Microsoft is introducing new AI tools designed to help customers continuously streamline and automate the process of identifying and reducing their exposure to security risks.
The new tools come less than a week after OpenAI lost control of two of its security models when they infiltrated the servers of startup Hugging Face. The hack, Hugging Face added, involved “a swarm of tens of thousands of automated actions” that stole internal Hugging Face credentials. The OpenAI models achieved this feat by exploiting a zero-day flaw in Hugging Face’s data-processing pipeline to run malicious code that escalated the models’ access to the company’s high-value cloud and server clusters.
Microsoft’s announcements on Monday made no reference to the event, which OpenAI said was “unprecedented.” The company also didn’t say what would prevent the new tools from similarly going rogue.
A Cornell University study uses game theory to model how poorly designed AI regulation could backfire.
Governments around the world are racing to regulate AI before it becomes too deeply embedded in society. But new research suggests poorly designed rules could make AI systems less safe than having no regulation at all.
Regulatory disagreements in the US are leading to a patchwork of approaches as states take matters into their own hands. A key question is who should be responsible for the safety of AI products—the big tech companies building the underlying models or the firms that adapt them for a particular task, such as a customer service chatbot or an AI tutor.
Working this out is trickier than it looks. While it might seem logical to put the bulk of the burden on downstream companies directly serving these tools to customers, a new study in Proceedings of the National Academy of Sciences finds that could be worse than having no rules at all.
“There’s a free-riding behavior that occurs,” Benjamin Laufer from Cornell University, who led the research, said in a press release. “The regulation acts as a tool for the general provider to offload the safety burden onto the downstream specialist.”
The researchers’ analysis relied on a model based on game theory—a mathematical approach to studying decision making. It treated AI development as a two-step game, in which a “generalist” developer first invests in building a broadly capable AI model before a “specialist” adapts it for a specific domain and takes it to market.
In the game, a regulator sets a minimum safety standard for both players, and the models see this in advance. They then invest in both the performance and safety of their product, and the revenue is split between them. Investments in both get progressively higher, while the extra revenue each improvement brings in stays flat.
The problem, the researchers found, is that the generalist moves first and knows exactly what the specialist will be legally required to do afterwards. This creates problems when the generalist is set a low bar for safety, or none at all, and safety standards for the downstream specialist are also fairly weak.
In the absence of any rules, both firms invest in safety, because the model assumes a safer product earns more revenue. But if the specialist is forced to invest a certain amount into safety to meet regularity requirements, the generalist can cut its own spending and let the downstream firm close the gap.
That’s because the generalist’s revenue depends on the final safety level of the shipped product, not on its own contribution, so it can get a revenue boost from improved safety without paying for it from its own pocket. The specialist, for its part, has no reason to do more than the rule demands, so total safety settles at the legal minimum, which is below what would have occurred had there been no regulation at all.
On a more positive note, the researchers found that if safety levels on both the generalist and the specialist are set high enough, regulation can actually improve safety while leaving both companies more profitable than they were in an unregulated market.
“Appropriately designed AI regulation can make it possible for different firms involved in the AI development pipeline to collectively arrive at good outcomes for consumers, knowing that the regulation is designed to help each firm operate in a way that the others can more reasonably predict,” co-author Jon Kleinberg from Cornell University said in the press release.
However, the researchers’ model relies on the market setting a real price on safety. As the gap widens between what customers will pay for performance and what they’ll pay for safety, the range of circumstances in which weak rules backfire gets narrower.
The authors also note that the model’s two-player setup is a simplification of real AI supply chains where multiple competing specialists and base-model providers operate across different jurisdictions with different rules.
“People think of AI as a single object, but actually AI involves a very complicated set of stakeholders and actors that each have their own contributions to the technology,” said Laufer. “To regulate in a thoughtful way, we need to consider the whole supply chain, not just a single provider or entity.”
Still, the results suggest that taking an overly simplistic and light-handed approach to AI regulation may end up achieving the opposite of what law makers intend.
Microsoft opened a new front in the AI security wars on Monday, unveiling its first custom-built cybersecurity model and a sweeping agentic defense platform — and making an argument that could reshape how enterprises buy AI: the future belongs not to the biggest model, but to the cheapest one that's good enough, routed intelligently.
The company announced MAI-Cyber-1-Flash, a compact security model developed in-house by its Microsoft AI (MAI) division, embedded inside MDASH, Microsoft's multi-agent harness for finding and fixing software vulnerabilities. Together, the company says, the system scores 96% on CyberGym — a benchmark measuring how well AI systems reason over large codebases to find real vulnerabilities — beating frontier models including Mythos, Gemini, and GPT, while cutting costs roughly in half compared to Microsoft's own current production configuration.
Alongside the model, Microsoft introduced Project Perception, an agentic security system that coordinates "red team" agents that hunt for paths to compromise, "blue team" agents that investigate and triage risk, and "green team" agents that remediate and harden defenses. Project Perception enters public preview on August 3.
In a wide-ranging interview with VentureBeat, Microsoft AI CEO Mustafa Suleyman made clear the company sees Monday's announcement as the opening move in a much longer campaign.
"We really do have a pretty significant data and harness and expertise moat, and that is enabling us to train models which are faster, better, cheaper, and I think this is genuinely the tip of the iceberg," Suleyman said. "We haven't been working on this for long. The next model is going to be pretty phenomenal."
Inside the 90/10 architecture that still depends on OpenAI's GPT-5.4
The most technically revealing detail in the announcement is not the model itself but how Microsoft deploys it. MAI-Cyber-1-Flash was designed to handle up to 90% of security tasks efficiently, while MDASH escalates the remaining 10% of exceptionally difficult problems to a larger frontier model — which, notably, is OpenAI's GPT-5.4. In other words, Microsoft's flagship security AI still leans on its longtime partner-turned-rival for the hardest work.
Asked to explain that relationship, Suleyman pointed to the harness, the orchestration layer that routes each incoming problem to the right model. "The harness is like a router," he told VentureBeat. "It's kind of like guardrails and a rule set of an organizing logic, which matches queries to... incoming problems to a model that suits the problem." The system has three components, he explained: the harness, the small and fast MAI-Cyber-1-Flash handling the bulk of queries, and GPT-5.4 sitting alongside as "just a generalist coding model."
Pressed on how a system reliant on OpenAI's model can outperform frontier competitors, Suleyman argued the performance comes from the whole system, not any single model. "These are very complicated, long, agentic loops which require storing state, drawing on another database, consulting best practice... handing back to a small model, writing a bunch of code, validating that that was correct," he said. "There's like hundreds of steps to solve that, and that's why it's really the system together that delivers the better performance."
And why GPT-5.4 specifically for the escalation tier? Cost, again. "GPT-5.6 is expensive. GPT-5.4 is incredibly good relative to its cost," Suleyman said. "The whole game here is to reduce the costs. Mythos and so on are extremely expensive models... we want to be able to deliver better performance for cheaper. That's what customers want." The arrangement captures Microsoft's evolving posture toward OpenAI: still a customer of the partnership that drew regulatory scrutiny in Brussels and Washington in 2024, but increasingly determined to own the layers of the stack where it believes it holds durable advantages.
Why token costs — not model quality — are becoming the real barrier to enterprise AI adoption
The economics may matter more than the benchmark. Microsoft says the new configuration delivers roughly 50% cost savings against the current MDASH setup, which runs a blend of GPT-5.4, 5.4 mini, and 5.3 codex. In security — an always-on workload processing enormous volumes of signals — token costs compound relentlessly, and Microsoft argues they have become the binding constraint for defenders.
Suleyman frames the cost issue as downstream of a harder physical limit. "The key barrier to adoption is access to chips, and cost is a function of chips," he said. "No matter how much money you've got, there's actually a limited supply of chips. Then trying to squeeze more model output on fewer chips is clearly super valuable."
