfad. Das ist als Default-Option keine schlechte Wahl. Allerdings gibt es bessere Alternativen.

Zum Beispiel „Dev Drive“, ein neuer Laufwerkstyp unter Windows. Dieser nutzt statt NTFS das neuere Dateisystem ReFS („Resilient File System“). Dieses wurde ursprünglich für Windows Server entwickelt und bietet Funktionen, die darauf ausgelegt sind, Softwareentwicklungs-Workloads besser zu bewältigen. Dazu gehören:  

• Copy-on-Write: Projektverzeichnisse können Tausende von Dateien und Dutzende von Unterverzeichnissen enthalten. Kopien von Projekten dieser Art anzufertigen, lässt sich mit ReFS deutlich schneller bewältigen, da das Dateisystem Kopien von Daten erst dann erstellt, wenn diese auch geändert werden. Reine Kopien sind hingegen Links, die auf die Originale verweisen.
• Antivirus-Komfort: Über einen Dev Drive lassen sich die standardmäßigen Beeinträchtigungen durch die nativen Antivirus-Tools von Windows minimieren. Dieses Feature erlaubt es, Entwicklerverzeichnisse manuell von Scan-Vorgängen zu exkludieren.
• Virtuelle Festplatte oder Partition: Dev Drives können als virtuelle Festplattendatei eingerichtet oder direkt auf einer formatierten Partition genutzt werden. Ersteres ist flexibler (unter anderem lässt sich die Größe leichter anpassen), Letzteres möglicherweise performanter.

Zwei Dinge sollten Sie im Zusammenhang mit Dev Drives unbedingt beachten:

1. Dev Drives sind für Projekte gedacht, nicht für Tools: Dort legen Sie Ihre Projekt-Repositories, Build-Artefakte und zwischengespeicherte Dateien ab. Language Runtimes, Compiler oder anderen Toolchain-Utlities sollten hingegen auf regulären NTFS-Volumes gespeichert werden.
2. Low-Level-Tools funktionieren unter Umständen nicht wie beabsichtigt: Dateisystem-Utilities auf Expertenniveau, die Informationen direkt aus den Dateiinformationen auslesen, verhalten sich im Zusammenspiel mit ReFS-Volumes möglicherweise nicht wie vorgesehen. So ist etwa das Speicherplatz-Management-Tool WizTree unter ReFS extrem langsam.

3. WinGet nutzen

Microsoft hat Windows inzwischen auch mit einem offiziellen Package-Management-System ausgestattet – WinGet. Dieses installiert jede Art von Windows-Applikation und bietet zudem ein vollständiges Befehlszeilen-Interface für Interaktion und Automatisierung.    

WinGet wird vom Windows-Software-Ökosystem umfassend unterstützt – die Wahrscheinlichkeit ist also groß, dass es für jedes Windows-Programm, das Sie benötigen, ein WinGet-Paket gibt (dazu gleich mehr).

Um im WinGet-Repository nach einem Paket zu suchen, nutzen Sie diesen Befehl (die Anführungszeichen sind erforderlich, wenn der Name des gesuchten Pakets Leerzeichen enthält – etwa Adobe Acrobat Reader):

winget search "Thing to search for"

Das WinGet-Package zu installieren, geht denkbar simpel von der Hand – und zwar mit:

winget install 

Dabei meint die ID des zu installierenden Pakets – nicht bloß seinen Namen. Im vorgenannten Beispiel (Adobe Acrobat Reader) würden Sie also folgenden Befehl nutzen, um dieses zu installieren:

winget install Adobe.Acrobat.Reader.64-bit

Falls Sie eine ansprechende grafische Benutzeroberfläche suchen, empfiehlt sich ein Blick auf UniGetUI. Dieses Tool verwaltet Packages aus verschiedenen Quellen – etwa WinGet, Scoop, Chocolatey, npm, pip oder Cargo, um nur einige zu nennen.

4. PowerShell für Skripte konfigurieren

Dieser Schritt ist lediglich einmal pro System zu absolvieren, kann jedoch die Entwicklererfahrung von Windows gewaltig steigern: PowerShell sollte entsprechend konfiguriert werden, damit lokale Skripte ausgeführt werden können.   

Um das zu bewerkstelligen, starten Sie PowerShell als Admin und nutzen folgendes Kommando:

set-executionpolicy remotesigned

Zwar verlangt Windows weiterhin, dass alle PowerShell-Skripte, die Sie aus dem Internet herunterladen, signiert sind – das ist jedoch im Grunde ein Edge Case. Alle lokal erstellten Skripte funktionieren nach dieser Maßnahme ohne Weiteres.

5. Weitere Dev-Tools installieren

Wie bereits erwähnt, bietet WinGet schnellen Zugriff auf alle gängigen Tools, die ein entwicklungsorientiertes Windows-System benötigt. Nachfolgend haben wir eine kleine Übersicht der wichtigsten Dev-Tools für Windows inklusive deren WinGet-IDs zusammengestellt, um Ihnen die Installation zu erleichtern.

• Git (Git.Git): Die Windows-Version des populären Versionskontrollsystems ist im Wesentlichen identisch mit der auf anderen Plattformen.
• Visual Studio BuildTools 2022 (Microsoft.VisualStudio.2022.BuildTools): Dieses minimale CLI-Tooling ist erforderlich, um das C/C++-Kompilierungssystem von Visual Studio zu nutzen.
• CMake (Kitware.Cmake): Die plattformübergreifende Build-Lösung wird häufig für größere oder komplexere Projekte benötigt, die C/C++ nutzen.

Dabei ist zu beachten, dass die standardmäßige BuildTools-Installation in der Regel nicht über die Tools verfügt, die für minimale C/C++-Build-Prozesse erforderlich sind. Das beheben Sie mit folgendem Befehl:

winget install -e --id Microsoft.VisualStudio.2022.BuildTools --force --override "--passive --wait --add Microsoft.VisualStudio.Workload.VCTools;includeRecommended"

Alle gängigen Editoren sind ebenfalls als native Windows-Apps über WinGet verfügbar – etwa:

• Microsoft Visual Studio Code (Microsoft.VisualStudioCode),
• GNU Emacs (GNU.Emacs), oder
• Neovim (Neovim.Neovim).

Für die Softwareentwicklung unter Windows optional, aber durchaus nützlich, sind außerdem folgende Werkzeuge:

• CoreUtils for Windows (Microsoft.Coreutils): Ein von Microsoft gepflegtes Open-Source-Projekt, das Dutzende von Linux-Befehlszeilen-Dienstprogrammen auf Windows bringt, beispielsweise cp, grep, find und ls.
• MSYS2 (MSYS2.MSYS2): Eine Tool-Sammlung, um Windows-Binärdateien mit dem GCC-Compiler zu erstellen. Diese bildet im Grunde eine Alternative zum Visual-Studio-Build-Stack auf Basis der Cygwin-Umgebung.
• LLVM (LLVM.LLVM): Auf diesem Compiler-Framework basieren Clang, Rust, Swift und viele andere Projekte. Wenn Sie LLVM als Abhängigkeit verwenden, müssen Sie die spezifische Version installieren, die Ihr Projekt erfordert.
• Docker Desktop (XP8CBJ40XLBWKX): Die Windows-native Version der Docker-Desktop-App.
• Microsoft PowerToys (Microsoft.PowerToys): Diese Sammlung besteht aus über 30 Utilities, die es erheblich vereinfachen, Windows anzupassen. Dazu gehören unter anderem ein Hosts-File-Editor, ein Unlocking-Tool für Dateien (praktisch, um festzustellen, welche Prozesse eine bestimmte Datei sperren) sowie ein Werkzeug, um Text zu extrahieren (praktisch, um Text von beliebigen Stellen auszulesen, einschließlich Bildschirmbereichen, die nicht mit dem Cursor markiert werden können).

(fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

Ancient Greek sophist Protagoras famously said, “There are two sides to every question.” But OpenAI’s latest attempt at reality distortion seems determined to narrow this dispute to just one. In its motion to reject Apple’s complaint, the company does not meaningfully acknowledge the criticisms levelled against it, preferring instead to recast the case as a grievance over talent retention and product-market failure.

The filing

In case you missed the news, OpenAI filed a motion to the court to dismiss Apple’s recent lawsuit against it. In that filing, OpenAI argued that, “Apple should not be permitted to use a baseless and pretextual lawsuit to make up for its shortcomings in the market for talent and retaining its employees, and its failures to integrate AI into its products.”

The company’s dismissal claims Apple’s case was, “plainly filed without adequate investigation and built on selectively excerpted communications and ordinary conduct stripped of context,” adding, in a turn of phrase borrowed from Apple’s own complaint, that it is “rotten to its core.”

The narratives can change

As ever with litigation, these are allegations and counter-allegations rather than findings of fact. The value of the filings is that they show how each side wants the court, and the public, to understand the same disputed events. At the moment, we don’t yet know how Apple will respond to OpenAI’s response; it follows that company’s failed attempt to woo public opinion earlier in the week when it deployed what some see as a “cookie jar” defense, arguing that Apple’s secrets only slipped out because the figurative jar lid was open.

OpenAI likely hopes for more success with its latest attempt to defend itself against Apple’s claims it engaged in a coordinated attempt to obtain trade secrets through questionable recruitment practices.

Central to the company’s counter-argument are its attempts to recharacterize some of Apple’s claims. For example, Apple alleges that one former staffer, Chang Liu, downloaded confidential files after leaving the company. OpenAI argues that Liu was instead attempting to help ex-colleagues who asked him for assistance. This is a useful example of the Protagorean frame: both companies are trying to extract different meanings from the same event.

What the truth might be

The courts will need to decide which version of events is closer to the truth. What is already clear is that OpenAI has been actively involved in recruiting Apple staff, including the services of former Chief Design Officer Jony Ive, as it develops a product that, to a layman like me, sounds likely to compete with Apple hardware. OpenAI says those recruitments reflect Apple’s failure to retain its staff; Apple argues its competitor is using exfiltrated confidential information to guide its hiring. The court will need to decide that story as well.

Ultimately, I don’t expect OpenAI’s efforts to have the court reject Apple’s lawsuit to succeed. Apple is asking for discovery precisely so it can test whether its reading of this distorted reality is supported by OpenAI’s internal procedures and the available facts. One of OpenAI’s arguments seems to be that Apple has not researched the matter thoroughly enough; Apple is quite literally requesting discovery to do just that.

What happens next?

I don’t know what discovery might turn up, but it does amuse me to think Apple could build its own large language model to boost the discovery process and identify communication conduits that might otherwise be obscured in the evidence initially available to it. How high, and in what direction, do OpenAI’s claimed recruitment practices go, and who is implicated in them? That’s something we might find out in the coming months.

OpenAI’s Protagorean defense extends a little further, of course, as the company also said it had “no use, need or desire for Apple’s trade secrets” because it is building “something entirely new.” This may surprise Apple, which has already alleged that OpenAI contacted its manufacturing partners and sought access to secret manufacturing processes Apple developed with them.

Once again, it will be up to the courts to decide whether those events took place, or if OpenAI’s defense has substance. Given that this dispute centers on product design and involves the AI company’s growing army of former Apple design and development staff, I find the denial hard to accept. But courts tend to make their own decisions, for good, or for ill. 

Fight or settle

What happens next? I think this attempt to reject the original litigation will fail, which means the case will enter the discovery process before one of two outcomes becomes more likely: A bitter public battle that lasts for years and might well end up in the Supreme Court, or an out-of-court settlement shaped by which side gains the most compelling evidence.

Like any war, there are really only two options: one side fights until the other can no longer continue, or both sides find a way to settle. The path to settlement may begin by recognizing that two stories can be applied to the same facts, and that the version closest to the truth often sits somewhere between them. I’m not a lawyer and I don’t have insider insight into the practicalities of the case, but based on what has been revealed so far, the most plausible combined story may be that Apple’s own vulnerabilities helped create an environment OpenAI chose to exploit. If so, Apple’s legal team will be searching hard for evidence of intent.

I expect they’ll find it.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.

AI is accelerating vulnerability discovery, exploit development, and attacker weaponization faster than most organizations can adapt. Security teams are inundated with vulnerability disclosures, threat intelligence feeds, exploit chatter, and vendor advisories, all demanding immediate attention. Yet only a small percentage of vulnerabilities are ever actively exploited in the wild.

The challenge is no longer visibility. The challenge is determining which threats actually create exploitable risk in your environment before attackers operationalize them at scale.

That operational gap is exactly why we built Horizon3.ai’s Rapid Response.

Rapid Response helps organizations validate exposure, prioritize action, verify fixes, and reduce uncertainty around emerging threats before attackers can scale exploitation.

That distinction matters more than ever

Over the past several months, the industry has seen a wave of research and demonstrations highlighting how AI can dramatically increase vulnerability discovery rates. Horizon3.ai’s Attack Team recently demonstrated this firsthand, using AI to identify and validate a critical Apache ActiveMQ vulnerability in minutes, reinforcing how quickly AI-assisted research can compress the timeline between discovery and exploitation. The pace is impressive, but it also exposes a deeper problem. 

Most organizations are already overwhelmed with the volume of potential risks being surfaced by myriad tooling; they struggle to prioritize managing existing systems based on today’s knowledge. Adding exponentially more vulnerabilities to analyze without improving clarity around what attackers can actually reach and exploit only increases noise, remediation backlog pressure, and response fatigue.

Most organizations do not need more feeds or alerts. They need better signals.

Horizon3.ai’s Attack Team continuously evaluates emerging vulnerabilities based on real-world attacker interest, deployment prevalence, accessibility, exploitability, and the likelihood of operationalization at scale. That upstream triage and curation ensures organizations focus attention on the vulnerabilities that present urgent and real risk instead of wasting cycles chasing every headline CVE.

Security teams also need faster answers to a much harder set of questions, such as these, which go beyond surface-level criticality:

• Are we actually exploitable?
• Which assets are exposed?
• What do we do to eliminate this risk?
• Did our mitigation and remediation efforts actually work?
• Can we prove risk reduction to leadership?

Most organizations still struggle to answer those questions quickly under pressure.

For example, 30 vulnerabilities drop on a Tuesday morning and only one is actually exploitable. Within hours, vendor advisories, threat intelligence feeds, KEV discussions, social media posts, and internal escalations are already spreading across the organization. Security teams scramble to determine:

• which, if any, matter
• whether any systems have been affected
• whether attackers can realistically reach affected systems
• if mitigation options exist
• how complex patching would be
• how to organize teams around focusing on reducing attacker-relevant exposure.

Meanwhile, attackers may already be scanning for exposed services, testing public exploits or developing their own, and identifying reachable attack paths. Defenders are still analyzing CVEs, figuring out their own inventory, analyzing scanner results, coordinating spreadsheets — all before even getting to the workflow to address any issues.

In many organizations, vulnerability response still depends on disconnected scanners, fragmented reporting, manual coordination across multiple teams, and incomplete visibility into which assets are exposed to exploitation risk, which may be leveraged in attack chains. 

The result is predictable: Security teams waste valuable time chasing noisy vulnerabilities while genuinely exploitable attack paths remain exposed. Meanwhile, the attacker just needs one exposed, reachable endpoint to throw the exploit at, and the consequences may be devastating.

The exploit window is shrinking

Many security programs still operate on workflows built for slower attacker timelines. Triage cycles, remediation coordination, validation testing, and executive reporting often happen across days, weeks, even months. Meanwhile, the time between vulnerability discovery and attacker weaponization continues to shrink, whether vulnerabilities are exploited as zero-days or rapidly operationalized after disclosure. That mismatch creates pressure across every layer of the security organization.

Leadership wants immediate answers. Security teams need to prioritize remediation efforts where they make a real difference. Infrastructure teams need actionable guidance. Defenders also need confidence that mitigations actually reduced attacker-relevant exposure instead of simply checking a compliance box. 

Defenders need workflows designed around reducing real attacker exposure, not just vulnerability awareness. They also need fast, defensible confirmation when a highly publicized vulnerability does not currently create operational risk in their environment. The most valuable answer is: “you are not exploitable.” 

That proves the effectiveness of operational efforts and allows security teams to direct focus to the next most urgent task. 

Rapid Response provides a streamlined workflow that provides organizations that proof and peace of mind. 

Rapid Response delivers early warnings on confirmed exploit risks, targeted validation tests, and guidance, often before vulnerabilities are added to the CISA KEV catalog, helping organizations respond faster and meaningfully reduce risk exposure earlier in the vulnerability lifecycle.

When vulnerabilities with high likelihood of real-world exploitation emerge, production-safe, repeatable validation tests are developed and delivered – often within hours – using a combination of AI-assisted research, expert human analysis, and real-world attacker tradecraft.

Organizations get a personalized view into their risk exposure, guided remediation workflows, and progress tracking from discovery to resolution.

Organizations can:

• Prioritize efforts based on real exposure to urgent threats
• Identify and track which assets are exploitable, potentially at risk, mitigated, or not exploitable
• Embed into rituals and workflows with seamless handoffs to team in charge of fixing
• Verify mitigations safely in production environments
• Track remediation progress over time
• Demonstrate measurable risk reduction and response timelines

Attackers already operate continuously and increasingly at machine speed, and we have conviction that exploitability is the defining signal to combat them successfully. We’re delivering these capabilities with key security outcomes in mind: close the exploit window ahead of attackers and prove your efforts kept you safe.

Read more about Rapid Response.

Ancient Greek sophist Protagoras famously said, “There are two sides to every question.” But OpenAI’s latest attempt at reality distortion seems determined to narrow this dispute to just one. In its motion to reject Apple’s complaint, the company does not meaningfully acknowledge the criticisms levelled against it, preferring instead to recast the case as a grievance over talent retention and product-market failure.

The filing

In case you missed the news, OpenAI filed a motion to the court to dismiss Apple’s recent lawsuit against it. In that filing, OpenAI argued that, “Apple should not be permitted to use a baseless and pretextual lawsuit to make up for its shortcomings in the market for talent and retaining its employees, and its failures to integrate AI into its products.”

The company’s dismissal claims Apple’s case was, “plainly filed without adequate investigation and built on selectively excerpted communications and ordinary conduct stripped of context,” adding, in a turn of phrase borrowed from Apple’s own complaint, that it is “rotten to its core.”

The narratives can change

As ever with litigation, these are allegations and counter-allegations rather than findings of fact. The value of the filings is that they show how each side wants the court, and the public, to understand the same disputed events. At the moment, we don’t yet know how Apple will respond to OpenAI’s response; it follows that company’s failed attempt to woo public opinion earlier in the week when it deployed what some see as a “cookie jar” defense, arguing that Apple’s secrets only slipped out because the figurative jar lid was open.

OpenAI likely hopes for more success with its latest attempt to defend itself against Apple’s claims it engaged in a coordinated attempt to obtain trade secrets through questionable recruitment practices.

Central to the company’s counter-argument are its attempts to recharacterize some of Apple’s claims. For example, Apple alleges that one former staffer, Chang Liu, downloaded confidential files after leaving the company. OpenAI argues that Liu was instead attempting to help ex-colleagues who asked him for assistance. This is a useful example of the Protagorean frame: both companies are trying to extract different meanings from the same event.

What the truth might be

The courts will need to decide which version of events is closer to the truth. What is already clear is that OpenAI has been actively involved in recruiting Apple staff, including the services of former Chief Design Officer Jony Ive, as it develops a product that, to a layman like me, sounds likely to compete with Apple hardware. OpenAI says those recruitments reflect Apple’s failure to retain its staff; Apple argues its competitor is using exfiltrated confidential information to guide its hiring. The court will need to decide that story as well.

Ultimately, I don’t expect OpenAI’s efforts to have the court reject Apple’s lawsuit to succeed. Apple is asking for discovery precisely so it can test whether its reading of this distorted reality is supported by OpenAI’s internal procedures and the available facts. One of OpenAI’s arguments seems to be that Apple has not researched the matter thoroughly enough; Apple is quite literally requesting discovery to do just that.

What happens next?

I don’t know what discovery might turn up, but it does amuse me to think Apple could build its own large language model to boost the discovery process and identify communication conduits that might otherwise be obscured in the evidence initially available to it. How high, and in what direction, do OpenAI’s claimed recruitment practices go, and who is implicated in them? That’s something we might find out in the coming months.

OpenAI’s Protagorean defense extends a little further, of course, as the company also said it had “no use, need or desire for Apple’s trade secrets” because it is building “something entirely new.” This may surprise Apple, which has already alleged that OpenAI contacted its manufacturing partners and sought access to secret manufacturing processes Apple developed with them.

Once again, it will be up to the courts to decide whether those events took place, or if OpenAI’s defense has substance. Given that this dispute centers on product design and involves the AI company’s growing army of former Apple design and development staff, I find the denial hard to accept. But courts tend to make their own decisions, for good, or for ill. 

Fight or settle

What happens next? I think this attempt to reject the original litigation will fail, which means the case will enter the discovery process before one of two outcomes becomes more likely: A bitter public battle that lasts for years and might well end up in the Supreme Court, or an out-of-court settlement shaped by which side gains the most compelling evidence.

Like any war, there are really only two options: one side fights until the other can no longer continue, or both sides find a way to settle. The path to settlement may begin by recognizing that two stories can be applied to the same facts, and that the version closest to the truth often sits somewhere between them. I’m not a lawyer and I don’t have insider insight into the practicalities of the case, but based on what has been revealed so far, the most plausible combined story may be that Apple’s own vulnerabilities helped create an environment OpenAI chose to exploit. If so, Apple’s legal team will be searching hard for evidence of intent.

I expect they’ll find it.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.

Meta has released a beta coding agent designed to handle complex software assignments across large codebases.

Available for macOS and Linux, Muse Code uses the company’s new Muse Spark 1.2 model. It includes specialized background agents that remain active throughout a session instead of being created separately for individual tasks.

The agents carry out work asynchronously and decide when to report their findings to the primary agent. Meta said keeping them active reduces repeated information gathering and the need for developer direction during difficult, multi-step tasks.

“Muse Code uses a local event log in which every model call, tool run, approval, and edit is appended,” Meta said in a post, adding that the record “makes the runtime replay-exact and restart-safe” and allows the agent to resume precisely where it stopped after a crash.

Muse Spark 1.2 is available through Muse Code and the Meta Model API, for which Meta announced expanded global access.

Training and evaluation

Meta said it co-trained Muse Spark 1.2 with Muse Code to improve the model’s performance and usability when used with the agent. The training incorporated Muse Code’s tools and agent workflows, while Meta increased the computing resources used for coding and broadened the range of development environments.

The model was also trained on longer assignments, including whole-repository generation and large end-to-end software projects.

Lian Jye Su, chief analyst at Omdia, said Meta’s co-training approach was unlikely to provide a clear advantage because rivals were also developing their coding models and agent harnesses in close coordination.

“Other vendors, such as OpenAI and Anthropic, have been treating harness engineering as part of the training process,” Su said.

Optimizing the model and agent together could improve planning and context handling, but any competitive advantage would need to be demonstrated through better results on enterprise projects while reducing the need for human intervention, said Pareekh Jain, CEO of Pareekh Consulting.

Meta reported that Muse Spark 1.2 achieved an 82.9% pass@1 score on Terminal-Bench 2.1, behind Claude Opus 5 but slightly ahead of GPT-5.6 Terra. On DeepSWE 1.1, the model scored 59.3%, trailing both rivals.

For Terminal-Bench 2.1 and DeepSWE 1.1, Meta evaluated each model with its selected coding agent rather than using the same agent throughout. It also acknowledged that rival proprietary models may have performed differently under tools and prompts designed specifically for them.

Neil Shah, vice president of research at Counterpoint Research, said cross-vendor comparisons would be more meaningful if models were evaluated with third-party tools or within the same agent harness.

“The key metric for CIOs is the pass rate against an enterprise’s own pipeline, which will determine the success of the model-and-harness bundle, or, in this case, Meta’s Muse Spark 1.2 and Muse Code,” Shah said. “This will be the real benchmark.”

Enterprise adoption hurdles

Su said security and governance requirements could slow enterprise adoption, particularly where coding agents must be connected to existing identity systems.

“Many enterprises are still less willing to open up their CI/CD environments for AI tool integration,” Su said.

Shah said companies would need controls governing how agents access repositories, along with records showing how models and agent workflows handle enterprise data. He also cited the difficulty of forecasting token consumption and its effect on costs.

Meta’s pricing structure also creates a data-governance choice. The company said the lower-priced Contributor model may be used to improve its products, while the standard tier is not used for that purpose.

The Contributor tier costs $0.10 per million input tokens and $0.20 per million output tokens, compared with $1.25 and $4.25, respectively, for the standard tier.

“There is also a fear of vendor lock-in and reliance, as it may hurt long-term flexibility and system interoperability,” Su added.

Jain said adoption was likely to begin with narrowly defined, lower-risk work before companies allowed persistent agents to modify critical production code.

AWS has added AI Insights to AWS Marketplace, a feature that it says is designed to help CIOs and developers better evaluate and compare products using AI-generated summaries and recommendations as enterprises grapple with increasing pressure to justify technology spending.

“Available in the pricing section of the listing in AWS Marketplace, AI Insights explains each product’s pricing in plain language: what a pricing unit maps to, how your bill changes as usage scales, how multiple pricing dimensions combine into one cost, and what is and isn’t included,” AWS wrote in a blog post.

Critical for procurement of AI-based tools, offerings

Analysts say the new feature could prove critical for CIOs procuring AI-based tools and services.

“AI pricing in the marketplace has always been a black box. You see a number per token, per API call, or per compute unit, but understanding what that actually means at enterprise scale requires significant effort to piece together,” said Amit Jena, AI development manager at IT Consulting firm Kanerika.

“CIOs are increasingly being held to account for AI spend, not just AI adoption, and that shift has created a genuine need for pricing transparency at the point of evaluation,” Jena added.

The challenge, according to Pareekh Jain, principal analyst at Pareekh Consulting, has compounded for CIOs because AI-based tools are now moving away from simple per-user subscription fees into complex consumption-based pricing.

“With tokens, API calls, agent executions, and compute, forecasting total cost of ownership has become very challenging. A feature like AI Insights should give CIOs pre-purchase clarity by translating multi-dimensional pricing into plain language on the listing, letting them calculate budget limits before committing,” Jain said.

Prior to the update, evaluating pricing for AI tools required separate research exercises outside the marketplace, with teams having to visit seller websites, read technical documentation written for developers rather than procurement leaders, and build their own cost models from scratch, Jena pointed out.

“That process was slow, error-prone, and often resulted in PoC projects frequently getting stalled in legal and FinOps reviews,” echoed Jain.

“Enterprises that deployed agentic AI tools without clear pricing rules often suffered post-implementation bill shock when autonomous workflows unexpectedly multiplied backend API calls. These runaway costs led CFOs to freeze AI budgets, resulting in abandoned software pilots and failed ROI metrics,” Jain added.

The update, then, essentially would help CIOs defend a purchase decision in front of a CFO or board, Jena pointed out, adding that accelerated procurement cycles would also indirectly lead to faster delivery cycles.

Quality of pricing information will be key

The analyst, however, cautioned that the usefulness of AI Insights as a feature will ultimately depend on the quality of pricing information published by software vendors offering tools on the Marketplace.

“AI Insights draws from seller-published pricing and their public websites, so the quality of the explanation is only as good as what sellers publish. If pricing pages remain vague, the AI-generated explanation will reflect that,” Jena said.

Even so, the analyst further pointed out that the feature could have a broader positive effect by encouraging other hyperscalers and enterprise software vendors to make pricing documentation more transparent in their respective marketplaces.

“Azure Marketplace and Google Cloud Marketplace will face pressure to offer something equivalent. The underlying driver is the same: enterprise buyers are now accountable for AI ROI in ways they were not two years ago, and pricing opacity is becoming a genuine risk to AI adoption at scale,” Jena said.

Microsoft has unveiled a suite of IQ products over the last few months. Work IQ, Fabric IQ, and Foundry IQ build on what Microsoft used to call its “Graphs,” the underlying data architecture that underpins its cloud services. These graphs provided a way to query the data your business uses, treating that data as nodes in a graph database and using the GraphQL API model to extract that data — for example, to pull data related to a specific individual held across the various Microsoft 365 applications.

The IQ suite follows a similar approach, using the same data, but treating it as the sparse vector store needed to provide grounding data for LLM-based applications. By treating the data as a set of embedding vectors, and integrating it with Model Context Protocol (MCP) servers, Microsoft is giving you the necessary tools to tie LLM output to your data, reducing the risk of hallucination and improving accuracy. Using your own data is a key part of delivering effective agents, ensuring they work within your constraints.

Extending IQ to the web

Web IQ, the latest member of the IQ suite, was unveiled at Build 2026. A modernization of the retired Bing Search APIs, Web IQ is an agent-focused web search tool that builds on the massive Bing search index to provide up-to-date general information for use in your applications.

It may seem a little odd to be talking about a web-wide source of grounding data in the context of a suite of tools that exist to improve the accuracy of your AI applications by providing access to your Microsoft-hosted data. However, in many cases you want to link your agent not only to your data but also to related information from the wider world. For example, an agent powering an ecommerce service could use Web IQ and web-based data sources to provide product comparisons. An agent managing stock levels for a product that is weather-sensitive could use Web IQ as a source of weather data, using Bing’s multiple weather feeds and forecasts.

Just as Google Gemini drew on Google Search, Microsoft Copilot began by using Bing search data to provide grounding for consumer chatbots. It’s easy to take a service like Bing and use it with a LLM, as the nearest neighbor search algorithms use semantic vector similarity techniques to find results that look like your query, ranking them according to their proximity to your search terms.

Microsoft has been tuning its search vector index and the underlying technology stack to work with agents, as agents operate much differently than humans searching the web or querying a chatbot. Providing web search capabilities to agents means having to deal with persistent queries, as the agent hunts for the information it needs, refining queries and applying reasoning algorithms to develop the response it needs. LLM inferencing requires quick responses that deliver large amounts of data, working with queries that go far beyond the one-word or two-word requests that are typical of humans.

More than the training weights

Using Web IQ gives you access to up-to-date information, beyond the training data used to build and weight an LLM. Bing’s crawler works within the standards developed by the search engine industry, obeying meta tags and using its own algorithms to crawl regularly updated websites more often. Bing’s crawler ensures that data is both fresh and being used appropriately, with a focus on quality rather than quantity.

Providing access to web data is only part of Web IQ. Microsoft is using Web IQ to host its own models to manage embeddings, ranking, and content extraction, all running on the company’s global hyperscale platform. The intent here is to use only a limited number of models, to keep the system performance high while aiming to deliver accurate results. The Web IQ models are different from those used to deliver search results to humans, as they’re designed to deliver responses that are suitable for LLMs to use for reasoning.

The underlying search system is based on the DiskANN algorithm developed by Microsoft Research, which allows fast search without requiring enormous amounts of in-memory data access. This approach has been extended to manage information retrieval at scale, building on Microsoft’s distributed systems architectures, to support the demands Microsoft is seeing from agent-based systems. At the same time, it must respond to the rapidly changing economics of inference, where token costs now demand the best possible output from the fewest tokens.

To meet those economic demands, the Web IQ platform doesn’t deliver whole documents to querying agents. Whole documents can lead to expensive inference further down the chain, as LLMs process results repeatedly to drive the agent workflow. Instead, Web IQ structures the information retrieved from the underlying search engine data, delivering what Microsoft calls “structured evidence objects” as well as passage-level information from unstructured text documents. This should result in a much higher signal-to-noise ratio than simply querying a search engine, with a focus on delivering information that lets agents work using fewer tokens.

Using Web IQ in your agent code

The API for Web IQ is a standard REST call, delivering a request object to the Web IQ endpoint. Along with your API authorization key, you will send a query, a set of parameters that control the number of results returned, the language and region used, and the maximum size of the responses and the format used. Responses can be returned in text, HTML, or markdown formats, as well as extracted passages that are selected for context. All other options return the full document, so can be more expensive to use. Markdown is an interesting alternative, as it can be used as the basis for giving agents semantic memories.

Results include important contextual and citation information, including web page titles and URLs, as well as data about when the site was last crawled and how stale the underlying information is. This can be used to improve grounding and provide more information that can be included in formatted responses — much in the same way as Bing’s Copilot displays context in the form of footnotes in its responses.

Responses to video searches include text descriptions. If these aren’t provided as part of the original web content, they will be generated by an LLM. The same approach is used for image searches, with both offering the same contextual cues as the web search API. If you don’t care about the type of data being returned, you can choose a “classic search,” which will return text, images, video, and news.

Supporting autonomous agents

Microsoft provides LLM-ready documentation for the Web IQ service, with an llms.txt file and an OpenAPI description. These allow AI tools to discover Web IQ capabilities and include them in workflows as part of autonomous operations, so that agents and other AI applications can implement grounding calls to Web IQ whenever user interactions require them. The API descriptions include errors as well as the structure of a standard 200 response.

As Web IQ is designed for use by modern agent frameworks, the Web IQ API is available through an MCP server. The Web IQ MCP server exposes tools that map to API calls: web, videos, news, and images. They also include a browse option, which lets you pull content from a target URL. The service can be configured with a standard JSON file and requires an API key to control access and manage billing. If your account doesn’t have access to a specific tool, then it won’t be available from inside the MCP server.

If you’re building an agent and you want to evaluate the Web IQ MCP server, it can be added to common coding agents, such as the GitHub Copilot CLI. You can then test it out using familiar tools and generate code that can be dropped into applications via your choice of development tooling. Queries sent to the Web IQ MCP server use the same syntax as REST calls, without having to construct the calls yourself. Working with the MCP server allows you to connect Web IQ to your choice of agent framework, relying on its built-in MCP methods to reduce the code and maintenance overhead.

Web IQ is not for human interactions; Microsoft provides an alternative “Grounding with Bing” service for chatbots. Instead, Web IQ is a tool for agents, providing necessary background information that helps keep results fresh and relevant. It’s easy to use, fast, and, above all, cheap, which makes it an ideal tool for modern inference platforms built around Microsoft Azure’s AI tooling.

More evidence is emerging about how AI is becoming part of the day-to-day workflow for cybercriminals, from building and refining tools to managing infrastructure and accelerating vulnerability research.

Drawing on recovered prompt logs, attack tooling, and threat actor conversations, research from Cisco Talos documents how AI is being used to develop malicious code, build fraud infrastructure, and accelerate vulnerability research and exploitation.

The study, released during the Black Hat USA conference, found AI systems guardrails were often ineffective.

Cisco Talos researchers write that threat actors frequently bypass guardrails with basic social engineering claims (“this is authorised testing” or “I’m asking this as part of a capture the flag exercise”) that convince most models to comply.

This duped permissiveness wasn’t specific to a single model or platform. Instead, analysis of prompt logs related to Claude Code, CodeX, Cursor, and Gemini showed this shortcoming was an issue across the board. And when censored models refuse, threat actors simply switch to uncensored alternatives.

Whereas novice cybercriminals continue to produce clunky malware with limited functionality, sophisticated threat groups are increasingly leveraging AI as a development assistant to rapidly build exploits, and some are even deploying it as a system administration tool for managing large-scale attack infrastructure.

Cisco Talos found real-world examples of attackers abusing AI systems to build a bulk-mail validation service processing tens of millions of email records, adapting the React2Shell vulnerability into a credential-harvesting pipeline, developing DDoS infrastructure targeting Android TVs, and supporting cryptocurrency theft operations, among other attacks.

Joseph Rooke, senior director at Recorded Future’s Insikt Group, sees attacker tradecraft evolving away from traditional code-based exploits toward prompt-based manipulation of large language models.

“Targeting weakness in LLMs enables malicious prompts to be embedded in shared text, video, or image files, with the aim of hijacking LLM-based assistants to carry out attacks,” Rooke tells CSO.

Norwegian AI researcher Håkon Måløy recently demonstrated such an attack, which could result in a Copilot worm spreading through Microsoft Word docs. Attackers are also crafting malicious AI instruction files, like CLAUDE.md, to trick agents into exfiltrating data and other tasks on their behalf.

“Malicious prompts will increasingly replace malware as the preferred intrusion method, enabling adversaries to extract sensitive data, override guardrails, or induce harmful actions without breaching traditional defenses,” Rooke says.

Attacking AI through the software supply chain

Separately, research from CrowdStrike shows that adversaries are increasingly targeting AI infrastructure through software supply chain-style attacks.

For example, in March 2026, North Korean cybercrime group Stardust Chollima used stolen maintainer credentials to compromise the Axios npm package and deliver platform-specific variants of their ZshBucket malware.

In June 2026, the same group injected a malicious npm package as a dependency into at least 131 Mastra AI framework packages, indicating that trusted AI building blocks are becoming targets in supply chain attacks.

During 1H 2026, 87% of identified software registry threats involved malicious npm packages. “This indicates adversaries’ preference for JavaScript’s scale, dependency chains, and automatic install scripts to spread downstream risk,” CrowdStrike’s researchers report.

CrowdStrike’s 2026 Threat Hunting Report also reveals how AI is collapsing the window between vulnerability disclosure and active exploitation.

For example, two separate Chinese APT groups exploited critical vulnerabilities within 24 hours of public proof-of-concept (PoC) release. From January through June 2026, 88% of CrowdStrike-observed exploitation of vulnerabilities with a public PoC was conducted within 48 hours of the PoC’s release.

After the React2Shell vulnerability disclosure, CrowdStrike responded to over 800 hunting leads across more than 80 victims in just four days.

Cybercrime group Altered Spider (aka TeamPCP) compromised more than 300 software dependencies in a single day to harvest credentials and pivot into cloud environments.

Authentication systems under attack

The study — based on frontline intelligence from CrowdStrike’s threat hunters and intelligence analysts — also found that trusted authentication has become a favored attack path with, for example, vishing intrusions doubling in 1H 2026. On a related front, cybercrime groups Cordial Spider and Snarky Spider compromised single sign-on (SSO) integrated SaaS applications for data exfiltration.

Recorded Future’s Rooke points out other ways authentication systems are at the front line of AI-based attacks.

“AI-generated deepfake videos and audio are also more likely to be used as part of business email compromise attacks and social engineering,” Rooke tells CSO. “Biometric and identity-verification systems will likely remain vulnerable to spoofing, replay, and cloned credentials, enabling synthetic personas to coerce payments, manipulate employees, and facilitate access handoffs to cyber operators.”

Cloud-focused cybercrime activity surged 171% as adversaries executed credential theft, cryptomining, LLM abuse, and digital financial asset theft, according to CrowdStrike.

How cyber teams should respond

“AI is now embedded in modern adversary operations. It is changing how attacks are planned, executed, and scaled while expanding the attack surface organizations must defend,” says Adam Meyers, head of counter adversary operations at CrowdStrike. “The organizations that succeed will secure AI as aggressively as they adopt it and use AI to defend at the speed of the adversary.”