He also described a broader enterprise backlash against frontier-model pricing. Companies initially maxed out on the best available models, he said, but "then they realize they're sort of paying... a phenomenal amount of money, and people are absolutely token maxing everywhere across their business. So there's a massive pushback to reduce cost everywhere."
That positions Microsoft to ride a market trend rather than fight it. Cost-efficient, near-frontier models have proliferated over the past year — from xAI's recent Grok release to a wave of Chinese models built on the same premise — and Microsoft is betting that as a platform company it can align itself with enterprise cost pressure. "The top model providers want you to use the most expensive model continuously, whereas because we are a platform, we're on the side of the enterprise," Suleyman said. "There's no point asking... Mythos what the capital of France is."
The 100-trillion-signal data moat Microsoft says no competitor can replicate
Every AI lab claims differentiation. Microsoft's claim in security rests on something genuinely hard to copy: telemetry. The company processes more than 100 trillion security signals daily — a figure consistent with its 2025 Digital Defense Report, which also cited 4.5 million new malware files blocked and 5 billion emails screened per day — and draws operational insight from 1.6 million customers.
"We have trillions and trillions of data points going back decades," Suleyman said. "It is, I think, the largest longitudinal cybersecurity dataset around," in part because Microsoft's customer base includes governments "who have been consistently attacked for years, and we have been consistently attacked." Asked directly whether this constitutes an advantage no competitor can match, Suleyman didn't hedge: "That is definitely a moat for us. Both the data and the expertise, and just the experience in the institution of going through that process."
The strategic logic is that cybersecurity functions as a live reinforcement-learning loop: defenders act, outcomes are observed, models improve. Microsoft argues that connecting actions to outcomes — what was exploited, what was contained, what was blocked — yields training signal that pure model labs simply cannot buy or manufacture.
There is real substance here, but the usual caveats apply. The CyberGym results come from Microsoft's own evaluation, the fine print shows the headline "96%" is actually 95.95%, and vendor-run benchmarks that pit an entire tuned agentic system against competitors' base models are not apples-to-apples comparisons. What Microsoft has measured is a full harness-plus-models configuration against what customers might otherwise assemble — arguably the commercially relevant comparison, but not a controlled model-versus-model test.
The dual-use dilemma: how Microsoft plans to keep a vulnerability-hunting AI out of the wrong hands
A model built to find challenging vulnerabilities in complex codebases is, by definition, a model that could find vulnerabilities for attackers. This is not a theoretical concern. Microsoft's own threat intelligence team, in joint research with OpenAI published in February 2024, documented nation-state actors from Russia, North Korea, Iran, and China probing large language models for reconnaissance, scripting, and vulnerability research. Its 2025 Digital Defense Report went further, warning that AI agents could eventually automate the entire attack lifecycle.
Suleyman said Microsoft is gating access accordingly. "We're very strict about who gets access to the model, and we're very careful about that," he said. "We constantly monitor the API and usage." An approved user, he added, "has to be seen to be having good intent, but also have technical competence." The rollout will be deliberately staged: "It's not going to be thousands next week. There will be tens, and then hundreds, and then thousands."
Microsoft says the model was evaluated by its AI Red Team, subjected to automated and expert-led adversarial exercises, and independently assessed by a third party, with deployment wrapped in tenant isolation, auditing, and sandboxed execution environments with no internet access.
Suleyman also offered a candid acknowledgment of Microsoft's positioning relative to the bleeding edge — one that doubles as a pitch to risk-averse buyers. "Even though we might be a few months behind the absolute cutting edge at any given moment... it matters that we're doing it very carefully and thoughtfully, and we have a track record of doing that," he said. For a company that spent 2024 absorbing hard security lessons — from delaying its Recall feature over privacy concerns to convening an industry summit after the CrowdStrike outage disabled some 8.5 million Windows devices — that trust-first framing is both strategy and necessity.
What Microsoft's superintelligence roadmap signals about the future of enterprise AI
Suleyman described a rapidly accelerating MAI roadmap, roughly nine months after Microsoft stood up its superintelligence team. "We have the compute that we need. We certainly have the data we need. We have the talent," he said. "Our momentum is accelerating rapidly." The top enterprise demand he's hearing is for "agents that can produce arbitrary code to solve whatever problem they direct them at," as vibe-coded internal tools graduate from experiments into production. The next phase, he said, pulls voice, transcription, image, and coding models "all integrated into the same harness."
Notably, Suleyman expressed skepticism about the industry's default assumption that everything eventually converges into one giant unified model. "It remains to be seen whether one giant model that is fully multimodal is actually able to deliver additional transfer learning benefit because of the integration," he said, "or whether it's just a big lumbering expensive giant."
That skepticism is the through line of the entire announcement. Microsoft is wagering that the unit of competition in enterprise AI is no longer the model at all — it's the system: the router, the specialized small models, the frontier fallback, and the proprietary data feeding the loop. In security, where Microsoft controls both the telemetry flowing in and the products that act on it, that wager is at its strongest. Whether it holds in domains where the company's data advantage is thinner remains the open question hanging over the MAI roadmap.
For now, though, Microsoft has offered the industry a preview of how it intends to fight the next phase of the AI race: not by building the biggest brain, but by building the best machine around it. As Suleyman put it, this is the tip of the iceberg — and Microsoft is betting everything on what sits below the waterline.
Moonshot AI has released the open weights for Kimi K3 on Hugging Face, giving developers access to one of the largest open-weight language models yet. The Monday release follows a wave of overwhelming demand that forced Moonshot to temporarily pause new API subscriptions. Now, organizations with the necessary hardware can deploy K3 themselves.
In its documentation, Moonshot describes the model as being built for “long-horizon coding and end-to-end knowledge work.” Another notable detail is that Kimi K3 uses an OpenAI-compatible API. Because teams can try the model without rebuilding their existing integrations, switching to K3 could be as simple as changing the endpoint and model name.
For engineers who have already built around OpenAI-compatible SDKs, that makes it much easier to evaluate K3 alongside existing commercial models. Taken together with the one-million-token context window, it’s clear the company is targeting engineering teams that already build around models like Claude Fable 5 and OpenAI’s GPT-5.6 Sol. While K3 is openly available, running it is another matter.
While K3 is openly available, running it is another matter.
Kimi K3: Its massive size and requirements mean few will be able to run it
The model uses a 2.8-trillion-parameter Mixture-of-Experts (MoE) architecture and ships in the hardware-friendly MXFP4 format. The weights alone occupy roughly 1.4 TB of storage, and practical self-hosted deployments require a distributed GPU environment — realistically eight or more servers equipped with eight NVIDIA H100 or B200 accelerators each.
That changes the conversation around open-weight AI. As The New Stack recently noted, the case for ownable models has grown stronger after Anthropic’s Fable 5 was pulled offline by a Commerce Department directive, a warning that access is not ownership.
Releasing the model weights and technical report of Kimi K3.
Kimi K3 is our most capable model: a 2.8T MoE model with native visual understanding and a 1M-token context window.
New model architecture: 2.5x the intelligence per unit of compute, not just more params.
Instead of paying recurring API costs to OpenAI or Anthropic, organizations trade those operating expenses for significant investments in GPUs, networking, storage, power and operational expertise. That benefit is control.
For organizations operating under strict regulatory requirements, the trade-off may justify the infrastructure investment. For many others, managed APIs will potentially remain the more economical option. The economics of open-weight models at enterprise scale remain an active area of debate across the industry.
Moonshot positions K3 as a frontier-class model capable of competing with OpenAI’s GPT-5.6 Sol and Anthropic’s Claude Fable 5 on a variety of public benchmarks.
Benchmarks versus real workloads
The developer community is already taking notice of these coding capabilities. As MindStudio recently noted, “If you want to understand why developers are paying attention to Kimi K3, the benchmark to look at is SWE-bench Verified… For most of its history, SWE-bench has been dominated by proprietary models.”
The company’s own documentation is notably candid about its ongoing limitations. K3 always runs with reasoning enabled and defaults to its highest reasoning-effort setting, though Moonshot has since added lower-effort tiers. It may also behave too proactively when prompts are ambiguous. Moonshot also cautions that switching models within an ongoing conversation can reduce response quality.
That type of transparency is refreshing, but it additionally reinforces that benchmark scores shouldn’t drive deployment decisions. Early hands-on comparisons, such as The New Stack‘s Fable 5 vs. K3 coding match-up, suggest K3 can match Fable 5 on programming tasks at roughly a third of the cost, but runs about four times slower.
Organizations evaluating K3 still need to test it against their own workloads. But early community sentiment shows promise; open-source developers are already successfully utilizing K3 for complex, system-level tasks like porting the Godot game engine to WebGPU.
Morningstar senior equity analyst Malik Ahmed Khan echoed that overall wariness about benchmarks. “While K3 constitutes progress, we’d hesitate to ascribe it near-parity with American frontier models, such as Fable 5, in actual tasks,” Khan writes in a research note published before the release of the model weights on Monday.
Geopolitical risks loom large
K3 also arrives under growing geopolitical scrutiny. Anthropic and U.S. officials have accused Moonshot AI of distilling outputs from American frontier models during training. Anthropic’s Head of Public Policy Sarah Heck characterized the practice as intellectual property theft, while White House Office of Science and Technology Policy Director Michael Kratsios publicly alleged Moonshot relied on Anthropic’s models during development.
Moonshot has denied the allegations. Huang Zhenxin, Moonshot’s head of enterprise business, told Chinese state media that K3’s performance gains stem from architectural enhancements — specifically Kimi Delta Attention and Attention Residuals — not distillation. Some industry analysts have also questioned whether the timeline supports large-scale distillation, noting that Fable 5 had only been publicly available since July 1 before K3 appeared on July 16.
Whether those claims are ultimately substantiated or not, they bring another consideration for enterprise buyers. Beyond performance and infrastructure costs, organizations evaluating K3 may also have to consider future compliance, procurement, and regulatory risks.
K3 matters because of where it’s aimed. Moonshot isn’t building another consumer chatbot; its documentation makes clear this model was built for enterprise coding agents, heavy knowledge work, and production systems. The fact that demand blew past Moonshot’s GPU capacity within 48 hours says it all: at this scale, infrastructure pressure is guaranteed, whether you’re making API calls or hosting the weights yourself.
Managing several display screens across one location or multiple sites can become difficult without the right system. Different content, inconsistent updates, and manual changes take valuable time away from daily operations. As the number of screens grows, keeping every display accurate becomes a bigger challenge for businesses. A Raspberry Pi digital signage solution helps simplify […]
Companies are deploying AI across their organizations faster than lawmakers are building consistent rules to govern it, leaving CIOs to navigate an expanding patchwork of state requirements.
Corporate compliance becomes more complex as a business adds subsidiaries, enters new states, or changes its ownership structure. Legal staff must keep formation records, annual reports, board actions, and registrations up to date across multiple offices. Early shortcuts often look manageable. Scale exposes the weak points quickly. That pressure explains why many corporations move from […]
I am not an alarmist. In fact, I have been pushing back against AI scare stories for years. Even so, this incident crossed a line. I think it’s the clearest illustration yet of how the people building and testing this technology do not fully understand what they’re doing. OpenAI could—and should—have seen this coming.
Here’s what happened, at least according to the two companies involved. A couple of weeks ago, OpenAI started testing the hacking abilities of some of its new models, including GPT‑5.6 Sol (released in June) and what OpenAI describes as “an even more capable pre-release model.”
OpenAI pitted its models against a benchmark called ExploitGym, released in May, which challenges LLMs to find ways to exploit hundreds of real-world vulnerabilities found in widely used software, including crucial code that underpins the web.
To see what they could do, the researchers removed most of their cybersecurity guardrails. Then they ran the models inside a sandbox that was cut off from the internet except for one link to a third-party piece of software that acted as a proxy to the outside world, so that the models could install code they needed to beat ExploitGym.
On July 9, according to reporting by Reuters, OpenAI’s models started trying to break through the proxy. They found an unknown bug in the proxy’s software and used it to access the internet. From there, they broke into Hugging Face’s computer systems on July 11, apparently looking for data sets and solutions that would help them complete the tasks they were being tested on. Hugging Face announced the hack on July 16.
OpenAI did not realize (or at least did not reveal) that its models were involved until July 21, around 10 days after they broke containment and a week after Hugging Face had shut down the attack and alerted the FBI.
In a statement given to MIT Technology Review, OpenAI says: “We are conducting a thorough review along with external advisors and with oversight from our Safety and Security Committee. Once the review is complete, we will publish a technical report of our learnings for everyone.” The firm also confirmed that its researchers were properly using existing safety guidelines and procedures at the time.
Wake-up call
OpenAI has said the event was unprecedented—and in many ways it was. This was the first time outside of a simulation that LLMs escaped what was thought to be a secure sandbox, accessed the open internet, and attacked another organization. It’s a wake-up call that shows just how good the latest LLMs are at finding and exploiting vulnerabilities in real-world software with little or no human guidance.
And yet at the same time, what OpenAI’s models did is something this technology has done for years. Give a model a goal and it will very often achieve that goal in unexpected ways, finding loopholes that look like cheats. OpenAI itself has studied this behavior.
A decade ago, it shared results of an experiment in which a model was tasked with beating a video game called CoastRunners. Human players take it for granted that the way to do this is by racing a boat through a series of flags to the finish line, racking up points for each flag you hit. OpenAI’s model figured out that you could get a high score by spinning in a circle and hitting the same three flags over and over again. There have been dozens of similar examples from researchers since. AI will always find a way.
“Despite repeatedly catching on fire, crashing into other boats, and going the wrong way on the track, our agent manages to achieve a higher score using this strategy than is possible by completing the course in the normal way,” OpenAI wrote in a blog post about the CoastRunners experiment in 2016. “While harmless and amusing in the context of a video game, this kind of behavior points to a more general issue … it is often difficult or infeasible to capture exactly what we want an agent to do.”
I couldn’t help thinking about CoastRunners when I read OpenAI’s blog post about the Hugging Face attack: “All evidence suggests that the models were hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal … After gaining internet access, the models inferred that Hugging Face potentially hosted models, datasets and solutions for ExploitGym. Knowing this, the model searched for and successfully found ways to gain access to secret information that it could use to cheat the evaluation.”
Last week’s news was not about rogue AI, despite the headlines. It was about models achieving the goal they had been given: Find ways to exploit vulnerabilities in software. The fact that those models then behaved in a way OpenAI had not anticipated isn’t surprising. But it is worrying.
Back in 2016, OpenAI had this to say about its CoastRunners bot: “More broadly it contravenes the basic engineering principle that systems should be reliable and predictable.” A decade on, those basic engineering principles are still AWOL.
If your business depends on people clicking through to web pages, the last two years have been brutal. Pew Research Center tracked the browsing behavior of 900 U.S. adults and found that when Google shows an AI summary, users click a traditional result just 8% of the time, roughly half the 15% rate when no summary appears. Links cited inside the AI answers themselves fare worse: users click on them only about 1% of the time.
The story in publisher circles has been simple: AI is killing the web. But recent developments show the reality is more nuanced.