Comprehensive industry-wide data remains limited because evidence of AI abuse is often difficult to identify via traditional security telemetry. Incidents documented by Cisco Talos and CrowdStrike, however, show how CISOs need to adapt in response to the growing threat.

Cisco Talos urges enterprises to improve detection, prioritization, and their own use of AI platforms and agents to handle the growing volume of alerts and vulnerabilities. “The organisations best equipped to handle the coming deluge of additional vulnerabilities, alerts, and incidents will be the ones that prepare now by deploying their own AI-assisted security capabilities,” according to the report.

“Security teams should assume AI is already embedded in attacker workflows; focus on detecting malicious behavior rather than proving AI involvement; treat LLMs and APIs as privileged, high-risk infrastructure; and strengthen logging, patching, and containment,” says Oliver Simonnet, lead cybersecurity researcher at AI security and governance platform CultureAI.

The race to adopt AI has left many CIOs wrestling with a fundamental question: How do you move faster without introducing unacceptable risk?

Few leaders face that challenge at a higher level than David Burns, CIO of GE Aerospace. Building on the company’s decade of experience applying AI across its business, Burns is helping lead the next phase of the company’s digital transformation by leveraging AI to simplify and automate processes. Burns’ experience shows how AI can accelerate innovation, improve decision-making, and create value for the business and customers while maintaining the trust, safety, and operational rigor expected in the aerospace industry.

In a recent episode of the Tech Whisperers podcast, Burns opened up his playbook for leading organizations through turbulence. In this conversation, edited for length and clarity, he shares more practical lessons for technology leaders who are seeking to move beyond experimentation and scale AI responsibly across the enterprise.

Dan Roberts: You’ve described AI as an accelerator. What exactly is AI accelerating inside GE Aerospace?

David Burns: At GE Aerospace, AI is used across our operations as an accelerator to Flight Deck, our proprietary lean operating model, and is applied to all key aspects of the business — design, manufacture, sales, and services. We identify and solve problems with Flight Deck and use AI to accelerate our problem-solving in ways we can genuinely feel, enabling us to identify issues earlier, solve problems faster for our customers, and improve how work gets done.

For example, we are also using AI in:

Design: While traditional processes for developing engine design concepts take months of manual work, the GE Aerospace Research Center built a proprietary generative AI application capable of producing hundreds of design concepts. As a result, the team produced the hypersonic ramjet engine design concept that met all regulatory requirements more than 90% faster than before, highlighting how AI is possible in engine design to support engineers bringing new technologies to market faster.

Manufacture: Our team in Indianapolis used an AI coding assistant to automate a part quality inspection workflow, reducing 8 hours of manual measurement data entry for complex parts to just 3 seconds while improving data accuracy and inspection consistency. This has improved both the quality and efficiency for clearing parts to build, which helps drive on-time engine deliveries.

Sales: Based on customer feedback that GE Aerospace’s responses for proposals needed to be faster, the sales team utilized a generative AI tool to synthesize data and produce deal proposals. The tool improved customer response time by more than two weeks for the GEnx team through reduced proposal development cycle time and standardized creation of more comprehensive deal proposals.

Service: When LEAP engine rebuilds faced potential turnaround time (TAT) challenges due to material availability at our Maintenance, Repair and Overhaul (MRO) sites, our team in Lafayette, Indiana, applied AI to help reduce delays for customers. Using Daily & Visual Management, they surfaced material flow challenges and their underlying drivers, leading to a new AI solution that leverages data to predict when and where parts are needed faster to reduce delays for our customers with an approximately six-day turnaround time improvement, 16% increase in on-time material orders, and 15% increase in on-time material delivery.

Ultimately, by leveraging AI, Flight Deck helps us eliminate waste and identify and accelerate the most value-added steps for our customers, be it designing a part faster or responding to a customer request faster. And I would underscore that it’s value through the eyes of our customer. How we define value is not what we internally say; it’s how our customers define value, and how we’re working to be more customer-driven.

GE Aerospace has been investing in analytics, machine learning, and digital capabilities for more than a decade. What advantages does that foundation create as you move into the generative AI era?

We’ve built one of the largest AI patent portfolios in the aviation industry through years of investment and supercomputing through digital technologies, and we continue to do work on our core transactional systems and our data foundations, so that way our data is AI-ready. This has allowed us to build our own AI capabilities and strong talent base. For example, the generative AI app we built to create new propulsion systems design was built in house by GE Aerospace scientists at the GE Aerospace Research Center.

At the same time, our knowledge and familiarity with the landscape has allowed us to make connections with tech companies, including one where we’re using agentic AI in a multi-year partnership to predict demand and identify constraints to enhance production readiness in the Defense business.

We were fortunate to have leaders who were very smart to invest in data scientists 10, 15 years ago, and we’re getting to leverage that talent today. The lesson there is that is you always have to be thinking long term when you’re talking about talent, because you may not know exactly how the world will play out, but making sure you have the best athletes on the field to run the race becomes critically important. For us, some of those investments we did around our people is what’s paying off today.

One of the biggest challenges facing CIOs today is balancing innovation with risk management. How do you approach that balance in an industry where safety, reliability, and trust are non-negotiable?

It’s all about risk tolerance. There are certain areas in our business where we don’t have high risk tolerance, and we’re very methodical and cautious about how we deploy technology into those uses and have very stringent processes that we comply consistently with. In areas that are not safety and quality critical, we are more aggressive in looking at how we can use technology to deliver more for our customers and to make our employees more effective. That’s where we strike the balance, and at the end of the day, it’s about making sure we’re never compromising safety or quality in what we do.

As for the process, we start with Flight Deck and focus AI where it can help solve critical challenges for our customers and with the highest impact to customer outcomes, enhancing safety, quality, delivery, and cost, in that order, to solve problems that matter most and keep fleets flying. ​

We have three guiding principles for safe and responsible AI use: 

• Trust: The data-informing AI must be known, trusted, and reliable. 
• Transparent: The AI must be transparent and repeatable, which means we need to know what is informing an AI model’s insights and actions.
• Human: A human must always be in the loop and make the final decision.    

Our culture of discipline also plays an important role. Our business variation is challenging, so one of the core fundamentals of Flight Deck is standard work. It’s embedded into our culture, and it’s the base expectation that we operate with standards that we’re continuously improving.

Many organizations are struggling to move from AI pilots to enterprise-scale value. What lessons have you learned about successfully scaling AI across a large, complex organization?

AI is a tool that strengthens the capabilities of skilled employees; it is not a substitute for their judgment, experience, or accountability. So we focus on testing and validating AI solutions through pilots before scaling, and look for AI applications that meaningfully change how work gets done.

Early on, when we started doing a lot of our generative AI work, we focused on 14 big problems in the business, and we didn’t let ourselves stray all over the place. We also didn’t look at it as a technology solution. We looked at the process and where technology played into the process, and then we embedded AI into those core processes. So now, it’s not a separate thing where you go do AI. It’s embedded in the workflow of how things get done.

That gave us a foundation to learn and grow from that we’ve now applied. We’re not trying to create popcorn AI solutions all over the place. We’re trying to transform our business processes. In some cases, we’re doing good old process improvement, lean process improvement, eliminating waste, not necessarily a technology play. In other places, we’re applying technology that’s helping to lift us up and accelerate value by embedding it into the way work gets done, with a little bit of burning the boats behind you. You’re not able to do it the old way. You’ve got to use the tools. You’ve got to use the technology, because it’s the best-known way of doing it. The technology becomes part of the standard work.

That’s why one of the biggest lessons in scaling AI is that success starts with the core fundamentals and understanding the problem you’re trying to solve. It’s critical to test and validate AI solutions before they are deployed at scale to ensure they improve how work gets done and become embedded in our workflows. If you do not have strong standard work and transparent and reliable data in place, it becomes difficult to move beyond pilot stage and create repeatable value at scale.

Every day brings a new AI announcement, new model, or new prediction about the future. How do you separate what is truly meaningful from what is simply noise, and what advice would you give other leaders trying to do the same?

First and foremost is starting with the problem being solved, not the solution. If you’ve got a hammer that you want to use, everything starts looking like a nail. The most effective use of AI begins with an understanding of the problem that needs to be solved, then determining whether AI is the right tool to address it.

As far as dealing with distractions, and there are a lot of them right now, it’s important to try a lot of things, but very quickly, and then make decisions on which are the bets you want to make and spend more time and more money on and which are the ones you want to pivot away from. We spend a lot of time doing quick experiments with technology and then having the courage to stop something when it’s not working.

What excites you most about the future intersection of AI, engineering, manufacturing, and aerospace? And what should CIOs be doing today to prepare for that future?

Across aviation, AI is already helping to enhance safety, support more efficient operations, strengthen the resilience of global fleets, and improve the overall passenger experience. That includes GE Aerospace. These benefits come from investing not only in technology, but also in people, capacity, and trusted partnerships. 

They also depend on building mature, fully connected data threads through manufacturing and services that will drive higher value across our operations. The challenge will be ensuring that we enable this data thread across our operations to support AI solutions that will be developed and deployed.

The most important thing is to understand that the role of digital technology and information technology is fundamentally going to change. When I came out of university, the only people that knew how to do software coding were computer scientists or information systems majors. We used to frown upon shadow IT, but the reality is, now everyone coming out of college knows how to do some level of software development, and AI tools are only going to make that easier.

What CIOs need to start doing today is prepare for the future. The big questions they need to answer: How are they going to make sure they’ve got the platforms and the data set up in a way to serve a workforce that is capable of doing true citizen development, able to develop their own applications, their own solutions? How do you govern that from a data perspective, from a data privacy perspective, from a cybersecurity perspective, while not stifling but enabling the innovation of all those smart people that we’re hiring?

While many organizations search for shortcuts to AI success, GE Aerospace’s disciplined investment in data, analytics, talent, and operational excellence sets the company apart. Burns’ experience offers a clear lesson for CIOs: Creating the greatest value from AI requires building the capabilities, culture, and foundations that allow AI to amplify what the organization already does exceptionally well. For more from his leadership playbook, tune in to the Tech Whisperers.

The race to adopt AI has left many CIOs wrestling with a fundamental question: How do you move faster without introducing unacceptable risk?

Few leaders face that challenge at a higher level than David Burns, CIO of GE Aerospace. Building on the company’s decade of experience applying AI across its business, Burns is helping lead the next phase of the company’s digital transformation by leveraging AI to simplify and automate processes. Burns’ experience shows how AI can accelerate innovation, improve decision-making, and create value for the business and customers while maintaining the trust, safety, and operational rigor expected in the aerospace industry.

In a recent episode of the Tech Whisperers podcast, Burns opened up his playbook for leading organizations through turbulence. In this conversation, edited for length and clarity, he shares more practical lessons for technology leaders who are seeking to move beyond experimentation and scale AI responsibly across the enterprise.

Dan Roberts: You’ve described AI as an accelerator. What exactly is AI accelerating inside GE Aerospace?

David Burns: At GE Aerospace, AI is used across our operations as an accelerator to Flight Deck, our proprietary lean operating model, and is applied to all key aspects of the business — design, manufacture, sales, and services. We identify and solve problems with Flight Deck and use AI to accelerate our problem-solving in ways we can genuinely feel, enabling us to identify issues earlier, solve problems faster for our customers, and improve how work gets done.

For example, we are also using AI in:

Design: While traditional processes for developing engine design concepts take months of manual work, the GE Aerospace Research Center built a proprietary generative AI application capable of producing hundreds of design concepts. As a result, the team produced the hypersonic ramjet engine design concept that met all regulatory requirements more than 90% faster than before, highlighting how AI is possible in engine design to support engineers bringing new technologies to market faster.

Manufacture: Our team in Indianapolis used an AI coding assistant to automate a part quality inspection workflow, reducing 8 hours of manual measurement data entry for complex parts to just 3 seconds while improving data accuracy and inspection consistency. This has improved both the quality and efficiency for clearing parts to build, which helps drive on-time engine deliveries.

Sales: Based on customer feedback that GE Aerospace’s responses for proposals needed to be faster, the sales team utilized a generative AI tool to synthesize data and produce deal proposals. The tool improved customer response time by more than two weeks for the GEnx team through reduced proposal development cycle time and standardized creation of more comprehensive deal proposals.

Service: When LEAP engine rebuilds faced potential turnaround time (TAT) challenges due to material availability at our Maintenance, Repair and Overhaul (MRO) sites, our team in Lafayette, Indiana, applied AI to help reduce delays for customers. Using Daily & Visual Management, they surfaced material flow challenges and their underlying drivers, leading to a new AI solution that leverages data to predict when and where parts are needed faster to reduce delays for our customers with an approximately six-day turnaround time improvement, 16% increase in on-time material orders, and 15% increase in on-time material delivery.

Ultimately, by leveraging AI, Flight Deck helps us eliminate waste and identify and accelerate the most value-added steps for our customers, be it designing a part faster or responding to a customer request faster. And I would underscore that it’s value through the eyes of our customer. How we define value is not what we internally say; it’s how our customers define value, and how we’re working to be more customer-driven.

GE Aerospace has been investing in analytics, machine learning, and digital capabilities for more than a decade. What advantages does that foundation create as you move into the generative AI era?

We’ve built one of the largest AI patent portfolios in the aviation industry through years of investment and supercomputing through digital technologies, and we continue to do work on our core transactional systems and our data foundations, so that way our data is AI-ready. This has allowed us to build our own AI capabilities and strong talent base. For example, the generative AI app we built to create new propulsion systems design was built in house by GE Aerospace scientists at the GE Aerospace Research Center.

At the same time, our knowledge and familiarity with the landscape has allowed us to make connections with tech companies, including one where we’re using agentic AI in a multi-year partnership to predict demand and identify constraints to enhance production readiness in the Defense business.

We were fortunate to have leaders who were very smart to invest in data scientists 10, 15 years ago, and we’re getting to leverage that talent today. The lesson there is that is you always have to be thinking long term when you’re talking about talent, because you may not know exactly how the world will play out, but making sure you have the best athletes on the field to run the race becomes critically important. For us, some of those investments we did around our people is what’s paying off today.

One of the biggest challenges facing CIOs today is balancing innovation with risk management. How do you approach that balance in an industry where safety, reliability, and trust are non-negotiable?

It’s all about risk tolerance. There are certain areas in our business where we don’t have high risk tolerance, and we’re very methodical and cautious about how we deploy technology into those uses and have very stringent processes that we comply consistently with. In areas that are not safety and quality critical, we are more aggressive in looking at how we can use technology to deliver more for our customers and to make our employees more effective. That’s where we strike the balance, and at the end of the day, it’s about making sure we’re never compromising safety or quality in what we do.

As for the process, we start with Flight Deck and focus AI where it can help solve critical challenges for our customers and with the highest impact to customer outcomes, enhancing safety, quality, delivery, and cost, in that order, to solve problems that matter most and keep fleets flying. ​

We have three guiding principles for safe and responsible AI use: 

• Trust: The data-informing AI must be known, trusted, and reliable. 
• Transparent: The AI must be transparent and repeatable, which means we need to know what is informing an AI model’s insights and actions.
• Human: A human must always be in the loop and make the final decision.    

Our culture of discipline also plays an important role. Our business variation is challenging, so one of the core fundamentals of Flight Deck is standard work. It’s embedded into our culture, and it’s the base expectation that we operate with standards that we’re continuously improving.

Many organizations are struggling to move from AI pilots to enterprise-scale value. What lessons have you learned about successfully scaling AI across a large, complex organization?

AI is a tool that strengthens the capabilities of skilled employees; it is not a substitute for their judgment, experience, or accountability. So we focus on testing and validating AI solutions through pilots before scaling, and look for AI applications that meaningfully change how work gets done.

Early on, when we started doing a lot of our generative AI work, we focused on 14 big problems in the business, and we didn’t let ourselves stray all over the place. We also didn’t look at it as a technology solution. We looked at the process and where technology played into the process, and then we embedded AI into those core processes. So now, it’s not a separate thing where you go do AI. It’s embedded in the workflow of how things get done.

That gave us a foundation to learn and grow from that we’ve now applied. We’re not trying to create popcorn AI solutions all over the place. We’re trying to transform our business processes. In some cases, we’re doing good old process improvement, lean process improvement, eliminating waste, not necessarily a technology play. In other places, we’re applying technology that’s helping to lift us up and accelerate value by embedding it into the way work gets done, with a little bit of burning the boats behind you. You’re not able to do it the old way. You’ve got to use the tools. You’ve got to use the technology, because it’s the best-known way of doing it. The technology becomes part of the standard work.

That’s why one of the biggest lessons in scaling AI is that success starts with the core fundamentals and understanding the problem you’re trying to solve. It’s critical to test and validate AI solutions before they are deployed at scale to ensure they improve how work gets done and become embedded in our workflows. If you do not have strong standard work and transparent and reliable data in place, it becomes difficult to move beyond pilot stage and create repeatable value at scale.

Every day brings a new AI announcement, new model, or new prediction about the future. How do you separate what is truly meaningful from what is simply noise, and what advice would you give other leaders trying to do the same?

First and foremost is starting with the problem being solved, not the solution. If you’ve got a hammer that you want to use, everything starts looking like a nail. The most effective use of AI begins with an understanding of the problem that needs to be solved, then determining whether AI is the right tool to address it.

As far as dealing with distractions, and there are a lot of them right now, it’s important to try a lot of things, but very quickly, and then make decisions on which are the bets you want to make and spend more time and more money on and which are the ones you want to pivot away from. We spend a lot of time doing quick experiments with technology and then having the courage to stop something when it’s not working.

What excites you most about the future intersection of AI, engineering, manufacturing, and aerospace? And what should CIOs be doing today to prepare for that future?

Across aviation, AI is already helping to enhance safety, support more efficient operations, strengthen the resilience of global fleets, and improve the overall passenger experience. That includes GE Aerospace. These benefits come from investing not only in technology, but also in people, capacity, and trusted partnerships. 

They also depend on building mature, fully connected data threads through manufacturing and services that will drive higher value across our operations. The challenge will be ensuring that we enable this data thread across our operations to support AI solutions that will be developed and deployed.

The most important thing is to understand that the role of digital technology and information technology is fundamentally going to change. When I came out of university, the only people that knew how to do software coding were computer scientists or information systems majors. We used to frown upon shadow IT, but the reality is, now everyone coming out of college knows how to do some level of software development, and AI tools are only going to make that easier.

What CIOs need to start doing today is prepare for the future. The big questions they need to answer: How are they going to make sure they’ve got the platforms and the data set up in a way to serve a workforce that is capable of doing true citizen development, able to develop their own applications, their own solutions? How do you govern that from a data perspective, from a data privacy perspective, from a cybersecurity perspective, while not stifling but enabling the innovation of all those smart people that we’re hiring?

While many organizations search for shortcuts to AI success, GE Aerospace’s disciplined investment in data, analytics, talent, and operational excellence sets the company apart. Burns’ experience offers a clear lesson for CIOs: Creating the greatest value from AI requires building the capabilities, culture, and foundations that allow AI to amplify what the organization already does exceptionally well. For more from his leadership playbook, tune in to the Tech Whisperers.

Die Normen der Softwareentwicklung sind weiterhin gültig. Zumindest offiziell sind robuste CI/CD-Pipelines, elegante Architekturmuster und wartbarer Code nach wie vor gesetzt.

Wenn wir unbeobachtet sind, zeigt sich dann in vielen Fällen die Realität: Wir hängen wie entrückte Magier mit manischem Glanz in den Augen über unseren Konsolen und beschwören Modelle und Agenten, um uns voll und ganz dem KI-Rausch hinzugeben.

Dabei begehen wir nicht selten Development-Sünden, die Fred Brooks die Schamesröte ins Gesicht getrieben hätten. So wie die folgenden sieben. Vorsicht, Ironie – stellenweise.

1. Grundlagenwissen für überflüssig halten

Objektorientierte oder funktionale Programmierung? CAP-Theorem? DRY-Prinzip? Design-Pattern? Können Sie vergessen. Ebenso Frameworks, Runtimes und Deployment-Plattformen.

Die KI weiß schließlich ganz genau, was bereits vorhanden ist und welche Tools zu nutzen sind. So haben wir als Entwickler auch mehr mentale Bandbreite, um uns Nebenprojekten zu widmen. Zum Beispiel einem Roman über die KI-Weltherrschaft.

2. Dokumentationen links liegen lassen

„RTFM“ nutzen viele Developer auch heutzutage noch gerne – auch wenn sie selbst eigentlich seit 2023 keine einzige Seite einer Anbieter-Dokumentation mehr gelesen haben. Löst ein Package eine bizarre Exception aus, wird weder der Execution-Pfad überprüft noch erfolgt ein Blick in die Release Notes. Stattdessen werden alle 200 Zeilen des Stack-Trace kopiert und in eine KI geworfen – in der Erwartung, dass diese uns dann löffelweise mit der Lösung füttert.

Oder es wird direkt eine ADE auf den Fehler angesetzt. Die findet den Fehler und fragt uns dann nur noch, ob die Lösung so korrekt ist. Manche werfen dann eventuell einen Blick auf die Beschreibung dieser Lösung – insofern sie die KI nicht vorher schon auf „Auto-Confirm“ umgestellt haben.

So werden wir zu glorifizierten Copy-Paste-Orchestratoren – die einfach nur darauf hoffen, dass der stochastische Papagei hinter dem Prompt die Syntax richtig errät.

3. Backend-Struktur ignorieren

KI-berauschte Devs geben manchmal vor, Datenflüsse akribisch designt, relationale Einschränkungen sorgfältig ausgearbeitet und API-Beziehungsgeflechte gewissenhaft abgebildet zu haben. Auch wenn wir eigentlich nur die KI angewiesen haben, ein modernes Deployment-Gerüst zu bauen und dieses mit einer Backend-Datenbank zu verknüpfen.   

Dabei wurden Security-Regeln und Schemata erstellt, die wir unter Umständen nicht vollständig verstehen. Aber solange es funktional aussieht, wird es schon gut gehen. Eventuell wurden auch Infrastructure-as-Code-Skripte generiert, die Cloud-Ressourcen bereitstellen. Sicher wird sich jemand anderes darum kümmern, dass das kein Loch ins Budget frisst. Wahrscheinlich, indem er die Metriken in einen anderen Chatbot einspeist.

Ist aber auch egal, weil das Mittagessen wartet.

4. Inzestuöses Testing fördern

Test-driven Development war immer schon ein schöner Traum, der – wenn man ihn lebt – in Dependency-Wildwuchs ausarten kann. Es ist also eine super Sache, dass wir heutzutage mit KI fast mühelos eine Testabdeckung von 95 Prozent erreichen können. Warum sollten wir die Maschine das nicht direkt mit übernehmen lassen, wenn sie auch alles andere automatisiert erstellt?

So kann man auch jedem der es wissen will (oder der gerade keine Fluchtmöglichkeit hat), das Narrativ von der erstaunlichen Testabdeckung unter die Nase reiben und sich in ausgiebigen Schwärmereien über die automatisierte Qualitätssicherung ergehen. Was dabei geflissentlich verschwiegen wird: Die komplexe Anwendungslogik und die Testsuite wurden von derselben KI generiert. Diese validiert also genau den Code, den sie zuvor zusammengeschustert hat.

Daraus entsteht ein hermetisch abgeriegelter Kreislauf der algorithmischen Selbstbeweihräucherung: Die Mocks, Randfälle und Assertions werden zur Echokammer für die ursprünglichen Annahmen des KI-Modells. Die Maschine benotet also ihre eigenen Hausaufgaben und gibt sich dafür eine Eins mit Sternchen.

Das wird von einigen von uns allerdings gerne in Kauf genommen, denn wenn der Code verändert werden muss, zaubert die KI auch dafür mühelos neue Tests aus dem Hut.

5. KI-Ergebnisse als Strategie ausgeben

Dokumente zu designen, kann KI erstaunlich gut: Diese sind meist apart formatiert, wirken schlüssig und schlagen nahtlos die Brücke zwischen übergeordneten Geschäftszielen und detaillierten technischen Specs. Und: Sie enthalten auch die tollen Sequenz-Diagramme, die das Management so schätzt.

Architekturvorschläge, die auf diese Art und Weise entstanden sind, werden regelmäßig in Sprint-Planungs-Meetings präsentiert – und kommen beim Rest des Teams oft gut an. Schließlich weiß auch niemand, dass in den hochgelobten Vorschlag ungefähr vier Sekunden „Mühe“ investiert wurden.

Ignoriert wird dabei, dass solche KI-generierten Dokumente gleichermaßen anfällig für fatale Mängel in Bezug auf Scope und Alignment sind, wie von Menschenhand gemachte. Aber wenn das Projekt schon scheitert, war wenigstens das Markdown schön klar und die Bulletpoints echt überzeugend. Das wahre Ausmaß des folgenden Desasters wird zwar erst erkannt, wenn es schon viel zu spät ist – aber immerhin war der Ansatz visionär.

6. Heimlich dem Vibe Coding verfallen

Vibe Coding ist unter Devs in sozialen Kanälen regelmäßig eine Lachnummer. Und auch in Slack-Channels werden regelmäßige augenrollende Emojis verschickt, wenn es um das Thema geht. Nach außen möchten wir alle möglichst professionell wirken.

Wenn niemand zusieht, wird dann unter Umständen aber doch der heimlichen Vibe-Coding-Leidenschaft gefröhnt: Unausgereifte Gedanken und ein Drink, sind alles was man braucht, um entspannt dabei zusehen zu können, wie die KI ihre “Coding-Magie” entfaltet.

Daraus entsteht dann vielleicht endlich ein funktionierender Ultima-V-Klon oder eine App, um Krypto-Protfolios zu tracken, die nach dem Interface aus „Neuromancer“ aussieht. Und zwar in 30 Sekunden. Das berauscht. Und kann süchtig machen. Leider ganz besonders, wenn man tief in der harten, altmodischen Realität des Programmierhandwerks verwurzelt ist.

7. Prompts als Allheilmittel betrachten

Ahnlich wie die Figur von Adam Sandler in „Der schwarze Diamant“ sind manche Devs davon überzeugt, dass mit der nächsten Runde alles besser wird – nur bezogen auf Prompts. Wenn die Dinge aus dem Ruder laufen, bevorzugen diese regelmäßig, den KI-Prompt zu verfeinern – statt sich selbst dem Komplexitätsdickicht zu widmen.

Der gleiche fehlerbehaftete Stack Trace wird dann unerbittlich immer und immer wieder in den Chat gehämmert, das Modell auf einen immer schmaleren Pfad gezwungen – solange, bis der Code endlich keine Fehler mehr ausgibt. Debugging und Variablen-Tracing sind so gut wie nicht mehr existent, Funktionen werden nicht mehr schrittweise geprüft. Stattdessen wird unermüdlich iterativer Druck auf die KI ausgeübt, bis diese kapituliert. Und dann geht’s ab in die Produktion.

So fließt am Ende ähnlich viel Zeit und Energie in den Kampf mit dem Bot, wie früher in die manuelle Syntaxerstellung. (fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

Java Development Kit (JDK) 28, a non-LTS (Long-Term Support) or “feature release” of standard Java due in March 2027, has started to take shape. Features listed for JDK 28 now include a preview of value objects, switching the default mode of the Shenandoah garbage collector to generational mode, and a preview of strict field initialization in the Java Virtual Machine (JVM).

As a non-LTS release, JDK 28 will be backed by six months of support by Oracle.

The three features currently targeted to JDK 28 include the following:

• Introduce value objects, which are immutable and lack object identity. Value objects are distinguished by the values of their fields, and can be represented by the JVM in ways that improve performance. A goal of the feature is to give developers a programming model for immutable data in which the == operator, and all other operations, distinguish objects by the values of their fields rather than their identities. Value objects is a preview language and VM feature.
• Switch the default mode of the Shenandoah Garbage Collector (GC) to the generational mode and deprecate the non-generational mode, with the intent to remove it in a future release. Goals include signaling the intent that future development will focus on generational mode, and reducing the maintenance cost of supporting two different modes. However, it is not a goal to remove non-generational mode at this time.
• Introduce strictly-initialized fields in the JVM. Such fields must be initialized before they are read, thus default values such as 0 or null are never observed. For strictly-initialized fields that are final, the same value is always observed. A goal is offering designers of JVM-based programming languages a model for field initialization, which has stronger integrity guarantees than the present model. This is a preview VM feature.

The predecessor to JDK 28, JDK 27, is due September 15. JDK 27 also is a non-LTS release that will be backed by six months of support by Oracle.

Modern attacks increasingly begin with the web application.

Customer portals, partner platforms, APIs, external business applications, and AI-powered services have become the front door to the enterprise. The systems organizations build to create value are now the same systems attackers target for initial access.

For years, security teams have invested heavily in protecting networks, endpoints, identities, and cloud infrastructure. Those investments remain essential, but the way attackers gain initial access has changed. Business-critical applications are internet-facing, constantly evolving, deeply connected to enterprise systems, and often changing faster than organizations can continuously validate them.

Artificial intelligence is accelerating this shift. The time between vulnerability discovery and exploitation continues to shrink, allowing attackers to identify and weaponize weaknesses at machine speed. Yet while attacks have evolved, much of security validation still reflects yesterday’s architecture.

That shift is exactly why we built NodeZero WebApp, extending autonomous attack validation to where modern attacks increasingly begin.

Validation still reflects yesterday’s architecture

Most organizations still organize security by technology. Application security teams test web applications. Identity teams validate authentication and access controls. Cloud teams secure cloud infrastructure, while infrastructure teams assess networks and endpoints. Each discipline performs valuable work.

The problem is that attackers don’t organize themselves the same way. They move across technologies, chaining weaknesses together until they reach their objective. A vulnerable application becomes compromised credentials. Compromised credentials become identity abuse. Identity abuse becomes access to cloud resources, infrastructure, and eventually the business systems they were after all along.

Taken together, this means security validation often stops where the next stage of the attack begins.

Attack paths don’t stop at the web application

A SQL injection isn’t the outcome. It’s the beginning of an attack path. An authentication weakness isn’t the breach. It’s simply the first opportunity to move deeper into the environment.

The question isn’t whether a vulnerability exists. Security teams already have plenty of ways to answer that. The real question is what an attacker can do after exploiting it.

Can they compromise identities? Reach sensitive data? Pivot into cloud resources? Move laterally into critical business systems?

Security teams don’t lose because they missed a vulnerability. They lose because they never validated where it could lead. Modern attacks don’t unfold within a single technology stack. They move across applications, identities, infrastructure, and cloud environments until they create business impact. Security validation has to reflect that reality.

Security validation has to change

For years, organizations validated individual technologies because that’s how enterprise environments were built. That approach made sense when applications, identities, infrastructure, and cloud platforms operated more independently and attackers moved more slowly.

Today’s attacks don’t respect those boundaries. Validation shouldn’t either.

It has to begin where attackers begin and continue until business impact is understood.

Asking the right question

Many security tools begin with privileged knowledge. They analyze source code, configuration files, or other internal artifacts before identifying weaknesses. Those approaches answer important questions during software development and secure coding, and they remain an important part of building secure software.

Attackers begin with what they can reach, interacting with an application as it exists in production, scouring exposed source code looking for novel vulnerabilities and stored identities, authenticating when they can, observing how it behaves, and looking for opportunities to move deeper into the environment. Every decision is driven by what the application reveals, not what its developers intended.

Security validation should begin with the same perspective an attacker has, and answer the same question every attacker is trying to answer:

What can I actually reach from here?

That shift changes more than where testing starts. It fundamentally changes what security teams learn from the exercise.

src="https://b2b-contenthub.com/wp-content/uploads/2026/08/configurationimages.png" alt="horizon3">Security validation shouldn’t stop at anonymous pages. NodeZero WebApp safely validates authenticated application workflows, helping organizations assess the same privileged experiences attackers seek after gaining initial access.

Click here to discover how NodeZero WebApp addresses modern attacks.

See NodeZero WebApp in action

Modern attacks start with web applications — but they rarely end there. Join our live webinar to see how NodeZero WebApp safely validates real attack paths from authenticated applications into identity, cloud, and infrastructure, helping you understand the business impact of exploitable weaknesses before attackers do.

Register for our webinar

Visual Studio Code 1.132, the latest version of Microsoft’s popular, open-source code editor, has been released. The brings improvements to built-in dictation, side chats, and support for commenting on web elements in the integrated browser.

VS Code 1.132 was released August 5. The update can be downloaded for Windows, Linux, and macOS at code.visualstudio.com.

With VS Code 1.132, the built-in multilingual dictation function lets developers dictate in multiple languages using an on-device model that follows language preference or detects the language automatically. The built-in dictation converts speech to text in chat inputs, editors, and terminals. Dictation now uses multilingual Nemotron 3.5 as the default on-device model. Plus, terminal dictation now applies shell-aware cleanup, so spoken commands preserve shell syntax.

Also in VS Code 1.132, developers can open a side chat by typing /bt in the chat input. A side chat shares the context and prompt cache of the primary chat, but allows developers to ask the agent questions about the current turn without interrupting the turn. Similarly, developers can select text in a chat response to ask contextual questions about that response.

Other new capabilities and improvements in VS Code 1.132:

• The integrated browser adds support for selecting web page elements and annotating them with agent feedback. Users can trigger this mode by using the workbench.action.browser.addElementCommentToChat keyboard shortcut.
• Active development continues on the agent host, a new VS Code feature that lets users connect to the same agent session from multiple VS Code windows. The agent host runs agent harnesses such as Copilot, Claude, and Codex in a dedicated process based on the Agent Host Protocol (AHP).
• In the previous release, Microsoft introduced the hybrid Markdown editor, which combines rendered Markdown with in-place editing and agent-actionable comments. In this release, Markdown diffs can be opened in the hybrid Markdown editor. 
• Expanded terminal output in chat now reflows to the available width as the view is resized. Previously, output used a fixed width, which caused lines to wrap too early and left unused space in wider views.

Arista Networks shared some good news about its earnings and future directions during its second-quarter earnings call this week.

For starters, Arista reported its first-ever $3 billion quarter. The company logged revenue of $3.036 billion, an increase of 12.1% compared to the first quarter of 2026, and an increase of 37.7% from the second quarter of 2025. Just five years ago, Arista reported $2.9 billion in revenue for the entire 2021 year, noted CEO Jayshree Ullal. 

“Customers see networking as the central nervous system for infrastructure from the client to campus to data and AI centers,” Ullal said. “Our AI fabrics momentum with Etherlink switches now exceeds 100 cumulative customers from the initial four to five customers I spoke of in 2024.” 

Ullal said the company is seeing growth in all sectors—from back-end AI fabrics to the core data-center front end, to adjacent campus and routing businesses. The scale-across switching and routing market is forecast to hit between $15 billion and $20 billion by 2030, for example, positioning Arista well for growth, Ullal said.

“We are now projecting 40% annual growth, which is an incremental $2.1 billion over our 2025 Analyst Day goal of $10.5 billion, and an incremental $1.1 billion over our recent projections of $11.5 billion in May of 2026,” Ullal said.

So what exactly is working? Arista highlighted a number of areas.

Supply chain pressures beginning to ease

Just last quarter, Arista said supply-chain pressures on networking components—memory, chips, and wafers—were leading to ongoing shortages and rising costs.

With a lot of work, some of that pressure has eased, reported Todd Nightingale, president and COO of Arista. “Arista has spent the last six months improving our supply chain to meet growing product demand, and we’re seeing significant improvements,” Nightingale said. “We’ve secured multiyear agreements with leading vendors of strategic components, qualified new suppliers in key areas to limit risk and built out supply chains for next gen AI technologies.”

“Relationships with our strategic silicon vendors continue to be strong, with really excellent collaboration in both supply chain and technical engagements,” Nightingale said. “Our memory supply has been secured for 2026, and we have extended visibility well into 2027 across DDR4, DDR5 and NAND memory. And importantly, we’ve increased our resiliency through optionality and expanded vendor qualification. For PCBs and optics, we’re now able to build capacity in a 12-month window and have strengthened our engagement and commitments from key suppliers. We’ve improved our lead times and inventory management of thousands of component SKUs, improving sub-component pipelining and multi-sourcing, and providing increased flexibility with reduced inventory risk,” Nightingale said.

Nightingale noted, too, that Arista has established a liquid-cooling supply chain “capable of driving and delivering the next generation of AI infrastructure. This includes cold plate, quick disconnect, and tubing vendors with capacity agreements for cutting-edge new AI technology.”

“By focusing on vendor stability and diversity, risk mitigation, and predictable delivery terms, innovation for new AI products, and capacity across our factories, we are making significant improvements and significant capacity increases across our supply chain,” Nightingale said.

Ullal kept things in perspective, however: “I don’t want you to believe that suddenly we waved a magic wand and all our problems have gone away,” she said. “The industry is going to have a two-year problem [with memory and other silicon availability challenges], and I don’t think we get out of it as an industry until 2028. But Arista is taking individually and specifically steps in the first half of this year that we believe will have results in the back half of this year.”

EOS innovations

“I have never witnessed the combination of rapid innovation and scale deployment that we are seeing in AI networks,” said Kenneth Duda, president and CTO of Arista. He highlighted three technologies, all of which are part of the vendor’s EOS operating system, that are helping to drive and differentiate Arista gear: Smart System Upgrade (SSU), Multipath Reliable Connection (MRC), and Segment Routing (SRV6). 

“SSU is the ability to upgrade switch software without any disruption. Frequent upgrades are a hard reality today, especially as AI both uncovers security vulnerabilities and creates tools to exploit them,” Duda said. “While many competing systems require a full reboot to address these issues, leading to expensive and disruptive downtime, Arista EOS handles these upgrades seamlessly.”

In order to maximize xPU utilization, customers need MRC, because in first-generation AI networks, every packet on an XPU-to-XPU flow has to take the same path. “That means if two flows hash to the same length, they both run at half speed. MRC enables senders to spray a single flow across many paths through the fabric, where receivers reassemble any data that arrives out of order, eliminating the performance hit from fabric cache collisions,” Duda said. 

But how is the sender supposed to control which paths deploy or use? That’s where SRV6 comes in. “It’s not new, but using it to load balance an AI fabric, that’s the game changer,” Duda said. “The sender tags each packet with a stack of SRV6 segment IDs dictating the exact path the packet will take. The system then uses real-time congestion signaling to dynamically shift packets away from hotspots.”

“Because Arista EOS provides a single unified operating system, we support this SRv6 intelligence all the way from the scale-out fabric to the long-distance scale-across routing,” Duda said. “It gives our customers the combination of high-quality top performance and operational simplicity that Arista is known for.”

The optics

Optical connection technology continues to move into the AI networking environment, and Ullal said Arista believes the majority of the market will continue using pluggable optics and copper through 2028-2029. “I think there’s very much a philosophy there [of] copper if you can, optics if you must,” Ullal said. 