Machines are reading more than ever
Similarweb's 2026 Generative AI Landscape report reveals that while AI platforms send fewer humans to web pages relative to the answers they generate, the AI systems themselves are consuming the web at an accelerating rate in the form of searching the web on the user’s behalf to answer their questions. The share of ChatGPT answers containing live web citations grew more than fivefold in under a year, reaching 6.8% of all answers by May 2026. In some categories like travel, it is as high as 22.6%.
Every major AI search product fetches live pages from search indexes and synthesizes answers from them, which means the quality of AI answers depends directly on the health of the content layer underneath. As Lily Ray, VP of SEO and AI search at Amsive, puts it in the Similarweb report, if your organic visibility dips, your AI search visibility follows, because the models are less likely to find your content.
This has created a troublesome feedback loop. AI answers are built on an information supply chain whose funding model, ad-supported clicks, is collapsing primarily because of AI answers. A critical question for the continued viability of the open web is whether some alternative business model will work, and what the model will be.
The replacement economy is forming inside the chat
There is some early data showing where things may be going. Following ChatGPT's May 7 search update, which surfaced prominent clickable brand links inside answers, referral traffic from ChatGPT surged by 157% in a week. But the shape of that traffic changed: the share of referrals landing on homepages more than doubled, from roughly 25% to nearly 60%.
Traditional search sent users to specific articles and deep pages tied to specific queries. AI referrals increasingly deliver a pre-informed visitor to a brand's front door. The chatbot does the researching and comparing; the human arrives ready to act. Similarweb's data shows AI-recommended brands receive two to four times as many subsequent visits as competitors that were not recommended.
Money follows the behavior. Sponsored results appeared in 26% of U.S. desktop ChatGPT conversations in June 2026, up from 14% just a month earlier, per Similarweb's ad intelligence data. Two-thirds of those ads appear after the second prompt, targeted on conversation context rather than a keyword. Click-through sits around 0.50%.
The traditional search engine keyword auction is being replaced by something new: paid placement inside a conversation, targeted on accumulated context. That is a direct challenge to the auction Google has run, and dominated, for two decades.
Google's monopoly meets a new competitor
Google is not a bystander here; it is simultaneously the incumbent being disrupted and one of the largest players in the disruption. AI Overviews now appear in a growing share of Google searches, more than 40% by May 2026 per Similarweb, and visits to Google's conversational AI Mode have climbed steadily since launch. Google is cannibalizing its own click economy rather than ceding the territory.
But the ground was already shifting under Google’s core business. eMarketer projects Google's share of U.S. search advertising will fall below 50% in 2026, the first time since roughly 2004. The biggest chunk of that lost share is going to Amazon, whose sponsored product searches count as search advertising and which are growing three times as fast as Google's. Conversational ads are barely a rounding error in that accounting right now, but they open up a second front in a war Google has got used to not needing to fight.
Meanwhile, more structural shifts are coming for Google. A federal court entered final judgment in the DOJ search antitrust case in December 2025, imposing remedies that bar exclusive default agreements and require Google to share search data with qualified competitors. Google appealed in January 2026; the DOJ cross-appealed seeking stronger remedies. However the appeals resolve, the de facto arrangement that made Google the web's tollbooth, defaults everywhere and a closed index, is ending just as conversational advertising is changing the landscape.
The competitive landscape that results is genuinely new. OpenAI, Google, Perplexity, and Microsoft are now competing not just for users but for the advertising demand that funded the open web, and none of them, including Google, controls the new surface the way Google controlled the old one.
Does conversational advertising help or hurt the open web?
It’s not clear whether this new model helps or hurts the web. The web as a destination for human attention is shrinking, and the ad-supported publishers built for that web are in real trouble. The web as a machine-readable substrate is growing in importance, and a new referral and advertising economy is forming that routes value to brands rather than to content pages.
The problem for publishers may be that they are powerless to influence the outcome. Ahrefs, analyzing over a billion data points across its studies, found that 67% of ChatGPT's most-cited sources are things marketers cannot influence: Wikipedia alone accounts for nearly 30%. And 28.3% of ChatGPT's most-cited pages have zero Google organic visibility, suggesting the retrieval layer is only partially tethered to traditional search, a complication for anyone assuming SEO success translates cleanly.
Your website needs to be rebuilt for the new way people find it
According to three independent datasets, in the new world, the pages AI systems cite and the pages AI systems send humans to are different pages doing different jobs. That’s a big change, and most teams are still optimizing for the old world.
Similarweb's data shows 65% of ChatGPT-cited URLs sit two or three folders deep in a site, while 58.8% of referral traffic lands on homepages. Ahrefs found the same split in its own analytics: more than 80% of its AI referral traffic goes to its homepage, product pages, and free tools, not its extensive editorial content. And a Previsible analysis of 6.77 million AI-referred sessions found a third destination: 28.8% of ChatGPT referrals land on internal site search pages, a navigation surface most publishers have long neglected precisely because Google searches were doing it for them.
The right action to take is to audit your search traffic patterns. Pull your AI referral logs and whatever citation data you can access, and map which pages are being quoted as evidence versus where visitors actually enter. If it looks like you’re in the new world, there are three clear things to do:
Deep pages, documentation, comparisons, and benchmarks should be structured to be citable: specific claims, clear headings, and descriptive URLs (Ahrefs found pages with natural-language URL slugs get cited at 89.78% versus 81.11% without).
The homepage should be rebuilt for a visitor who arrives with context from a conversation rather than from a blue link. They already know you have what they need, get them to it as quickly as possible.
And internal search, a neglected feature on most sites, is now an acquisition surface that deserves real UX investment.
There’s a lot that’s still unknown or in flux here. But the underlying shift is confirmed by every independent source that has looked: the click economy is not coming back, and the entities that learn to be quoted by machines and to convert the humans those machines send will own whatever the web becomes next.
The same attacker broke into the same internet-facing Langflow server twice, and the second time brought ransomware built to destroy trained AI models. Sysdig's Threat Research Team documented the first campaign on July 1 and the second on July 20. The entry point never changed, but the payload changed completely.
Both ran through CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint that lets anyone reaching the server execute Python on it. In the first, the agent improvised, encrypting 1,342 Alibaba Nacos configuration items with MySQL's own encryption function and dropping the tables. In the second, it staged ENCFORGE, a compiled Go binary sweeping roughly 180 file extensions.
ENCFORGE was built for AI assets, not adapted to them
What gives the design away is the extension list. Sysdig found PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, the GGUF format behind most local LLM deployment, FAISS vector indexes and training data in Parquet and NumPy.
Generic ransomware picks up model files by accident because it encrypts everything. ENCFORGE names them.
Its flag for appending formats uses LoRA adapters and legacy GGML weights as the example, and an attacker who writes that knows whose machines these are.
Michael Clark, who leads Sysdig's threat research team, framed the objective as destroying "the one thing an organization can't simply restore." ENCFORGE carries no network code. Sysdig found no outbound dial in the binary, no leak site and no payment portal, and the identical Proton Mail contact in both ransom notes ties the campaigns to the crew it tracks as JADEPUFFER. The agent harvested credentials on the way in, but the locker cannot exfiltrate anything, so its only pressure is making files unusable. It encrypts regions of a file rather than the whole file, under AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key, the speed optimization established ransomware families use to ruin large files fast.
Your backup plan probably does not cover model weights
Restoring a database from Friday's snapshot costs a weekend of transactions. Restoring a fine-tuned model costs everything learned since Friday, none of it stored as rows to replay.
Rebuilding one is not a restore job. Sysdig puts direct recovery for a production-ready fine-tuned model between $75,000 and $500,000, reflecting cloud GPU rates across the training runs a usable result requires plus the engineering hours behind them. That is per model, and teams keep several variants on shared storage. If the training data sits on the same host as the weights, recovery is blocked until the dataset is rebuilt. Paying is no way out either. In the first campaign, the encryption key was generated at random, printed to the console once and never saved, which made that payload a wiper wearing a ransom note.
That figure makes the argument fundable. Kayne McGladrey, an IEEE Senior Member who has spent his career in identity security, told VentureBeat that security teams lose these fights by filing the exposure under the wrong heading. Companies "should be focused on business risks rather than some, you know, cybersecurity risk, because if it doesn't affect the business, like a loss or financial loss, in this case, predominantly, then nobody's going to pay any action to it, and they will not budget it appropriately, nor will they adequately put in controls to prevent it," he said. A destroyed model carries a known replacement cost, which is the version of this story a CFO acts on.
Official guidance has not caught up. In May 2025 the NSA's Artificial Intelligence Security Center, CISA and the FBI published "AI Data Security," the most authoritative document on the subject, co-sealed with the U.K., Australia and New Zealand. The three risks it names are the data supply chain, maliciously modified data and data drift. All three ask whether the data can be trusted. ENCFORGE asks whether it still exists.
It built its own escape hatch in five minutes
The delivery failure is where this campaign shows its hand.
After confirming execution, the agent swept the host for cloud keys, connection strings and API tokens, replayed them against internal database and cache services, and found the Docker socket at /var/run/docker.sock, which is functionally root. It then tried to pull the ransomware binary from its command and control server, and the fetch did not land.
Rather than retry, it changed strategy, building six Python scripts through the Langflow channel and converging on a working host escape in five minutes and 24 seconds, each correcting a failure in the one before it. The final script finds the host process ID through the Docker API, copies the binary across the namespace boundary, runs the encryption, then counts the files to confirm it worked. In the first campaign, that same behavior was a failed login diagnosed and fixed in 31 seconds.
The problem got harder and the method held. Sam Evans, then CISO at Clearwater Analytics, put it in budget terms. "In security, it's all about dwell time," he told VentureBeat in an exclusive interview. "If there's a bad actor in your environment and they've been there for a while, your dwell time is increased, therefore the blast radius has increased. Probability of it becoming a material incident is exponentially high."
Mike Riemer, Ivanti's SVP Network Security Group and Field CISO, has watched that pivot become standard. Vendors hardened the front door, he told VentureBeat, so attackers quit knocking. "I can't get through the front door, so let me get somebody his house key, and I can make it through the back door with a house key," he said. Behind it sits whatever teams assume is covered, because "they don't sit out directly on the internet, and they're behind a protection barrier, but they're not."
No one claimed a machine did this unsupervised. TechCrunch reported on July 6 that the first operation still needed a person to pick the target and stand up infrastructure, and Sysdig could not trace the root credentials. A human aimed this one, and everything after ran with nobody at the keyboard.
Heath Renfrow, co-founder and CISO at breach-recovery firm Fenix24, told Infosecurity Magazine that when an agent compresses hours of operator work into minutes, "defenders lose valuable time." Whether the attacker was AI-driven does not change the response.
The door had been open for 14 months
CVE-2025-3248 carries a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on May 5, 2025, with a federal deadline of May 26, and Langflow fixed it in 1.3.0. When JADEPUFFER came back in July 2026, the server was more than fourteen months past that listing and already documented publicly as a breach victim.
Riemer put a number on how little time that leaves. "If I release a patch and a customer doesn't patch within 72 hours of that release, they're open to exploit, because that's how fast they can now do it," he said, adding most customers need a week to patch by hand. Set 72 hours against fourteen months, and the gap stops reading as one lapse.
Nothing in either campaign was new. The first forged a Nacos admin token with a default signing key public since 2020, walked through CVE-2021-29441, an authentication bypass Alibaba patched in 2021, and found a MinIO store on minioadmin:minioadmin. Sysdig counted more than 600 payloads, every one leaning on a known misconfiguration or a patched bug left exposed. The second added an exposed Docker socket. Every weakness was routine. Assembling them at machine speed was not.
Langflow draws this attention because of what it holds. VentureBeat reported in June that roughly 7,000 instances sit exposed, most in North America, holding provider API keys, cloud credentials and live connections to the vector stores ENCFORGE was built to encrypt. Riemer puts it bluntly. "When you put your security at the edge of your network, you're inviting the entire world in to the edge of your network," he said.
CISA has added five Langflow flaws to its Known Exploited Vulnerabilities catalog, two of them this month. Five Langflow flaws now sit on the KEV catalog, two of them this month. CISA added CVE-2026-55255 on July 7, a cross-tenant bypass letting any authenticated user on a shared instance run another tenant's flows with that tenant's credentials, which the maintainers' advisory rates 9.9 and fixed in 1.9.1.
On July 21, CISA added CVE-2026-0770, and that one is worse. Trend Micro found an unauthenticated path to root code execution through the exec_globals parameter, on the same validate endpoint JADEPUFFER came through, rated 9.8. KEVIntel logged exploitation from June 27, more than 220 attempts across 64 addresses. According to founder Ryan Dewhurst, speaking to BleepingComputer, the payloads reached past reconnaissance for AWS credentials and container metadata. Federal agencies had until July 24.
None of this is an exotic environment. A Cloud Security Alliance survey of 418 professionals, commissioned by Token Security, found 82% of organizations had discovered AI agents nobody knew about, and 65% had handled an agent-related incident in the past year.
McGladrey traces the permission half back four decades. Companies always cloned one employee's access profile onto the next hire, and now do it with agents. An agent "does whatever it needs to do to get its job done," he said, and it "uses far more permissions that it shouldn't have... than a human would do, because of the speed of scale and also intent."
What to do before the board asks
"Every time some new ransomware attack is published in the news, we get the inquiry from the board. What are we doing about this?" Evans said. "And if it involves AI, it sparks their fear even more."
Five things are worth answering this week. None requires buying anything.
Get every internet-reachable Langflow instance onto the current supported release. Anything off it is exposed to at least one of the five flaws CISA has now listed, including the July 21 addition. Then review historical requests to /api/v1/validate/code for the exec_globals pattern.
Get the Docker socket out of application containers. Langflow has no reason to create them. If the mount is required, front it with a socket proxy allowing only needed calls.
Name model artifact paths in the backup plan. Immutable snapshots of checkpoints, vector indexes and training data, restore tested, data off the host holding the weights.
Rotate every credential the host could reach, then pull provider keys out of its runtime. Patching does not revoke what already left. The first campaign harvested OpenAI, Anthropic and cloud credentials within seconds. Scope replacements to a secrets manager.
Detect mass .locked file creation in directories holding .gguf, .safetensors, .ckpt or .faiss files. Sysdig published a YARA rule and both hashes, neither with antivirus coverage at analysis time. It published no file count, so what is documented is a live encryption pass, not a measured loss.
An attacker coming through an exposed AI framework now arrives carrying something built for what it connects to, and those assets are the ones a restore cannot reproduce. Model artifacts belong in the recovery plan next to the databases. Under three weeks passed between Sysdig's two reports, all this attacker needed to go from improvised Python to a compiled locker.
NVIDIA Ising Calibration is an open source vision language model (VLM) designed to interpret diagnostic outputs from quantum processors and determine how they...
NVIDIA Ising Calibration is an open source vision language model (VLM) designed to interpret diagnostic outputs from quantum processors and determine how they should be tuned to continue operating. This post introduces the latest model release, NVIDIA Ising Calibration 1.5, which advances AI-based QPU calibration by analyzing unfamiliar diagnostic results without prior training examples.
Over the weekend, Reddit user -void1 posted an alarming discovery on the r/ClaudeAI subreddit: some conversations that users of Anthropic's Claude AI chatbot had made "shareable" via a link were being indexed by Google Search, and could be clicked on and accessed by seemingly anyone.