“I think you’re going to see a lot of copper in that two-meter, three-meter distance, well within a rack, that type of thing, and the importance of pluggable optics. But in some cases, there is a number of instances of proprietary implementations of traditional co-packaged optics (CPO) that’s been floating around,” Ullal said. “Arista is not a fan of five different proprietary implementations.”

Arista’s development team has been working to solve one aspect, which is an open CPO. “We don’t think open CPO is going to happen overnight, but the idea here is to use socketed optical engines, pigtail fibers, and allow these modules to be fully pretested. And whether they’re soldered on the board or nearby, the idea is to have a truly open interface that can operate with multiple vendors and multiple switch configurations,” Ullal said.

“Arista supports open, socketed optical engines rather than multiple proprietary solutions. And CPO/Near Packaged Optics (NPO) are expected to enter trials in 2027 but will remain a small portion near term,” Ullal said.

Arista recently unveiled extended pluggable optics (XPO), a form factor designed specifically for optics at high speed and assembled over 100 optics module suppliers as part of a multi-source agreement to build and support XPO. 

AWS is finally adding native vector search to its managed NoSQL database DynamoDB, which is typically used to store high-volume operational and transactional data.

The update, according to analysts, removes complexity for development teams that are trying to maintain separate vector databases for a rapidly growing class of AI and agentic applications that rely on real-time access to operational and transactional data to improve the accuracy and relevance of their responses.

“This collapses a common two-database architecture into one operational data layer. Developers can update an item and its vector representation together, use familiar DynamoDB APIs, and avoid building a separate synchronization pipeline. That should materially shorten time-to-market for AI features built around existing DynamoDB data,” said Stephanie Walter, practice lead of the AI stack at HyperFRAME Research.

Prior to the update, enterprises using DynamoDB typically had to copy data into OpenSearch or another vector database, such as Pinecone and Weaviate, often using DynamoDB Streams or custom pipelines, which meant operating two data layers and managing embedding generation, backfills, retries, schema changes, security policies, and synchronization, Walter noted.

That dependence on two separate data layers, Walter pointed out, added to query latency and increased the risk of the vector index lagging behind the operational record.

Such delays, according to Ashish Chaturvedi, executive research leader at HFS Research, can have real consequences for AI agents: “If an agent is acting on what it retrieves, a synced-five-minutes-ago copy can mean a confident wrong action.”

Beyond improving data freshness, eliminating a separate vector database could also lower cloud and operational costs, Chaturvedi said: “Maintaining a second database meant paying at least $700 a month for a second database regardless of usage.”

For CIOs, those benefits combined could translate into lower total cost of ownership and simpler governance as enterprises scale AI applications, Chaturvedi added.

“It is a real consolidation for CIOs: fewer systems to secure, no pipelines to maintain, fresh data. Add to it usage-based cost, which means no standing minimums for idle infrastructure, even at trillion-vector scale,” Chaturvedi noted.

The architectural simplification could also make AI adoption easier for business leaders by eliminating the need to staff and govern a second data platform, said Michael Leone, principal analyst at Moor Insights & Strategy.

Native vector search capabilities have been gaining popularity over the past few years. Over the last three years, AWS has steadily expanded vector search across its database portfolio, adding support to Aurora PostgreSQL through pgvector, Amazon MemoryDB for Redis and Amazon DocumentDB as enterprise demand for generative AI applications has grown.

Rivals have followed a similar path, with MongoDB, Microsoft, Google Cloud, Oracle and Couchbase integrating native vector search into their databases to support retrieval-augmented generation (RAG), AI agents and other generative AI workloads.

These announcements themselves reflect a broader convergence in the database market since the rise of generative AI. While specialized vector databases have expanded beyond similarity search by adding SQL, NoSQL and operational database capabilities, mainstream operational databases have been embedding vector search and RAG capabilities into their core platforms, allowing enterprises to consolidate AI and transactional workloads on fewer data platforms.

AWS has not shared details on the rollout of DynamoDB’s native vector search capability, including its availability timeline or the AWS Regions where it will initially be offered.

Data released at this week’s Black Hat security conference suggests the era of manual zero-day hunting and 50-day patch windows is coming to an end. This is a double-edged sword for security professionals: Vulnerabilities can now be found at machine speed, perhaps bringing the discovery time eventually to zero, but it also means that AI-driven threats require autonomous operations to protect the organization.

At the show, Palo Alto Networks unveiled research and platform updates signaling a structural shift in cybersecurity. By deploying an autonomous multi-model AI harness called NOVA (Network and Open-Source Vulnerability Analyzer), Palo Alto demonstrated that frontier AI models can now audit codebases, write proofs of concept, and validate severe security flaws at speeds and scales previously unimaginable. 

To counter that rapidly evolving threat landscape, the vendor simultaneously launched PAN-OS 12.2 Ceres, the operating system for Palo Alto’s firewalls. The release introduces Advanced Virtual Patching, Advanced IP Defense, and autonomous Network Security Agents that neutralize AI-generated exploits at the network level within hours, not months.

The news in brief: scale, speed, and platform defense

The headline numbers from Palo Alto’s research team illustrate the sheer velocity of AI-driven vulnerability discovery:

• 14,090 confirmed vulnerabilities: Identified across 3,915 open-source software (OSS) projects in just two months.
• 99.4% zero-day flaws: Virtually all identified vulnerabilities were previously unreported in public databases.
• 39.7% high or critical severity: Under CVSS 4.0 metrics, nearly 5,600 findings pose severe real-world operational risks.
• PAN-OS 12.2 Ceres rollout: Includes 55+ innovations, highlighted by Advanced Virtual Patching (delivering pre-patch protections via “vaulted protection” engines within hours), Advanced IP Defense (blocking direct-to-IP and proxy evasion attacks), and six role-specific AI Network Security Agents.

The deep dive: challenges of cybersecurity in the frontier era

For years, defenders relied on structural asymmetry. Finding a zero-day flaw was labor-intensive, requiring elite human security researchers to spend weeks or months on manual reverse engineering. That asymmetry has vanished due to the speed of AI advances and the new challenges posed by the frontier era.

1. The death of the patch window

Historically, IT teams had a grace period—an average exposure window of about 55 days to test, stage, and deploy vendor software updates before widespread scanning and exploitation began. Frontier AI has crushed that timeline. Adversaries do not need access to state-of-the-art supercomputers to automate exploit development; off-the-shelf open-weight and proprietary models can analyze public commit logs, reverse-engineer fixes, and generate working weaponized code within hours.

2. Beyond memory corruption: the 92% problem

Traditional automated security scanning relied heavily on fuzzing, which involves pounding a binary with random inputs to trigger memory crashes, null pointer dereferences, or buffer overflows. NOVA’s research reveals that fuzzing-friendly bugs accounted for only 8% of total AI discoveries.

The remaining 92% comprised complex semantic and architectural flaws:

• PHP, Python and Java: Concentrated heavily in broken authorization and access control logic (up to 60% of Python flaws).
• JavaScript/TypeScript: Heavy concentration in code injection, prototype pollution, and Server-Side Request Forgery (SSRF).
• Go: Path traversal and file access issues dominated due to its frequent deployment in microservices and file routing engines.

AI models do not just look for crashes; they analyze the business logic of software, identifying subtle authorization bypasses that static analyzers consistently miss.

2. The power of multi-model complementarity

No single AI model catches everything. NOVA tested an ensemble of frontier models across codebases and found strong model complementarity. In controlled evaluations, Model A found 235 vulnerabilities (185 unique to it), while Model D found 139 (93 unique). Because different models reason about code structures differently, attackers running multiple, distinct AI agents simultaneously will uncover exponentially larger attack surfaces that single-scanner defensive environments miss. 

How Palo Alto Networks flips the script

To survive machine-speed discovery, defensive technology must operate autonomously across the entire vulnerability lifecycle.

• Autonomous agentic discovery (NOVA): NOVA uses an iterative agentic loop. Scoping agents define the scan strategy; discovery agents run parallel code analysis; proof-of-concept agents validate findings deterministically in isolated sandboxes (gVisor/VMs); and gatekeeper agents confirm exploitability before generating remediations. 
• Advanced Virtual Patching: With PAN-OS 12.2 Ceres, Palo Alto Networks deploys inline network protection via its Advanced Threat Prevention (ATP) engines within hours of zero-day discovery. By enforcing network-level filtering before vendor code-level patches are available, organizations achieve a “vaulted protection” shield without forcing system reboots or causing downtime. 
• Ecosystem and supply chain collaboration: Palo Alto Networks proactively reports findings upstream to open-source maintainers, project clearinghouses (such as Project Lightwell and Akrites), and enterprise software partners to address underlying vulnerabilities at the source.

Advice for IT and security professionals

The shift to AI-driven threat discovery means security leaders can no longer rely on traditional patch management cadences. CISOs and IT administrators should take immediate steps to adapt:

• Prioritize network-layer virtual patching: Stop assuming software patches can be tested and deployed quickly enough. Implement inline virtual patching at the firewall, SASE, and perimeter layers to block exploit traffic long before host-level updates are applied.
• Audit open-source supply chains beyond direct imports: Static dependency checking is insufficient. Map deep transitive dependencies. As NOVA proved, a single low-level package flaw (such as an IP parser or zip extractor) can expose thousands of downstream applications.
• Shift focus to identity and access control logic: Because 92% of AI-discovered bugs target application logic and authorization rather than simple memory crashes, re-evaluate application security testing. Prioritize dynamic API testing and identity-centric access rules.
• Prepare for post-quantum and evasive IP threats: Upgrade infrastructure to handle direct-to-IP command-and-control bypasses and use automated management tools to prepare for shorter cryptographic certificate lifecycles.
• Embrace human-in-the-loop automation: Use specialized AI administrative agents for routine network triage and rule configuration, reserving high-value human expertise for complex threat modeling, creative architectural design, and strategic oversight.

The era of AI vulnerability discovery is not a distant future—it is fully operational today. Securing the modern enterprise requires matching machine-speed discovery with machine-speed prevention. It’s time for security pros to stop fearing AI-driven security and embrace it, as the only way to combat AI-driven threats is with AI-enabled defense.

Most enterprises are rushing toward autonomous AI. They shouldn’t. Autonomy you haven’t earned doesn’t speed you up. In fact, it slows you down.

Here’s what I’ve moved our organization toward: a five-stage set of AI adoption maturity benchmarks. It’s a practical framework for understanding where employee development, decision-making and business value intersect. Each stage provides value for your organization. Some roles and functions may only ever reach Stage 1 or 2, while others should be fast-tracked to Stage 5. By understanding this progression, leadership can stop viewing AI as a tool for task delegation and treat it as a catalyst for developing stronger, more decisive and more valuable teams.

Stage 1: Research assistance

You hand people a premium ChatGPT account. Employees stop Googling and start prompting. Their experience improves: no ads, paragraph-form answers instead of blue links. But the underlying dynamic hasn’t changed. Output quality depends on input quality. A vague Google search returns a mess of links. A vague ChatGPT prompt returns a well-formatted mess of paragraphs. If your team didn’t know how to ask a precise question before, they still don’t.
           
The real danger at Stage 1 isn’t the bad answers – it’s the confident-sounding ones. A hallucinated statistic arrives in the same calm, authoritative prose as an accurate one. Teams that don’t verify sources in Google don’t suddenly fact-check ChatGPT. Before moving to Stage 2, your team needs to develop the instinct to ask, “How do I know this is true?”

Stage 2: Task assistance

The next stage uses AI tools to complete tasks. It starts simply: “I need to write this email,” or “Make a spreadsheet to track open items.”

The average employee takes what AI produces and passes it off without revision. At best, their efforts pass muster, with only a dash of workslop. At worst, the flood of unchecked AI outputs creates rework for teammates and clients.

Another employee further along in Stage 2 may augment what AI produces. That impulse serves them well. But if they default to editing AI output rather than dictating the rules for what AI should produce, they can easily spend more time editing AI’s work than creating work from scratch.

For employees whose work will largely remain in Stage 2, the focus should be on writing more precise prompts. The instinct to edit AI output isn’t wrong. The problem arises when the prompt is a rough starting point rather than a detailed spec. AI cares that your instructions are clear, specific and unambiguous. Get the spec right up front.

Stage 3: Workflow integration

My daughter’s class recently had an assignment: write a paper on the causes of the Civil War.

Her teacher knew what was going to happen. Every 11-year-old would go home and use ChatGPT to write a five-paragraph essay. So, she changed the exercise. The class generated and printed out the essay. Then, the teacher explained how to annotate, how to ask follow-up questions and how to revise in ChatGPT using the marked-up draft.

The same three-step sequence — assemble context, build the prompt, edit hard — applies when someone writes a post-mortem. The temptation is to skip straight to the draft. Pull the incident data, ask Gemini for a timeline and root cause analysis, clean it up, get a quick peer review and send it.

An engineer working at Stage 3 does what the teacher did. First, they assemble context: the Slack thread where someone flagged the anomaly two hours before the alert fired, the Jira ticket, the gap in monitoring that nobody documented. Then they build a prompt that reflects the full context and generate a draft. Now the red pen comes out: push back on the root cause analysis, add the institutional context Gemini couldn’t know, tighten the remediation steps until they’re actionable.

The result is a better document — and an engineer who understands what failed and builds a better repeatable process. Saving time on a first draft is a fine side effect. The goal is to produce a final draft that’s worthy of review.

Stage 4: Guided automation

The fourth stage is where collaboration becomes self-sustaining. You’re no longer asking AI to help you do a task. You’re asking it to run the task and surface the decisions that require your judgment.

My LinkedIn workflow is a good example of what this looks like in practice.

A couple of years ago, I would read an article, develop a point of view, write two or three paragraphs and publish. Not bad, but dependent on me having the time and cognitive bandwidth.

The friction was the 15 decisions that came before drafting: Which angle is worth pursuing? Does this use my voice? Have I said this before?

So, I started researching my patterns. First, I fed Claude my prior LinkedIn posts and prompted it to analyze my tone, sentence patterns and structural habits. I didn’t ask it to “describe my voice” – that gets you a paragraph of flattering generalities. This analysis became the base layer of the tool.

Then I added a second layer: LinkedIn-specific rules and AI writing patterns to avoid. That context got embedded alongside the voice analysis.

Now the workflow runs like this. I click a link, save the article, highlight and annotate the sections that interest me. My Claude Managed Agent picks up the annotation, infers what I found worth engaging with and writes four drafts with meaningfully different angles on the source material. It compares each draft against my post history and proposes two. I read the proposals, pick one, edit and authorize publication with Buffer.

The automation didn’t remove my judgment from the process. It freed me from work that didn’t depend on judgment. Now I do the work that matters: deciding what to say, identifying patterns and sharing my point of view.

That shift in what I’m accountable for is where the ROI changes. The value isn’t in the time saved on any single post. It’s that the workflow no longer depends on me having the bandwidth to start from zero. The capacity was always there; the system makes it consistent and repeatable.

Stage 5: Full automation

The most advanced stage of maturity is when the system largely runs on its own. You’re no longer managing step-by-step actions; you’re defining goals, setting guardrails and measuring outcomes.

We have one running in our engineering org right now. When a ticket gets escalated from our support team to engineering, the agent triages it and routes it to the team responsible for the fix. When an engineering manager reassigns the ticket – because the routing was wrong – the agent picks up that correction, feeds it back into its prompt tooling and updates its model of who owns what. We’re now extending it further: the agent is learning which parts of the codebase need to change and which engineers are likely to own the fix.

There’s a critical catch: this stage only works if you’ve earned your way there. We learned this firsthand. When we first rolled out the routing agent, we used a static map of application areas to engineering teams and assumed that was enough. It wasn’t. We couldn’t reliably distinguish front-end bugs from back-end ones, so the front-end team kept getting tickets caused by a misbehaving API. Features were split between teams in ways the map didn’t capture — one team owned exports, another owned reports. Before the routing could work, the knowledge had to exist somewhere it could be used. An autonomous system is only as good as the foundation beneath it – the clarity of your workflows, the health of your data, the alignment of your teams. Deploy an autonomous agent into a broken process and you get bad results at scale. You cannot safely delegate what you don’t fully understand.

This is why racing straight to Stage 5 often fails. You need to know what “good” output looks like (Stages 2 and 3) and how to orchestrate the pieces (Stage 4) before you can confidently take your hands off the wheel.

Where business value emerges

The evolution from a premium search engine to an autonomous system is an organizational challenge, not a technology one. Realizing the value of AI is determined not by the sophistication of the underlying model, but by the maturity of the team wielding it.

The practical move isn’t to audit your whole organization’s AI readiness. Start with one workflow. Push it one stage higher. Measure what changes. That’s how you find out if this matters in your specific context – not in theory, but in the work your team actually does.

Most enterprises are rushing toward autonomous AI. They shouldn’t. Autonomy you haven’t earned doesn’t speed you up. In fact, it slows you down.

Here’s what I’ve moved our organization toward: a five-stage set of AI adoption maturity benchmarks. It’s a practical framework for understanding where employee development, decision-making and business value intersect. Each stage provides value for your organization. Some roles and functions may only ever reach Stage 1 or 2, while others should be fast-tracked to Stage 5. By understanding this progression, leadership can stop viewing AI as a tool for task delegation and treat it as a catalyst for developing stronger, more decisive and more valuable teams.

Stage 1: Research assistance

You hand people a premium ChatGPT account. Employees stop Googling and start prompting. Their experience improves: no ads, paragraph-form answers instead of blue links. But the underlying dynamic hasn’t changed. Output quality depends on input quality. A vague Google search returns a mess of links. A vague ChatGPT prompt returns a well-formatted mess of paragraphs. If your team didn’t know how to ask a precise question before, they still don’t.
           
The real danger at Stage 1 isn’t the bad answers – it’s the confident-sounding ones. A hallucinated statistic arrives in the same calm, authoritative prose as an accurate one. Teams that don’t verify sources in Google don’t suddenly fact-check ChatGPT. Before moving to Stage 2, your team needs to develop the instinct to ask, “How do I know this is true?”

Stage 2: Task assistance

The next stage uses AI tools to complete tasks. It starts simply: “I need to write this email,” or “Make a spreadsheet to track open items.”

The average employee takes what AI produces and passes it off without revision. At best, their efforts pass muster, with only a dash of workslop. At worst, the flood of unchecked AI outputs creates rework for teammates and clients.

Another employee further along in Stage 2 may augment what AI produces. That impulse serves them well. But if they default to editing AI output rather than dictating the rules for what AI should produce, they can easily spend more time editing AI’s work than creating work from scratch.

For employees whose work will largely remain in Stage 2, the focus should be on writing more precise prompts. The instinct to edit AI output isn’t wrong. The problem arises when the prompt is a rough starting point rather than a detailed spec. AI cares that your instructions are clear, specific and unambiguous. Get the spec right up front.

Stage 3: Workflow integration

My daughter’s class recently had an assignment: write a paper on the causes of the Civil War.

Her teacher knew what was going to happen. Every 11-year-old would go home and use ChatGPT to write a five-paragraph essay. So, she changed the exercise. The class generated and printed out the essay. Then, the teacher explained how to annotate, how to ask follow-up questions and how to revise in ChatGPT using the marked-up draft.

The same three-step sequence — assemble context, build the prompt, edit hard — applies when someone writes a post-mortem. The temptation is to skip straight to the draft. Pull the incident data, ask Gemini for a timeline and root cause analysis, clean it up, get a quick peer review and send it.

An engineer working at Stage 3 does what the teacher did. First, they assemble context: the Slack thread where someone flagged the anomaly two hours before the alert fired, the Jira ticket, the gap in monitoring that nobody documented. Then they build a prompt that reflects the full context and generate a draft. Now the red pen comes out: push back on the root cause analysis, add the institutional context Gemini couldn’t know, tighten the remediation steps until they’re actionable.

The result is a better document — and an engineer who understands what failed and builds a better repeatable process. Saving time on a first draft is a fine side effect. The goal is to produce a final draft that’s worthy of review.

Stage 4: Guided automation

The fourth stage is where collaboration becomes self-sustaining. You’re no longer asking AI to help you do a task. You’re asking it to run the task and surface the decisions that require your judgment.

My LinkedIn workflow is a good example of what this looks like in practice.

A couple of years ago, I would read an article, develop a point of view, write two or three paragraphs and publish. Not bad, but dependent on me having the time and cognitive bandwidth.

The friction was the 15 decisions that came before drafting: Which angle is worth pursuing? Does this use my voice? Have I said this before?

So, I started researching my patterns. First, I fed Claude my prior LinkedIn posts and prompted it to analyze my tone, sentence patterns and structural habits. I didn’t ask it to “describe my voice” – that gets you a paragraph of flattering generalities. This analysis became the base layer of the tool.

Then I added a second layer: LinkedIn-specific rules and AI writing patterns to avoid. That context got embedded alongside the voice analysis.

Now the workflow runs like this. I click a link, save the article, highlight and annotate the sections that interest me. My Claude Managed Agent picks up the annotation, infers what I found worth engaging with and writes four drafts with meaningfully different angles on the source material. It compares each draft against my post history and proposes two. I read the proposals, pick one, edit and authorize publication with Buffer.

The automation didn’t remove my judgment from the process. It freed me from work that didn’t depend on judgment. Now I do the work that matters: deciding what to say, identifying patterns and sharing my point of view.

That shift in what I’m accountable for is where the ROI changes. The value isn’t in the time saved on any single post. It’s that the workflow no longer depends on me having the bandwidth to start from zero. The capacity was always there; the system makes it consistent and repeatable.

Stage 5: Full automation

The most advanced stage of maturity is when the system largely runs on its own. You’re no longer managing step-by-step actions; you’re defining goals, setting guardrails and measuring outcomes.

We have one running in our engineering org right now. When a ticket gets escalated from our support team to engineering, the agent triages it and routes it to the team responsible for the fix. When an engineering manager reassigns the ticket – because the routing was wrong – the agent picks up that correction, feeds it back into its prompt tooling and updates its model of who owns what. We’re now extending it further: the agent is learning which parts of the codebase need to change and which engineers are likely to own the fix.

There’s a critical catch: this stage only works if you’ve earned your way there. We learned this firsthand. When we first rolled out the routing agent, we used a static map of application areas to engineering teams and assumed that was enough. It wasn’t. We couldn’t reliably distinguish front-end bugs from back-end ones, so the front-end team kept getting tickets caused by a misbehaving API. Features were split between teams in ways the map didn’t capture — one team owned exports, another owned reports. Before the routing could work, the knowledge had to exist somewhere it could be used. An autonomous system is only as good as the foundation beneath it – the clarity of your workflows, the health of your data, the alignment of your teams. Deploy an autonomous agent into a broken process and you get bad results at scale. You cannot safely delegate what you don’t fully understand.

This is why racing straight to Stage 5 often fails. You need to know what “good” output looks like (Stages 2 and 3) and how to orchestrate the pieces (Stage 4) before you can confidently take your hands off the wheel.

Where business value emerges

The evolution from a premium search engine to an autonomous system is an organizational challenge, not a technology one. Realizing the value of AI is determined not by the sophistication of the underlying model, but by the maturity of the team wielding it.

The practical move isn’t to audit your whole organization’s AI readiness. Start with one workflow. Push it one stage higher. Measure what changes. That’s how you find out if this matters in your specific context – not in theory, but in the work your team actually does.

Generative AI is notoriously eager to help, to the point that if it can’t find something matching what you ask for, it’ll create it. So the problem with relying on guardrails is that all too often, a model will be wrong, showing a high confidence score for an incorrect answer because it’s relying on stale or non-canonical data.

Not only do you need to be able to track the lineage of data your model uses from source to token, something the EU AI Act requires, you also need to be able to take into account where the data came from, whether it’s out of date, if it changed in a way that affects the result, or if it was never really relevant or authoritative in the first place.

Gartner expects organizations will abandon 60% of AI projects because they don’t have the right metadata management, data quality, and data observability. IBM’s acquisition of Confluent also highlights the importance of real-time data with lineage, governance, and policy for AI agents, and one of IBM’s 2026 predictions was the importance of smarter data.

The usual approach is adding metadata and validation later in the data pipeline. That’s similar to the way the bronze, silver, and gold tiers of typical lakehouse architecture are supposed to represent how filtering, cleaning, and augmenting data improves structure and quality until it’s ready to use. That can mean an enormous amount of work since nearly three quarters of the CPU work in training a frontier model is data cleansing and validation.

But that can also remove a lot of the context crucial for gen AI. Rather than cleaning data and losing the original context, it’s often more effective to keep as much information about the original state of the data, says David Aronchick, open-source platform Kubeflow founder, and CEO of distributed data pipeline vendor Expanso. “You can’t pursue exactly purely clean data; that’s just not possible,” he says. “As you pull data into your ML model, every line should have some mechanism saying where it came from. Otherwise, you’re never really going to know because you can’t mix them together and tease them apart later. You can search your raw content, your raw logs, but it’s just not going to be there.”

IoT digital twin systems often tag data all the way back to the device capturing it so you can see whether a temperature spike is a critical failure, which you want to react to, or a routine calibration, which you don’t. But that information may well be relevant down the line when you want to use that data more broadly. So unless you capture at least some elements about the source of data before you move it, you’re not going to be able to easily reconstruct the context later, or at all sometimes.

Ulrik Hansen, co-CEO of Encord, a platform for managing and annotating data, calls this in-stream labelling and cautions it’s not an alternative to cleansing data. “Dirty conflates two things: actual corruption you should fix, and context dependence, where a reading only looks anomalous because you threw away the frame that explained it,” he says. “Cleansing kills both. The point isn’t to stop cleaning, it’s to stop normalizing away context you can never recover.”

Context can be cheap to capture at the source and nearly impossible to recover after, he adds. “The question isn’t whether to keep it,” he says, “it’s about curating what actually helps.”

Raw but not rancid

Aronchick characterizes the state of most bronze tiers as toxic waste because raw data doesn’t get validated before ingestion, or have a metadata wrapper on each data point. “You’ve taken raw data and stripped it of context,” he says.

Take a wind farm operator, for instance. When sensor data about the turbines is generated, it comes from a particular turbine at a particular position in a specific wind farm at a known location, running at a specific speed in specific weather conditions, at a particular time. “If you have other turbines also working in the field, the performance of your turbine will go down, but the field performance will go up,” says Aronchick. “The performance of your turbine going down isn’t a negative, but unless you have the context at the point of data collection, you’re going to make your life much harder later on, when someone asks about the efficiency.”

Metadata needs to be much richer, and it needs to be added as early in your data pipeline as possible when you have the most detail available to make sense of the structure and complexity of the data, Aronchick adds. “You want to capture as much about the data you’re collecting as possible, where it doesn’t require insane activity to do so.”

But not all the metadata you need will be generated with the data, he says. You almost certainly need to augment and annotate your data, and provide extra structure, especially for something like a point of sale system with very light metadata. “Data comes off these things in poor structure,” he says. “It’s not OpenLineage, it’s often a CSV or a text record, and you have to reconstruct them into a full structured log. So do smart things where you’re creating data. That might be compressing, sampling, converting, appending metadata to it, and enforcing schema and lineage all before you start moving anything.”

That doesn’t have to mean bloating your data, Hansen points out. He suggests capturing what’s free and unrecoverable. “The system of origin is the label,” he says. “You don’t tag HR policy, you capture that it came from the HR system. Anything a model can derive later, you can skip.”

Structure isn’t static

Routine changes to APIs, schemas, and how data is collected or stored happen in every organization, and need to be reflected in metadata that lives alongside the data or added as data is collected, not reconstructed later in a fragile process that depends on knowing about all those changes. Google’s research into these data cascades shows how easily context gets lost and how badly it affects data quality.

Shifting schema enforcement further left in your data pipeline so you deal with it as soon as possible allows you to make more effective downstream decisions. For a sensor recording temperature and humidity, you need to know the temperature scale it uses, readings, and how the timestamp is recorded. Checking that against the schema before ingesting the data lets you route it differently depending on whether it validates or triggers alerts about data quality.

“Maybe I’ll delete it, or send it off to some place where a human being or other tooling can reconstruct it into something valuable,” says Aronchick. “But what it doesn’t do is allow the polluted or bad data into my pipeline. Saying whether or not something passed your schema makes your downstream systems much more reliable.”

Sensing structure

Unstructured and semistructured data needs more augmentation. A PDF or Word document has an author and a creation date, but doesn’t necessarily include any context about the job title and department of the author, whether it’s up to date, only applies to a particular group of customers, or is based on accounting regulations that can change. If that information is available, it needs to travel with the document, not be left in a compliance spreadsheet.

Data platforms like DataHub and SurrealDB both capture and create context. The latter can analyze a photo, for instance, using vision AI to understand what’s in the image. “From completely unstructured data, we get as much structure as possible,” says the company’s CEO Tobie Morgan Hitchcock.

That’s paired with other data potentially useful for an AI agent down the line. “Understanding what happened around an event becomes a lot easier if you’re tracking the conversation, telemetry, tool and model usage, geospatial data, and the vector search and relationships,” he says. “You’re going to have a far better chance of getting an accurate understanding of that data, which started off completely unstructured, than if you weren’t capturing anything.”

Metadata about document authors, which might come from the company directory, can show how much authority a document has. He describes that as building an understanding of what trust and provenance is over time by the weight and authority of who’s updating the information. After all, he says, company-generated information has more trust or can have traced provenance compared to conversational inputs from a user.

Incentives for annotating

DataHub CTO Shirshanka Das saw how much of a mess data can be even with strong guidelines as former architect of LinkedIn’s GDPR strategy. “The data was a swamp, despite us having had pretty good data-first and schema-first practices,” he says. As well as cleaning up the data governance, they added in the first nuggets of the DevOps’ ‘shift left’ approach.

LinkedIn already required data checked in to its Kafka ecosystem to have a schema, and ran CI/CD pipelines to check backward compatibility. “I attached metadata attribution and collection around compliance metadata into that pipeline, where developers weren’t able to check in a schema until they had declared what every column meant.”

The extra work was unpopular until teams who didn’t participate saw the flood of tickets that came their way, which allowed him to extend that same proactive governance and annotation at source approach to pretty much every data set being produced.

“The starting point of data at most companies is a lot more swampy,” he says. “Many people are using Kafka, which is a very schema forward system, and yet they’re just shoving in JSON and unstructured stuff.”

That’s common, agrees Megha Kumar, research VP for analytics and AI at IDC, because while collecting more metadata provides better context and cleaner data lineage, it’s hard in practice. “Most organizations batch process data, so real-time context capture rarely happens,” she says. “Even the ones that process in real-time tend to have pre-defined schemas, so adding context requires changes to the data, which unfortunately happens later.”

People don’t know how to start, says Das, so DataHub Cloud tries to add back context by collecting operational metadata from multiple systems, including queries and BI tools to extrapolate a semantic model. “We confront the mess by giving them something they can react to,” he says. “They can quickly validate, and then it starts becoming a governance layer on top where humans annotate at source.”

Online whiteboard provider Miro, for example, dramatically improved AI agent query accuracy from about 50% to 90% using DataHub. Then they applied GitOps principles on top of what was inferred with a human in the loop for approvals.

So getting people to do the work happened the same way at LinkedIn, says Das. “When a data scientist gets 10 times more requests because they didn’t document their work well, resulting in the AI making lots of mistakes and stakeholders constantly pinging them for answers, they have the incentive to add the annotation when they produce an analysis, because then they get out of the critical path.”

DBOMs and data contracts

Provenance and lineage of data is critical, Aronchick says, so you can preserve details like who collected the data, when, from where, if the source was authoritative or canonical, what transformations were run, and exactly what the model saw.

“It’s not just about the version and the metadata,” he says. “Where things really start to change is when you can say along the way this data has gone through these steps, this is the root source, and these were the other elements.” You want to be able to find out if there were any experimental flags, like a new customer campaign running when it was collected, as well as what claims the data contributes to.

Aronchick advocates for a SLSA-style data bill of materials using a tool like Makoto, which can add signed provenance and attestation to simplify applying central concepts of governance and structure to upstream data.

The notion of a data contract or a data product spec is starting to become common in the financial sector says Das, defining it as a data set, or a group of data sets, bound together by a contract that defines expectations which aren’t just cosmetic but machine verifiable. They can also include operational SLOs for APIs as contracts describe not just the shape of the data but operational characteristics and guarantees.

Document graph markup language (DGML), a new open source specification from Docugami, promises provenance down to individual data points automatically extracted from documents.

“It’s critical to know the validity and provenance of the information your AI is relying on,” Docugami CEO and XML co-creator Jean Paoli says. “Establishing the validity of data right from the start, at scale, is vital and far more efficient than trying to clean up bad data later.” DGML combines semantic tags describing what content means in its business context with bounding boxes showing exactly where in the document the content comes from, with attestation to prove it.

AI demands provenance

All this context is the kind of metadata Anthropic’s context engineering guide recommends feeding to agents for accuracy. Developers are already used to giving coding agents more context, Das argues. “The same thing is happening with data, as when people realize when AI agents can’t make sense of what they’re doing, hallucinations happen,” he says.

Kumar agrees that organizations realize agents need context to provide better insights. “In many cases, it has to do with ensuring the existing data had clear semantics and relationships,” she says.

If you want to make sure the purchase return window an AI chatbot promises customers is based on your own policy, not a wish list from a user forum, you need rich context. It’s not just metadata. Organizations need to have semantics, data lineage, and ontologies. “Many are also building knowledge and ontology graphs,” adds Kumar. “By ensuring the systems understand what the data means, it’ll be able to provide a better response.”

And if you’re going to the expense of fine tuning, which needs relevant and domain- or task-specific examples, you don’t want noise, duplication, or irrelevant content in your data. You can, of course, exclude poor data if it’s annotated and verified earlier, but you can also improve model performance with extra information, Aronchick points out. “The augmentation of the existing data makes the data you pull out more valuable,” he says.

Expanso recently won an Edge AI award for fine tuning a base level model with only about 3,200 images by augmenting them with metadata. “The reason it worked on that few is because I could tell it deterministically what was in the frame,” he adds. “It’s labeling at the point of capture instead of paying somebody to label it later. What if I developed models for predictive analytics of store behavior on a per city, region, or country basis? If I’m able to take the raw point of sale information and augment it with additional metadata, I’m turning this into a much easier thing to fine tune.”

Or you might even avoid the expense of fine tuning entirely, suggests Das. “You get the short-term advantage by fine-tuning and getting great performance at much cheaper cost on a smaller model, and it gets stripped away in a couple of months as a new model shows up,” he says. “You have to always run that calculus of when’s the right threshold to fine tune an existing model, distil it, and then run it for a fair amount of time to recoup the costs of fine tuning.”

Although regulated or slow-moving industries will see benefits from fine tuning a model they can run for six to 12 months on data with higher quality and better provenance, many organizations may use the improved data quality to get good results without fine tuning.

“We’re taking a more knowledge graph-oriented approach to grounding the model, and betting on the fact that because the knowledge graph is changing often, it’s better to keep it as a runtime artifact than a baked-in one.”

Generative AI is notoriously eager to help, to the point that if it can’t find something matching what you ask for, it’ll create it. So the problem with relying on guardrails is that all too often, a model will be wrong, showing a high confidence score for an incorrect answer because it’s relying on stale or non-canonical data.

Not only do you need to be able to track the lineage of data your model uses from source to token, something the EU AI Act requires, you also need to be able to take into account where the data came from, whether it’s out of date, if it changed in a way that affects the result, or if it was never really relevant or authoritative in the first place.

Gartner expects organizations will abandon 60% of AI projects because they don’t have the right metadata management, data quality, and data observability. IBM’s acquisition of Confluent also highlights the importance of real-time data with lineage, governance, and policy for AI agents, and one of IBM’s 2026 predictions was the importance of smarter data.

The usual approach is adding metadata and validation later in the data pipeline. That’s similar to the way the bronze, silver, and gold tiers of typical lakehouse architecture are supposed to represent how filtering, cleaning, and augmenting data improves structure and quality until it’s ready to use. That can mean an enormous amount of work since nearly three quarters of the CPU work in training a frontier model is data cleansing and validation.

But that can also remove a lot of the context crucial for gen AI. Rather than cleaning data and losing the original context, it’s often more effective to keep as much information about the original state of the data, says David Aronchick, open-source platform Kubeflow founder, and CEO of distributed data pipeline vendor Expanso. “You can’t pursue exactly purely clean data; that’s just not possible,” he says. “As you pull data into your ML model, every line should have some mechanism saying where it came from. Otherwise, you’re never really going to know because you can’t mix them together and tease them apart later. You can search your raw content, your raw logs, but it’s just not going to be there.”

IoT digital twin systems often tag data all the way back to the device capturing it so you can see whether a temperature spike is a critical failure, which you want to react to, or a routine calibration, which you don’t. But that information may well be relevant down the line when you want to use that data more broadly. So unless you capture at least some elements about the source of data before you move it, you’re not going to be able to easily reconstruct the context later, or at all sometimes.

Ulrik Hansen, co-CEO of Encord, a platform for managing and annotating data, calls this in-stream labelling and cautions it’s not an alternative to cleansing data. “Dirty conflates two things: actual corruption you should fix, and context dependence, where a reading only looks anomalous because you threw away the frame that explained it,” he says. “Cleansing kills both. The point isn’t to stop cleaning, it’s to stop normalizing away context you can never recover.”

Context can be cheap to capture at the source and nearly impossible to recover after, he adds. “The question isn’t whether to keep it,” he says, “it’s about curating what actually helps.”

Raw but not rancid

Aronchick characterizes the state of most bronze tiers as toxic waste because raw data doesn’t get validated before ingestion, or have a metadata wrapper on each data point. “You’ve taken raw data and stripped it of context,” he says.

Take a wind farm operator, for instance. When sensor data about the turbines is generated, it comes from a particular turbine at a particular position in a specific wind farm at a known location, running at a specific speed in specific weather conditions, at a particular time. “If you have other turbines also working in the field, the performance of your turbine will go down, but the field performance will go up,” says Aronchick. “The performance of your turbine going down isn’t a negative, but unless you have the context at the point of data collection, you’re going to make your life much harder later on, when someone asks about the efficiency.”

Metadata needs to be much richer, and it needs to be added as early in your data pipeline as possible when you have the most detail available to make sense of the structure and complexity of the data, Aronchick adds. “You want to capture as much about the data you’re collecting as possible, where it doesn’t require insane activity to do so.”

But not all the metadata you need will be generated with the data, he says. You almost certainly need to augment and annotate your data, and provide extra structure, especially for something like a point of sale system with very light metadata. “Data comes off these things in poor structure,” he says. “It’s not OpenLineage, it’s often a CSV or a text record, and you have to reconstruct them into a full structured log. So do smart things where you’re creating data. That might be compressing, sampling, converting, appending metadata to it, and enforcing schema and lineage all before you start moving anything.”