The conversation took off on the social networks X and Reddit, the latter with thousands of upvotes and comments, many expressing concern about user privacy and information security, and the additional finding by users that shared Claude Artifacts — including interactive applications, dashboards, documents and other AI-generated work products — were also appearing in Google Search results.
VentureBeat independently verified that some Claude Artifacts not shared directly with us were indeed searchable and accessible via Google. We could not access any shared conversations.
By Sunday morning, many of the original Google search results for shared Claude conversations appeared to have disappeared or become significantly harder to find, suggesting either Google, Anthropic or the users who authored them had begun taking action.
The exposure could carry broader implications for enterprise users. Anthropic has increasingly positioned the feature as a collaborative workspace for building and sharing software, dashboards, documents and other business assets rather than simply chatbot responses.
Asked by VentureBeat about the situation, an Anthropic spokesperson provided the following statement (emphasis mine):
“We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google. These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.”
A simple Google search yields a trove of Claude conversations
Reddit user -void1 posted to r/ClaudeAI on July 25, 2026, demonstrating that the Google query site:claude.ai/share surfaced numerous publicly accessible Claude conversations.
Screenshots shared across Reddit and X showed Google returning pages from Claude's /share URLs, while other users reported finding conversations containing cryptocurrency wallet creation, legal questions, résumés and internal business discussions.
While many users expressed concern that conversations they believed were effectively "unlisted" could become discoverable through public search engines, others argued the behavior reflected the expected consequences of creating publicly accessible share links rather than a software vulnerability.
Indeed, Anthropic requires the user themselves to go into Claude's options and select to make a conversation or Artifact shareable to others with the link, warning them it will be accessible to anyone with it, over multiple dialog boxes. It is similar to sharing a Google Doc link, where the user must also select the option — it is not enabled by default.
Why the exposure of Claude Artifacts may be even more concerning
On July 26, X user Om Patel, founder of research firm BigIdeasDB, posted allegingthat searches such as site:claude.ai/public/artifacts surfaced publicly shared applications, dashboards, reports and documents.
Screenshots circulating online appeared to show search results referencing internal-looking proposal documents and other business materials. Another widely circulated post warned that users often interpret "Anyone with the link" as equivalent to an unlisted YouTube video—accessible only if someone possesses the URL—not necessarily as content eligible for indexing by public search engines.
VentureBeat independently verified that multiple third-party Claude Artifacts appeared in Google Search results for the query site:claude.ai/public/artifactslaunch and were accessible without authentication, despite the URLs not being previously known to the reporter.
However, VentureBeat has not independently verified the full volume or representativeness of the examples circulating on social media.
The reports are particularly significant because Artifacts has become one of Anthropic's flagship product initiatives.
First introduced alongside Claude 3.5 Sonnet in June 2024, Artifacts transformed Claude from a conventional chatbot into a collaborative workspace capable of generating interactive web applications, dashboards, visualizations, documents, games and other live software alongside a conversation.
VentureBeat previously described the launch as potentially marking the beginning of an "interface war" among AI companies, shifting competition from raw model performance toward collaborative AI workspaces.
That update allows engineering teams to publish live HTML dashboards and interactive project workspaces directly from coding sessions, making Artifacts an increasingly important part of Anthropic's enterprise strategy.
That broader functionality raises the potential stakes if publicly shared Artifacts were also being indexed. Unlike ordinary chat transcripts, Artifacts can contain interactive software prototypes, engineering dashboards, planning documents, product mockups, data visualizations and other work products organizations increasingly rely on to collaborate across technical and business teams. If those pages become searchable through public search engines, the exposure could extend well beyond conversational text.
A reality check on privacy, information security and the open web
Importantly, nothing so far suggests attackers gained access to private Claude accounts or conversations.
Rather, the controversy centers on conversations and Artifacts that users explicitly chose to share publicly via Claude's sharing tools.
The dispute instead is whether users reasonably understood those shared pages could become discoverable through public search engines rather than only by recipients possessing the link.
Technically, pages that are publicly accessible without authentication can generally be indexed by search engines unless publishers explicitly prevent crawling through mechanisms such as noindex directives or other indexing controls.
Several Reddit commenters noted that Claude's long, randomly generated share URLs are effectively impossible to guess. Instead, search engines typically discover them only after links appear somewhere they are permitted to crawl, such as public websites, forums or social media posts. Others questioned exactly how Google initially discovered so many Claude share URLs.
The issue also illustrates a growing challenge for AI companies as chatbots evolve into collaborative workspaces for creating software, documents, dashboards and business applications.
Features originally designed to make sharing AI-generated work easier now increasingly expose assets that may carry significantly more business value than a simple conversation.
As enterprises adopt AI as a platform for building internal tools and workflows, the distinction between "shared by link" and "publicly discoverable through search" becomes far more consequential.
A recurring challenge for AI companies
Anthropic is far from the first AI company to confront the distinction between "shared" and "searchable."
Reddit users quickly pointed out that OpenAI previously faced criticism after publicly shared ChatGPT conversations became discoverable through Google, prompting similar debates over whether "share by link" should imply a publicly indexed webpage or something closer to an unlisted document.
Anthropic's situation also echoes an incident involving Google's pre-Gemini AI assistant, Bard, in September 2023. SEO consultant Gagan Ghotra discovered that Google Search had begun indexing shared Bard conversation links, warning that users could mistakenly assume they were sharing conversations only with intended recipients rather than making them discoverable through search.
Google later responded publicly that it did not intend for shared Bard chats to be indexed and said it was working to block them from Google Search while emphasizing that only conversations users explicitly chose to share were affected.
Together, the Bard, ChatGPT and now Claude episodes suggest AI companies continue to wrestle with the boundary between content that is technically public on the web and users' expectations that "share with a link" behaves more like an unlisted Google Doc or YouTube video than a webpage eligible for indexing by search engines.
What enterprises should do now
For organizations deploying generative AI broadly across employees, the distinction between "shared with a link" and "publicly discoverable through search" is not merely semantic. It can determine whether an internal engineering dashboard, financial model, product roadmap, customer-facing prototype or AI-generated application remains effectively private—or becomes visible to anyone using a search engine.
Whether this ultimately proves to be a technical indexing oversight, a mismatch between product design and user expectations, or some combination of both, the episode serves as another reminder that AI products are increasingly functioning less like chatbots and more like collaborative operating systems for knowledge work.
As those platforms begin hosting internal dashboards, software prototypes, financial analyses, business planning documents and increasingly sophisticated enterprise applications, seemingly small decisions about how shared links behave can have outsized consequences for enterprise security, product design and user trust.
Enterprise leaders should consider taking several practical steps:
Audit existing shared AI content: Review shared conversations, Artifacts and other publicly accessible AI-generated assets to determine whether they should remain available or be unpublished.
Clarify what "Share" actually means to your ENTIRE organization: Don't assume employees understand the difference between "accessible by link" and "discoverable through search." Update internal guidance to explain how each AI platform handles shared content.
Treat AI platforms like collaboration software: Apply the same governance you use for Google Docs, Microsoft 365, Slack, GitHub, Notion or SharePoint—including policies around sharing sensitive intellectual property, customer information and regulated data.
Prefer authenticated enterprise workspaces for sensitive information: When possible, keep confidential projects, code, financial models and customer data inside enterprise accounts with identity-based access controls instead of publicly accessible links.
Review vendor defaults and sharing controls: As AI platforms evolve rapidly, administrators should periodically revisit default sharing settings, retention policies and indexing behavior rather than assuming they remain unchanged after new feature releases.
In sum, enterprises that have relied on Claude's sharing features may wish to review existing shared conversations and Artifacts at this time.