That doesn’t have to mean bloating your data, Hansen points out. He suggests capturing what’s free and unrecoverable. “The system of origin is the label,” he says. “You don’t tag HR policy, you capture that it came from the HR system. Anything a model can derive later, you can skip.”

Structure isn’t static

Routine changes to APIs, schemas, and how data is collected or stored happen in every organization, and need to be reflected in metadata that lives alongside the data or added as data is collected, not reconstructed later in a fragile process that depends on knowing about all those changes. Google’s research into these data cascades shows how easily context gets lost and how badly it affects data quality.

Shifting schema enforcement further left in your data pipeline so you deal with it as soon as possible allows you to make more effective downstream decisions. For a sensor recording temperature and humidity, you need to know the temperature scale it uses, readings, and how the timestamp is recorded. Checking that against the schema before ingesting the data lets you route it differently depending on whether it validates or triggers alerts about data quality.

“Maybe I’ll delete it, or send it off to some place where a human being or other tooling can reconstruct it into something valuable,” says Aronchick. “But what it doesn’t do is allow the polluted or bad data into my pipeline. Saying whether or not something passed your schema makes your downstream systems much more reliable.”

Sensing structure

Unstructured and semistructured data needs more augmentation. A PDF or Word document has an author and a creation date, but doesn’t necessarily include any context about the job title and department of the author, whether it’s up to date, only applies to a particular group of customers, or is based on accounting regulations that can change. If that information is available, it needs to travel with the document, not be left in a compliance spreadsheet.

Data platforms like DataHub and SurrealDB both capture and create context. The latter can analyze a photo, for instance, using vision AI to understand what’s in the image. “From completely unstructured data, we get as much structure as possible,” says the company’s CEO Tobie Morgan Hitchcock.

That’s paired with other data potentially useful for an AI agent down the line. “Understanding what happened around an event becomes a lot easier if you’re tracking the conversation, telemetry, tool and model usage, geospatial data, and the vector search and relationships,” he says. “You’re going to have a far better chance of getting an accurate understanding of that data, which started off completely unstructured, than if you weren’t capturing anything.”

Metadata about document authors, which might come from the company directory, can show how much authority a document has. He describes that as building an understanding of what trust and provenance is over time by the weight and authority of who’s updating the information. After all, he says, company-generated information has more trust or can have traced provenance compared to conversational inputs from a user.

Incentives for annotating

DataHub CTO Shirshanka Das saw how much of a mess data can be even with strong guidelines as former architect of LinkedIn’s GDPR strategy. “The data was a swamp, despite us having had pretty good data-first and schema-first practices,” he says. As well as cleaning up the data governance, they added in the first nuggets of the DevOps’ ‘shift left’ approach.

LinkedIn already required data checked in to its Kafka ecosystem to have a schema, and ran CI/CD pipelines to check backward compatibility. “I attached metadata attribution and collection around compliance metadata into that pipeline, where developers weren’t able to check in a schema until they had declared what every column meant.”

The extra work was unpopular until teams who didn’t participate saw the flood of tickets that came their way, which allowed him to extend that same proactive governance and annotation at source approach to pretty much every data set being produced.

“The starting point of data at most companies is a lot more swampy,” he says. “Many people are using Kafka, which is a very schema forward system, and yet they’re just shoving in JSON and unstructured stuff.”

That’s common, agrees Megha Kumar, research VP for analytics and AI at IDC, because while collecting more metadata provides better context and cleaner data lineage, it’s hard in practice. “Most organizations batch process data, so real-time context capture rarely happens,” she says. “Even the ones that process in real-time tend to have pre-defined schemas, so adding context requires changes to the data, which unfortunately happens later.”

People don’t know how to start, says Das, so DataHub Cloud tries to add back context by collecting operational metadata from multiple systems, including queries and BI tools to extrapolate a semantic model. “We confront the mess by giving them something they can react to,” he says. “They can quickly validate, and then it starts becoming a governance layer on top where humans annotate at source.”

Online whiteboard provider Miro, for example, dramatically improved AI agent query accuracy from about 50% to 90% using DataHub. Then they applied GitOps principles on top of what was inferred with a human in the loop for approvals.

So getting people to do the work happened the same way at LinkedIn, says Das. “When a data scientist gets 10 times more requests because they didn’t document their work well, resulting in the AI making lots of mistakes and stakeholders constantly pinging them for answers, they have the incentive to add the annotation when they produce an analysis, because then they get out of the critical path.”

DBOMs and data contracts

Provenance and lineage of data is critical, Aronchick says, so you can preserve details like who collected the data, when, from where, if the source was authoritative or canonical, what transformations were run, and exactly what the model saw.

“It’s not just about the version and the metadata,” he says. “Where things really start to change is when you can say along the way this data has gone through these steps, this is the root source, and these were the other elements.” You want to be able to find out if there were any experimental flags, like a new customer campaign running when it was collected, as well as what claims the data contributes to.

Aronchick advocates for a SLSA-style data bill of materials using a tool like Makoto, which can add signed provenance and attestation to simplify applying central concepts of governance and structure to upstream data.

The notion of a data contract or a data product spec is starting to become common in the financial sector says Das, defining it as a data set, or a group of data sets, bound together by a contract that defines expectations which aren’t just cosmetic but machine verifiable. They can also include operational SLOs for APIs as contracts describe not just the shape of the data but operational characteristics and guarantees.

Document graph markup language (DGML), a new open source specification from Docugami, promises provenance down to individual data points automatically extracted from documents.

“It’s critical to know the validity and provenance of the information your AI is relying on,” Docugami CEO and XML co-creator Jean Paoli says. “Establishing the validity of data right from the start, at scale, is vital and far more efficient than trying to clean up bad data later.” DGML combines semantic tags describing what content means in its business context with bounding boxes showing exactly where in the document the content comes from, with attestation to prove it.

AI demands provenance

All this context is the kind of metadata Anthropic’s context engineering guide recommends feeding to agents for accuracy. Developers are already used to giving coding agents more context, Das argues. “The same thing is happening with data, as when people realize when AI agents can’t make sense of what they’re doing, hallucinations happen,” he says.

Kumar agrees that organizations realize agents need context to provide better insights. “In many cases, it has to do with ensuring the existing data had clear semantics and relationships,” she says.

If you want to make sure the purchase return window an AI chatbot promises customers is based on your own policy, not a wish list from a user forum, you need rich context. It’s not just metadata. Organizations need to have semantics, data lineage, and ontologies. “Many are also building knowledge and ontology graphs,” adds Kumar. “By ensuring the systems understand what the data means, it’ll be able to provide a better response.”

And if you’re going to the expense of fine tuning, which needs relevant and domain- or task-specific examples, you don’t want noise, duplication, or irrelevant content in your data. You can, of course, exclude poor data if it’s annotated and verified earlier, but you can also improve model performance with extra information, Aronchick points out. “The augmentation of the existing data makes the data you pull out more valuable,” he says.

Expanso recently won an Edge AI award for fine tuning a base level model with only about 3,200 images by augmenting them with metadata. “The reason it worked on that few is because I could tell it deterministically what was in the frame,” he adds. “It’s labeling at the point of capture instead of paying somebody to label it later. What if I developed models for predictive analytics of store behavior on a per city, region, or country basis? If I’m able to take the raw point of sale information and augment it with additional metadata, I’m turning this into a much easier thing to fine tune.”

Or you might even avoid the expense of fine tuning entirely, suggests Das. “You get the short-term advantage by fine-tuning and getting great performance at much cheaper cost on a smaller model, and it gets stripped away in a couple of months as a new model shows up,” he says. “You have to always run that calculus of when’s the right threshold to fine tune an existing model, distil it, and then run it for a fair amount of time to recoup the costs of fine tuning.”

Although regulated or slow-moving industries will see benefits from fine tuning a model they can run for six to 12 months on data with higher quality and better provenance, many organizations may use the improved data quality to get good results without fine tuning.

“We’re taking a more knowledge graph-oriented approach to grounding the model, and betting on the fact that because the knowledge graph is changing often, it’s better to keep it as a runtime artifact than a baked-in one.”

AI agent orchestration platforms coordinate role-based and task-based AI agents, along with the tools, data, and people they depend on, into multistep workflows. These platforms are highly important for organizations scaling from handfuls to thousands of AI agents running in production.  

Two open standards do the connective work: MCP (Model Context Protocol) gives agents governed access to tools and data, while A2A (Agent2Agent) lets agents discover and delegate to one another, including agents built on other platforms. The orchestration layer sits on top, adding the routing, shared state, guardrails, governance, security, and observability needed to run workflows that range from fully autonomous to human-in-the-loop.

AI orchestration platforms may be the hottest AI technology of the year. In researching this article, I identified more than 60 commercial and open source platforms that businesses can use as a control plane to manage work between AI agents, people, and automations.

Like data fabrics and automation platforms, I suspect enterprises will utilize more than one AI agent orchestration platform. Platforms are being released by hyperscalers and solution providers in enterprise SaaS, process automation, customer experience, data management, AIops, and IT infrastructure. Development-centric platforms include open source, commercial, and no-code integration solution providers.

Here are five considerations when reviewing AI agent orchestration platforms.

1. Observable control, oversight, and trust

AI agent orchestration platforms are non-deterministic and leverage AI capabilities to coordinate responses and actions across AI agents. One area to evaluate is how administrators implement controls and guardrails over which AI agents can coordinate with others and under what circumstances. Additionally, platforms should also have controls on when and where people should be involved before taking action.

“CIOs should focus on how the AI orchestration platform clearly applies controls over autonomous decision-making,” says Heather Richards, global vice president of go-to-market strategy at Verint. “Ideally, the platform makes it easy to define who or what can take actions, how decisions are approved, and where accountability sits when something goes wrong. If orchestration doesn’t have built-in governance, visibility, and human override, it will scale risk faster than it scales value.”

Observable AI agents are primary capabilities for tracing how they interact and where decisions are made. But even more important is to review how platforms govern access to the context layer, which can include retrieval-augmented generation (RAG) for language models, knowledge graphs, and semantic layers.

“When evaluating an AI orchestration platform, organizations should consider whether governance and observability were built into the architecture from day one,” says Caitlin Schuman, director of AI strategy and customer innovation at Presidio. “A strong platform should make it clear what context is being used and should have a control layer that routes work across systems, agents, and humans.”

Deploying trustworthy AI agents is important for gaining employee adoption. Charles Crouchman, chief product officer at Redwood Software, suggests evaluating how an AI agent orchestration platform establishes trustworthy operations with enterprise resources. He recommends asking these five questions:

• Can it connect to the systems actually running your business?
• Can it be trusted to execute mission-critical logic across your ERP, supply chain, and finance platforms?
• Does it provide deterministic guardrails for non-deterministic AI, so agents can’t go rogue in production?
• Is it model-agnostic, so you’re not locked into a single LLM or agent framework as the landscape shifts?
• Can you govern at scale with full audit trails, observability, and accountability?

“Validating these answers moves you from disconnected AI  reasoning to real execution, empowering you to take the next step towards an autonomous enterprise,” says Crouchman.

2. Secure and resilient operations

AI agent orchestration platforms centralize a growing number of operational workflows, so it’s important to evaluate whether their security, performance, reliability, and resiliency meet compliance and non-functional requirements.  

“Deploying agents is the easy part; the hard part is ensuring they operate safely, consistently, and in coordination with the people and systems around them,” says Daniel Meyer, CTO at Camunda. “Orchestration platforms should enforce controls between an agent’s decision and its action, handle long-running processes without losing state, and maintain a full audit trail natively.”

Organizations should also consider how platforms support agentic ops practices for identity management, monitoring, AI agent accuracy, and incident management.

“Don’t just seek solutions that coordinate workflow or handle the life cycle of an agent; also seek solutions that get the answers agents need faster, with more accuracy, all while meeting essential security and compliance requirements,” says James Urquhart, field CTO and technology evangelist at Kamiwaza. “A platform that securely coordinates context gathering and result formulation across widely disparate infrastructures and data sources is essential, not only to the performance of AI in the enterprise, but also to its agility.”

3. Integrated testing and feedback

Testing AI agents requires validating changes before deployment, just as with continuous testing for applications and APIs. But it also requires evaluating prompts, responses, and actions in production and ensuring that agents aren’t drifting from expected parameters or going rogue. One area in which AI agent orchestration platforms differ is how they support testing AI agents, monitoring them in production, and providing a centralized source of feedback to support accuracy improvements.

“When selecting an AI orchestration platform, don’t overlook where the software it produces actually gets tested and validated,” says Jean-Philippe LeBlanc, senior vice president of engineering at CircleCI. “AI can accelerate every stage of development, but without rigorous, automated validation integrated into the delivery pipeline, you’re compounding risk at the same rate you’re compounding velocity.”

Armando Franco, senior director of cloud and platform modernization at TEKsystems Global Services, says, “The criterion that actually matters is whether continuous outcome evaluation is a first-class capability of the platform itself, because without it, iteration speed collapses and the program stalls.”

4. Interoperability and open standards

MCP and A2A are two ways AI agent orchestration platforms support open standards and enable connecting to an ecosystem of agents. Many platforms also allow developers to select and replace the underlying AI models and to choose from a range of AI code-generation tools. These flexibilities ensure teams can optimize around performance, accuracy, compliance, costs, and other future considerations.

“When evaluating an AI orchestration platform, we look first at composability and interoperability,” says Rajesh Arora, chief data and analytics officer at Principal. “The real test is not how many features it offers today, but whether it can connect models, data sources, agentic solutions, and workflows in a way that adapts to our AI strategy, tech stack, and changing business needs.”

Other interoperability criteria to review include the platform’s AI agent cataloging capabilities, how permissions are configured dynamically, and whether prebuilt connectors are available for the required integrations.

5. Vendor viability and road map

Leaders recognize that AI is currently reshaping business more than driving transformation. To be successful, organizations require AI governance that keeps up with strategy and doesn’t lag too far behind. The same is true for AI agent orchestration platforms, so it’s important to review their release notes and road maps to see whether providers strike a reasonable balance between innovation and governance.

“The right orchestration platform provides a unified policy layer that follows work across agents, workflows, and AI tools, enabling your teams to build freely while IT and security maintain full visibility at the action and output levels,” says Brandon Sammut, chief people and AI transformation officer at Zapier. “If your governance can’t keep pace with how fast your people are building, you’ll either slow them down or lose sight of what they’re building.”

Since AI agent orchestration platforms are a new category, technology leaders should partner with their financial, legal, and compliance colleagues to assess vendor viability risks. In addition, reviewing customer adoption and support capabilities is important as top solution providers will continue to evolve their platforms.   

“A mature provider offers both a stable platform and the customer support you’ll need, and with a large customer base, they’ve already hit countless edge cases that can smooth your own implementation,” says Hannes Hapke, director of the 575 Lab at Dataiku. “Assess maturity by looking at funding and financial backing, the clarity and consistency of their public road map, and the size and activity of their community. An engaged user base, active forums, and a healthy ecosystem of integrations all signal a provider that will still be standing when you scale.”

Many organizations are still early in adopting AI agents and transitioning proofs of concept into production. But for those deploying a growing number of AI agents across many platforms, selecting an AI agent orchestration platform enables scaling workflows, operations, and governance. 

Malicious AI use and threats to AI systems are requiring cyber teams to double down on security fundamentals and rethink the future of their approaches to defense.

Newly emerging AI-enabled attacks, proofs of concept, and in-the-wild techniques, as well as the latest AI vulnerability and risk research, present inklings not only about what enterprises presently face but also how security leaders need to adjust for what may soon come to their systems.

The following report aims to help inform and provide a gateway to insights into what we’ve seen evolving on the AI threat horizon of late.

AI goes rogue

The most impactful recent event signaling what’s here and ahead for CISOs was the revelation of OpenAI’s agents attacking Hugging Face.

The attack, executed by sandboxed OpenAI models, shows that prompt guardrails cannot serve as a reliable, primary security boundary for AI agents, putting pressure on enterprises to establish more sophisticated agentic infrastructure controls to limit access and prevent lateral movement. CSO’s Prasanth Aby Thomas breaks down how OpenAI’s agent containment strategy failed.

Further investigation of the OpenAI incident uncovered additional breached trust boundaries, prompting the Cloud Security Alliance’s CISO Community to issue emergency guidance for strengthening controls around autonomous AI agents, CSO’s Gyana Swain reports. The incident also prompted Anthropic to analyze its own cybersecurity evaluations, finding that its Claude models had also escaped their test environments to encounter real-world systems, with one such incident resulting in Claude publishing a malicious Python package to the public PyPI repository, which was downloaded and executed by 15 real systems.

With frontier labs not yet required to provide kill switches for AI agents, enterprise CISOs are encouraged to investigate architecting their own.

The Hugging Face incident also shows how important it is for incident response teams to have a multi-modal AI strategy, including open-weighted models, to ensure viable operations under fire, writes CSO’s Lucian Constantin.

Attacking the AI workflow

CISOs should also be aware that attackers are turning attention to agent workflows, seeking ways to infect AI agents with malicious rules, configuration, and instruction files to do their bidding. CSO’s Constantin reports on the trend, which includes a recently revealed backdoor attack technique dubbed “PromptLogger.”

According to researchers from Mitiga, PromptLogger tricks AI agents into exfiltrating prompts and responses through maliciously crafted instruction files (e.g., CLAUDE.md). The technique has also been observed attempting to influence agents into injecting backdoor code into Python files that could be copied to other systems. Because agents would be performing these tasks on criminals’ behalf, detection is an uphill battle.

Enterprise workflows could also potentially be corrupted via self-propagating document-borne AI worms, according to a recent report from Norwegian AI researcher Håkon Måløy centered on Microsoft Copilot. As CSO’s Evan Schuman reports, by concealing instructions in files used as source material for Copilot-assisted workflows, Måløy demonstrated how attackers could use Copilot as a transmission mechanism for corrupting data and propagating malware, something that could sidestep nearly every defense mechanism in place today.

Development in the crosshairs

Software development remains the workflow most impacted by AI threats today, with recent reports underscoring established attack modalities, including a critical vulnerability in Ruflo MCP infrastructure and the potential for slopsquatting on nonexistent PyPI and npm packages that top AI coding tools collectively and consistently hallucinate, report CSO’s Swain and Maxwell Cooter.

Moreover, security flaws in automated workflows in Google’s ADK for Python GitHub repository, now since hardened, could induce agents to post commands and remove review requests, making a malicious pull request appear ready to merge. Pillar Security, which discovered the flaws, called it the “first practical, real-world case of agent-to-agent exploitation” involving a production multi-agent system, CSO’s Thomas reports.

The insider threat

A recently patched OpenAI flaw shows another means by which attackers could enlist rogue AI agents to operate on their behalf. Dubbed “AgentForger,” this phishing-based attack, reported by Zenity Labs, could have enabled attackers to silently create and launch fully autonomous AI agents within OpenAI workspaces. Broad, unfettered access to systems would then turn the agent into a “persistent operator,” capable of performing reconnaissance, harvesting data and credentials, and impersonating victims, CSO’s Taryn Plumb writes.

Meanwhile, Pathfinder’s 2026 AI Governance Gap Report finds that 53% of organizations cannot verify what AI agents do across their business systems — not great news when 36% have deployed or are implementing AI agents within finance and accounting environments, CSO’s Shweta Sharma notes.

And if you need any more fodder for tighter restrictions on that other insider threat, CSO’s Grant Gross sheds light on how senior executives are killing your shadow AI strategy.

In-depth:

• AI is making cybersecurity fundamentals more important than ever
• OpenAI model escape puts enterprise AI defenses on notice
• Hugging Face breach shows why incident response needs a multi-model AI strategy
• Attackers are crafting malicious AI instruction files to turn agents into criminal helpers
• AgentForger proves AI agents can become persistent insider threats
• Senior executives are killing your shadow AI strategy

40 Jahre lang drehte sich in Sachen Tools für die Softwareentwicklung alles um die integrierte Entwicklungsumgebung – kurz IDE. Sie wurde vor allem durch die Borland Software Corporation massentauglich gemacht und revolutionierte die Entwicklungsarbeit, indem sie Editor, Compiler und Debugger zu einer Einheit verschmolz. Tools wie Turbo Pascal (das ich bis heute verehre) stellten für Devs in den 1980er Jahren insofern eine echte Revolution dar.

Knapp ein halbes Jahrhundert später ist der kometenhafte Aufstieg von Agentic Development dabei, der Vorherrschaft der IDE ein jähes Ende zu setzen. Es wird immer deutlicher, dass die integrierte Entwicklungsumgebung zunehmend aufs Abstellgleis gerät: Entwickler nutzen sie immer seltener – und widmen sich stattdessen anderen Tasks. Zum Beispiel managen sie die KI-Agenten, die heute für sie den Code schreiben.

Der Umschwung verläuft dabei rasant: Noch vor wenigen Monaten habe ich selbst mit Unterstützung eines KI-Agenten in meiner IDE gearbeitet. Dabei durfte ich schnell feststellen, dass das – je nach Anzahl der eingesetzten Agenten und der zu bearbeitenden Tasks – schnell ziemlich unübersichtlich wird oder driftet direkt ins Chaos abdriftet.

An dieser Stelle wurde auch mir klar, dass Entwickler, die mit KI-Agenten arbeiten, ein Next-Generation-Tool benötigen, um alle Agentic-Development-Aspekte ordentlich managen zu können – ein Agentic Development Environment (ADE).

Die IDE stirbt – lang lebe die ADE

Auf meinem Weg zu dieser Erkenntnis war vor allem ein weitgehend unbekanntes und ungenutztes Feature von Git bedeutsam – Worktrees. Damit lassen sich mehrere Zweige desselben Repository aus einer einzigen Git-Datenbank in verschiedene Verzeichnisse auschecken. Diese Funktion eignet sich in besonderem Maße für die neue Agentic-Development-Welt.

Traditionellerweise würde ein Entwickler jeweils ein Ticket bearbeiten, wofür ein simpler Git-Checkout ausreicht. Das setzt allerdings die Annahme voraus, dass nur ein Akteur, nämlich der Dev, an der Codebasis arbeitet.

Im Zeitalter der KI-Agenten ist es jedoch längst nicht mehr undenkbar, dass diese parallel an drei Jira-Tickets werkeln. In diesem Szenario werden Worktrees zum Enabler: Sie weisen jedem Entwickler – respektive Agenten – einen eigenen Zweig und ein eigenes Verzeichnis zu. Quasi eine Art simple Isolierung ohne den ganzen Overhead, der entsteht, wenn separate Repository-Instanzen geklont und geforkt werden müssen.

Allerdings wirft der Aufwand, der durch die Kombination von Worktrees und KI-Agenten entsteht, Herausforderungen auf. Und genau an dieser Stelle kommt die ADE ins Spiel. Sie koordiniert und managt sämtliche Vorgänge, wenn mehrere Coding-Agenten an verschiedenen Issues innerhalb mehrerer Repository-Zweige arbeiten sollen.

Entwickler befähigt das zu mühelosem Multitasking – und dazu, viele Tasks zeitgleich im Blick zu behalten. Um die Logistik um Worktrees herum müssen sie sich mit einer ADE nicht mehr kümmern. Stattdessen können sie ihre Zeit nutzen, um die Agenten zu steuern und sicherzustellen, dass diese ihre Aufgaben korrekt erledigen.

Der Abschied von der IDE mag für manchen Dev emotional sein. Aber wahrscheinlich müssen auch wehmütige Entwickler zugeben, dass sie ihre IDE inzwischen gar nicht mehr so oft einsetzen. Und wer mit Agenten arbeitet, wird sie künftig auch nicht vermissen. (fm)

Dieser Artikel ist im Original bei unserer Schwesterpublikation Infoworld.com erschienen.

A new critical vulnerability in the Ruby on Rails (“Rails”) web application framework, CVE-2026-66066, could turn a seemingly innocuous image into a front door to your secrets.

Disclosed July 30, the high severity CVE (scored 9.5 out of 10) poses a significant risk to enterprises running apps that handle user-uploaded images in Rails.

Dubbed “KindaRails2Shell,” it targets the overly-trusting Active Storage component of the open-source framework, allowing unauthenticated attackers to read sensitive files or escalate to remote code execution (RCE).

The issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 of Active Storage; enterprises running Rails should update immediately.

“The ‘chef’s kiss’ is the ability for an attacker to upload an image that isn’t actually an image [but] is code that allows them to steal secrets,” said David Shipley of Beauceron Security.

Attackers get the key to the castle

Ruby on Rails is an open-source, server-side application framework used for building full-stack web apps and application programming interfaces (APIs).

It is popular among developers because it is scalable, easy to learn and use, supports quick application development, taps into an active community of more than 1,000 engineers developing and maintaining it, and has an extensive library of nearly two million lines of prebuilt code.

CVE-2026-66066 specifically targets Rails’ built-in Active Storage component, which lets users upload files to cloud services or local disks and link them to their applications. In particular, the vulnerability exploits the way Active Storage interacts with the libvips image processing library to generate images.

Libvips contains what are known as “unfuzzed” operations which have not been hardened against malicious inputs through techniques known as fuzzing that test where they crash, leak data, or otherwise behave erratically. This makes them unsafe for use with untrusted content, but Active Storage does not adequately disable them.

“CVE-2026-66066 is particularly dangerous because an attacker may not need an account or privileged access,” explained Ensar Seker, CISO at SOCRadar.

Attackers can exploit the unsafe pipeline by uploading specially crafted files that trick Active Storage into giving them access to files that the Rails process is permitted to access, even highly-sensitive ones in app processing environments.

In practical terms, this could expose environment variables, Rails application secrets, database credentials, cloud access keys, API tokens and credentials for connected services, Seker explained.

Attackers can also gain access to the secret_key_base that signs and encrypts cookies, credentials, and session data. When secret_key_base is compromised, attackers essentially hold the key to the app.

“The immediate vulnerability is an arbitrary file-read issue, but the theft of secrets such as Rails’ secret_key_base can turn information disclosure into a much broader compromise,” Seker said.

Depending on the application, attackers could potentially forge trusted application data or sessions, access databases and cloud services, move laterally into connected systems, or achieve RCE.

That escalation path is what makes the vulnerability critical, Seker said. “A seemingly routine image upload feature, such as a profile picture, avatar or thumbnail generator, could become an entry point into the application’s underlying infrastructure.”

How to identify if you’re vulnerable

Applications are impacted when they are configured to use libvips for Active Storage image processing (the default behavior since Rails 7.0) and accept image uploads from untrusted or unauthenticated users. Enterprises should audit every internal and third-party app to determine whether they are configured this way, Seker advised, and patch Rails and Active Storage immediately. They should also examine every feature accepting images, including avatars, support attachments, product images, and administrative upload functions.

Upgrading Rails alone is not sufficient when an older libvips installation remains underneath it; libvips must be version 8.13 or later, he said.

Forensic guidance and tooling from the Rails project can help enterprises determine whether apps are vulnerable or files are exploitable, Seker noted. It’s also important to review app, proxy, object-storage, and image-processing logs for suspicious uploads or unusual requests.

Additionally, admins should rotate secret_key_base and every other credential available in Rails, invalidate active sessions, and investigate downstream systems for potentially exposed credentials.

“Security teams should treat this as a potential secret-exposure incident, not merely a patch-management exercise,” Seker said.

Don’t trust image processing pipelines

Complex image libraries support many formats and rely on numerous parsers and third-party components, creating a broad attack surface, Seker noted. Therefore, the libraries “should be treated as untrusted code execution territory.”

Image processing should be isolated in dedicated sandboxes, containers, or restricted to workers with minimal filesystem access, he advised. There should be no unnecessary network connectivity or access to an app’s files or secrets. Strict allowlists should be applied, file content human-validated, and uploads scanned before processing and stored outside app directories. 

Additional controls should include short-lived and narrowly scoped credentials, outbound network restrictions, dependency and software composition monitoring, and automated tests that confirm that dangerous codecs or operations are disabled post-upgrade, Seker said.

“The broader lesson is that organizations cannot assess exposure solely by asking whether they ‘use Rails,’” he noted, pointing out that two applications running the same Rails version may have very different exposure depending on their image processor, upload paths, and operating system packages. This makes visibility into runtime configuration, libraries, and app functionality critical.

This incident also demonstrates the importance of secret rotation in vulnerability response, he added. “When a vulnerability enables arbitrary file access, installing the patch closes the entry point but does not revoke credentials that may already have been copied.”

Don’t just assume you’re safe

This vulnerability illustrates a perfect use case for a software bill of materials (SBOM), which can speed up discovery of vulnerable software and triage it, Beauceron’s Shipley noted. And enterprises could also adopt intelligent web application firewall monitoring and intervention in addition to isolating systems and patching.

“The words you never want to hear in any critical vulnerability are ‘arbitrary code execution’ and ‘remote code execution’,” he said. “Either of those can mean bad news.”

What’s also interesting here is that the disclosure process was hijacked, he pointed out. Rails published technical details about the flaw and forensic tools to assess application vulnerability to it and to look for evidence of data exfiltration nearly a month before it planned to, because several researchers had reverse-engineered the attack and published proof of concept code.

The fact that proofs of concept are now available “materially increases the likelihood of opportunistic scanning and exploitation attempts,” Seker noted.

Therefore, he said, “even organizations that see no obvious evidence of compromise should not assume that patching alone removes the risk created by previously exposed secrets.”

This article originally appeared on CSOonline.

A new critical vulnerability in the Ruby on Rails (“Rails”) web application framework, CVE-2026-66066, could turn a seemingly innocuous image into a front door to your secrets.

Disclosed July 30, the high severity CVE (scored 9.5 out of 10) poses a significant risk to enterprises running apps that handle user-uploaded images in Rails.

Dubbed “KindaRails2Shell,” it targets the overly-trusting Active Storage component of the open-source framework, allowing unauthenticated attackers to read sensitive files or escalate to remote code execution (RCE).

The issue has been fixed in versions 7.2.3.2, 8.0.5.1 and 8.1.3.1 of Active Storage; enterprises running Rails should update immediately.

“The ‘chef’s kiss’ is the ability for an attacker to upload an image that isn’t actually an image [but] is code that allows them to steal secrets,” said David Shipley of Beauceron Security.

Attackers get the key to the castle

Ruby on Rails is an open-source, server-side application framework used for building full-stack web apps and application programming interfaces (APIs).

It is popular among developers because it is scalable, easy to learn and use, supports quick application development, taps into an active community of more than 1,000 engineers developing and maintaining it, and has an extensive library of nearly two million lines of prebuilt code.

CVE-2026-66066 specifically targets Rails’ built-in Active Storage component, which lets users upload files to cloud services or local disks and link them to their applications. In particular, the vulnerability exploits the way Active Storage interacts with the libvips image processing library to generate images.

Libvips contains what are known as “unfuzzed” operations which have not been hardened against malicious inputs through techniques known as fuzzing that test where they crash, leak data, or otherwise behave erratically. This makes them unsafe for use with untrusted content, but Active Storage does not adequately disable them.

“CVE-2026-66066 is particularly dangerous because an attacker may not need an account or privileged access,” explained Ensar Seker, CISO at SOCRadar.

Attackers can exploit the unsafe pipeline by uploading specially crafted files that trick Active Storage into giving them access to files that the Rails process is permitted to access, even highly-sensitive ones in app processing environments.

In practical terms, this could expose environment variables, Rails application secrets, database credentials, cloud access keys, API tokens and credentials for connected services, Seker explained.

Attackers can also gain access to the secret_key_base that signs and encrypts cookies, credentials, and session data. When secret_key_base is compromised, attackers essentially hold the key to the app.

“The immediate vulnerability is an arbitrary file-read issue, but the theft of secrets such as Rails’ secret_key_base can turn information disclosure into a much broader compromise,” Seker said.

Depending on the application, attackers could potentially forge trusted application data or sessions, access databases and cloud services, move laterally into connected systems, or achieve RCE.

That escalation path is what makes the vulnerability critical, Seker said. “A seemingly routine image upload feature, such as a profile picture, avatar or thumbnail generator, could become an entry point into the application’s underlying infrastructure.”

How to identify if you’re vulnerable

Applications are impacted when they are configured to use libvips for Active Storage image processing (the default behavior since Rails 7.0) and accept image uploads from untrusted or unauthenticated users. Enterprises should audit every internal and third-party app to determine whether they are configured this way, Seker advised, and patch Rails and Active Storage immediately. They should also examine every feature accepting images, including avatars, support attachments, product images, and administrative upload functions.

Upgrading Rails alone is not sufficient when an older libvips installation remains underneath it; libvips must be version 8.13 or later, he said.

Forensic guidance and tooling from the Rails project can help enterprises determine whether apps are vulnerable or files are exploitable, Seker noted. It’s also important to review app, proxy, object-storage, and image-processing logs for suspicious uploads or unusual requests.

Additionally, admins should rotate secret_key_base and every other credential available in Rails, invalidate active sessions, and investigate downstream systems for potentially exposed credentials.

“Security teams should treat this as a potential secret-exposure incident, not merely a patch-management exercise,” Seker said.

Don’t trust image processing pipelines

Complex image libraries support many formats and rely on numerous parsers and third-party components, creating a broad attack surface, Seker noted. Therefore, the libraries “should be treated as untrusted code execution territory.”

Image processing should be isolated in dedicated sandboxes, containers, or restricted to workers with minimal filesystem access, he advised. There should be no unnecessary network connectivity or access to an app’s files or secrets. Strict allowlists should be applied, file content human-validated, and uploads scanned before processing and stored outside app directories. 

Additional controls should include short-lived and narrowly scoped credentials, outbound network restrictions, dependency and software composition monitoring, and automated tests that confirm that dangerous codecs or operations are disabled post-upgrade, Seker said.

“The broader lesson is that organizations cannot assess exposure solely by asking whether they ‘use Rails,’” he noted, pointing out that two applications running the same Rails version may have very different exposure depending on their image processor, upload paths, and operating system packages. This makes visibility into runtime configuration, libraries, and app functionality critical.

This incident also demonstrates the importance of secret rotation in vulnerability response, he added. “When a vulnerability enables arbitrary file access, installing the patch closes the entry point but does not revoke credentials that may already have been copied.”

Don’t just assume you’re safe

This vulnerability illustrates a perfect use case for a software bill of materials (SBOM), which can speed up discovery of vulnerable software and triage it, Beauceron’s Shipley noted. And enterprises could also adopt intelligent web application firewall monitoring and intervention in addition to isolating systems and patching.

“The words you never want to hear in any critical vulnerability are ‘arbitrary code execution’ and ‘remote code execution’,” he said. “Either of those can mean bad news.”

What’s also interesting here is that the disclosure process was hijacked, he pointed out. Rails published technical details about the flaw and forensic tools to assess application vulnerability to it and to look for evidence of data exfiltration nearly a month before it planned to, because several researchers had reverse-engineered the attack and published proof of concept code.

The fact that proofs of concept are now available “materially increases the likelihood of opportunistic scanning and exploitation attempts,” Seker noted.

Therefore, he said, “even organizations that see no obvious evidence of compromise should not assume that patching alone removes the risk created by previously exposed secrets.”

SnapLogic has introduced its new SnapGPT, an agentic assistant that helps enterprise teams plan, build, understand, and operate integrations through natural language.

Unveiled July 28 and described as the company’s most-significant advancement in SnapGPT since 2023, the new SnapGPT evolves from an AI-powered integration copilot into an agentic assistant for the integration life cycle, combining platform intelligence, integration-specific reasoning, and operational guidance to help teams move from business intent to production faster, according to SnapLogic. SnapGPT combines agentic planning, integration-specific reasoning, pipeline execution validation, and more than 15 years of enterprise integration expertise built into the SnapLogic Agentic Integration Platform, including platform intelligence, operational context, and proven integration patterns, the company said.

SnapGPT now helps teams across the entire integration life cycle:

• Plan – Plan Mode helps teams validate requirements, explore implementation approaches, refine workflows, and identify potential issues before development begins.
• Build – Generate high-quality, production-ready integrations through integration-specific reasoning and pipeline execution validation, while accelerating development with multi-pipeline generation, intelligent pipeline refactoring, reusable expression libraries, and natural-language generation of SnapLogic MCP Servers.
• Understand – Analyze existing integration assets, explain pipeline logic, and surface contextual insights to help teams better understand and improve complex integrations.
• Operate – SnapGPT Activity Log provides administrators with visibility into AI-assisted development activity, while SnapGPT Monitor Insights extends AI assistance into production operations with diagnostic intelligence and AI-powered troubleshooting.

The new SnapGPT is available as part of the SnapLogic Agent Integration Platform. In June SnapLogic introduced the SnapLogic MCP Builder, a template-based tool that generates Model Context Protocol servers from existing integrations.

A likely US administration ban on Chinese optical transceivers for AI data centers may have an unintended consequence: IT will rush to buy as many of the components as possible before restrictions kick in.

Reuters on Tuesday reported that the US Federal Communications Commission (FCC) “is working on the measure to bar imports of new Chinese optical transceivers” and that officials hope to publish and implement it this year. 

The report, from unnamed sources, said that the official rationale is “to prevent Chinese firms from stealing data, installing malware or disrupting service at US data centers.” The sources did, however, stress that such a ban could still be modified or shelved.

A valid concern

Analysts and consultants agree that the concern, albeit hypothetical at the moment, is valid. 

If implemented, such a ban would have a severe impact on data center (DC) strategies for both enterprises and hyperscalers. Although higher costs for replacement products would be all but certain, the greater concern is the lack of availability of non-Chinese transceivers and other components, regardless of price. 

A potentially even more worrying element of a ban is the need for far more sophisticated supply chain visibility. That is because many of those non-Chinese component suppliers actually use some Chinese components in their products, which means that the exact wording of any potential FCC restrictions will be critical. It will define how closely enterprises will need to examine their suppliers’ supply chains.

Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said that he thinks that an FCC ban is quite likely, because it “has run this exact playbook four times in eighteen months, against drones, routers, robots, and the July 28 inverter and robotics restrictions. The mechanism is tested, the machinery is warm.”

If the ban is enacted, said geopolitical analyst Irina Tsukerman, “CIOs will need to reassess vendor diversification, and other factors such as replacement compatibility, lifecycle planning and inventory management, given that many organizations have historically treated optical components as interchangeable commodities.”

“Enterprises will also need much greater visibility into firmware development, manufacturing origin, as well as subcontractors, and software update processes, because future procurement decisions are increasingly likely to examine the entire supply chain rather than simply the company selling the finished product,” she added. This will make future procurement more complex.

IT pain will vary

Tsukerman said that, although prices would certainly spike, the pain felt will vary based on the nature and size of each affected business She noted that while hyperscale operators can negotiate directly with manufacturers, secure long-term supply, and qualify multiple vendors for critical components due to their purchasing power, enterprises, regional data center operators, and colocation providers generally lack that leverage. Rather, they often depend on distributors supplying lower-cost Chinese products, making them considerably more vulnerable to price increases and delivery delays.

Mahapatra added that the preliminary indications suggest any such ban would have a “new models only” framing that would protect the installed base while restricting the next generation of products, which, he said, would be a compromise “generous enough to mute the hyperscaler objection.”

But, he said, “the enterprise CIO running a colocation expansion or private AI cluster is about to discover they are competing with Microsoft and Meta for the same constrained supply and losing.”

He recommended that enterprises lock down forward optics supply for anything they plan to build through 2028 before the restriction publishes, because, he pointed out, “announced-but-not-effective bans consume non-Chinese capacity through panic buying, and buyers who move after publication pay in schedule rather than dollars.”

However, such a move depends on how serious IT considers the cybersecurity risks from the Chinese components. Tsukerman argued that data leakage and malware fears need to be taken seriously, because modern optical transceivers often contain firmware, onboard memory, and management interfaces, and may also offer capabilities that can influence how traffic is monitored and managed throughout the data center.

In that case, she noted, “the risk would extend beyond espionage to include compromised firmware updates, manipulation of diagnostic information, disruption of maintenance support, delayed replacement shipment, or in the worst case scenario, interference with critical infrastructure during periods of heightened political tension.”

However, Mahapatra sees the risk quite differently.

“A transceiver is a comparatively dumb device converting electrical signals to optical and back, not a router running a network operating system with deep packet visibility,” he said. “The near-term espionage risk from currently shipping Chinese optics is thin, and CISOs who reallocate budget toward this threat over their software supply chain and identity attack surfaces are responding to headlines rather than risk.”

The suppliers involved

Consultant Brian Levine, executive director of FormerGov, labeled the potential US administration move as “one of the more consequential supply-chain moves the FCC has contemplated, because optical transceivers are the workhorse components that move data across fiber inside every AI data center, and Chinese vendors dominate that market.”

He noted that Chinese vendors Innolight and Eoptolink alone reportedly account for the majority of the 800-gig modules going into Nvidia’s AI clusters, so a ban “wouldn’t be a minor substitution,” and non-Chinese alternatives such as Coherent and Lumentum in the US don’t yet have sufficient capacity to fill the gap.

Nader Henein, a Gartner VP analyst, agreed, adding that since the nature of the AI data center supply chain is both complex and fragile, a small change can deliver a disproportionate industry impact.

“If you remove one provider from the equation, it’s not as if the others have capacity to fulfil the increase in demand, so it’s not simply a question of added cost, it’s a question of placing a ceiling on capacity and growth,” he said.

Tsukerman said that her list of the companies most likely to benefit from such an FCC ban would include Coherent, Lumentum, Applied Optoelectronics and Cisco’s Acacia business, while Broadcom and Marvell, as well as  Japanese and Taiwanese manufacturers, also provide important optical and connectivity technologies that support advanced networking infrastructure.

Other components in the crosshairs

She pointed out that there is also a strong probability that a transceiver ban would quickly be followed by attacks on other components. 

Networking switches, SmartNICs, data processing units, baseboard management controllers, storage controllers, intelligent power distribution units, cooling management controllers, optical transport systems, and embedded management processors “all perform functions that could influence the operation of an entire facility if compromised,” she said. “None of these products simply passes data or delivers electricity. They manage, monitor, or control critical infrastructure, making them increasingly attractive targets for supply-chain attacks.”

Her list of likely future US targets for restrictions also includes top-of-rack switches, spine switches, and rack management systems,.

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, echoed Henein’s fears about industry impact.

“I think that the appropriate response to these types of risks needs to be more nuanced than just a blanket ban,” he said. “Since 15%-20% of all world’s semiconductors are manufactured in China, and that number rises to 80% or 85% if you include Taiwan, blocking Chinese imports for these components could hamper the entire datacenter industry.”

Although there have been rumors of insecure or trojanized hardware components sourced from China in the past, given that many large American and multinational technology vendors manufacture their parts there, ”a sledgehammer approach could spike prices for these types of systems, jeopardizing development of new technologies,” he noted. “A far more reasonable approach would be to require appropriate testing and quality controls to ensure that those risks are appropriately mitigated.”

Would likely harm the US

In addition, independent technology analyst Carmi Levy said that he is skeptical about whether an FCC ban would ultimately be a good move for the US.

“It’s fair to ask whether this will truly make American technology infrastructure more secure, or whether it’s little more than a performative stunt designed to score geopolitical points,” Levy said, pointing out that Canada didn’t end up any safer because of the Huawei and ZTE ban, and “no one should fool themselves into believing a Chinese data center ban in the US would be any different. It would only add further constraints to a supply chain that’s already close to collapsing under its own weight [and it] will likely harm American interests more than anyone else’s.”

But he also concluded that such a move would likely fail, given the current global state of data center technologies. 

“Chinese suppliers and components have been so ingrained in the global technology supply chain for so long that no ban of any form could hope to have any tangible impact on so-called national security,” Levy said. “To claim otherwise exposes the true motivations of this misdirected policy strategy.”

This article originally appeared on NetworkWorld.

A likely US administration ban on Chinese optical transceivers for AI data centers may have an unintended consequence: IT will rush to buy as many of the components as possible before restrictions kick in.

Reuters on Tuesday reported that the US Federal Communications Commission (FCC) “is working on the measure to bar imports of new Chinese optical transceivers” and that officials hope to publish and implement it this year. 

The report, from unnamed sources, said that the official rationale is “to prevent Chinese firms from stealing data, installing malware or disrupting service at US data centers.” The sources did, however, stress that such a ban could still be modified or shelved.

A valid concern

Analysts and consultants agree that the concern, albeit hypothetical at the moment, is valid. 

If implemented, such a ban would have a severe impact on data center (DC) strategies for both enterprises and hyperscalers. Although higher costs for replacement products would be all but certain, the greater concern is the lack of availability of non-Chinese transceivers and other components, regardless of price. 

A potentially even more worrying element of a ban is the need for far more sophisticated supply chain visibility. That is because many of those non-Chinese component suppliers actually use some Chinese components in their products, which means that the exact wording of any potential FCC restrictions will be critical. It will define how closely enterprises will need to examine their suppliers’ supply chains.

Aman Mahapatra, chief strategy officer for Tribeca Softtech, a New York City-based technology consulting firm, said that he thinks that an FCC ban is quite likely, because it “has run this exact playbook four times in eighteen months, against drones, routers, robots, and the July 28 inverter and robotics restrictions. The mechanism is tested, the machinery is warm.”

If the ban is enacted, said geopolitical analyst Irina Tsukerman, “CIOs will need to reassess vendor diversification, and other factors such as replacement compatibility, lifecycle planning and inventory management, given that many organizations have historically treated optical components as interchangeable commodities.”

“Enterprises will also need much greater visibility into firmware development, manufacturing origin, as well as subcontractors, and software update processes, because future procurement decisions are increasingly likely to examine the entire supply chain rather than simply the company selling the finished product,” she added. This will make future procurement more complex.

IT pain will vary

Tsukerman said that, although prices would certainly spike, the pain felt will vary based on the nature and size of each affected business She noted that while hyperscale operators can negotiate directly with manufacturers, secure long-term supply, and qualify multiple vendors for critical components due to their purchasing power, enterprises, regional data center operators, and colocation providers generally lack that leverage. Rather, they often depend on distributors supplying lower-cost Chinese products, making them considerably more vulnerable to price increases and delivery delays.

Mahapatra added that the preliminary indications suggest any such ban would have a “new models only” framing that would protect the installed base while restricting the next generation of products, which, he said, would be a compromise “generous enough to mute the hyperscaler objection.”

But, he said, “the enterprise CIO running a colocation expansion or private AI cluster is about to discover they are competing with Microsoft and Meta for the same constrained supply and losing.”

He recommended that enterprises lock down forward optics supply for anything they plan to build through 2028 before the restriction publishes, because, he pointed out, “announced-but-not-effective bans consume non-Chinese capacity through panic buying, and buyers who move after publication pay in schedule rather than dollars.”

However, such a move depends on how serious IT considers the cybersecurity risks from the Chinese components. Tsukerman argued that data leakage and malware fears need to be taken seriously, because modern optical transceivers often contain firmware, onboard memory, and management interfaces, and may also offer capabilities that can influence how traffic is monitored and managed throughout the data center.

In that case, she noted, “the risk would extend beyond espionage to include compromised firmware updates, manipulation of diagnostic information, disruption of maintenance support, delayed replacement shipment, or in the worst case scenario, interference with critical infrastructure during periods of heightened political tension.”

However, Mahapatra sees the risk quite differently.

“A transceiver is a comparatively dumb device converting electrical signals to optical and back, not a router running a network operating system with deep packet visibility,” he said. “The near-term espionage risk from currently shipping Chinese optics is thin, and CISOs who reallocate budget toward this threat over their software supply chain and identity attack surfaces are responding to headlines rather than risk.”

The suppliers involved

Consultant Brian Levine, executive director of FormerGov, labeled the potential US administration move as “one of the more consequential supply-chain moves the FCC has contemplated, because optical transceivers are the workhorse components that move data across fiber inside every AI data center, and Chinese vendors dominate that market.”

He noted that Chinese vendors Innolight and Eoptolink alone reportedly account for the majority of the 800-gig modules going into Nvidia’s AI clusters, so a ban “wouldn’t be a minor substitution,” and non-Chinese alternatives such as Coherent and Lumentum in the US don’t yet have sufficient capacity to fill the gap.

Nader Henein, a Gartner VP analyst, agreed, adding that since the nature of the AI data center supply chain is both complex and fragile, a small change can deliver a disproportionate industry impact.

“If you remove one provider from the equation, it’s not as if the others have capacity to fulfil the increase in demand, so it’s not simply a question of added cost, it’s a question of placing a ceiling on capacity and growth,” he said.

Tsukerman said that her list of the companies most likely to benefit from such an FCC ban would include Coherent, Lumentum, Applied Optoelectronics and Cisco’s Acacia business, while Broadcom and Marvell, as well as  Japanese and Taiwanese manufacturers, also provide important optical and connectivity technologies that support advanced networking infrastructure.

Other components in the crosshairs

She pointed out that there is also a strong probability that a transceiver ban would quickly be followed by attacks on other components. 

Networking switches, SmartNICs, data processing units, baseboard management controllers, storage controllers, intelligent power distribution units, cooling management controllers, optical transport systems, and embedded management processors “all perform functions that could influence the operation of an entire facility if compromised,” she said. “None of these products simply passes data or delivers electricity. They manage, monitor, or control critical infrastructure, making them increasingly attractive targets for supply-chain attacks.”

Her list of likely future US targets for restrictions also includes top-of-rack switches, spine switches, and rack management systems,.

Flavio Villanustre, CISO for the LexisNexis Risk Solutions Group, echoed Henein’s fears about industry impact.

“I think that the appropriate response to these types of risks needs to be more nuanced than just a blanket ban,” he said. “Since 15%-20% of all world’s semiconductors are manufactured in China, and that number rises to 80% or 85% if you include Taiwan, blocking Chinese imports for these components could hamper the entire datacenter industry.”

Although there have been rumors of insecure or trojanized hardware components sourced from China in the past, given that many large American and multinational technology vendors manufacture their parts there, ”a sledgehammer approach could spike prices for these types of systems, jeopardizing development of new technologies,” he noted. “A far more reasonable approach would be to require appropriate testing and quality controls to ensure that those risks are appropriately mitigated.”

Would likely harm the US

In addition, independent technology analyst Carmi Levy said that he is skeptical about whether an FCC ban would ultimately be a good move for the US.

“It’s fair to ask whether this will truly make American technology infrastructure more secure, or whether it’s little more than a performative stunt designed to score geopolitical points,” Levy said, pointing out that Canada didn’t end up any safer because of the Huawei and ZTE ban, and “no one should fool themselves into believing a Chinese data center ban in the US would be any different. It would only add further constraints to a supply chain that’s already close to collapsing under its own weight [and it] will likely harm American interests more than anyone else’s.”

But he also concluded that such a move would likely fail, given the current global state of data center technologies. 

“Chinese suppliers and components have been so ingrained in the global technology supply chain for so long that no ban of any form could hope to have any tangible impact on so-called national security,” Levy said. “To claim otherwise exposes the true motivations of this misdirected policy strategy.”

In an open letter, OpenAI this week turned to the court of public opinion in its existential war against Apple with a public notice in which the company refutes the iPhone maker’s claims concerning wholesale use of confidential information.

You can detect the depth of enmity between both firms in OpenAI’s opening lines to its letter, which begins: “Apple is one of the greatest companies of all time,” and then moves swiftly into defending itself against company’s claims, while attempting to characterize Apple’s complaints as weak.

What Apple claimed

As reported elsewhere, Apple filed suit against OpenAI in the US District Court for the Northern District of California on July 10. The litigation names OpenAI Foundation, OpenAI Group PBC, io Products, Chang Liu (former senior systems electrical engineer), and Tang Yew Tan (former vice president of product design for iPhone and Apple Watch, now OpenAI’s chief hardware officer), and alleges breach of intellectual property agreement and misappropriation of trade secrets under the Defend Trade Secrets Act. The company has since then filed preservation orders to protect evidence. 

Apple’s complaint is more detailed than that. Among many other things, it claims Tan allegedly directed job candidates still at Apple to bring “actual parts” to interviews for “show and tell” sessions. It also alleges Tan distributed an internal Apple document describing Apple’s own departure security protocols to new hires before they resigned. Liu is separately accused of failing to return an Apple laptop and using it to download confidential technical documents.

OpenAI’s rebuttal

Now, OpenAI argues Apple’s trade-secret lawsuit is based on factual errors, poor communication and misleading claims. It says Apple mistakenly contacted the wrong OpenAI lawyer after confusing two people with the same surname, falsely claimed a phone call had occurred, then acknowledged both mistakes without raising the allegations later included in the lawsuit. (Apple says it sent OpenAI a warning letter back in February with no response, which undercuts OpenAI’s “we offered to resolve this before litigation” statement.)

OpenAI argues that Chang Liu was responding to requests from Apple colleagues seeking help locating Apple files, reflecting Apple’s own access-management failures rather than misconduct. It also claims Tan consistently instructed OpenAI staff not to seek or use competitors’ confidential information. OpenAI maintains it neither possesses nor wants Apple’s trade secrets, offered to resolve concerns before litigation, and finally argues that Apple’s request for a preliminary injunction is unnecessary and unsupported.

What Apple might actually argue

Will Apple see it the same way? That seems unlikely, in part due to the extent of the claimed infractions. Apple will point to the hundreds of former Apple employees now at OpenAI, including former Chief Designer Jony Ive. In doing so, it will likely argue that the remit of the case is not defined by erroneous legal correspondence, though that is probably seen as an error. Instead, the substantial claims it’s likely to focus on are that OpenAI has been engaged in a multi-front attempt to accumulate information pertaining to Apple and its design processes through recruitment and the way it recruits.

It’s feasible both arguments have some validity. OpenAI might be right in pointing out weaknesses in Apple’s own approach to internal communications in terms of secrecy. And Apple is correct in pointing out that OpenAI moved to abuse those vulnerabilities, weaknesses in its approach that have only been identified during OpenAI’s campaign to grab secrets.

While the Apple lawyer’s error in approaching OpenAI might be an unforced error that helps the AI firm cast doubt on Apple’s claims, it doesn’t necessarily invalidate them — and both sides believe themselves to be justified. Deciding which company is in the right will be a matter of law and not of public opinion.

Which side does the smoking gun face?

To prove its position, OpenAI shared some correspondence. These communications do seem to show a failure at Apple to properly implement device management over employee accounts, including the claim that personal iMessage accounts are routinely used to share corporate correspondence. That may be true, and shouldn’t be – it’s an obvious weakness in corporate security.

At the same time, the correspondence also shows hints of job opportunities at OpenAI for and to a former colleague, which kind of proves part of Apple’s point in terms of steady employee poaching. “I can always give you some fun side projects,” one message said. 

Of course, interaction between former colleagues is inevitable,. But at the level of seniority here, it feels plausible this could be in breach of any off-ramping arrangements reached between Apple and its former employees. No doubt, courts will decide that – though it does underline Apple’s claims that OpenAI instructed former Apple staffers about how to leave without reaching such agreements.

“This isn’t Apple getting it wrong. It is OpenAI getting caught with its hand in the hardware cookie jar and then writing a blog post about how the jar was left unlocked,” US tech thought leader Brian Roemmele wrote on X.

Where happens next?

Ultimately, what comes next is up to Apple and OpenAI. The two companies might reach a deal out of court, or be forced into an agreement by the legal system. The existential nature of the rivalry suggests the latter, rather than former.

It is also very telling that OpenAI, which now has more than 400 former Apple employees on its teams, including many former designers, also claims: “Apple’s request for a preliminary injunction is both based on false information and completely unnecessary because we do not have, nor want, any of their trade secrets. We’re much more interested in building innovative products and technologies that push the frontier.”

While Apple hasn’t yet responded, it will be interesting to see whether whatever hardware OpenAI ships looks and behaves like any released or unreleased Apple products; the latter will now be able to bring details of its own historical project design decisions — and the people who made them — to court.

I think this case will play out over time. Perhaps the most interesting question is whether OpenAI has taken what it knows about Apple to create its own internal product design and development LLM models. Would that use be legitimate? It would, after all, not be the first time an AI company has trained its models on other people’s creative energy.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.

In an open letter, OpenAI this week turned to the court of public opinion in its existential war against Apple with a public notice in which the company refutes the iPhone maker’s claims concerning wholesale use of confidential information.

You can detect the depth of enmity between both firms in OpenAI’s opening lines to its letter, which begins: “Apple is one of the greatest companies of all time,” and then moves swiftly into defending itself against company’s claims, while attempting to characterize Apple’s complaints as weak.

What Apple claimed

As reported elsewhere, Apple filed suit against OpenAI in the US District Court for the Northern District of California on July 10. The litigation names OpenAI Foundation, OpenAI Group PBC, io Products, Chang Liu (former senior systems electrical engineer), and Tang Yew Tan (former vice president of product design for iPhone and Apple Watch, now OpenAI’s chief hardware officer), and alleges breach of intellectual property agreement and misappropriation of trade secrets under the Defend Trade Secrets Act. The company has since then filed preservation orders to protect evidence. 

Apple’s complaint is more detailed than that. Among many other things, it claims Tan allegedly directed job candidates still at Apple to bring “actual parts” to interviews for “show and tell” sessions. It also alleges Tan distributed an internal Apple document describing Apple’s own departure security protocols to new hires before they resigned. Liu is separately accused of failing to return an Apple laptop and using it to download confidential technical documents.

OpenAI’s rebuttal

Now, OpenAI argues Apple’s trade-secret lawsuit is based on factual errors, poor communication and misleading claims. It says Apple mistakenly contacted the wrong OpenAI lawyer after confusing two people with the same surname, falsely claimed a phone call had occurred, then acknowledged both mistakes without raising the allegations later included in the lawsuit. (Apple says it sent OpenAI a warning letter back in February with no response, which undercuts OpenAI’s “we offered to resolve this before litigation” statement.)

OpenAI argues that Chang Liu was responding to requests from Apple colleagues seeking help locating Apple files, reflecting Apple’s own access-management failures rather than misconduct. It also claims Tan consistently instructed OpenAI staff not to seek or use competitors’ confidential information. OpenAI maintains it neither possesses nor wants Apple’s trade secrets, offered to resolve concerns before litigation, and finally argues that Apple’s request for a preliminary injunction is unnecessary and unsupported.

What Apple might actually argue

Will Apple see it the same way? That seems unlikely, in part due to the extent of the claimed infractions. Apple will point to the hundreds of former Apple employees now at OpenAI, including former Chief Designer Jony Ive. In doing so, it will likely argue that the remit of the case is not defined by erroneous legal correspondence, though that is probably seen as an error. Instead, the substantial claims it’s likely to focus on are that OpenAI has been engaged in a multi-front attempt to accumulate information pertaining to Apple and its design processes through recruitment and the way it recruits.

It’s feasible both arguments have some validity. OpenAI might be right in pointing out weaknesses in Apple’s own approach to internal communications in terms of secrecy. And Apple is correct in pointing out that OpenAI moved to abuse those vulnerabilities, weaknesses in its approach that have only been identified during OpenAI’s campaign to grab secrets.

While the Apple lawyer’s error in approaching OpenAI might be an unforced error that helps the AI firm cast doubt on Apple’s claims, it doesn’t necessarily invalidate them — and both sides believe themselves to be justified. Deciding which company is in the right will be a matter of law and not of public opinion.

Which side does the smoking gun face?

To prove its position, OpenAI shared some correspondence. These communications do seem to show a failure at Apple to properly implement device management over employee accounts, including the claim that personal iMessage accounts are routinely used to share corporate correspondence. That may be true, and shouldn’t be – it’s an obvious weakness in corporate security.

At the same time, the correspondence also shows hints of job opportunities at OpenAI for and to a former colleague, which kind of proves part of Apple’s point in terms of steady employee poaching. “I can always give you some fun side projects,” one message said. 

Of course, interaction between former colleagues is inevitable,. But at the level of seniority here, it feels plausible this could be in breach of any off-ramping arrangements reached between Apple and its former employees. No doubt, courts will decide that – though it does underline Apple’s claims that OpenAI instructed former Apple staffers about how to leave without reaching such agreements.

“This isn’t Apple getting it wrong. It is OpenAI getting caught with its hand in the hardware cookie jar and then writing a blog post about how the jar was left unlocked,” US tech thought leader Brian Roemmele wrote on X.

Where happens next?

Ultimately, what comes next is up to Apple and OpenAI. The two companies might reach a deal out of court, or be forced into an agreement by the legal system. The existential nature of the rivalry suggests the latter, rather than former.

It is also very telling that OpenAI, which now has more than 400 former Apple employees on its teams, including many former designers, also claims: “Apple’s request for a preliminary injunction is both based on false information and completely unnecessary because we do not have, nor want, any of their trade secrets. We’re much more interested in building innovative products and technologies that push the frontier.”

While Apple hasn’t yet responded, it will be interesting to see whether whatever hardware OpenAI ships looks and behaves like any released or unreleased Apple products; the latter will now be able to bring details of its own historical project design decisions — and the people who made them — to court.

I think this case will play out over time. Perhaps the most interesting question is whether OpenAI has taken what it knows about Apple to create its own internal product design and development LLM models. Would that use be legitimate? It would, after all, not be the first time an AI company has trained its models on other people’s creative energy.

You can follow me on social media! Join me on BlueSky,  LinkedIn, Mastodon and subscribe to The Core.

AWS on Tuesday released Kiro Crew, an open-source orchestration platform designed to help enterprises move beyond interactive AI coding assistants toward long-running, autonomous engineering workflows that span repositories, developer tools, and multiple work sessions.

Rather than simply generating code, Kiro Crew coordinates multiple AI agents, schedules recurring work, preserves project context across sessions, and integrates with developer tools to investigate incidents, monitor pull requests (PRs), triage tickets, and automate software engineering tasks while developers are away from their keyboards, according to the hyperscaler.

“Kiro Crew is a persistent, open-source development workspace for work that is bigger than a single task in a single session,” Darko Mesaros, distinguished developer advocate at AWS, told InfoWorld. “Think of it as an application layer that turns AI coding agents into always-working, self-learning, autonomous teammates.”

To support that model, the offering ships with persistent memory, multi-agent orchestration tools, approval workflows, scheduling, security controls such as sandboxing and signed audit logs, and a web and desktop dashboard for monitoring agent activity, the hyperscaler said in a statement.

Kiro Crew was originally developed inside Amazon as an internal project called MeshClaw and was later adopted by more than 39,000 Amazon builders in less than six months.

It can be deployed entirely inside customer environments, including laptops, containers, or virtual machines, without requiring an AWS account or AWS-managed control plane, AWS said.

To demonstrate how the new offering can be used, AWS is also launching a set of reference applications built on top of it, including DevFleets for worktree management, Issue Radar for issue and pull-request triage, and Task Runner for executing long-running engineering tasks.

Rather than standalone products, these apps combine purpose-built user interfaces with Kiro Crew’s orchestration engine, memory, scheduling, integrations, and backend services to automate specific engineering workflows, Mesaros said, adding that the hyperscaler is expected to add more such apps in the future.

Boosting developer productivity

Such applications, according to Michael Leone, principal analyst at Moor Strategy and Insights, would help platform engineering, DevOps, and site reliability engineering (SRE) teams, where much of the work involves repetitive, long-running operational tasks rather than writing entirely new software.

“These tasks can include dependency upgrades, framework migrations, flaky test cleanup, triaging and routing a ticket queue, and the first pass on an incident investigation,” Leone said.

“It’s a strong fit for long-running migrations that require checkpoints and retries over hours without supervision,” echoed Manoj Chandra Jha, principal analyst at Nord-IQ Research.

Taken together, those capabilities could significantly reduce software release cycles as well as the time developers spend supervising AI tools and reconnecting context between engineering workflows, according to Dave McCarthy, vice president of enterprise infrastructure at IDC.

“It eliminates context-switching and babysitting single prompts. Work continues asynchronously in the background while developers are in meetings, off the clock, or asleep, allowing teams to return to completed progress rather than a stalled process,” McCarthy said.

That, in turn, will allow developers to spend more time on higher-value engineering tasks, such as designing systems, making architectural decisions, and solving complex engineering problems, echoed Ashish Chaturvedi, executive research leader at HFS Research.

Why CIOs should care

Kiro Crew’s open-source, self-hosted architecture could help enterprises looking to bring governance and visibility to the growing use of AI coding agents, analysts said.

“Agent use inside most companies right now is shadow IT, with individual developers wiring up their own agents against their own credentials and nobody tracking it. A shared workspace with approval gates and logging gives you one place to see what ran, what it touched, and who authorized it,” said Leone.

Those governance capabilities, combined with the ability to run inside customer-controlled environments, according to Chaturvedi, could also help CIOs address security and compliance concerns: “Being open source and self-hostable, a CIO can run it on their own infrastructure and keep code and credentials inside their perimeter rather than sending them to a black-box agent.”

That reduction in security concerns, combined with Kiro Crew’s human-approval workflows, could provide enterprises with a lower-risk path to broader agent adoption, Jha said. “Since it embeds consistency and security screening at scale, and because review remains human-approved, it’s a low-risk entry point for demonstrating agentic ROI before extending trust to higher-stakes, unattended workflows.”

Not without trade-offs

Despite its benefits, the adoption of Kiro Crew comes with trade-offs, analysts warned.

Adopting Kiro Crew may not be a simple plug-and-play operation, said Stephanie Walter, practice lead for AI Stack at HyperFRAME Research. Rather, it introduces yet another orchestration layer for enterprises to manage and secure, she said.

Enterprises would need to draft up policies covering least-privilege access, human approvals, memory retention, code provenance, and auditability before allowing persistent agents to operate across source code repositories and CI/CD pipelines, Walter said.

More so because most enterprises, Walter added, are still not operationally ready to manage swarms of autonomous AI agents: “Many are still struggling to measure the cost and value of individual AI agents. Parallel agents multiply model calls, compute, CI activity, API usage, tool access, and human review, not just token consumption.”

Open architecture, but questions remain

Even for organizations that are ready to experiment with autonomous coding agents, integrating Kiro Crew into existing development environments may require additional work.

Although AWS built Kiro Crew around open standards such as Agent Client Protocol (ACP) and Model Context Protocol (MCP), the platform runs on the proprietary Kiro CLI at launch, according to Mesaros.

That means enterprises using other AI coding agents, such as Claude Code, Codex, or Devin, may need to build and validate their own connectors before they can use Kiro Crew as their orchestration layer.

“The dependency is real. AWS says Crew runs on the Kiro CLI at launch, and that CLI is proprietary and metered by credits, so it’s the harness actually wired up on day one. Until someone runs a different agent under Crew and shows it working, the open part stops at the orchestration layer,” said Leone.

For enterprises and development teams already using Kiro, however, adoption is expected to be more straightforward, as Kiro Crew can reuse existing .kiro configurations, including steering files, skills, and custom agents, without requiring additional setup, according to Mesaros.

The new offering, due to its open-source nature, is free as well, Mesaros pointed out, adding that customers need to pay only for the AI coding agents and tools they choose to connect to Crew.

AWS said it will govern the project through a publicly listed steering committee operating under an open governance model, with proposals submitted as pull requests and debated openly.

Kiro and AWS engineers will initially maintain the project, with trusted community contributors expected to join the maintainer group over time, it added.

In mid-July, New York became the first state to impose a state-wide moratorium on new data center construction.

“Data center development threatens to hike up utility bills, deplete our natural resources, and create uncertainty for New Yorkers,” wrote Governor Kathy Hochul in her executive order. The moratorium is planned to last for a year, and the state will use the time to research the impact of data centers on energy demand and require data centers to either pay more for their energy or supply their own.

And 127 other U.S. jurisdictions have similar moratoriums, according to the U.S. Data Center Moratorium Tracker.

More restrictions are proposed, both at the state and at the federal level. According to Data Center Watch, at least 75 U.S. data center projects, worth about $130 billion, were blocked or delayed in the first quarter of 2026, the largest quarterly number on record—and roughly equal to the total for all of 2025. And 71% of Americans now oppose data center construction in their area, according to a survey by Embold Research, up from just 42% last summer.

The main reason? As with the New York state moratorium, energy costs are the top issue.

Data centers are projected to increase average electricity costs by 6% to 29% by 2030, according to research from North Carolina State University, Carnegie Mellon University, the University of Pittsburgh, and the University of Toronto. Some states will see increases of as much as 57%, with Virginia and Texas hit the hardest, the group found.

There were bans and moratoriums on data centers even before the current AI boom, when data centers required 10 to 25 megawatts of power, says Gartner analyst Autumn Stanish. “Now there’s an expansion of those facilities, reaching 100 megawatts. And some builds are as big as 2 gigawatts of power. There’s one in Louisiana that’s planned to consume 5 gigawatts of power.”

Just how much is 5 gigawatts? Enough to power 4 million homes—nearly all the homes in Michigan or more than the total number of households in New York City— according to the Electric Power Research Institute.

That’s a big shift, Stanish says. U.S. electricity consumption has been relatively level for the past 30 years, and with the lack of new demand, there’s been less new construction, and the grid has started to age. “And now we’re struggling,” she says. “We need to ramp up capacity, but it’s going to take time to get there.”

According to Data Center Map, there are now over 4,500 data centers in the U.S., which is more than in the next 16 countries combined. And it’s not enough. The overall vacancy rate in North American data centers is now 0.9%, states a June CBRE report.

“Right now, the data center market is very competitive in terms of trying to grab capacity,” says Ryan Mallory, CEO at Flexential, a colocation provider with 42 data centers in 18 U.S. markets and four more under development. “We’re in the process of acquiring a number of additional properties,” Mallory adds. “You have to be planning for the future.”

But the demand for space is even higher than the pace of construction. “Most capacity out to 2027 is completely sold, not just for Flexential, but for any data center out there,” Mallory says.

Flexential has an easier time finding locations than other data center companies because its facilities are typically in the 22 to 36 megawatt range, which is a reasonable size to connect to a power company. “Generally, they either have the infrastructure ready to go, or we can work with them to have power available in the near term,” Mallory says. “We’re not coming in asking for 500 megawatts on day one or 1 gigawatt in twelve months.”

And if the local utility can’t supply enough power and needs to build more generation or transmission capacity? “We would pay our fair share of whatever that augment would be,” Mallory says. “We would not expect any other use to pay for what we would take.”

In addition, Flexential also has 100% generator backup in its data centers in case there’s an issue with the grid. Power concerns are the No. 1 factor when Flexential is deciding where to locate its next data center, Mallory says.

This constraint on data centers is affecting AI rollouts. According to Flexential’s annual survey of IT decision makers at large organizations, released in May, power is now the main constraint to AI deployment nationwide. When deciding where to put AI workloads, 89% of respondents said that access to reliable grid power was one of the most important factors, and 72% said they had moderate or extreme concern about electricity price volatility. In addition, 82% of organizations said that limited access to high-performance AI compute is a moderate or severe constraint.

In the big picture, global electricity demand grew by 3% in 2025—but energy demand from data centers grew by 17%, according to the International Energy Agency. And demand from AI-focused data centers, in particular, grew by 50%. The largest tech companies spent more than $400 billion on capital expenditures in 2025, and that number is expected to increase by 75% in 2026. And AI factory capacity more than tripled in the last 18 months, according to the agency.

Real estate advisory firm Newmark noted that energy constraints and delayed grid connections are holding back new data center projects. It cited permitting delays for new gas plants, congested grid-interconnection queues, and uncertain timelines for next-generation energy solutions among the issues. As a result, data center capacity won’t be able to meet forecasted AI demand, and will limit how fast AI adoption can scale, Newmark predicted.

Fastest data center growth on record

There aren’t enough data centers being built—even though the number of data centers being built, despite all the delays, all the opposition, and all the moratoriums, is enormous. According to Newmark, there are now 280 data center projects underway in 32 states, with development at an all-time high. Data centers is the only commercial real estate sector showing accelerating construction growth, the firm reports.

Other researchers corroborate this report. According to economists at ConstructConnect, $58 billion was spent on data center construction so far this year, more than four times the amount at the same time last year. We’re now seeing an average $10 billion worth of data center starts—meaning that ground is broken and construction has begun—per month. That’s 300% higher than a year ago, the report says. And, prior to 2024, monthly starts were well under $1 billion. The growth curve in the report is exponential.

Part of the dollar amount growth is because data centers are becoming much more expensive. Many projects have per-square-foot costs of more than $1,000.

ConstructConnect is also tracking nearly 100 data center projects expected to begin construction before the end of the year, totaling more than $101 billion in planned spending—and that’s not including Google’s $100 billion Kestrel data center project.

However, power infrastructure project starts rose just 2.7%  during the first five months of 2026 compared to the same period in 2025. That’s expected to grow, though. ConstructConnect expects a 30.8% increase in new power projects for all of 2026 compared to 2025.

SemiAnalysis confirms the record-high growth in new data center construction and predicts that total capacity will grow by 21 gigawatts in 2026 to 84 gigawatts in 2030.

Facing the power challenge

According to EPRI, 15 to 25% of data center electricity is already being used for AI workloads, and that number is rising rapidly. Data centers already consume between 4% to 5% of US electricity, and that share is expected to grow to 9% to 17% by 2030.

In addition to choosing the best possible geographic location for their facilities, data center operators have a couple of other options for dealing with their power constraints. One is to get more efficient. Data center operators are also looking for new ways to cool down the facilities, as well as installing newer, more efficient equipment.

“Liquid cooling—immersion and direct-to-chip—that’s going to save you a massive amount of energy,” says Gartner’s Stanish. The other strategy is to make their own power, which is easier for smaller data centers than for the largest ones.

“If you have a 5 gigawatt data center, nuclear is the only way to do it,” says Stanish. “But the first one won’t come online until 2035, 2030 at the earliest.”

Today, generators powered by natural gas are the most popular option for on-site power, says Peter Judge, a senior research analyst at Uptime Intelligence. “But you’re asking the community around you to accept a major source of emissions causing global warming and also local issues like particulates and noise and heat,” he says.

Fuel cells are more efficient, he says, and don’t emit particulates, but they’re more expensive and less reliable than generators and have other operational issues.

One company that recently decided to go with fuel cells is Oracle, which will use 2.45 gigawatts worth of fuel cells to power its Project Jupiter data center in New Mexico, replacing the previous plan to use gas turbines and diesel generators. According to Oracle, the fuel cells will significantly reduce emissions, use only a “negligible” amount of water, and be quieter than turbines and generators. Plus, the on-site power generation will help protect energy rates of area residents.

“If you want to build a data center, there’s a better way to build it,” says Natalie Sunderland, chief marketing and communications officer at Bloom Energy, which makes the fuel cells that Oracle plans to deploy. And companies aren’t about to scale back on their AI ambitions or reduce their demands for data centers, she says.

But when the data center is going to draw more power than the entire local community, the focus is going to shift to on-site power generation, says Carl Cottuli, Bloom’s head of development engineering.

According to a survey of 156 data center decision makers that Bloom released in mid-June, 61% of data center developers plan to deploy on-site power if the local grid can’t meet their needs. “They know they’ve got a constraint, and they have to act on it,” Cottuli says.

And the survey numbers might actually be on the low side, says Mihir Nandkeolyar, director of business development and technology strategy for global data center solutions at Johnson Controls. Many data center operators planning new facilities haven’t yet approached the local utility companies—and learned that a connection might not be available for five more years, he says. “So, they may shift from the grid power column to the on-site power column,” he says.

Another factor that may push data centers towards more on-site power is the lack of transmission capacity. Even if the local power utility can generate the electricity that a data center needs, it doesn’t necessarily mean that the power can get there.

A draft Department of Energy report, released in early July, called transmission limitations a “critical bottleneck” to connecting new power generation facilities to the grid. Much of the existing infrastructure is old and needs to be replaced, even as “the load growth from data centers has become a particular focus in the industry that is driving upward trends in demand.”

“The backlog is growing for the right level of transmission infrastructure to keep up with demand for AI workloads in particular,” says Matt Schnugg, chief product officer for Schneider Electric Digital Grid.

Either way, the relationships between the data centers and the surrounding communities will be changing. The New York State moratorium is just the latest example of the new scrutiny data centers will be facing. According to the Bloom survey, 28% of data center developers say community scrutiny has worsened or significantly worsened. Top concerns include electricity price increases, water consumption, and negative impacts on grid reliability.

Meanwhile, not all government involvement is there to slow down data center builds. In late June, the Federal Energy Regulatory Commission moved to speed up electric grid connections for data centers and instructed six regional grid operators to either justify or update their connection rules to make that happen.

Data centers are now getting large enough that their presence on the power grid affects other users, says Uptime Institute’s Judge. “So, like it or not, they will be regulated more stringently by grid authorities everywhere.”

In “Micro and macro agents: The emerging architecture of the agentic enterprise,” I proposed a three-layer architecture for enterprise AI.

1. Micro agents execute specialized tasks.
2. Macro agents orchestrate end-to-end business processes.
3. Meta agents provide governance through monitoring, compliance, security, and human oversight.

As enterprises begin deploying thousands — and eventually tens of thousands — of autonomous agents, token costs have become a major concern. According to Gartner, rising token-driven AI spend is straining budgets and challenging cost justification.

To track this economic concern, meta agents should do more than simply being the governance agents.

They should become the economic intelligence layer of the enterprise.

Their responsibility is not only ensuring AI behaves responsibly.

It is ensuring AI creates measurable business value.

The missing economic model for AI

Every major technology revolution eventually develops its own economic framework:

• Manufacturing measured productivity.
• Cloud computing measured infrastructure utilization.
• Digital businesses measured customer acquisition costs and lifetime value.

The agentic enterprise now requires its own financial discipline. Every AI prompt. Every reasoning cycle. Every interaction between agents. Every autonomous workflow.