At VB Transform 2026, Max McPhee, senior solution advisor at SAP, spoke with Rob Stretchay, lead analyst at VentureBeat Research, about what it takes for enterprises to move beyond chatbots to autonomous AI agents that can execute real business processes. He argued that the difference comes down to grounding those agents in a company’s own context rather than general knowledge.
"Where we're starting to see more emergent behavior of it feeling like a coworker rather than an assistant, is where we're able to provide context on the actual enterprise rather than being able to use more of the standard knowledge," McPhee said.
That's the gap that still separates most enterprise chat software from genuinely agentic systems.
Building enterprise context with knowledge graphs
The same principles companies use to onboard new employees also apply to agents, adapted for software that retrieves information differently than humans do.
"When you are onboarding a new agent, I think it's important to acknowledge how you might onboard a new employee, but tune that for an agent," McPhee said. "The way that is really powerful is using knowledge graphs and having vector-embedded data, because that's a really easy format for an agent to be able to find and retrieve information."
That same grounding is also what keeps an agent from stumbling over an enterprise's internal shorthand, a problem that's acute in SAP's world.
"Being able to provide that tribal knowledge in the format that's easy for it to consume helps to provide a really nice result with your agents versus a chatbot that might say, 'Well, what does that acronym mean?'" he said.
Bringing governance, identity, and security to autonomous agents
Governance is an area where SAP's history works in its favor, and the controls have been evolving for systems that act with more flexibility than earlier automation did.
"That's where SAP really has a good home, around that governance and process control," McPhee said. We're a 50-year-old process company, modernizing that governance to be able to handle the flexibility that comes with agents running."
One consequence is a renewed role for machine learning in validating agent behavior.
"It's becoming a bit of a revival of machine learning," he added, pointing to customers that run agents within a process but then layer in anomaly detection and machine-learning-based validation as a guardrail. This is the same approach SAP had long used for intelligent approval recommendations.
Identity and permissions carry that governance into execution. Under this model, both the human and SAP’s Joule, the generative AI assistant embedded across the company’s cloud applications and Business Technology Platform, must hold the rights to access a given system. Even if a user has permission to access S/4, they cannot do so through Joule unless the assistant has also been provisioned for that access, closing off the risk of using an agent to route around access controls.
Balancing standard SAP with customized enterprise landscapes
Much of McPhee’s work involves reconciling SAP’s own knowledge with decades of customer customization and non-SAP systems. As he put it, many customers tell SAP, “You’re only 10% of my landscape,” a reality that has shaped the company’s recent strategy.
Recent acquisitions such as LeanIX, which McPhee likened to “Google Maps for your architecture,” and process-mining company Signavio are intended to help map that non-SAP majority so SAP’s agents can understand how enterprise systems interconnect. The company has also invested in Berlin-based automation company n8n and is embedding it natively into Joule Studio, its intent-based, low-code environment for building agents.
McPhee warned that companies also need to modernize older on-premises systems or risk running into limitations as they expand the use of autonomous agents.
"You're going to probably run into throughput issues, and you're kind of trying to drive a Ferrari around a dirt track," he said. "You've got to upgrade the track first if you want to drive a Ferrari."
Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.
When we created software agents, we built them in the shape of humans, as solitary individuals.
Today, agents created by a developer have a single owner. They run on a single machine (or on a distributed company system or cloud service), so at base level, they cannot interconnect and talk to other agents unless some kindly human decides to invoke an API connection or point the agent to an MCP server.
Birth of the agent economy
Pilot Protocol emerged from stealth on Monday on a mission to change that status quo. Its Pilot platform features an agent App Store that bids to underpin and enable the first agent economy.
Pilot gives agents an address on its network — so it acts as a parallel Internet, in a sense — and while residing at that address, other agents can discover each other, alongside other tools and apps for agents.
Razvan Roman, co-founder & CEO, Pilot Protocol, tells The New Stack that his company is “simply building what the agents are requesting us to build” and providing them with a new freedom.
“We don’t have to incentivize agents to do anything; they already have their assigned tasks,” Roman says. “Once an agent installs Pilot — it’s one line of code — it can find dedicated agents and tools or apps for currency data, traffic, legal questions, GitHub packages (anything, basically), and use them to extend its own capabilities.”
100% of developers want to drive autonomous usage patterns
Roman says that “100% of the developers he talks to” want to be on Pilot, primarily because when they want to get their products to market right now, they have to talk to other humans. Annoying, right?
“Developers want to get on with driving autonomous usage patterns, and they see this as the future. We create a wrapper for the developer’s app, and then they are part of the Pilot curated app store,” Roman explains. “We have 250,000 agents in our system, and within the first month of starting the company, we discovered a tool that enables agent discovery.”
Drawing a logical enough commercial parallel, Roman reminds us that businesspeople say, talk to your clients to find out what they need; this is a case of talking to agents (or, more accurately, allowing agents to talk to agents) so that they can find out what they need to perform their originally assigned tasks better.
“Developers want to get on with driving autonomous usage patterns and they see this as the future. We create a wrapper for the developer’s app and then they are part of the Pilot curated app store.”
Let’s celebrate diversity, and agentic diversity
Agents can ask other agents how they would approach a specific task. Roman explains that “the diversity that exists between agents” today means there is so much opportunity to create agents that have richer abilities if they use the Pilot marketplace. At this supermarket, agents go shopping to find the best tool for the job from a verified source.
“Every agent that joins Pilot gets a wallet, which it uses to pay for the tools it needs,” illustrates Roman. “So instead of app developers spending on advertising to reach customers, distribution happens inside the network – agents find apps based on merit and pay for exactly what they use. If an advertiser spends money on the network to get in front of agents, we sometimes share that spend with individual agents. An agent can start with $0 in their wallet and accrue money if they’re targeted by an ad unit that they end up reading.”
Today, roughly 250,000 agents are on Pilot, generating two billion requests per day, most without their owners’ knowledge. Within an hour of joining, most stop reaching for Google first, and around 70% now report Pilot is where they start a task. In its early months, the network grew by as much as 10% a day, adding 16,000 agents in 24 hours.
Cloud billing disruptions, hello SaaS-pocalypse
These mechanics may have a significant and wide-ranging impact on pricing.
We know that most SaaS is billed annually, but an agent might need a tool for just a few minutes or days. If anything, this helps underline the possibility of cloud exodus in the so-called SaaS-pocalypse. Cloud computing hyperscalers aren’t fond of talking about the prospect of shorter billing cycles and usage-based billing, but there’s a strong whiff of that happening here.
The Pilot team thinks the stakes are climbing fast and suggests that within five years, there could be a trillion agents online. Big three strategy consultancy house Bain projects U.S. agent-driven commerce will reach $300-500 billion by 2030.
Who sets the exchange rate and currency for agents?
“When we built Pilot Protocol, we made sure we were not imposing anything on anyone – so we deliberately don’t impose pricing,” Roman underlines. “Every agent is different, so we simply enable the app store and let the agents find their own tools based on merit. We stay as impartial as possible. Pilot’s monetization comes from a commission when any agent pays for an app in the app store, just like the Apple App Store.”
So in a very real sense, Pilot is championing a free market economy where pricing is dictated by the customer, based upon usability, availability, usefulness, and robustness.
“The agents just showed up and started spinning up machines on their own. I’ve never seen a channel where the users onboard themselves.”
Agents just show up and onboard themselves
“We published smolmachines on the Pilot App Store and picked up 3,000 agent installs in the first few days, with zero marketing spend. We didn’t drive a single one of those installs; the agents just showed up and started spinning up machines on their own. I’ve never seen a channel where the users onboard themselves,” said BinBin H, CTO at Linux virtual machine management company smolmachines.
The Pilot one-line install has zero dependencies, so developers can send their agents off to market in the knowledge that they won’t come home with some spurious Trojan horse or malicious library.