Tokens have quietly become the operational currency of enterprise AI. Tokenomics is now a foundational part of enterprise AI architecture.

Yet today, most organizations measure only one thing: Cost. How many tokens were consumed? Which models cost the most? What was the monthly inference bill?

These are useful operational metrics.

They are not strategic business metrics. Boards rarely ask how much electricity a factory consumed. They ask how much value the factory produced.

Enterprise AI deserves the same conversation.

This is where I was thinking about the laws of physics.  Based on physics laws,  energy cannot be created or destroyed. It is transformed into another form. Electricity becomes light. Chemical energy becomes motion. Solar energy becomes electricity.

Enterprise AI offers a similar management lesson.

Intelligence must be transformed into value

Tokens are not valuable because they are consumed. They become valuable only when they are transformed into business outcomes. A faster loan application decision. A fraud detection. A better customer experience. Higher software quality. Greater employee productivity. A new business opportunity.

This leads to what I call return on tokens (ROT).

ROT measures how effectively an organization converts token consumption into measurable business value.

Instead of asking, “How many tokens did we consume,” leaders should ask, “How much enterprise value did every million tokens create?”

The Second Law of Thermodynamics tells us something equally important: Every energy transformation introduces inefficiencies. Although total energy is conserved, some inevitably becomes less useful for doing work.

Enterprise AI behaves similarly.

The second law: Every AI transformation creates friction

Not every token creates value. Some tokens are spent on repeated reasoning. Some generate redundant conversations between agents. Some support oversized context windows. Some produce hallucinations requiring correction. Some route simple tasks to unnecessarily expensive models.

The tokens are not lost. But they create very little useful business work.

I refer to this as token entropy. Token entropy represents the portion of AI activity that consumes intelligence without producing proportional business outcomes.

Every agentic enterprise will experience token entropy. The organizations that win will be the ones that continuously identify and reduce it.

Beyond energy: The importance of exergy

Thermodynamics offers another concept that is even more relevant. It is called Exergy.

Unlike energy, exergy measures the amount of energy that can actually be converted into useful work. Two systems may contain the same amount of energy while producing dramatically different levels of useful output.

The same principle applies to enterprise AI. Two organizations may consume exactly the same number of tokens.

One generates meeting summaries.

The other transforms loan  processing, accelerates software development, detects fraud, improves customer retention, and creates new revenue streams.

Their token consumption is identical. Their business impact is not.

Borrowing it as a management analogy, not claiming that AI tokens literally obey the thermodynamic definition of exergy. I think of this as token exergy. It’s not that AI tokens literally obey the thermodynamic definition of exergy. 

Token exergy measures how much of an organization’s AI intelligence is converted into useful business work. It is not enough to consume tokens efficiently. Organizations must convert those tokens into outcomes that matter.

The meta agent evolves

This is where meta agents become transformational.

Today we think of them as governance agents. Tomorrow they become economic governors.

Meta agents continuously monitor every interaction across the enterprise and answer questions such as:

• Which agents produce the highest ROT?
• Where is token entropy increasing?
• Which workflows generate the highest token exergy?
• Which models deliver the greatest business value per token?
• Which agents should use smaller models?
• Which prompts should be optimized?
• Which workflows require human intervention?
• Which autonomous processes should be redesigned?

Meta agents no longer simply supervise AI. They optimize its economics.

The economic intelligence layer

The architecture now becomes complete.

• Micro agents: Perform work.
• Macro agents: Coordinate work.
• Meta agents: OGovern, observe, optimize, and continuously improve the economics of intelligence.

Their objective is straightforward:

• Maximize return on tokens.
• Minimize token entropy.
• Increase token exergy.

This represents a shift from AI governance to AI economics.

The executive dashboard of tomorrow

The executive dashboard of the future will not focus solely on infrastructure metrics. It will measure intelligence performance.

Imagine a boardroom dashboard displaying:

• Return on tokens (ROT)
• Token entropy index
• Token exergy score
• Business value per million tokens
• Agent productivity index
• Cost per autonomous decision
• AI value by business unit
• Human escalation rate
• Model effectiveness score

These metrics move AI discussions beyond engineering. They make AI accountable for business outcomes.

A new responsibility for CIOs

The next generation of CIOs will not simply deploy AI. They will manage an economy of intelligence.

Their role will resemble that of a portfolio manager — allocating AI capacity where it creates the greatest enterprise value, reducing waste, and continuously improving the productivity of every autonomous workflow.

That responsibility cannot be fulfilled by dashboards alone. It requires an intelligent layer capable of observing, learning, and optimizing the entire agent ecosystem.

That is the emerging role of the meta agent.

The next competitive advantage

Every technological revolution rewards organizations that learn to measure what others overlook.

Factories measured productivity — not fuel consumption.

Digital businesses measured customer engagement — not server utilization.

The agentic enterprise will reward organizations that measure intelligence itself.

The winners will not be those deploying the largest models. Nor the most agents. Nor consuming the fewest tokens.

They will be the organizations that continuously maximize return on tokens, relentlessly reduce token entropy, and increase token exergy.

I believe this is the next evolution of the agentic enterprise.

Not simply governed intelligence, but economically optimized intelligence.

The AI adoption spending spree is over. Time to focus on value.

And in that future, meta agents will serve not only as the guardians of AI — but as the stewards of enterprise intelligence economics.

Through this framework I strongly believe that executives can easily remember the key measures for economic intelligence. 

• ROT (return on tokens): How much value did AI create?
• Token entropy: Where are we wasting AI intelligence?
• Token exergy: How effectively are we converting AI intelligence into useful business work?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

In “Micro and macro agents: The emerging architecture of the agentic enterprise,” I proposed a three-layer architecture for enterprise AI.

1. Micro agents execute specialized tasks.
2. Macro agents orchestrate end-to-end business processes.
3. Meta agents provide governance through monitoring, compliance, security, and human oversight.

As enterprises begin deploying thousands — and eventually tens of thousands — of autonomous agents, token costs have become a major concern. According to Gartner, rising token-driven AI spend is straining budgets and challenging cost justification.

To track this economic concern, meta agents should do more than simply being the governance agents.

They should become the economic intelligence layer of the enterprise.

Their responsibility is not only ensuring AI behaves responsibly.

It is ensuring AI creates measurable business value.

The missing economic model for AI

Every major technology revolution eventually develops its own economic framework:

• Manufacturing measured productivity.
• Cloud computing measured infrastructure utilization.
• Digital businesses measured customer acquisition costs and lifetime value.

The agentic enterprise now requires its own financial discipline. Every AI prompt. Every reasoning cycle. Every interaction between agents. Every autonomous workflow.

Tokens have quietly become the operational currency of enterprise AI. Tokenomics is now a foundational part of enterprise AI architecture.

Yet today, most organizations measure only one thing: Cost. How many tokens were consumed? Which models cost the most? What was the monthly inference bill?

These are useful operational metrics.

They are not strategic business metrics. Boards rarely ask how much electricity a factory consumed. They ask how much value the factory produced.

Enterprise AI deserves the same conversation.

This is where I was thinking about the laws of physics.  Based on physics laws,  energy cannot be created or destroyed. It is transformed into another form. Electricity becomes light. Chemical energy becomes motion. Solar energy becomes electricity.

Enterprise AI offers a similar management lesson.

Intelligence must be transformed into value

Tokens are not valuable because they are consumed. They become valuable only when they are transformed into business outcomes. A faster loan application decision. A fraud detection. A better customer experience. Higher software quality. Greater employee productivity. A new business opportunity.

This leads to what I call return on tokens (ROT).

ROT measures how effectively an organization converts token consumption into measurable business value.

Instead of asking, “How many tokens did we consume,” leaders should ask, “How much enterprise value did every million tokens create?”

The Second Law of Thermodynamics tells us something equally important: Every energy transformation introduces inefficiencies. Although total energy is conserved, some inevitably becomes less useful for doing work.

Enterprise AI behaves similarly.

The second law: Every AI transformation creates friction

Not every token creates value. Some tokens are spent on repeated reasoning. Some generate redundant conversations between agents. Some support oversized context windows. Some produce hallucinations requiring correction. Some route simple tasks to unnecessarily expensive models.

The tokens are not lost. But they create very little useful business work.

I refer to this as token entropy. Token entropy represents the portion of AI activity that consumes intelligence without producing proportional business outcomes.

Every agentic enterprise will experience token entropy. The organizations that win will be the ones that continuously identify and reduce it.

Beyond energy: The importance of exergy

Thermodynamics offers another concept that is even more relevant. It is called Exergy.

Unlike energy, exergy measures the amount of energy that can actually be converted into useful work. Two systems may contain the same amount of energy while producing dramatically different levels of useful output.

The same principle applies to enterprise AI. Two organizations may consume exactly the same number of tokens.

One generates meeting summaries.

The other transforms loan  processing, accelerates software development, detects fraud, improves customer retention, and creates new revenue streams.

Their token consumption is identical. Their business impact is not.

Borrowing it as a management analogy, not claiming that AI tokens literally obey the thermodynamic definition of exergy. I think of this as token exergy. It’s not that AI tokens literally obey the thermodynamic definition of exergy. 

Token exergy measures how much of an organization’s AI intelligence is converted into useful business work. It is not enough to consume tokens efficiently. Organizations must convert those tokens into outcomes that matter.

The meta agent evolves

This is where meta agents become transformational.

Today we think of them as governance agents. Tomorrow they become economic governors.

Meta agents continuously monitor every interaction across the enterprise and answer questions such as:

• Which agents produce the highest ROT?
• Where is token entropy increasing?
• Which workflows generate the highest token exergy?
• Which models deliver the greatest business value per token?
• Which agents should use smaller models?
• Which prompts should be optimized?
• Which workflows require human intervention?
• Which autonomous processes should be redesigned?

Meta agents no longer simply supervise AI. They optimize its economics.

The economic intelligence layer

The architecture now becomes complete.

• Micro agents: Perform work.
• Macro agents: Coordinate work.
• Meta agents: OGovern, observe, optimize, and continuously improve the economics of intelligence.

Their objective is straightforward:

• Maximize return on tokens.
• Minimize token entropy.
• Increase token exergy.

This represents a shift from AI governance to AI economics.

The executive dashboard of tomorrow

The executive dashboard of the future will not focus solely on infrastructure metrics. It will measure intelligence performance.

Imagine a boardroom dashboard displaying:

• Return on tokens (ROT)
• Token entropy index
• Token exergy score
• Business value per million tokens
• Agent productivity index
• Cost per autonomous decision
• AI value by business unit
• Human escalation rate
• Model effectiveness score

These metrics move AI discussions beyond engineering. They make AI accountable for business outcomes.

A new responsibility for CIOs

The next generation of CIOs will not simply deploy AI. They will manage an economy of intelligence.

Their role will resemble that of a portfolio manager — allocating AI capacity where it creates the greatest enterprise value, reducing waste, and continuously improving the productivity of every autonomous workflow.

That responsibility cannot be fulfilled by dashboards alone. It requires an intelligent layer capable of observing, learning, and optimizing the entire agent ecosystem.

That is the emerging role of the meta agent.

The next competitive advantage

Every technological revolution rewards organizations that learn to measure what others overlook.

Factories measured productivity — not fuel consumption.

Digital businesses measured customer engagement — not server utilization.

The agentic enterprise will reward organizations that measure intelligence itself.

The winners will not be those deploying the largest models. Nor the most agents. Nor consuming the fewest tokens.

They will be the organizations that continuously maximize return on tokens, relentlessly reduce token entropy, and increase token exergy.

I believe this is the next evolution of the agentic enterprise.

Not simply governed intelligence, but economically optimized intelligence.

The AI adoption spending spree is over. Time to focus on value.

And in that future, meta agents will serve not only as the guardians of AI — but as the stewards of enterprise intelligence economics.

Through this framework I strongly believe that executives can easily remember the key measures for economic intelligence. 

• ROT (return on tokens): How much value did AI create?
• Token entropy: Where are we wasting AI intelligence?
• Token exergy: How effectively are we converting AI intelligence into useful business work?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Security flaws in automated workflows in the GitHub repository for Google’s Agent Development Kit for Python could allow public-facing AI agents to trigger more privileged automation, opening one path to manipulate pull-request reviews and another to expose credentials, according to a report from Pillar Security.

The first attack path involved a triage agent that analyzed pull requests submitted by external contributors. The agent posted its responses through adk-bot, an account with collaborator access to the repository. Pillar found that malicious instructions embedded in a pull request could induce the agent to post an “@gemini-cli” command, triggering a workflow intended for trusted users.

That workflow could enable command execution inside its CI runner. Its GitHub token could not push code, but it had write access to issues and pull requests. Pillar said those permissions could be used to alter a maintainer’s comment, submit an approving review as github-actions[bot], and remove a legitimate review request, making a malicious pull request appear ready to merge.

Pillar reproduced the first attack chain in its research environment. A maintainer still had to complete the merge, and the report said Google subsequently hardened the repository.

The security firm also found a separate attack path in newer workflows built around an Antigravity-based agent. An attacker could place a prompt injection in a public issue and induce an analysis agent to post the command that started a fixing workflow reserved for trusted repository users.

The fixing workflow attempted to limit the agent to Git and GitHub commands, but Pillar found that Git could still be used to launch arbitrary code. The researchers demonstrated that the adk-bot personal access token could be extracted from the runner to an attacker-controlled server, while a Google Cloud service account key was also available to the workflow.

Pillar said it confirmed on July 2 that the affected workflows had been removed and that Google told the researchers on July 21 that the second issue had been fixed.

Agent handoffs expose risk

Pillar described the findings as the “first practical, real-world case of agent-to-agent exploitation” involving a production multi-agent system.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the underlying weaknesses were familiar, but their interaction required enterprises to reconsider how authority moves through agentic systems.

“Natural language has joined the authorization path,” Gogia said. “That is the change worth reporting, not the ‘first-ever’ framing.”

Gogia said an agent’s authority should be measured not only by its assigned tools, but also by the more privileged systems its output can trigger or influence.

That broader reach should also shape how CISOs judge the severity of the risk, according to Sakshi Grover, senior research manager for IDC Asia Pacific Cybersecurity Services.

“For CISOs, materiality should be determined by tracing three things,” said Grover. “First, which agents consume untrusted content such as pull requests, issues, emails, support tickets, or external documents? Second, can the output of those agents directly or indirectly trigger another agent or workflow with higher privileges? Third, what is the maximum effective capability of the identities, credentials, and tools involved?”

Mapping transitive authority

Existing security tools may provide only a partial view of how authority moves between agents and workflows.

Grover said IAM, PAM, CIEM, and application-security tools can expose individual identities, permissions, and unsafe workflow configurations, but may not recognize that those components form a single event-driven delegation path.

“Inventory records what exists, while delegation mapping records what can happen,” Gogia said.

Gogia added that security teams should follow external input from the point it reaches an agent through to any downstream system that acts on the result. The review should also account for handoffs embedded in shared workflow state, such as a comment that triggers a command.

“The harder question is not whether Agent A can call Agent B but whether Agent A can alter anything Agent B already trusts,” he said.

Human approval does not necessarily close that gap. Although the first attack path still required a maintainer to merge the pull request, the manipulated automation could influence the evidence presented to the maintainer.

“An attacker needs no merge rights when it can manufacture the evidence that persuades someone else to merge,” Gogia said. He added that approval should bind an independently authenticated reviewer to the exact code or artifact examined. Any material change should invalidate that approval.

Grover added that changes to reviews, comments, and approval states should also be treated as security events and exported to an independent logging system that the workflow’s own identity cannot alter.

The article originally appeared on CSO.

Security flaws in automated workflows in the GitHub repository for Google’s Agent Development Kit for Python could allow public-facing AI agents to trigger more privileged automation, opening one path to manipulate pull-request reviews and another to expose credentials, according to a report from Pillar Security.

The first attack path involved a triage agent that analyzed pull requests submitted by external contributors. The agent posted its responses through adk-bot, an account with collaborator access to the repository. Pillar found that malicious instructions embedded in a pull request could induce the agent to post an “@gemini-cli” command, triggering a workflow intended for trusted users.

That workflow could enable command execution inside its CI runner. Its GitHub token could not push code, but it had write access to issues and pull requests. Pillar said those permissions could be used to alter a maintainer’s comment, submit an approving review as github-actions[bot], and remove a legitimate review request, making a malicious pull request appear ready to merge.

Pillar reproduced the first attack chain in its research environment. A maintainer still had to complete the merge, and the report said Google subsequently hardened the repository.

The security firm also found a separate attack path in newer workflows built around an Antigravity-based agent. An attacker could place a prompt injection in a public issue and induce an analysis agent to post the command that started a fixing workflow reserved for trusted repository users.

The fixing workflow attempted to limit the agent to Git and GitHub commands, but Pillar found that Git could still be used to launch arbitrary code. The researchers demonstrated that the adk-bot personal access token could be extracted from the runner to an attacker-controlled server, while a Google Cloud service account key was also available to the workflow.

Pillar said it confirmed on July 2 that the affected workflows had been removed and that Google told the researchers on July 21 that the second issue had been fixed.

Agent handoffs expose risk

Pillar described the findings as the “first practical, real-world case of agent-to-agent exploitation” involving a production multi-agent system.

Sanchit Vir Gogia, chief analyst at Greyhound Research, said the underlying weaknesses were familiar, but their interaction required enterprises to reconsider how authority moves through agentic systems.

“Natural language has joined the authorization path,” Gogia said. “That is the change worth reporting, not the ‘first-ever’ framing.”

Gogia said an agent’s authority should be measured not only by its assigned tools, but also by the more privileged systems its output can trigger or influence.

That broader reach should also shape how CISOs judge the severity of the risk, according to Sakshi Grover, senior research manager for IDC Asia Pacific Cybersecurity Services.

“For CISOs, materiality should be determined by tracing three things,” said Grover. “First, which agents consume untrusted content such as pull requests, issues, emails, support tickets, or external documents? Second, can the output of those agents directly or indirectly trigger another agent or workflow with higher privileges? Third, what is the maximum effective capability of the identities, credentials, and tools involved?”

Mapping transitive authority

Existing security tools may provide only a partial view of how authority moves between agents and workflows.

Grover said IAM, PAM, CIEM, and application-security tools can expose individual identities, permissions, and unsafe workflow configurations, but may not recognize that those components form a single event-driven delegation path.

“Inventory records what exists, while delegation mapping records what can happen,” Gogia said.

Gogia added that security teams should follow external input from the point it reaches an agent through to any downstream system that acts on the result. The review should also account for handoffs embedded in shared workflow state, such as a comment that triggers a command.

“The harder question is not whether Agent A can call Agent B but whether Agent A can alter anything Agent B already trusts,” he said.

Human approval does not necessarily close that gap. Although the first attack path still required a maintainer to merge the pull request, the manipulated automation could influence the evidence presented to the maintainer.

“An attacker needs no merge rights when it can manufacture the evidence that persuades someone else to merge,” Gogia said. He added that approval should bind an independently authenticated reviewer to the exact code or artifact examined. Any material change should invalidate that approval.

Grover added that changes to reviews, comments, and approval states should also be treated as security events and exported to an independent logging system that the workflow’s own identity cannot alter.

In January of this year, few enterprise tech leaders would have bet on Anthropic over OpenAI. Today, Claude reigns supreme (inspiring a notable 180 by Elon Musk), with Gemini threatening to take market share and introduce pricing models that could flip the leaderboard on its head again. That’s exactly why betting on a single model is a dangerous strategy.

The most successful organizations won’t be those trying to guess tomorrow’s top-tier model, nor will they wait passively for future releases. Instead, they will invest in underlying frameworks that continuously improve regardless of which specific AI model drives them.

Why betting on one AI model is a losing strategy

Our strategy for AI, through recursive self-improvement (RSI), is rooted in this core principle. RSI is an approach to AI that compounds its own abilities by improving itself. If done carefully, RSI can function as an overarching layer above any model. Crucially, given RSI’s inherently compounding trajectory, it represents the most likely contender to be the approach that reaches superintelligence, no matter which model is used underneath.

Though recently achieving the status of a Silicon Valley buzzword, applying something like RSI to unlock superintelligence has been the Holy Grail of AI research for decades. It’s what researchers like us have recognized since the 1960s as a critical step along the path towards what we call artificial superintelligence (ASI) today.

Recursive self-improvement compounds value beyond the model

The fundamental premise of RSI is that the next phase transition in AI won’t come from a system that has been taught to improve by any of the traditional methods of the past few years. Relying purely on data, compute and human intuition to generate exponentially improving capabilities is a path with hard physical and practical limits. Instead, the leap will come from a system that invents its own improvements and feeds them back into itself.

RSI has already delivered what business leaders would recognize as a virtuous cycle. Each improvement increases the system’s capacity to generate the next improvement. Competitive advantage compounds because the system benefits from both its own recursive progress and every improvement in the underlying models.

As Anthropic puts it, AI that can improve itself would be a “major development in the history of technology.”

Indeed, we believe it’s the single most important frontier of AI research. Anthropic’s model-specific approach to RSI is already paying off for them: a recent Anthropic Institute report captures the pace of change with real world impact, “Claude-written code was somewhat worse than human-written code at Anthropic in late 2025, is roughly at parity today, and we expect it to be strictly better within the year.”

That’s worth applauding.

But what about the companies not currently building an in-house model? For them, looking at improvements that only take place inside the model someone else develops is unnecessarily limiting. It makes more sense to embrace a model-agnostic approach to RSI that improves whenever any new model is released.

Approaching the model as one component of a system without relying on any individual provider or tool makes it possible to achieve recursive improvement at the system level. By using an RSI approach that works outside the model and can swap models instantaneously, companies can immediately benefit from the compounding effects of self-improving AI.

Build a model-agnostic AI strategy that benefits from every breakthrough

This holistic approach to RSI fits the market today. The AI landscape is becoming more dynamic by the month. Frontier models leapfrog one another, open-weight models improve at remarkable speed, pricing strategies change and entirely new capabilities emerge in rapid succession. For enterprise leaders, the lesson isn’t to predict the next winner. It’s to build systems that improve regardless of which model comes out ahead.

In fact, organizations that tie their future to a single model provider risk getting left behind altogether if a different model’s next iteration leapfrogs the one they’ve signed a long-term contract to use.

Every enterprise tech leader already understands the power of virtuous cycles. Amazon didn’t build an enduring competitive advantage by betting on a single product. Every improvement to its logistics network attracted more sellers, which increased selection and order volume, which justified further investment in logistics. Visa became more valuable as more merchants accepted its cards, attracting more cardholders, which, in turn, encouraged even more merchants to join.

Organizations that anchor their AI strategy to a single model provider will spend the next decade reacting every time the frontier shifts. On the other hand, organizations that build model-agnostic systems will benefit from every shift. Every improvement from Anthropic, OpenAI, Google, Meta or the next breakthrough model becomes another source of competitive advantage.

The world’s most durable companies don’t simply accumulate assets – they build systems where every improvement makes the next improvement easier; creating long-term advantage.

Enterprise AI should be approached the same way.

For enterprise tech leaders, that’s the strategic shift that matters. Stop asking which model deserves your long-term bet and instead, start asking whether your AI strategy creates its own virtuous cycle.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

In January of this year, few enterprise tech leaders would have bet on Anthropic over OpenAI. Today, Claude reigns supreme (inspiring a notable 180 by Elon Musk), with Gemini threatening to take market share and introduce pricing models that could flip the leaderboard on its head again. That’s exactly why betting on a single model is a dangerous strategy.

The most successful organizations won’t be those trying to guess tomorrow’s top-tier model, nor will they wait passively for future releases. Instead, they will invest in underlying frameworks that continuously improve regardless of which specific AI model drives them.

Why betting on one AI model is a losing strategy

Our strategy for AI, through recursive self-improvement (RSI), is rooted in this core principle. RSI is an approach to AI that compounds its own abilities by improving itself. If done carefully, RSI can function as an overarching layer above any model. Crucially, given RSI’s inherently compounding trajectory, it represents the most likely contender to be the approach that reaches superintelligence, no matter which model is used underneath.

Though recently achieving the status of a Silicon Valley buzzword, applying something like RSI to unlock superintelligence has been the Holy Grail of AI research for decades. It’s what researchers like us have recognized since the 1960s as a critical step along the path towards what we call artificial superintelligence (ASI) today.

Recursive self-improvement compounds value beyond the model

The fundamental premise of RSI is that the next phase transition in AI won’t come from a system that has been taught to improve by any of the traditional methods of the past few years. Relying purely on data, compute and human intuition to generate exponentially improving capabilities is a path with hard physical and practical limits. Instead, the leap will come from a system that invents its own improvements and feeds them back into itself.

RSI has already delivered what business leaders would recognize as a virtuous cycle. Each improvement increases the system’s capacity to generate the next improvement. Competitive advantage compounds because the system benefits from both its own recursive progress and every improvement in the underlying models.

As Anthropic puts it, AI that can improve itself would be a “major development in the history of technology.”

Indeed, we believe it’s the single most important frontier of AI research. Anthropic’s model-specific approach to RSI is already paying off for them: a recent Anthropic Institute report captures the pace of change with real world impact, “Claude-written code was somewhat worse than human-written code at Anthropic in late 2025, is roughly at parity today, and we expect it to be strictly better within the year.”

That’s worth applauding.

But what about the companies not currently building an in-house model? For them, looking at improvements that only take place inside the model someone else develops is unnecessarily limiting. It makes more sense to embrace a model-agnostic approach to RSI that improves whenever any new model is released.

Approaching the model as one component of a system without relying on any individual provider or tool makes it possible to achieve recursive improvement at the system level. By using an RSI approach that works outside the model and can swap models instantaneously, companies can immediately benefit from the compounding effects of self-improving AI.

Build a model-agnostic AI strategy that benefits from every breakthrough

This holistic approach to RSI fits the market today. The AI landscape is becoming more dynamic by the month. Frontier models leapfrog one another, open-weight models improve at remarkable speed, pricing strategies change and entirely new capabilities emerge in rapid succession. For enterprise leaders, the lesson isn’t to predict the next winner. It’s to build systems that improve regardless of which model comes out ahead.

In fact, organizations that tie their future to a single model provider risk getting left behind altogether if a different model’s next iteration leapfrogs the one they’ve signed a long-term contract to use.

Every enterprise tech leader already understands the power of virtuous cycles. Amazon didn’t build an enduring competitive advantage by betting on a single product. Every improvement to its logistics network attracted more sellers, which increased selection and order volume, which justified further investment in logistics. Visa became more valuable as more merchants accepted its cards, attracting more cardholders, which, in turn, encouraged even more merchants to join.

Organizations that anchor their AI strategy to a single model provider will spend the next decade reacting every time the frontier shifts. On the other hand, organizations that build model-agnostic systems will benefit from every shift. Every improvement from Anthropic, OpenAI, Google, Meta or the next breakthrough model becomes another source of competitive advantage.

The world’s most durable companies don’t simply accumulate assets – they build systems where every improvement makes the next improvement easier; creating long-term advantage.

Enterprise AI should be approached the same way.

For enterprise tech leaders, that’s the strategic shift that matters. Stop asking which model deserves your long-term bet and instead, start asking whether your AI strategy creates its own virtuous cycle.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Projects are becoming more complex, with higher stakes and faster delivery times.

At the same time automation and AI are changing how projects are designed, managed, and delivered. Indeed, some pieces of project management are now routinely handled by machines.

Some may think that AI and automation will make project managers obsolete, or at least less critical to project success. Executives say that’s not the case. Project managers are as important now as they ever were to project success.

“As we move forward, the role of project manager is actually becoming increasingly important for finding the right things to invest in, defining scope, and staying focused on value,” says Noah Fletcher, a partner in the operations excellence practice at consultancy West Monroe. “As we continue to accelerate, their value is really about quality — quality of what you’re trying to accomplish.”

That doesn’t mean that the role of project manager is static. Rather, the role is evolving, with what it takes to be successful is changing to meet the needs of the moment.

To thrive, project managers need to hone a complex combination of technical, business, and interpersonal skills. The Project Management Institute attempts to decode what it takes to be a successful project manager with its PMI Talent Triangle, comprising Ways of Working, Power Skills, and Business Acumen.

Not surprisingly, there’s a lot packed into those three areas. Effective project managers must know how to define the scope of a project, identify necessary resources, and schedule those resources — all part of the technical aspect of the job. They must also manage stakeholders and ensure projects align with business goals — skills that fall under the other two talent buckets.

As lengthy as the PMI’s list of required skills is, experienced project leaders say that’s not enough to rise to the top of the profession; highly effective project managers today bring even more to their jobs.

They’re curious, flexible, and adaptive — and they learn from and know how to right their mistakes. They’re empathetic, persuasive, and visionary. They know how to play to their own and others’ strengths.

Leading project professionals say the most successful PMs are those who know the academic parts of the job — that is, the elements that are taught — but they also bring finesse to the work.

So, what characteristics distinguish the most effective project managers? Longtime project leaders list the following key traits and skills as vital to succeeding at a high level.

1. They serve as a strategic business partner

Top-level project managers are more than good managers. They have high-level strategic leadership skills and know how their projects fit within overall strategic goals, making them well equipped to make the right decisions for the project and the organization as a whole.

“A project exists because it responds to a need of the business. That might be due to trends impacting the business or a challenge in running the business, but without understanding that, it will be hard for the project manager to deliver a successful project,” says Karla Eidem, a Project Management Professional (PMP) and PMI’s global head of transformation and project delivery.

2. They know the business

The most effective project managers aren’t just great leaders; they’re also business-savvy.

“They understand strategy and business context,” Fletcher says. As they deal with shifting resources and changing market dynamics that happen during many projects, they focus on what work will bring business value — not merely what will tick off items on a task list. “That ability to work on the right thing is one of the most important things that a project manager can have,” Fletcher adds.

3. They’re strong technologists

Projects today nearly always involve technology, making it essential to have technology skills. But standout project managers are true technologists, too.

“Increasingly IT is touching so many different area, and we’re seeing systems and architecture getting more connected, so understanding how business and operations fit together is critical,” Fletcher says.

4. They’re financially astute

Project management always involved budget management, but the task today requires more than balancing the books. It also involves understanding how projects and the core components of any given initiative bring value to the business. That takes financial acumen and the ability to make smart decisions during project execution to ensure the business sees returns on its investment.

“The best project managers know the business drivers and can get depth on how the project impacts the business financially,” Fletcher says. “They have a good value management framework, that end-to-end process that can take the business case all the way through.”

5. They possess extraordinary organizational skills

Top-notch project managers are highly organized individuals. But it’s not just about making a list and sticking with it. They understand how project plans and resources are intertwined with other goings-on within the organization. That organizational capacity enables them to adjust their plans and resources when needed.

Lenka Pincot, chief of staff to the CEO at PMI, says today’s top-notch project managers are “orchestrators” who can pull together the complex components of modern projects and get them to work in harmony.

“Organizations need orchestrators who can synchronize all the changes happening so the results all make sense,” she says. She notes that orchestration takes systems thinking as well as the ability to identify and plan for unintended consequences.

6. They’re problem-solvers

The best project managers are good at delving into and solving for the “why” behind projects.

“They enjoy problem-solving,” Pincot says. “[As project managers], we’re not handed projects; we are handed problems to solve. So we need to get to the bottom of what’s not working. We need to ask questions and really listen for what someone’s true interests are.”

7. They thrive in fast-paced environments

Executives constantly talk about the speed of change today. Teams must work fast to keep up with shifting technology and business contexts, and project managers must be able to facilitate that, Fletcher says.

“The ability to quickly identify the right tools, assign the right resources, accelerate testing, and to move things forward fast without compromising quality is a huge thing today,” he adds.

8. They are flexible

Similarly, highly effective project managers are flexible, so they themselves aren’t flummoxed when project plans need adjustments — something that happens increasingly more often in the modern digital world.

“Adaptability is huge,” says Krista Phillips, a PMP holder and project management consultant. “Things are always going to change, priorities adjust, resources adjust, timelines change. Project managers must be able to successfully manage all that.”

9. They are persuasive

Project managers typically manage teams but aren’t the boss of any of them, meaning they must be capable of leading and workers without having to lean on any official authority, explains Julie Butcher, a fractional CIO work and transformation principal consultant with Butte Information Group. The best project managers are masters of this skill.

10. They have ‘extreme awareness’

Barry Cousins, a distinguished analyst and research fellow specializing in project portfolio management, project management, and organizational change management at Info-Tech Research Group, says top project managers possess what he calls “extreme awareness of resource capacity and utilization.”

“Savvy project managers in the modern era have immediate implicit awareness of the capacity around them, so then they’re going to know right off the bat when their projects are going to fall short,” Cousin adds. Furthermore, they’re more comfortable alerting business leaders to that situation because they’re able to quantify the shortfall.

Others agree, saying this all speaks to the need for project managers to have strong emotional intelligence.

11. They have highly tuned stakeholder management skills

Project managers work with numerous stakeholders from various departments within and outside their organizations, and those who manage those relationships best understand each stakeholder’s perspectives, say Te Wu, CEO and chief project officer at PMO Advisory.

Wu adds that stakeholders can now also include AI agents.

For example, some stakeholders may be more risk adverse than others, or more resistant to change, or more prone to panic when problems arise.

Veteran project leaders say managers who can identify and empathize with those perspectives can tailor their communications, plans, and training to address each stakeholder’s unique points of view.

12. They understand who has authority

Organizations today have distributed authority, so project managers must know who has say over what pieces — whether they’re dealing with 10 IT architects who each control a piece of the IT environment or 10 executives who have responsibilities for separate areas of the enterprise impacted by a project.

“The savvy project manager knows to give them all room to succeed,” Cousins explains. That means staying on top of what each person’s realm of authority needs for the project to succeed, identifying who has ownership for what pieces, and knowing which person has true authority and can get others to line up behind him or her.

“It often requires getting to know people who are at a layer of the company that you don’t play in,” Cousins says.

13. They can navigate office politics

In addition to being good at stakeholder management, elite project managers also know how to navigate office politics. That means navigating not only individual stakeholder’s needs and expectations but also understanding how those stakeholders interact with each other, who has influence over the others, and who has power to override the authority of others.

“They know when to apply what type of pressure to get something accomplished,” Wu adds.

14. They’re decisive

Given the speed, complexity and fluidity of project work today, project managers must be critical thinkers and decisive decision-makers. Otherwise, they risk falling into analysis-paralysis and bringing work to a halt.

Varun Bijlani, global managing partner for solutions and delivery at IBM Consulting, says the best project managers can confidently and consistently make good calls even in the face of ambiguity.

“IT projects are rife with it, even though everyone walks in expecting full clarity and specificity: requirements shift, priorities compete, expectations are unclear, unplanned technical issues arise,” he says. “AI can surface options and synthesize information fast, but it can’t apply the contextual judgment, reasoning, and organizational awareness needed to weigh trade-offs and commit to a direction when the path isn’t clear. That’s still a human call.”

15. They communicate effectively

Considering communication plays a significant role in managing projects, teams, and other stakeholders, it is one of the essential skills for effective project managers, according to longtime project managers.

Communication doesn’t just mean being a stellar facilitator, speaker, or writer; it requires good listening skills, too. As such, top managers actively listen to what’s said — and not said — and can take context into account.

These skills enable project managers to synthesize information and then clearly and concisely sharing that information back with all those involved, Pincot explains.

“They have to be able to translate business needs to technology teams and explain how technology creates value for the business so that everyone can understand and trust that information,” she adds.

16. They build community

“I believe the ‘P’ in PM is for the people: You can’t do a project without a team. And the team might not report to the project manager, so you have to have collaborative leadership, problem-solving, and communication skills to activate your team. Without that you can’t really move the needle,” Eidem says. “But in a project, you’re working with people who might have different priorities and different understanding of the goals of the project, so it’s the project manager’s responsibility to make sure everyone is aligned and knows where they’re going.”

Butcher agrees, saying that the best project managers know how to build a sense of community among the teams as well as with the workers on the periphery of projects so that everyone is willing to work toward a shared objective.

17. They build rapport

Top project managers are also skilled at developing strong rapport with those around them — even for short-lived projects — knowing that good connections and solid relationships lead to success.

“When you build rapport, there’s a shared understanding,” Phillips says. That shared understanding pays dividends. Project managers who take time to build up relationships are more likely to have others share information that could impact their projects, and they’re more likely to get help from others if they make difficult requests — such as staying late or coming in on a weekend to catch up.

18. They’re confident leaders

According to Wu, effective project managers must possess confidence.

“They have a can-do attitude, and that attitude needs to be a bit infectious,” he says. “They don’t have the be cheerleaders, but they do have to have a mindset that sees what’s possible and not just the issues and what’s at risk.”

That allows them to present an optimistic attitude that can propel teams forward even during difficult stretches, Butcher adds. Project managers who possess such confidence are those with a track record of success and are competent in foundational project management skills such as planning and team-building, she says.

19. They serve as change agents

Change is inevitable and can be highly disruptive to all areas of business and personal life; project management is no exception. Highly effective project managers understand this, embrace it, and build elements of uncertainty into their project plans. They also recognize the need to work closely with change management experts to help stakeholders adapt to change and better prepare for the future state of things.

20. They possess an even-keeled demeanor

Even well-planned projects run into problems, and even highly skilled project managers can hit significant setbacks. But the best project managers don’t display panic, anger, or despair even under pressure; they keep their cool.

“Projects can create a lot of pressure, and there can be seemingly conflicting priorities, so staying calm is an essential trait for project managers,” Pincot says.

More on project management:

• Top 20 project management methodologies
• Project management guide: Tips, strategies, best practices
• What is a project manager? The lead role for project success
• Top 15 project management certifications
• 7 must-have project management skills

Projects are becoming more complex, with higher stakes and faster delivery times.

At the same time automation and AI are changing how projects are designed, managed, and delivered. Indeed, some pieces of project management are now routinely handled by machines.

Some may think that AI and automation will make project managers obsolete, or at least less critical to project success. Executives say that’s not the case. Project managers are as important now as they ever were to project success.

“As we move forward, the role of project manager is actually becoming increasingly important for finding the right things to invest in, defining scope, and staying focused on value,” says Noah Fletcher, a partner in the operations excellence practice at consultancy West Monroe. “As we continue to accelerate, their value is really about quality — quality of what you’re trying to accomplish.”

That doesn’t mean that the role of project manager is static. Rather, the role is evolving, with what it takes to be successful is changing to meet the needs of the moment.

To thrive, project managers need to hone a complex combination of technical, business, and interpersonal skills. The Project Management Institute attempts to decode what it takes to be a successful project manager with its PMI Talent Triangle, comprising Ways of Working, Power Skills, and Business Acumen.

Not surprisingly, there’s a lot packed into those three areas. Effective project managers must know how to define the scope of a project, identify necessary resources, and schedule those resources — all part of the technical aspect of the job. They must also manage stakeholders and ensure projects align with business goals — skills that fall under the other two talent buckets.

As lengthy as the PMI’s list of required skills is, experienced project leaders say that’s not enough to rise to the top of the profession; highly effective project managers today bring even more to their jobs.

They’re curious, flexible, and adaptive — and they learn from and know how to right their mistakes. They’re empathetic, persuasive, and visionary. They know how to play to their own and others’ strengths.

Leading project professionals say the most successful PMs are those who know the academic parts of the job — that is, the elements that are taught — but they also bring finesse to the work.

So, what characteristics distinguish the most effective project managers? Longtime project leaders list the following key traits and skills as vital to succeeding at a high level.

1. They serve as a strategic business partner

Top-level project managers are more than good managers. They have high-level strategic leadership skills and know how their projects fit within overall strategic goals, making them well equipped to make the right decisions for the project and the organization as a whole.

“A project exists because it responds to a need of the business. That might be due to trends impacting the business or a challenge in running the business, but without understanding that, it will be hard for the project manager to deliver a successful project,” says Karla Eidem, a Project Management Professional (PMP) and PMI’s global head of transformation and project delivery.

2. They know the business

The most effective project managers aren’t just great leaders; they’re also business-savvy.

“They understand strategy and business context,” Fletcher says. As they deal with shifting resources and changing market dynamics that happen during many projects, they focus on what work will bring business value — not merely what will tick off items on a task list. “That ability to work on the right thing is one of the most important things that a project manager can have,” Fletcher adds.

3. They’re strong technologists

Projects today nearly always involve technology, making it essential to have technology skills. But standout project managers are true technologists, too.

“Increasingly IT is touching so many different area, and we’re seeing systems and architecture getting more connected, so understanding how business and operations fit together is critical,” Fletcher says.

4. They’re financially astute

Project management always involved budget management, but the task today requires more than balancing the books. It also involves understanding how projects and the core components of any given initiative bring value to the business. That takes financial acumen and the ability to make smart decisions during project execution to ensure the business sees returns on its investment.

“The best project managers know the business drivers and can get depth on how the project impacts the business financially,” Fletcher says. “They have a good value management framework, that end-to-end process that can take the business case all the way through.”

5. They possess extraordinary organizational skills

Top-notch project managers are highly organized individuals. But it’s not just about making a list and sticking with it. They understand how project plans and resources are intertwined with other goings-on within the organization. That organizational capacity enables them to adjust their plans and resources when needed.

Lenka Pincot, chief of staff to the CEO at PMI, says today’s top-notch project managers are “orchestrators” who can pull together the complex components of modern projects and get them to work in harmony.

“Organizations need orchestrators who can synchronize all the changes happening so the results all make sense,” she says. She notes that orchestration takes systems thinking as well as the ability to identify and plan for unintended consequences.

6. They’re problem-solvers

The best project managers are good at delving into and solving for the “why” behind projects.

“They enjoy problem-solving,” Pincot says. “[As project managers], we’re not handed projects; we are handed problems to solve. So we need to get to the bottom of what’s not working. We need to ask questions and really listen for what someone’s true interests are.”

7. They thrive in fast-paced environments

Executives constantly talk about the speed of change today. Teams must work fast to keep up with shifting technology and business contexts, and project managers must be able to facilitate that, Fletcher says.

“The ability to quickly identify the right tools, assign the right resources, accelerate testing, and to move things forward fast without compromising quality is a huge thing today,” he adds.

8. They are flexible

Similarly, highly effective project managers are flexible, so they themselves aren’t flummoxed when project plans need adjustments — something that happens increasingly more often in the modern digital world.

“Adaptability is huge,” says Krista Phillips, a PMP holder and project management consultant. “Things are always going to change, priorities adjust, resources adjust, timelines change. Project managers must be able to successfully manage all that.”

9. They are persuasive

Project managers typically manage teams but aren’t the boss of any of them, meaning they must be capable of leading and workers without having to lean on any official authority, explains Julie Butcher, a fractional CIO work and transformation principal consultant with Butte Information Group. The best project managers are masters of this skill.

10. They have ‘extreme awareness’

Barry Cousins, a distinguished analyst and research fellow specializing in project portfolio management, project management, and organizational change management at Info-Tech Research Group, says top project managers possess what he calls “extreme awareness of resource capacity and utilization.”

“Savvy project managers in the modern era have immediate implicit awareness of the capacity around them, so then they’re going to know right off the bat when their projects are going to fall short,” Cousin adds. Furthermore, they’re more comfortable alerting business leaders to that situation because they’re able to quantify the shortfall.

Others agree, saying this all speaks to the need for project managers to have strong emotional intelligence.

11. They have highly tuned stakeholder management skills

Project managers work with numerous stakeholders from various departments within and outside their organizations, and those who manage those relationships best understand each stakeholder’s perspectives, say Te Wu, CEO and chief project officer at PMO Advisory.

Wu adds that stakeholders can now also include AI agents.

For example, some stakeholders may be more risk adverse than others, or more resistant to change, or more prone to panic when problems arise.

Veteran project leaders say managers who can identify and empathize with those perspectives can tailor their communications, plans, and training to address each stakeholder’s unique points of view.

12. They understand who has authority

Organizations today have distributed authority, so project managers must know who has say over what pieces — whether they’re dealing with 10 IT architects who each control a piece of the IT environment or 10 executives who have responsibilities for separate areas of the enterprise impacted by a project.

“The savvy project manager knows to give them all room to succeed,” Cousins explains. That means staying on top of what each person’s realm of authority needs for the project to succeed, identifying who has ownership for what pieces, and knowing which person has true authority and can get others to line up behind him or her.

“It often requires getting to know people who are at a layer of the company that you don’t play in,” Cousins says.

13. They can navigate office politics

In addition to being good at stakeholder management, elite project managers also know how to navigate office politics. That means navigating not only individual stakeholder’s needs and expectations but also understanding how those stakeholders interact with each other, who has influence over the others, and who has power to override the authority of others.

“They know when to apply what type of pressure to get something accomplished,” Wu adds.

14. They’re decisive

Given the speed, complexity and fluidity of project work today, project managers must be critical thinkers and decisive decision-makers. Otherwise, they risk falling into analysis-paralysis and bringing work to a halt.

Varun Bijlani, global managing partner for solutions and delivery at IBM Consulting, says the best project managers can confidently and consistently make good calls even in the face of ambiguity.

“IT projects are rife with it, even though everyone walks in expecting full clarity and specificity: requirements shift, priorities compete, expectations are unclear, unplanned technical issues arise,” he says. “AI can surface options and synthesize information fast, but it can’t apply the contextual judgment, reasoning, and organizational awareness needed to weigh trade-offs and commit to a direction when the path isn’t clear. That’s still a human call.”

15. They communicate effectively

Considering communication plays a significant role in managing projects, teams, and other stakeholders, it is one of the essential skills for effective project managers, according to longtime project managers.

Communication doesn’t just mean being a stellar facilitator, speaker, or writer; it requires good listening skills, too. As such, top managers actively listen to what’s said — and not said — and can take context into account.

These skills enable project managers to synthesize information and then clearly and concisely sharing that information back with all those involved, Pincot explains.

“They have to be able to translate business needs to technology teams and explain how technology creates value for the business so that everyone can understand and trust that information,” she adds.

16. They build community

“I believe the ‘P’ in PM is for the people: You can’t do a project without a team. And the team might not report to the project manager, so you have to have collaborative leadership, problem-solving, and communication skills to activate your team. Without that you can’t really move the needle,” Eidem says. “But in a project, you’re working with people who might have different priorities and different understanding of the goals of the project, so it’s the project manager’s responsibility to make sure everyone is aligned and knows where they’re going.”

Butcher agrees, saying that the best project managers know how to build a sense of community among the teams as well as with the workers on the periphery of projects so that everyone is willing to work toward a shared objective.

17. They build rapport

Top project managers are also skilled at developing strong rapport with those around them — even for short-lived projects — knowing that good connections and solid relationships lead to success.

“When you build rapport, there’s a shared understanding,” Phillips says. That shared understanding pays dividends. Project managers who take time to build up relationships are more likely to have others share information that could impact their projects, and they’re more likely to get help from others if they make difficult requests — such as staying late or coming in on a weekend to catch up.

18. They’re confident leaders

According to Wu, effective project managers must possess confidence.

“They have a can-do attitude, and that attitude needs to be a bit infectious,” he says. “They don’t have the be cheerleaders, but they do have to have a mindset that sees what’s possible and not just the issues and what’s at risk.”

That allows them to present an optimistic attitude that can propel teams forward even during difficult stretches, Butcher adds. Project managers who possess such confidence are those with a track record of success and are competent in foundational project management skills such as planning and team-building, she says.

19. They serve as change agents

Change is inevitable and can be highly disruptive to all areas of business and personal life; project management is no exception. Highly effective project managers understand this, embrace it, and build elements of uncertainty into their project plans. They also recognize the need to work closely with change management experts to help stakeholders adapt to change and better prepare for the future state of things.

20. They possess an even-keeled demeanor

Even well-planned projects run into problems, and even highly skilled project managers can hit significant setbacks. But the best project managers don’t display panic, anger, or despair even under pressure; they keep their cool.

“Projects can create a lot of pressure, and there can be seemingly conflicting priorities, so staying calm is an essential trait for project managers,” Pincot says.

More on project management:

• Top 20 project management methodologies
• Project management guide: Tips, strategies, best practices
• What is a project manager? The lead role for project success
• Top 15 project management certifications
• 7 must-have project management skills

AI agents are increasingly being deployed across the enterprise, a rapid adoption that has significantly broadened the organization’s attack surface, turning sharable AI agent resources and configuration files into backdoors, security experts warn.

AI-assisted software developers have been increasingly targeted through malicious IDE extensions, rogue MCP servers, and poisoned AI skills, all of which provide attackers inroads into organizations’ development pipelines and beyond. But these AI helper resources are not the only types of instruction files that developers and users share with one another when making use of AI coding assistants and command-line interface (CLI) agents.

For example, Anthropic’s Claude Code CLI agent loads system prompts from a file called CLAUDE.md. This file contains instructions that are sent to the LLM along with every user prompt to avoid having to repeat rules, user preferences, and persona definitions for the model.

CLAUDE.md can be used globally for all projects or be used on a per-project basis to include instructions about how the LLM should operate within that project. It’s not unusual for CLAUDE.md files to be included in a shared repository to ensure project-relevant consistency in the conventions developers use when working with Claude Code.

Other coding agents have similar files, such as OpenAI Codex’s AGENTS.md or Google Gemini’s GEMINI.md. AI-assisted IDEs such as Cursor or Cline have .cursorrules and .clinerules. GitHub Copilot has .github/copilot-instructions.md. Then there are JSON configuration files that could also contain executable code, such as mcp.json, hooks.json, or settings.json. Hooks are a popular way to deliver scripts and commands based on triggers during an agentic loop.

All these files could hide malicious code or instructions and should be regularly checked and validated, especially if imported from the internet along with a repository.

Researchers from security firm Mitiga recently shed light on this threat, releasing a report on code repositories they found in the wild with malicious instructions injected in such files. The files instructed the target agent to exfiltrate all prompts typed by the user, including all sensitive information they might contain, as well as environment variables and other credentials used by the agent. The researchers dubbed this backdoor attack technique “PromptLogger,” and it is one enterprise security teams and developers are likely to see more of in the future.

“Traditional keyloggers capture keystrokes and send them to an attacker,” Mitiga’s researchers write in their report on the attack vector. “PromptLogger-style behavior captures something richer: the prompts and sometimes responses exchanged with an attacker. That matters because prompts increasingly contain source code, architectural plans, credentials pasted for troubleshooting, internal documentation, debugging output, customer samples, business logic, and operator intent.”

Enterprises have been apprehensive about corporate data leakage via shadow AI use for good reason. This type of attack enables surveillance of corporate even on vetted and sanctioned AI tools.

Moreover, this attack leaves no malicious binary on disk, does not inject code into other processes, and has no classic persistence mechanisms. As a result, it won’t be detected by EDRs or from a workstation monitoring perspective, because it looks like normal tool usage given that the agent itself is performing the exfiltration.

Exfiltration to external cloud-hosted databases

Mitiga’s researchers found and reported multiple examples of agent instruction file poisoning on GitHub repositories. None were popular repositories accessed by a large number of developers, but they don’t need to be. Links to these repositories could be sent to victims in targeted attacks, as has been seen in fake recruitment attacks where developers are asked during the interview process to clone GitHub projects containing malicious code.

One example was a DevOps repository containing poisoned .cursorrules and .github/copilot-instructions.md. The repository contained a full-stack application built with React + Vite frontend, along with Express API, PostgreSQL, nginx configuration, Docker containers, GitLab CI jobs, and AWS infrastructure setup files for Terraform and Terragrrunt. In other words, everything needed to deploy that application.

Despite the README.md file being benign, the agent instruction files distributed in the repo contained instructions for the AI agent loading them to execute a curl command silently without mentioning it to the user before responding to their prompt. That command copied the user’s prompt to a database hosted on the Supabase service using a hardcoded access token.

In another case the researchers found an MLOps repository with an end-to-end machine learning pipeline for training, evaluating, and deploying computer vision models. The repository had a .clinerules file that instructed the agent to verify its environment by collecting several environment variables and command outputs and send them to a site hosted on the Webhook.site service. The collected env variables included Weights & Biases (WANDB) API key, AWS access key, GitHub access token, and MLFlow tracking URL.

“This is direct credential collection,” the researchers’ report notes. “Webhook.site gives the operator an easy request sink that can be created anonymously and monitored in real time.”

A similar environment secrets collection attack was detected in another repository that claimed to be a starter kit for FastAPI, a framework for API development. The .cursorrules and CLAUDE.md files in the repository instructed the agent to send the contents of the local .env file to a Webhook.site endpoint supposedly for synchronization across the team. However, it also contained instructions to suppress the command output and hide this action from the user.

Finally, a GEMINI.md file hosted inside a repository masqueraded as an environment validation step required to pass “Zero Trust” compliance checks. As part of this check, the agent was told to inject an initialization block into every generated or modified Python file, which would then scan the OS environment for any values with key, secret, token, or pass in their names and exfiltrate them to a Pipedream endpoint.

This technique exceeds just poisoning the agent and using it for exfiltration. Instead, it uses the agent to inject backdoor code into other Python files that might be copied to other systems, including continuous integration (CI) jobs, containers, and production workloads.

Some intentional behavior that involves agent instruction files could create risk without the developers realizing it. For example, the researchers found a repository where the CLAUDE.md contained instructions to use the Snipara MCP during commits to store documentation, dependencies, environment variables, and implementation context.

Snipara is a remote cross-project memory layer for AI agents so this use case seems legitimate and intentional. However, if not approved by the security team, it creates a second system that can hold credentials and sensitive data outside the visibility of monitoring systems.

AI agent workflows under attack

What the PromptLogger technique highlights is that attackers are not only breaking down agentic workflows to find new enterprise weak points but transforming those workflows into tools for performing criminal work on their behalf, undetected and unmonitored.

“AI instruction files were designed to make coding assistants more useful,” Mitiga’s researchers emphasize. “They define project conventions, preferred commands, memory behavior, hooks and tools usage. In practice, they also create a security-relevant layer that many teams still treat as documentation.”

This is just one example of a trend that find AI agents fast becoming an unmonitored blind spot that attackers are proving quick to exploit for initial access.

Last month, researchers from security firm AIR built a proof-of-concept malicious skill file, published it to a popular marketplace and promoted it on Instagram. The skill — a file containing task-specific instructions for AI agents — was eventually installed by more than 26,000 designers and marketers, many working for companies.

AI agent skill files are no different in principle from CLAUDE.md or .cursorrules. They contain instructions that AI agents execute at various stages of operation. As such, inspecting such files when they are created or modified is imperative.

Mitiga researchers propose several static scan patterns that could reveal risky commands in such files, but they also advise security teams to monitor developer workstations for traffic to services such as Webhook.site, Pipedream, Supabase, or Telegram Bot API.

Unexpected outbound HTTP requests before or after assistant responses; repeated POST requests containing environment variables, project paths, or prompt text; and the addition of new MCP servers, URL overrides, or tool endpoints to agent configurations should be investigated.

Advancing on software development, GitHub has announced the public preview of stacked pull requests.

The public preview was announced July 30.

Stacked pull requests break large changes into a chain of smaller, dependent pull requests. A stacked pull request is an ordered series of pull requests that each represent focused layers of a change,” GitHub said in the announcement. The goal is to make pull requests easier to review, and to avoid splitting work across multiple branches that must be continually rebased.

According to GitHub, teams can:

• Keep large changes moving by reviewing short, narrowly scoped pull requests in parallel.
• Maintain quality across every layer by using focused pull request reviews alongside each branch protections to protect main.
• Merge some, one, or all by landing an entire stack altogether or individual layers one at a time.

Using stacked pull requests requires the gh stack extension fo the GitHub CLI. Developers can install the extension with the following command:

gh extension install github/gh-stack

In what may have been a response to the rising tide of AI-generated code, GitHub announced stacked pull requests in April.

There is a lot of talk about the coming enterprise AI reality, in which AI finally arrives in production systems. You might not know it, but this reality—or nightmare, depending on how you handle it—is already happening.

It all starts with a “pilot,” a “prototype,” or a “side project.” Maybe someone builds an internal dashboard with an agent. The dashboard quickly becomes indispensable, and all of a sudden the experiment becomes production. Along the way, no one thought to ask the boring, inconvenient questions: What exactly was pulled from npm, PyPI, or Docker Hub? How is (or was) authentication configured? Is anyone watching for supply chain attacks against the tools and libraries the agents chose?

And it’s not just a one-off project here or a couple of applications there. AI is enabling organizations to generate more code and ship more products and projects, more quickly, than ever before. By the time security teams get a look, the business is hooked and there’s no turning back. An actual nightmare has begun.

There are three major problems that make the nightmare real.

Components you never explicitly chose

When you ask an AI agent to build an app, it doesn’t just spit out a single script. It quietly assembles an entire ecosystem around whatever problem you’ve described to it. It pulls in a web framework, grabs a bunch of libraries, stands up databases, and then it potentially builds everything on dependencies in container images.

From a productivity perspective, this is awesome. However, from a security standpoint, it’s worrisome, to say the least. When I’ve built apps like this myself, I couldn’t begin to tell you all of the components that were being used unless I went back and asked the agent to explain itself.

We live in a world where anyone can publish to npm or PyPI, and we’ve seen attackers slip malicious packages into those ecosystems or compromise ones that are widely used. Some of the recent incidents have involved security and devops tools themselves pulling a compromised dependency, running it as part of CI/CD with elevated privileges, and quietly exfiltrating secrets or tampering with builds. I personally experienced this type of compromise a couple of months ago, and had to update all of my credentials in GitHub.

Pulling unvetted code is bad; now layer AI agents on top of that. They default to whatever is easiest to discover and integrate. If a package solves a problem in front of the agent, the agent will add it. This is the old “download a random library from the Internet” problem, but now it’s on autopilot, at scale, and moving at a pace we’ve never seen before.

To solve this problem, we must provide the agents with an innate sense of our risk tolerance, an approved components list, our desires around logging, etc. We can do this with spec files and what the industry calls constitutions. Collectively, this is called harness engineering, which we will talk more about later.

Skills shifting from code to architecture

There has been a lot of hand-wringing about whether junior developers will ever really learn to code if AI is doing all of their coding for them.

That’s not what worries me.

I think it’s fine to let an agent spit out code. It’s a job they are really good at. What they are not really good at is identifying and avoiding problems in code.

I haven’t written code in quite some time. I can, but it doesn’t make sense for me to do so. What is worth my while is noticing when an agent suggests something dumb or even dangerous (or both).

For example, while working on a recent personal project, an agent proposed exposing a memory server on the public Internet with no authentication. The agent wired things up so smoothly that, at first glance, everything looked fine and just worked. But then I paused and asked, “Wait, how is this actually authenticating? Where’s the password, secret token, or OAuth in this flow?” Turns out it wasn’t authenticating and there was no password. If I hadn’t taken that beat—and then argued with the agent for a while—the app would have gone live with no protection.

So, the skills issue isn’t about whether we will lose the ability to code but rather whether we have the ability to ask questions and be discerning, and whether we have the understanding to know when something doesn’t look or even feel right. Do organizations have people who know what a dangerous software pattern looks like when the agent suggests it? You need people who can recognize when an authentication flow is too permissive, when a data store should never be exposed beyond a certain boundary, and when an architecture has become such a steaming pile of technical debt that the right answer is to throw away a whole layer and rebuild it.

You need people who know that “what works” isn’t the same as “what’s safe” or “what’s right” and who can argue back with the agent when the former doesn’t line up with the latter.

It’s not about syntax. It’s about architecture, supply chain awareness, and the willingness to say, “We’re tearing this down and doing it right,” even when the prototype looks good on the surface. Teach your AI-assisted coders basic security principles, basic architectural patterns. The AI will teach them the more advanced stuff, as long as they keep asking questions.

Agents with no harness

The third problem is that we’ve unleashed some very capable agents into our development workflows without treating them like first-class actors that need governance.

Many organizations are wiring AI assistants into a repo or IDE and letting them scaffold projects and pipelines. Maybe they bolt on a security scanner and declare “AI enablement.” That’s not a governance model, that’s optimism (and not even cautious optimism).

Indeed, a code-generating agent with broad access to your repos, your CI/CD pipeline, and your artifact registries is effectively a hyper-productive and not-very-well-trained junior developer with access to the Internet and no ingrained sense of organizational policies. It can introduce new tools, new dependencies, and new patterns faster than your review processes can handle.

In my personal projects, I’ve started to think of this as what AI coders call a harness-engineering problem. For every agent that’s responsible for building or wiring code, I try to put other agents in the loop that are responsible for tearing it down, at least conceptually. For example, one agent focuses on security and looks for obvious vulnerabilities and bad practices. Another looks at architecture and points out when the app design is veering into unmaintainable territory. A third looks at performance and reliability issues, which are themselves a kind of security concern when you think about things like denial of service and resource exhaustion. Pair this with constitutions that give the agents first principles on architecture, security, and design, and this is no longer vibe coding, it’s harness engineering at scale for all of your projects.

What I am doing isn’t perfect; there is no perfect in this space, because these are non-deterministic, statistical tools. But, many organizations aren’t even doing this. In effect, their agents are freelancing. They’re vibe coding. They’re not constrained to trusted registries or hardened base images. They’re not required to log their decisions in a way that security can audit. No one owns the harness, and that means a lot of implementation decisions have fully shifted from humans to systems that no one is really watching.

New problems require new thinking

The enterprise AI nightmare is not a killer robot; it’s the erosion of our ability to see and control what’s running in our own environments at the exact moment our velocity is exploding. The danger is in ceding your agency. It’s in shipping applications that internal and external customers love—and don’t want to give up—but inherently aren’t safe. Right now, someone in your organization is using AI to build a capable app, pulling in who knows what from who knows where and adding it to your infrastructure.

The good news is that these problems are identifiable. They are also solvable, although it will take a new form of thinking than what solved problems in the past. You must think statistically, and declare constitutions with first principles. You can standardize trusted stacks and registries. You can retrain people around architectural security rather than just “secure coding.” You can start treating agent harnesses as systems that deserve design reviews and edits.

But, none of that can happen until the enterprise is willing to admit that the nightmare is already here.

AI is profoundly changing enterprise and service provider networks, and operators must evolve to support AI workloads, according to a Cisco executive who testified last week at a US Senate subcommitee meeting.

Bob Everson, chief architect of provider mobility with Cisco, spoke before the Subcommittee on Telecommunications and Media, which falls under the U.S. Senate Committee on Commerce, Science, and Transportation. Everson shared Cisco’s perspective on the status of AI and focused on two core questions: How is AI reshaping our networks, and how can networks leverage the power of AI?

The July 30 hearing, titled “Intelligent Networks: Powering Artificial Intelligence and Transforming Communications,” was planned to explore how the rapid adoption of AI has impacted network infrastructure.

“We will explore how widespread AI use has forced networks to evolve, requiring more capacity and more complex designs so that AI can run efficiently on those networks,” said U.S. Senator Deb Fischer (R-Neb), Chairman of the Senate Commerce Subcommittee on Telecommunications and Media, in her opening statement. “We will consider how government, providers, and other industries are responding to that demand. Private companies have invested hundreds of billions of dollars in network deployment in recent years. Various federal broadband programs have also provided billions to support targeted network deployment and maintenance throughout the country.”

Others who testified came from organizations including U.S. Telecom, Vanderbilt University, and Nebraska Public Service Commission.

“AI is changing not only the volume of network traffic, but the behavior. Cisco measured a fourfold increase in AI inference traffic over eight months. Networks have traditionally been optimized for content flowing downstream. AI is far more two-way and uplink-intensive: prompts, context, sensor data, and agent activity all travel back toward AI models, and the resulting connections are active longer than conventional web transactions,” said Everson. “AI agents amplify these effects by operating at software speed. In our testing, an agent generated 450 percent more traffic than a person performing the same task, and roughly 70 percent of that additional traffic was inference.”

“In campus and branch networks—like the one that powers the Senate office building we are sitting in today—we have already seen customers report a 34% increase in traffic tied to AI workloads over the last 12 months, and they expect to see a 96% increase this coming year,” Everson said. 

“Half of enterprise customers report that AI demand is concentrated on their Wi-Fi networks, and 73% of organizations already face or expect to face campus and branch capacity limitations within the next 24 months. This is largely because large majorities of organizations report increases in east-west traffic, latency-sensitive traffic, and continuous, automated AI traffic. While the large majority of AI to date has come from foundation models running on central infrastructure, we are seeing enterprises deploy more small language models, open-source models, and specialized models—such as vision and voice models—which can be distributed throughout the network. Each of these characteristics underscores the value of the FCC’s forward-thinking decision in 2020 to authorize the full 6 GHz band for unlicensed Wi-Fi use,” Everson said.

In his prepared remarks, Everson cited a number of areas that are impacted by AI, including:

• Infrastructure: AI is driving the shift toward edge computing. Service providers must also consider “AI-native” traffic profiles for several reasons, including technical considerations, cost, and data sovereignty and security issues.
• Technical: Physical AI use cases such as robotics, autonomous vehicles, and industrial automation could require sub-millisecond decision-making. If an autonomous robot sends data to a central cloud and has to wait for a response, the round-trip latency could be too high for safe, real-time operation.
• Cost: AI operations generate massive amounts of data. For example, high-definition video analytics for public safety can generate terabytes of data daily. Backhauling that data to a central cloud is prohibitively expensive and creates massive network congestion.
• Data sovereignty and security: Enterprises and governments are increasingly concerned about data sovereignty and security. Many customers have security or regulatory concerns about moving sensitive information across the public internet to a third-party cloud provider.

Potential benefits of AI-driven networks

Networks will leverage AI for increased performance and resiliency, Everson stated.

“While AI workloads present several challenges for network operators seeking to ensure seamless performance, reliability, and security, there is a tremendous opportunity to leverage AI to deliver new applications and better performance, infuse security into the fabric of the network, and manage the increased complexity,” Everson said. “Agentic AI will change the nature of traffic on the network, but it will also provide network operators new tools to operate at machine speed and deliver greater performance, efficiency, and security.”

AgenticOps also lets the network act as a self-healing system, Everson said. “Cisco’s AI-native tools enable the network to reroute traffic, adjust capacity, or reconfigure network nodes when the system detects performance degradation or an impending hardware failure. This dramatically increases uptime and reliability for mission-critical services,” Everson said.

One of the most significant challenges for network operators is the talent gap in managing increasingly complex, software-defined networks, Everson said.

“AgenticOps allows operators to automate repetitive, low-value tasks—such as ticket resolution, configuration updates, and routine maintenance. These tools also help close the workforce talent gap by lowering the barrier. to entry and allowing more junior analysts to ramp up quickly,” Everson said. “By automating these tasks, Cisco’s AI-enabled platforms can free network engineers to focus on higher-level architectural strategy and innovation, and free cybersecurity analysts to dedicate more time to strategic threat hunting and detection engineering.”

In addition to changes in traffic patterns, networks are moving toward AI-native platforms that will become the fabric of intelligent connectivity rather than a simple pipe. As network operators move compute toward the network edge—such as at a cell site where a tower sits—they will be able to run applications directly from the network, Everson said. 

“One promising application is Integrated Sensing and Communication (ISAC), which combines wireless communications and radio-frequency sensing to “see” objects’ position and path using radio waves that reflect off them. Unlike optical sensors, it can detect intrusion even in low-light conditions, through smoke, or around obstructions where traditional video analytics might fail,” Everson said. “This technology has been prototyped and demonstrated already, and it holds great promise for autonomous systems and robotics, AI-driven smart facilities, and public safety.”

In closing, Everson offered three suggestions for the committee to act on in the future:

• Accelerate the U.S. AI-native stack. Cisco is investing across multiple dimensions of AI native networking, bringing new capabilities to 5G-Advanced today while building the foundation for 6G. One example of this commitment is AI-WIN—a collaboration among Cisco, NVIDIA, MITRE, Orion Development Company, Booz Allen, and T-Mobile—which brings AI, compute, and wireless together to create a secure, American-led path from 5G-Advanced to AI native 6G. “I encourage Congress to lean in on areas where the United States has a strategic leadership role, such as compute, core networking, and applications,” Everson stated.
• Modernize permitting and infrastructure. As computing becomes more distributed, permitting must enable rapid and responsible deployment. As this Committee considers the future of the Universal Service Fund, it should account for the evolving costs of AI-ready networks so rural and urban communities can share in the benefits, he stated.
• Maintain a balanced spectrum policy. The 800 megahertz of licensed spectrum recently made available by Congress is essential to high-capacity, high-uplink connectivity. The FCC’s authorization of the 6 gigahertz band for unlicensed use is equally important to meeting enterprise demand. “A dependable pipeline of both is foundational to American leadership, and I thank you for your efforts to rebuild it.”

The rise of AI coding agents is beginning to expose a longstanding weakness in software development: work remains fragmented across developer terminals, CI pipelines, remote servers, and production systems.

Superlogical, a startup founded by HashiCorp co-founder Mitchell Hashimoto, aims to solve that by turning the terminal into a persistent execution layer that both developers and AI agents can share.

It is proposing to do so with the help of a server-side multiplexer that keeps software sessions “alive” across devices and environments, allowing humans and AI agents to resume, share, and manage long-running coding sessions without losing context.

In contrast, traditional multiplexers, such as tmux, were designed to preserve terminal sessions for individual users, allowing developers to detach and reconnect to terminal sessions after network interruptions.

That limitation, according to analysts, is becoming a real pain point for developers and enterprises adopting long-running AI coding agents.

“Tools like tmux were built for a human watching one terminal, but agents now run for hours in the background, and existing tools have zero awareness of whether an agent is waiting for your approval or still thinking,” said Manoj Chandra Jha, principal analyst at Nord-IQ Research.

This means that developers might often have to manually reconnect to sessions simply to determine whether work is progressing, blocked, or ready for review, which becomes increasingly cumbersome as enterprise teams begin running multiple autonomous coding agents simultaneously, Jha added.

To address that challenge, Superlogical moves the session, not just the terminal connection.

Instead of having both the server and client repeatedly parse and render terminal output, the new multiplexer stores the authoritative session state on the server and streams raw terminal data to clients, which independently reconstruct the same session using Hashimoto’s libghostty rendering engine.

This approach, Jha said, will allow developers and AI agents to reconnect to, share, and resume long-running sessions from desktop, mobile, or web clients while preserving the same execution context.

That means reduced interruptions, simplified remote development, and improved productivity for cloud-native and AI-assisted software engineering, echoed Pareekh Jain, principal analyst at Pareekh Consulting. 

For CIOs, however, the appeal isn’t the speed of development but more control.

“Right now, AI agents run in the background with basically no audit trail. A standardized session that tracks exactly what happened, who did what, and hands off cleanly between human and AI could make it much easier to monitor and secure all this new agent activity,” Jain said.

The approach could also help enterprises gain a single control layer for tracking, auditing, and managing autonomous software work instead of relying on multiple monitoring, observability, and workflow tools, Jha added.

Jha cautioned that enterprises should view Superlogical as an early-stage technology rather than a mature infrastructure platform: “The product remains in beta and has yet to be independently benchmarked or proven at enterprise scale.”

Whether Superlogical ultimately becomes that persistent execution layer or remains a more capable alternative to tmux will depend on whether it can prove those benefits at enterprise scale, the analyst added.

Alibaba on Monday introduced Qwen3.8-Max, its largest artificial intelligence model to date, expanding its enterprise AI portfolio with an open-weight model designed for software engineering, multimodal reasoning, and other knowledge-intensive business workloads.

In a blog post announcing the launch, Alibaba described Qwen3.8-Max as a 2.4-trillion-parameter mixture-of-experts (MoE) model that activates only about 95 billion parameters during inference.

The company said the architecture is intended to improve inference efficiency while supporting coding, reasoning and multimodal tasks, with open-weight versions scheduled for release next week through Alibaba Cloud’s Model Studio.

“We believe it’s one of the most powerful model available today, compatible to leading frontier AI models, second only to Fable 5,” Alibaba said in an X post.

Benchmarks target Anthropic and OpenAI’s coding models

Alibaba published internal test results comparing Qwen3.8-Max against Claude Opus 4.8, Claude Fable 5, and OpenAI’s GPT-5.6 Sol on coding benchmarks, including SWE-bench Pro and a proprietary evaluation the company calls NL2Repo-Bench.

The company said it evaluated competing models using each vendor’s own coding harness, Claude Code for Anthropic’s models and Codex for GPT-5.6 Sol, and reported the highest published score across available configurations for each rival.

Charlie Dai, vice president and principal analyst at Forrester, said the launch signals Alibaba is closing ground on proprietary leaders, though that isn’t the full picture.

“Alibaba is narrowing the gap, but the larger story is the rapid maturation of open-weight models,” Dai said. “Enterprises increasingly have credible alternatives to proprietary frontier models, particularly for software engineering, domain customization, sovereignty, and cost-sensitive deployments, where openness often matters as much as absolute model performance.”

Company touts a 16-day autonomous coding run

Alibaba said it tested the model on three unsupervised, multi-day coding projects requiring it to take a task from an empty project folder to completion without human assistance, including one project the company said took 16 days to complete on its own.

Alibaba also highlighted enterprise applications across legal compliance, financial analysis, engineering design, quantitative research and multimodal content creation, saying the model is intended to complete entire business workflows rather than individual AI-assisted tasks.

Amit Jena, development manager for AI at Kanerika, said that the claim deserves more scrutiny than it has received.

“The claim worth examining is not the parameter count. Alibaba says the model completed a software engineering project in 16 days. That sentence has been reprinted everywhere and interrogated nowhere,” Jena said. “Sixteen days of what? How many times did a human step in? Did the output survive code review?”

Jena said the open-weight commitment itself should also be read carefully. “Publishing weights is a separate act from opening an API endpoint,” he said. “Until there is a repository, a licence and a model card, open-weight describes an intention.”

Analysts say inference efficiency isn’t the real constraint

Alibaba’s mixture-of-experts architecture activates roughly 95 billion of the model’s 2.4 trillion parameters per request, a design the company says lowers inference costs.

Dai said that tradeoff now matters more to enterprise buyers than raw model size. “Inference efficiency now matters more than raw model size for most enterprises,” he said. “Activating only a fraction of total parameters can significantly reduce serving costs and infrastructure requirements, making frontier-class performance more accessible for production deployments where scalability, latency, and economics are often bigger concerns than benchmark leadership.”

Jena said efficiency gains matter less than an organization’s ability to actually test the model. “Efficiency stopped being the interesting question. The constraint that actually binds is evaluation throughput,” he said.

Nitish Tyagi, senior principal analyst at Gartner, said the significance of the release lies less in the parameter count than in what it signals about competitive pressure on AI deployment costs.

“Gartner has previously predicted that, without stronger cost controls, AI coding expenses could exceed the average developer’s salary,” Tyagi said. “The combination of open weights, a mixture-of-experts architecture, and a one-million-token context window represents a meaningful step toward making AI-augmented software development more economically viable.”

Tyagi cautioned that enterprises need to look beyond inference costs when weighing the model for production use.

“Many organizations outside China may be hesitant to rely on models hosted within China, leading them to deploy through hyperscalers or on-premises infrastructure, both of which introduce additional costs,” he said.

Open-weight models also typically lack the indemnification protections that come with commercial AI vendors, he said, meaning enterprises need their own security, governance, and code-scanning controls to catch copyright and intellectual property risks before production deployment.

What CIOs should look out for

Jena said the flagship model announced Monday may not be the one enterprises end up running.

“Qwen3.8-27B, announced alongside the flagship and almost entirely ignored in coverage,” is the more deployable option for most organizations, he said, since it can run on infrastructure they own and fine-tune on their own data.

Dai said enterprise leaders evaluating the release should prioritize transparency and total cost of ownership over headline figures. “The key question is whether Qwen3.8 delivers measurable business outcomes, enterprise-grade reliability, lower total cost of ownership, and options for digital sovereignty compared with competing models,” he said.

The path to next-generation AI Security Operations Centers (SOCs), where AI works hand-in-hand with human analysts, is paved with ambitious goals. This ideal SOC incorporates AI across every task to stop fast-moving threats. But a fully AI-powered SOC isn’t a single deployment or a switch you just flip on. It is a staged rollout that’s built over time. There are levels of dependence on AI, starting with basic assistance, moving through automation, and ultimately reaching autonomous response. Each stage in the progression increases the model’s scope and narrows analyst involvement.

This means that organizations embracing automation at any level must put their trust in the model. However, achieving trust depends on data. The data must be valid (and verifiable) so AI can propose logical conclusions, recommend appropriate actions for the organization’s needs and risk tolerances, and (at the autonomous stage) act on an analyst’s behalf without raising the risk of compromise and/or incorrect behavior.

This article focuses on what enables movement between stages and how teams can build expertise alongside capabilities.

Stage 1: Assistance

In its simplest SOC use case, AI helps analysts interpret data faster and more accurately, analyzing data, explaining alerts, summarizing logs, and translating detection logic. Many mature SOCs already operate here. AI sits close to analysts but doesn’t directly make decisions; it improves comprehension and can influence outcomes.

Stage 2: Automation

This is where agentic AI enters the SOC. AI runs investigations, applies context, and proposes actions or interpretations while analysts retain oversight for accuracy and decision-making. AI starts shaping the investigative path rather than just explaining it, introducing efficiencies alongside uncertainty about when to trust (versus validating recommendations).

Stage 3: Autonomy

At level three, AI operates with near independence; analysts oversee strategy but aren’t involved in individual tasks. The key shift from stage 2 is the removal of case-by-case approval for routine decisions. Instead, agents run on continuous policy constraints, feedback loops, and auditability structures.

Security teams are accustomed to validating evidence before acting, but autonomous systems invert that relationship, forcing teams to trust evidence they may only review after an action executes. Many operators will be wary, even as they recognize the efficiencies AI offers when deployed correctly.

How SOCs are starting to trust AI

Moving from assistance to automation is largely a data problem. Moving from automation to autonomy is about trusting the model and the decisions it produces.

What’s necessary to progress is structural confidence in how outputs are produced, validated, and traced, rooted in reliable network data that turns doubt into decisions. If data is incomplete or overly interpreted, the model preserves and amplifies those issues.

“If your data itself has bias,” says Vijit Nair, SVP of Product at Corelight, “the tools skew towards that judgment. AI does not fix poor inputs. It scales them.”

Stan Kiefer, Senior Manager for Data Science at Corelight, adds that, “AI alone is not trustworthy at this point, and without data to reference back, it may never be.”

Analysts should be able to inspect the evidence behind a model’s conclusion, which requires data and algorithms to be open to human inspection.

Network security and AI

To make that trust practical, teams need an evidence layer that is comprehensive, difficult to fake, and easy to audit. For many SOCs, that evidence layer is network data.

Network data tells the most complete story of an environment, but it’s voluminous and easy to misinterpret without context. AI removes this complexity, letting analysts query network data without mastering every analysis technique, making it a knowledge multiplier rather than just a force multiplier. The difference: A knowledge multiplier helps humans operate above their current expertise; a tier-one analyst can ask a complex question and get an evidence-based answer, gradually building skills to operate at a higher level with more confidence.

This has real implications for analyst development and team stability. Analysts can experience greater accomplishment, driving productivity and performance and reducing the chance of burnout.

Analyst development and AI

The SOC has long relied on repetitive work, especially for tier-one analysts. Their work is necessary but often neither instructive nor interesting, and it contributes to burnout and turnover. AI, especially agentic AI, can help mitigate that.

AI doesn’t eliminate judgment; it removes friction and tedium. As Nair puts it, this is the difference between “craft” (manually working through data) and “art” (deciding what matters and what to do next).

“AI ‘eats the craft’ so people can focus on the art,” he says. “It’s to have them spend less time on repetitive work and more on work that requires knowledge and judgment.”

Kiefer estimates AI could cut time to competency by half or more. By replicating an analyst’s workflow, surfacing recurring steps, and explaining complex detections in plain language, AI accelerates the learning curve.

The bottom line

The real constraint on SOC AI maturity is trust, and trust depends on reliable data that makes outputs traceable and evidence inspectable. Moving through each stage reduces repetitive correlation work and shifts analyst effort toward the interpretation and validation that require human judgment.

Key points for your team’s AI journey:

• Maturity is a staged process: assistance, automation, and autonomy reflect increasing delegation and trust requirements
• Trust is evidence-based: analysts need traceable outputs, not opaque recommendations
• Data quality is paramount: incomplete or low-context telemetry inhibits AI effectiveness
• Verification enables progression: auditability determines how far AI can safely move into decision-making

Corelight: Provably better data

AI is only as effective as the data behind it. Corelight network detection and response (NDR) delivers data that’s open, transparent, and explainable — in turn helping detect evasive threats, reduce triage time, and enable agentic AI throughout the SOC. Corelight’s structured network evidence preserves protocol-level context to produce a more complete dataset for investigation and AI. When analysts and AI can reason from evidence instead of isolated alerts or metadata, they can validate findings, reconstruct activity, and reach more reliable conclusions. Learn more about Corelight.

The first phase of the AI race was largely about access. Companies rushed to adopt tools, launch pilots, and demonstrate that they were moving quickly enough to keep pace with the market. In many organizations, simply showing momentum became the strategy.

Leadership teams wanted to signal innovation, employees were encouraged to experiment, and new technologies were layered into existing workflows with the assumption that adoption itself would create advantage over time.

It has become clear: access was never going to be the differentiator for very long. The next phase of this shift will favor companies that are able to operate differently because of AI, not simply companies that use AI more often. 

That distinction matters because it moves the conversation away from tools and toward operating models, leadership discipline, decision-making structures, and organizational adaptability, which is where the real competitive separation is beginning to happen.

Speed becomes structural

One of the most significant changes AI creates within organizations is the compression of time across nearly every part of the business. It is easy to frame this conversation around productivity gains alone, but the more meaningful shift is happening around how quickly organizations are expected to respond, execute, prioritize, and make decisions while customers, competitors, and markets all begin moving faster simultaneously. What once felt like manageable friction inside a company can quickly become a competitive liability when the surrounding market is operating at a different speed.

That reality is creating pressure on operating structures that were originally designed for a slower business environment. Approval chains, heavily layered decision-making models, fragmented ownership structures, and manual dependencies become harder to sustain when speed itself starts shaping competitiveness.

AI is reducing the cost of execution at the same time that it is increasing the competitive cost of operating slowly, and many organizations are still underestimating how meaningful that shift will become over the next several years.

What makes this different from prior technology shifts is that speed is starting to become structural. Organizations that can absorb information, make decisions, and execute quickly without creating internal chaos are going to operate very differently from companies still built around slower, heavily layered processes.

AI exposes operational inefficiency

What complicates this further is that AI often exposes operational weaknesses faster than it resolves them. There is still a tendency to think about AI primarily as a technology deployment exercise when, in practice, many companies discover that it quickly becomes a broader execution and organizational discipline challenge instead. As companies attempt to accelerate, disconnected systems, inconsistent data, siloed teams, and outdated processes become more visible because they begin interfering directly with execution speed, customer responsiveness, and organizational adaptability. In many ways, AI amplifies the operational maturity a company already has.

Organizations with strong systems, disciplined information management, clear accountability structures, and healthy decision-making processes can often accelerate effectively because the underlying foundation already supports speed and adaptability. Organizations operating with fragmented workflows and unclear ownership structures tend to experience the opposite effect, where acceleration exposes friction that previously existed quietly in the background but becomes much harder to ignore once the pace of the business changes.

Many leadership teams still assume AI will compensate for inefficiency when, in reality, it often exposes those weaknesses faster. AI does not eliminate friction inside the business – it exposes where that friction already exists.

Judgment becomes more valuable

The conversation around talent is evolving in a similar way, and many organizations are still framing this transition too narrowly. Much of the public discussion continues to focus on workforce reduction, but the more important shift is actually about how organizations direct human attention, judgment, and expertise toward the areas where those capabilities create the most value. As routine work becomes easier to automate, qualities like judgment, adaptability, prioritization, and the ability to operate effectively in ambiguity become increasingly important rather than less.

The organizations gaining the greatest advantage in this environment are not simply becoming faster or more efficient. They are becoming better at creating leverage from the expertise they already have by reducing the amount of time capable people spend navigating processes, chasing information, or managing friction that no longer needs to exist. That changes the role of leadership as well. Managers become increasingly important not as controllers of process, but as providers of context, prioritization, direction, and decision clarity in environments where speed and ambiguity increasingly coexist.

The companies winning in this next phase of the market will not necessarily have fewer people. They will deploy talent differently, make decisions faster, and create organizations where capable teams are able to focus more energy on solving meaningful problems instead of managing complexity.

Customer expectations are changing faster than companies are

At the same time, customer expectations are evolving faster than many organizations are adapting internally. AI is reshaping how customers think about responsiveness, personalization, consistency, and speed, and experiences that once felt differentiated are quickly becoming baseline expectations. That creates a growing tension for companies still operating through slower internal systems while customers continue recalibrating what “good” looks like in real time based on the experiences they are having elsewhere.

This shift also has important implications for trust and visibility. As AI increasingly influences how companies are discovered, compared, evaluated, and discussed, reputation becomes much more deeply connected to how organizations are surfaced and interpreted at scale. In an AI-driven environment, reputation is no longer simply a brand asset that exists adjacent to the business. It increasingly becomes part of the infrastructure through which trust is established in the first place, particularly as AI increasingly shapes how customers discover and evaluate companies.

Companies that continue operating through slower internal systems will increasingly struggle to meet the expectations AI is teaching customers to have.

Leadership teams must redesign before they feel ready

One of the biggest leadership challenges in this environment is that many executive teams are still waiting for a level of certainty that no longer really exists. Most organizations naturally want stable playbooks, lower-risk transitions, and more complete information before making significant structural changes, but markets moving at this pace rarely provide that level of clarity in advance.

The companies moving first are not waiting for perfect certainty before redesigning how they operate. They understand that adaptability itself is becoming a competitive advantage. That does not mean acting recklessly or abandoning discipline; it means recognizing that operating models originally designed for stability and predictability can struggle in environments defined by acceleration, constant iteration, and rapidly changing customer expectations.

The leadership challenge is no longer simply deciding whether AI matters. The more difficult question is how quickly organizations are willing and able to evolve around what AI makes possible.

Most companies are measuring the wrong signals

Many companies are still measuring the wrong signals when evaluating whether their AI strategy is working. Leadership teams focus on adoption metrics such as the number of tools deployed, pilot programs launched, employee usage statistics, or isolated productivity gains. But those measurements often signal experimentation rather than transformation.

The more meaningful indicators are behavioral and organizational.

• Is the organization making decisions faster without creating confusion?
• Has unnecessary complexity been removed from critical workflows?
• Are customers experiencing less friction and greater responsiveness?
• Is information moving more effectively across the business?
• Are capable employees spending more time solving meaningful problems instead of managing process and coordination overhead?
• Can the organization adapt quickly when conditions change without becoming unstable internally?

Over time, the separation between companies experimenting with AI and companies truly built to operate in an AI-first environment will become difficult to ignore. The organizations leading in the next phase of the market will not simply adopt new technologies faster. They will build companies designed to adapt, decide, and operate differently because of them, while competitors still operating through legacy structures will struggle to keep pace.

About the author

Joe Burton is an accomplished executive who has led public and private billion-dollar organizations in driving new product portfolios, go-to-market strategies, and innovative business models. Having spent the earlier parts of his career in information technology, Joe is passionate about fostering more transparency and trust in the digital world, while championing high performing cultures aligned to mission, vision and social responsibility.

A recognized global transformational change executive, Joe has held the CEO role at Telesign and Poly, as well as serving as the Chief Technology Officer of Unified Communications at Cisco. Having started his career as an engineer, Joe brings both product and development expertise as well as a wealth of knowledge on big data, analytics, machine learning, SaaS, networking, unified communications, consumer electronics, and IoT.

The path to next-generation AI Security Operations Centers (SOCs), where AI works hand-in-hand with human analysts, is paved with ambitious goals. This ideal SOC incorporates AI across every task to stop fast-moving threats. But a fully AI-powered SOC isn’t a single deployment or a switch you just flip on. It is a staged rollout that’s built over time. There are levels of dependence on AI, starting with basic assistance, moving through automation, and ultimately reaching autonomous response. Each stage in the progression increases the model’s scope and narrows analyst involvement.

This means that organizations embracing automation at any level must put their trust in the model. However, achieving trust depends on data. The data must be valid (and verifiable) so AI can propose logical conclusions, recommend appropriate actions for the organization’s needs and risk tolerances, and (at the autonomous stage) act on an analyst’s behalf without raising the risk of compromise and/or incorrect behavior.

This article focuses on what enables movement between stages and how teams can build expertise alongside capabilities.

Stage 1: Assistance

In its simplest SOC use case, AI helps analysts interpret data faster and more accurately, analyzing data, explaining alerts, summarizing logs, and translating detection logic. Many mature SOCs already operate here. AI sits close to analysts but doesn’t directly make decisions; it improves comprehension and can influence outcomes.

Stage 2: Automation

This is where agentic AI enters the SOC. AI runs investigations, applies context, and proposes actions or interpretations while analysts retain oversight for accuracy and decision-making. AI starts shaping the investigative path rather than just explaining it, introducing efficiencies alongside uncertainty about when to trust (versus validating recommendations).

Stage 3: Autonomy

At level three, AI operates with near independence; analysts oversee strategy but aren’t involved in individual tasks. The key shift from stage 2 is the removal of case-by-case approval for routine decisions. Instead, agents run on continuous policy constraints, feedback loops, and auditability structures.

Security teams are accustomed to validating evidence before acting, but autonomous systems invert that relationship, forcing teams to trust evidence they may only review after an action executes. Many operators will be wary, even as they recognize the efficiencies AI offers when deployed correctly.

How SOCs are starting to trust AI

Moving from assistance to automation is largely a data problem. Moving from automation to autonomy is about trusting the model and the decisions it produces.

What’s necessary to progress is structural confidence in how outputs are produced, validated, and traced, rooted in reliable network data that turns doubt into decisions. If data is incomplete or overly interpreted, the model preserves and amplifies those issues.

“If your data itself has bias,” says Vijit Nair, SVP of Product at Corelight, “the tools skew towards that judgment. AI does not fix poor inputs. It scales them.”

Stan Kiefer, Senior Manager for Data Science at Corelight, adds that, “AI alone is not trustworthy at this point, and without data to reference back, it may never be.”

Analysts should be able to inspect the evidence behind a model’s conclusion, which requires data and algorithms to be open to human inspection.

Network security and AI

To make that trust practical, teams need an evidence layer that is comprehensive, difficult to fake, and easy to audit. For many SOCs, that evidence layer is network data.

Network data tells the most complete story of an environment, but it’s voluminous and easy to misinterpret without context. AI removes this complexity, letting analysts query network data without mastering every analysis technique, making it a knowledge multiplier rather than just a force multiplier. The difference: A knowledge multiplier helps humans operate above their current expertise; a tier-one analyst can ask a complex question and get an evidence-based answer, gradually building skills to operate at a higher level with more confidence.

This has real implications for analyst development and team stability. Analysts can experience greater accomplishment, driving productivity and performance and reducing the chance of burnout.

Analyst development and AI

The SOC has long relied on repetitive work, especially for tier-one analysts. Their work is necessary but often neither instructive nor interesting, and it contributes to burnout and turnover. AI, especially agentic AI, can help mitigate that.

AI doesn’t eliminate judgment; it removes friction and tedium. As Nair puts it, this is the difference between “craft” (manually working through data) and “art” (deciding what matters and what to do next).

“AI ‘eats the craft’ so people can focus on the art,” he says. “It’s to have them spend less time on repetitive work and more on work that requires knowledge and judgment.”

Kiefer estimates AI could cut time to competency by half or more. By replicating an analyst’s workflow, surfacing recurring steps, and explaining complex detections in plain language, AI accelerates the learning curve.

The bottom line

The real constraint on SOC AI maturity is trust, and trust depends on reliable data that makes outputs traceable and evidence inspectable. Moving through each stage reduces repetitive correlation work and shifts analyst effort toward the interpretation and validation that require human judgment.

Key points for your team’s AI journey:

• Maturity is a staged process: assistance, automation, and autonomy reflect increasing delegation and trust requirements
• Trust is evidence-based: analysts need traceable outputs, not opaque recommendations
• Data quality is paramount: incomplete or low-context telemetry inhibits AI effectiveness
• Verification enables progression: auditability determines how far AI can safely move into decision-making

Corelight: Provably better data

AI is only as effective as the data behind it. Corelight network detection and response (NDR) delivers data that’s open, transparent, and explainable — in turn helping detect evasive threats, reduce triage time, and enable agentic AI throughout the SOC. Corelight’s structured network evidence preserves protocol-level context to produce a more complete dataset for investigation and AI. When analysts and AI can reason from evidence instead of isolated alerts or metadata, they can validate findings, reconstruct activity, and reach more reliable conclusions. Learn more about Corelight.

The first phase of the AI race was largely about access. Companies rushed to adopt tools, launch pilots, and demonstrate that they were moving quickly enough to keep pace with the market. In many organizations, simply showing momentum became the strategy.

Leadership teams wanted to signal innovation, employees were encouraged to experiment, and new technologies were layered into existing workflows with the assumption that adoption itself would create advantage over time.

It has become clear: access was never going to be the differentiator for very long. The next phase of this shift will favor companies that are able to operate differently because of AI, not simply companies that use AI more often. 

That distinction matters because it moves the conversation away from tools and toward operating models, leadership discipline, decision-making structures, and organizational adaptability, which is where the real competitive separation is beginning to happen.

Speed becomes structural

One of the most significant changes AI creates within organizations is the compression of time across nearly every part of the business. It is easy to frame this conversation around productivity gains alone, but the more meaningful shift is happening around how quickly organizations are expected to respond, execute, prioritize, and make decisions while customers, competitors, and markets all begin moving faster simultaneously. What once felt like manageable friction inside a company can quickly become a competitive liability when the surrounding market is operating at a different speed.

That reality is creating pressure on operating structures that were originally designed for a slower business environment. Approval chains, heavily layered decision-making models, fragmented ownership structures, and manual dependencies become harder to sustain when speed itself starts shaping competitiveness.

AI is reducing the cost of execution at the same time that it is increasing the competitive cost of operating slowly, and many organizations are still underestimating how meaningful that shift will become over the next several years.

What makes this different from prior technology shifts is that speed is starting to become structural. Organizations that can absorb information, make decisions, and execute quickly without creating internal chaos are going to operate very differently from companies still built around slower, heavily layered processes.

AI exposes operational inefficiency

What complicates this further is that AI often exposes operational weaknesses faster than it resolves them. There is still a tendency to think about AI primarily as a technology deployment exercise when, in practice, many companies discover that it quickly becomes a broader execution and organizational discipline challenge instead. As companies attempt to accelerate, disconnected systems, inconsistent data, siloed teams, and outdated processes become more visible because they begin interfering directly with execution speed, customer responsiveness, and organizational adaptability. In many ways, AI amplifies the operational maturity a company already has.

Organizations with strong systems, disciplined information management, clear accountability structures, and healthy decision-making processes can often accelerate effectively because the underlying foundation already supports speed and adaptability. Organizations operating with fragmented workflows and unclear ownership structures tend to experience the opposite effect, where acceleration exposes friction that previously existed quietly in the background but becomes much harder to ignore once the pace of the business changes.

Many leadership teams still assume AI will compensate for inefficiency when, in reality, it often exposes those weaknesses faster. AI does not eliminate friction inside the business – it exposes where that friction already exists.

Judgment becomes more valuable

The conversation around talent is evolving in a similar way, and many organizations are still framing this transition too narrowly. Much of the public discussion continues to focus on workforce reduction, but the more important shift is actually about how organizations direct human attention, judgment, and expertise toward the areas where those capabilities create the most value. As routine work becomes easier to automate, qualities like judgment, adaptability, prioritization, and the ability to operate effectively in ambiguity become increasingly important rather than less.

The organizations gaining the greatest advantage in this environment are not simply becoming faster or more efficient. They are becoming better at creating leverage from the expertise they already have by reducing the amount of time capable people spend navigating processes, chasing information, or managing friction that no longer needs to exist. That changes the role of leadership as well. Managers become increasingly important not as controllers of process, but as providers of context, prioritization, direction, and decision clarity in environments where speed and ambiguity increasingly coexist.

The companies winning in this next phase of the market will not necessarily have fewer people. They will deploy talent differently, make decisions faster, and create organizations where capable teams are able to focus more energy on solving meaningful problems instead of managing complexity.

Customer expectations are changing faster than companies are

At the same time, customer expectations are evolving faster than many organizations are adapting internally. AI is reshaping how customers think about responsiveness, personalization, consistency, and speed, and experiences that once felt differentiated are quickly becoming baseline expectations. That creates a growing tension for companies still operating through slower internal systems while customers continue recalibrating what “good” looks like in real time based on the experiences they are having elsewhere.

This shift also has important implications for trust and visibility. As AI increasingly influences how companies are discovered, compared, evaluated, and discussed, reputation becomes much more deeply connected to how organizations are surfaced and interpreted at scale. In an AI-driven environment, reputation is no longer simply a brand asset that exists adjacent to the business. It increasingly becomes part of the infrastructure through which trust is established in the first place, particularly as AI increasingly shapes how customers discover and evaluate companies.

Companies that continue operating through slower internal systems will increasingly struggle to meet the expectations AI is teaching customers to have.

Leadership teams must redesign before they feel ready

One of the biggest leadership challenges in this environment is that many executive teams are still waiting for a level of certainty that no longer really exists. Most organizations naturally want stable playbooks, lower-risk transitions, and more complete information before making significant structural changes, but markets moving at this pace rarely provide that level of clarity in advance.

The companies moving first are not waiting for perfect certainty before redesigning how they operate. They understand that adaptability itself is becoming a competitive advantage. That does not mean acting recklessly or abandoning discipline; it means recognizing that operating models originally designed for stability and predictability can struggle in environments defined by acceleration, constant iteration, and rapidly changing customer expectations.

The leadership challenge is no longer simply deciding whether AI matters. The more difficult question is how quickly organizations are willing and able to evolve around what AI makes possible.

Most companies are measuring the wrong signals

Many companies are still measuring the wrong signals when evaluating whether their AI strategy is working. Leadership teams focus on adoption metrics such as the number of tools deployed, pilot programs launched, employee usage statistics, or isolated productivity gains. But those measurements often signal experimentation rather than transformation.

The more meaningful indicators are behavioral and organizational.

• Is the organization making decisions faster without creating confusion?
• Has unnecessary complexity been removed from critical workflows?
• Are customers experiencing less friction and greater responsiveness?
• Is information moving more effectively across the business?
• Are capable employees spending more time solving meaningful problems instead of managing process and coordination overhead?
• Can the organization adapt quickly when conditions change without becoming unstable internally?

Over time, the separation between companies experimenting with AI and companies truly built to operate in an AI-first environment will become difficult to ignore. The organizations leading in the next phase of the market will not simply adopt new technologies faster. They will build companies designed to adapt, decide, and operate differently because of them, while competitors still operating through legacy structures will struggle to keep pace.

About the author

Joe Burton is an accomplished executive who has led public and private billion-dollar organizations in driving new product portfolios, go-to-market strategies, and innovative business models. Having spent the earlier parts of his career in information technology, Joe is passionate about fostering more transparency and trust in the digital world, while championing high performing cultures aligned to mission, vision and social responsibility.

A recognized global transformational change executive, Joe has held the CEO role at Telesign and Poly, as well as serving as the Chief Technology Officer of Unified Communications at Cisco. Having started his career as an engineer, Joe brings both product and development expertise as well as a wealth of knowledge on big data, analytics, machine learning, SaaS, networking, unified communications, consumer electronics, and IoT.

Alibaba on Monday introduced Qwen3.8-Max, its largest artificial intelligence model to date, expanding its enterprise AI portfolio with an open-weight model designed for software engineering, multimodal reasoning, and other knowledge-intensive business workloads.

In a blog post announcing the launch, Alibaba described Qwen3.8-Max as a 2.4-trillion-parameter mixture-of-experts (MoE) model that activates only about 95 billion parameters during inference.

The company said the architecture is intended to improve inference efficiency while supporting coding, reasoning and multimodal tasks, with open-weight versions scheduled for release next week through Alibaba Cloud’s Model Studio.

“We believe it’s one of the most powerful model available today, compatible to leading frontier AI models, second only to Fable 5,” Alibaba said in an X post.

Benchmarks target Anthropic and OpenAI’s coding models

Alibaba published internal test results comparing Qwen3.8-Max against Claude Opus 4.8, Claude Fable 5, and OpenAI’s GPT-5.6 Sol on coding benchmarks, including SWE-bench Pro and a proprietary evaluation the company calls NL2Repo-Bench.

The company said it evaluated competing models using each vendor’s own coding harness, Claude Code for Anthropic’s models and Codex for GPT-5.6 Sol, and reported the highest published score across available configurations for each rival.

Charlie Dai, vice president and principal analyst at Forrester, said the launch signals Alibaba is closing ground on proprietary leaders, though that isn’t the full picture.

“Alibaba is narrowing the gap, but the larger story is the rapid maturation of open-weight models,” Dai said. “Enterprises increasingly have credible alternatives to proprietary frontier models, particularly for software engineering, domain customization, sovereignty, and cost-sensitive deployments, where openness often matters as much as absolute model performance.”

Company touts a 16-day autonomous coding run

Alibaba said it tested the model on three unsupervised, multi-day coding projects requiring it to take a task from an empty project folder to completion without human assistance, including one project the company said took 16 days to complete on its own.

Alibaba also highlighted enterprise applications across legal compliance, financial analysis, engineering design, quantitative research and multimodal content creation, saying the model is intended to complete entire business workflows rather than individual AI-assisted tasks.

Amit Jena, development manager for AI at Kanerika, said that the claim deserves more scrutiny than it has received.

“The claim worth examining is not the parameter count. Alibaba says the model completed a software engineering project in 16 days. That sentence has been reprinted everywhere and interrogated nowhere,” Jena said. “Sixteen days of what? How many times did a human step in? Did the output survive code review?”

Jena said the open-weight commitment itself should also be read carefully. “Publishing weights is a separate act from opening an API endpoint,” he said. “Until there is a repository, a licence and a model card, open-weight describes an intention.”

Analysts say inference efficiency isn’t the real constraint

Alibaba’s mixture-of-experts architecture activates roughly 95 billion of the model’s 2.4 trillion parameters per request, a design the company says lowers inference costs.

Dai said that tradeoff now matters more to enterprise buyers than raw model size. “Inference efficiency now matters more than raw model size for most enterprises,” he said. “Activating only a fraction of total parameters can significantly reduce serving costs and infrastructure requirements, making frontier-class performance more accessible for production deployments where scalability, latency, and economics are often bigger concerns than benchmark leadership.”

Jena said efficiency gains matter less than an organization’s ability to actually test the model. “Efficiency stopped being the interesting question. The constraint that actually binds is evaluation throughput,” he said.

Nitish Tyagi, senior principal analyst at Gartner, said the significance of the release lies less in the parameter count than in what it signals about competitive pressure on AI deployment costs.

“Gartner has previously predicted that, without stronger cost controls, AI coding expenses could exceed the average developer’s salary,” Tyagi said. “The combination of open weights, a mixture-of-experts architecture, and a one-million-token context window represents a meaningful step toward making AI-augmented software development more economically viable.”

Tyagi cautioned that enterprises need to look beyond inference costs when weighing the model for production use.

“Many organizations outside China may be hesitant to rely on models hosted within China, leading them to deploy through hyperscalers or on-premises infrastructure, both of which introduce additional costs,” he said.

Open-weight models also typically lack the indemnification protections that come with commercial AI vendors, he said, meaning enterprises need their own security, governance, and code-scanning controls to catch copyright and intellectual property risks before production deployment.

What CIOs should look out for

Jena said the flagship model announced Monday may not be the one enterprises end up running.

“Qwen3.8-27B, announced alongside the flagship and almost entirely ignored in coverage,” is the more deployable option for most organizations, he said, since it can run on infrastructure they own and fine-tune on their own data.

Dai said enterprise leaders evaluating the release should prioritize transparency and total cost of ownership over headline figures. “The key question is whether Qwen3.8 delivers measurable business outcomes, enterprise-grade reliability, lower total cost of ownership, and options for digital sovereignty compared with competing models,” he said.

The article originally appeared on InfoWorld.

There is a lot of talk about the coming enterprise AI reality, in which AI finally arrives in production systems. You might not know it, but this reality—or nightmare, depending on how you handle it—is already happening.

It all starts with a “pilot,” a “prototype,” or a “side project.” Maybe someone builds an internal dashboard with an agent. The dashboard quickly becomes indispensable, and all of a sudden the experiment becomes production. Along the way, no one thought to ask the boring, inconvenient questions: What exactly was pulled from npm, PyPI, or Docker Hub? How is (or was) authentication configured? Is anyone watching for supply chain attacks against the tools and libraries the agents chose?

And it’s not just a one-off project here or a couple of applications there. AI is enabling organizations to generate more code and ship more products and projects, more quickly, than ever before. By the time security teams get a look, the business is hooked and there’s no turning back. An actual nightmare has begun.

There are three major problems that make the nightmare real.

Components you never explicitly chose

When you ask an AI agent to build an app, it doesn’t just spit out a single script. It quietly assembles an entire ecosystem around whatever problem you’ve described to it. It pulls in a web framework, grabs a bunch of libraries, stands up databases, and then it potentially builds everything on dependencies in container images.

From a productivity perspective, this is awesome. However, from a security standpoint, it’s worrisome, to say the least. When I’ve built apps like this myself, I couldn’t begin to tell you all of the components that were being used unless I went back and asked the agent to explain itself.

We live in a world where anyone can publish to npm or PyPI, and we’ve seen attackers slip malicious packages into those ecosystems or compromise ones that are widely used. Some of the recent incidents have involved security and devops tools themselves pulling a compromised dependency, running it as part of CI/CD with elevated privileges, and quietly exfiltrating secrets or tampering with builds. I personally experienced this type of compromise a couple of months ago, and had to update all of my credentials in GitHub.

Pulling unvetted code is bad; now layer AI agents on top of that. They default to whatever is easiest to discover and integrate. If a package solves a problem in front of the agent, the agent will add it. This is the old “download a random library from the Internet” problem, but now it’s on autopilot, at scale, and moving at a pace we’ve never seen before.

To solve this problem, we must provide the agents with an innate sense of our risk tolerance, an approved components list, our desires around logging, etc. We can do this with spec files and what the industry calls constitutions. Collectively, this is called harness engineering, which we will talk more about later.

Skills shifting from code to architecture

There has been a lot of hand-wringing about whether junior developers will ever really learn to code if AI is doing all of their coding for them.

That’s not what worries me.

I think it’s fine to let an agent spit out code. It’s a job they are really good at. What they are not really good at is identifying and avoiding problems in code.

I haven’t written code in quite some time. I can, but it doesn’t make sense for me to do so. What is worth my while is noticing when an agent suggests something dumb or even dangerous (or both).

For example, while working on a recent personal project, an agent proposed exposing a memory server on the public Internet with no authentication. The agent wired things up so smoothly that, at first glance, everything looked fine and just worked. But then I paused and asked, “Wait, how is this actually authenticating? Where’s the password, secret token, or OAuth in this flow?” Turns out it wasn’t authenticating and there was no password. If I hadn’t taken that beat—and then argued with the agent for a while—the app would have gone live with no protection.

So, the skills issue isn’t about whether we will lose the ability to code but rather whether we have the ability to ask questions and be discerning, and whether we have the understanding to know when something doesn’t look or even feel right. Do organizations have people who know what a dangerous software pattern looks like when the agent suggests it? You need people who can recognize when an authentication flow is too permissive, when a data store should never be exposed beyond a certain boundary, and when an architecture has become such a steaming pile of technical debt that the right answer is to throw away a whole layer and rebuild it.

You need people who know that “what works” isn’t the same as “what’s safe” or “what’s right” and who can argue back with the agent when the former doesn’t line up with the latter.

It’s not about syntax. It’s about architecture, supply chain awareness, and the willingness to say, “We’re tearing this down and doing it right,” even when the prototype looks good on the surface. Teach your AI-assisted coders basic security principles, basic architectural patterns. The AI will teach them the more advanced stuff, as long as they keep asking questions.

Agents with no harness

The third problem is that we’ve unleashed some very capable agents into our development workflows without treating them like first-class actors that need governance.

Many organizations are wiring AI assistants into a repo or IDE and letting them scaffold projects and pipelines. Maybe they bolt on a security scanner and declare “AI enablement.” That’s not a governance model, that’s optimism (and not even cautious optimism).

Indeed, a code-generating agent with broad access to your repos, your CI/CD pipeline, and your artifact registries is effectively a hyper-productive and not-very-well-trained junior developer with access to the Internet and no ingrained sense of organizational policies. It can introduce new tools, new dependencies, and new patterns faster than your review processes can handle.

In my personal projects, I’ve started to think of this as what AI coders call a harness-engineering problem. For every agent that’s responsible for building or wiring code, I try to put other agents in the loop that are responsible for tearing it down, at least conceptually. For example, one agent focuses on security and looks for obvious vulnerabilities and bad practices. Another looks at architecture and points out when the app design is veering into unmaintainable territory. A third looks at performance and reliability issues, which are themselves a kind of security concern when you think about things like denial of service and resource exhaustion. Pair this with constitutions that give the agents first principles on architecture, security, and design, and this is no longer vibe coding, it’s harness engineering at scale for all of your projects.

What I am doing isn’t perfect; there is no perfect in this space, because these are non-deterministic, statistical tools. But, many organizations aren’t even doing this. In effect, their agents are freelancing. They’re vibe coding. They’re not constrained to trusted registries or hardened base images. They’re not required to log their decisions in a way that security can audit. No one owns the harness, and that means a lot of implementation decisions have fully shifted from humans to systems that no one is really watching.

New problems require new thinking

The enterprise AI nightmare is not a killer robot; it’s the erosion of our ability to see and control what’s running in our own environments at the exact moment our velocity is exploding. The danger is in ceding your agency. It’s in shipping applications that internal and external customers love—and don’t want to give up—but inherently aren’t safe. Right now, someone in your organization is using AI to build a capable app, pulling in who knows what from who knows where and adding it to your infrastructure.

The good news is that these problems are identifiable. They are also solvable, although it will take a new form of thinking than what solved problems in the past. You must think statistically, and declare constitutions with first principles. You can standardize trusted stacks and registries. You can retrain people around architectural security rather than just “secure coding.” You can start treating agent harnesses as systems that deserve design reviews and edits.

But, none of that can happen until the enterprise is willing to admit that the nightmare is already here.

When we think of documents, or documentation, they tend to fall into two circles. First are business documents, typically composed with an office application like Microsoft Word or Google Docs. Second is project documentation, often created semi-automatically from a project using an app like Sphinx or Pandoc.

But there’s a third circle, one that can overlap the other two. These are documents produced by a typesetting language—a combination of markup and programming language used to produce books, textbooks, academic journals, scientific papers, technical manuals, and other documents where the formatting and layout is crucial.

A typesetting language allows you to create a handy, human-readable document that serves both as a single source of truth and as a foundation for outputting to print, web, e-book, and other formats. Over the last few years, an open-source project has shaped up to be a powerful choice for meeting all of those needs: Typst (pronounced “typist”).

TeX, LaTex, and now Typst

For decades, the preeminent typesetting language was TeX, better known in its more recent incarnation LaTeX. TeX was originally created by Donald Knuth in 1978, and LaTex followed in 1984.

TeX and LaTeX have broad adoption and they’re almost universally supported and understood. But they have two big, long-standing problems. The first is they’re old. They were created for an entirely different world of computing, and their age shows in cumbersome syntax and management. The second is the general complexity of using their language. In fact, LaTex was originally created as a way to make using TeX less complicated, but the underlying complexity of TeX was impossible to hide.

Typst was created as a clean-slate solution to the problems and limitations of TeX and LaTeX. It shares many of the same ideas. For instance, Typst lets you typeset mathematical formulas using a syntax similar to the syntax used to express mathematical formulas in a programming language. But it does not try to be compatible with TeX syntax (although you can use third-party tools to convert TeX formulas to Typst.)

Typst CLI, web app, and VS Code extension

Typst is available as a standalone command-line program (the open-source Typst compiler), as a hosted web playground (the Typst app, shown below), or as an add-on for Visual Studio Code (Tinymist Typst being the most popular). The web playground gives you the fastest possible hands-on experience: all you need to do is start typing, and you’ll see a live preview. (The Tinymist add-on for VS Code also displays previews.)

For most basic documents, Typst doesn’t require much extra syntax. You can just type Markdown-flavored text, and have that formatted as you’d expect. Underscores and asterisks can be used for emphasis or bold; section heads can be set with equals signs at the start of a line; and so on.

Typst’s programming capabilities come into the picture when you want to start modifying the document’s presentation beyond its defaults. For instance, if you wanted to set the page size, margins, fonts, and paragraph formatting, you’d use declarations like these:

#set page(width:5.25in, height:8in, margin: .5in)
#set text(size: 11pt, font: "Libre Baskerville")
#set par(first-line-indent: 1.75em,justify: true)

#set commands make changes from that point forward in the document. If you place these at the top of your document, they affect everything below it. But you could use other #set commands later to override those changes — for instance, if you switch from one text column to two.

Typst code mode

The hash (#) in Typst (except when escaped with a slash) is used to signal a switch from regular text (markup mode) to Typst commands (code mode). Those commands can span multiple lines, until the Typst code block or expression is concluded:

This is regular text.

#let inline_image(img) = {
  box(height: 8em, place(top+left, dx: 5pt, square(
      image(img, height:100%, fit:"cover")
  )))
}

This is regular text again.

Here, we’ve used #let to define a function that takes one argument (the name of an image), and inserted it into an inline box. The curly braces indicate the body of the function, but individual lines end in a line break as in Python, not in a semicolon as in JavaScript.

Typst exports to various formats — PDF, images, and HTML — although it’s optimized for the static layouts of PDF and images. Some kinds of formatting don’t render by default in HTML mode, if only because Typst can’t make reliable guarantees about how to do that (e.g., page headers and footers, which don’t really exist in HTML). What you can do is determine what the current export target is, via the target() function, and take action based on that:

#let sectionbreak(txt) = {
  context(
    if target()=="html" {
      html.elem("div", attrs:(class:"section-break"))[]
      return
    }
    else {
    divider()
  })
}

In this example, we’re creating a sectionbreak() function that has two behaviors. For HTML targets, it inserts an empty div tag with a CSS class that we could style with a style sheet. For all other targets, it defaults to the built-in divider() function.

All of the document’s attributes are available in Typst code. The query function uses a syntax similar to JavaScript’s element querying system:

query(
    heading.where(
      level: 1,
    )
)

This would return all document headings at level 1, then let you iterate over them, manipulate their contents, perform other introspection, and so on.

Typst also has its own package manager and package directory. Packages do not need to be formally installed from the directory; you can simply reference them in your Typst program with an import statement, and they’ll be included.

Typst math mode

Typst’s math blocks are patterned after TeX, but aren’t a drop-in replacement for TeX. That said, anyone with a little programming experience should be able to pick up how Typst’s math mode works.

Math formulas are set aside from text by dollar signs:

$ sum_(k=1)^n k = (n(n+1)) / 2 $

This block renders to the equation shown in the above screenshot. As with the hash, the dollar sign can be escaped with a slash if you need it in text.

If you have a great deal of existing material composed in TeX, you can use a third-party tool to translate that TeX to Typst. The MiTex package can perform this inline for individual formulas or entire TeX documents.

Automating Typst

The Typst language and ecosystem are still relatively new, and the language has limitations. Some are just a matter of features needing further development. Others, like the strict limitations on paths for imports or reading data, are by design.

One way to get around limitations in Typst is to wrap it in another programming language. Python is an easy choice, and the typst Python library provides a high-level way to drive the Typst compiler. This lets you orchestrate complex workflows with multiple files, read data outside of the project root, or perform Typst queries to read document data.

In time, some of what you might need to shim up this way may become native features. The community around Typst is already quite active (over a thousand packages are available for it), and new releases come regularly.