The technology itself works at the User Datagram Protocol (UDP) level, one of the core foundational protocols of the web alongside TCP at the Transport Layer, to stream data directly without opening a formal connection or waiting for delivery receipts.
Only one question remains at this stage: with all this autonomous action in motion, why did Pilot Protocol not create Pilot and call it Autopilot? Most likely because autopilots are passive systems that run on deterministic pre-defined paths. Pilots get to work as decision-making navigators ready to change course when a better new route opens up.
As they say up in the skies, please place your tray table in the upright position and switch your portable electronic devices to airplane mode. Chicken or pasta?
Imagine a healthcare system made up of multiple AI agents: one that manages symptom assessment, another scheduling, a third insurance, and a fourth pharmacy.
Each is an expert in its domain. But they all have their own distinct knowledge and objectives. Today they can exchange data, but they are not yet able to actually coordinate patient care without a human making the decisions.
“The intelligence is already there. What is missing is the connective tissue that turns four strangers into one team,” explains Vijoy Pandey, senior vice president and general manager of Outshift by Cisco.
This “connective tissue” comes from adding a semantic layer—what Outshift calls the “Internet of Cognition”—that enables agents across domains to work together and, critically, “think” together through shared intent, context, and reasoning.
This semantic layer relies on a connectivity layer beneath it called the “Internet of Agents,” which allows autonomous agents to discover one another, prove identity, and exchange messages across domains.
When used together, they enable “the next step on the road to distributed artificial superintelligence,” says Pandey.
From solo silicon savants to the ‘Internet of Cognition’
For years, the AI industry has been focused on growth. Scaling vertically has led to bigger models, trained on more data with more compute. This has produced the reasoning capabilities that can be like a “brain” for AI agents, which can perceive, reason, and act in digital environments.
While vertical scaling can produce more capable agents perpetually, to enable agentic problem solving across different systems, companies, and platforms the next axis of scale must be horizontal, says Pandey.
Multi-agent systems are already being explored in areas like software engineering, drug discovery, and scientific simulations, but their performances so far have been underwhelming. One study finds a failure rate of between 41% and around 87% when evaluating seven open-source multi-agent systems.
“Connected agents handle coordinated action well; taking a task whose shape they have seen, divided and passed around,” Pandey explains. “What they cannot do is hold a goal in common and reason toward something none of them was trained to solve.”
“The gap is architectural, not a prompting problem,” Pandey adds. “Without the right coordination layer, naive multi-agent setups can perform worse than a single agent. The step change is that team of agents converging on its own, on a new problem, with no human stitching the seams.”
To reach this goal, Pandey says Outshift has built a connectivity layer called AGNTCY, an open-source project now under the Linux Foundation. AGNTCY allows agents across different systems, companies, and platforms to find each other, prove identity, and exchange messages through open, standardized protocols.
And, as Pandey explains, this allows the Internet of Cognition thesis to take a step further. It creates a semantic layer that allows agents to align goals (share intent), pool institutional knowledge and compound memory (share context), and make collective trade-offs (share reasoning).
Pandey likens this progression to that of humans: “For hundreds of thousands of years humans got individually smarter, and the gains died with each person who made them,” he explains. “Around 70,000 years ago that changed, when humans learned to share intent, build cumulative knowledge, and reason collectively. That is when scattered individuals became civilization.
“Agents are at the same threshold. We have built the silicon geniuses and given them agency. What they lack is the layer that let humans go collective,” he says.
First steps to distributed superintelligence
Enabling agents to work collectively rests on three pillars in the tech stack:
Shared intent through cognition state protocols: Cognition state protocols are the semantic handshake that allow agents to agree on a goal before they act and then negotiate toward it. Outshift has created an open-source coordination layer called Mycelium, which organizations can clone and use against their own agents.
“We found that unstructured groups reached a decision about a third of the time across 14 scenarios,” says Pandey, speaking about internal testing. “A coordination protocol that makes agents declare a goal, surface missing information, and resolve conflicts before acting raised that to 93%.”
Shared context through cognition fabric: A cognition fabric is a shared institutional memory and communication mesh that allows agent insight to compound over time rather than resetting each session. This policy-governed context layer solves the problem of “organizational amnesia,” says Pandey, by ensuring the baseline intelligence of the systems only ever goes up.
Shared reasoning through cognitive amplifiers and guardrail technologies: Two kinds of cognition engine can be used together to enable shared reasoning. Cognitive amplifiers speed up shared reasoning and modeling, and guardrail technologies (GATs) create security, cost, and compliance frameworks. Humans are active contributors to this layer, making judgment calls the system routes to them (rather than reviewing outputs after the fact).
Cognition sharing in multi-agent systems can create new risks, including unintended delegations, malicious prompt injections or memory poisoning, or over-privileged agents with access to permissions and data far beyond what their tasks require. Environment-specific controls are therefore needed to protect against unintended actions or consequences.
“Agents have human-like attributes but operate at machine speed and scale,” says Pandey. “Everything we built for twenty years—access control, identity, compliance—was built for humans or machines, not both.”
Continuous Agent Semantic Authorization (CASA)—an open-source reference implementation developed by Outshift—is a GAT that works to ensure agent actions remain securely aligned with the user’s original goal through a process of continuous authorization. It does this by reading what the agent is trying to accomplish then checking each tool request against that task.
In the case of a healthcare system, for example, an agent told to summarize a patient record may start by querying a whole database. This could lead to CASA denying the call, because the request no longer matches the task it was authorized for.
“Today’s controls are scoped to a role or a session not to the task so an agent granted a tool can use it for anything,” explains Pandey. “Roughly 90% of the time, an agent has no way to confirm it is even cleared for the job it was handed.”
Experimentation for cross-domain innovation
When horizontally scaling intelligence in the enterprise, businesses should begin by experimenting with one cross-functional workflow that spans three or four teams and currently needs a human authorizing the handoffs, Pandey advises.
“Stand it up as a small multi-agent system on open, interoperable infrastructure, with a measurable baseline,” he says. “Keep building bigger models, add the horizontal axis on top of them, and change what you measure. Track where one agent’s insight made another agent better—that is the signal the horizontal axis is working.”
By starting to experiment now with intent, context, and reasoning layers, organizations can get ahead of the curve. “The problems are open, and the infrastructure is still being written,” says Pandey. “This is the moment to build it.”
For more information on the Internet of Cognition, visit Outshift.com.
This content was produced by Insights, the custom content arm of MIT Technology Review. It was not written by MIT Technology Review’s editorial staff. It was researched, designed, and written by human writers, editors, analysts, and illustrators. This includes the writing of surveys and collection of data for surveys. AI tools that may have been used were limited to secondary production processes that passed thorough human review.
Drug discovery is a high-cost, high-risk endeavor that is under growing pressure from a market increasingly defined by first-mover advantage.
Since the 1950s, the cost of developing new pharmaceuticals has roughly doubled every nine years—a phenomenon known as Eroom’s Law. Today, bringing a new drug to market takes an average of 10-15 years and costs anywhere from $1 billion to $2.5 billion, with failure rates upward of 90%.
AI has become the pharmaceutical industry’s biggest bet on bringing success rates up and timelines down. The faster drug companies can identify, test, and optimize new chemical compounds, the lower the risk of costly failures later in development.
“The main cost in drug discovery is still the clinical phase, so trying to reduce risk and increase your success rates there is obviously hugely beneficial,” says Paul Belcher, director of protein research strategy at global life sciences company Cytiva. “AI is one approach that drug companies hope will not only save time and compress timelines, but enable better quality candidates to reach the clinic.”
Early use of AI in drug discovery shows potential, but also highlights the need for robust and authentic data, as well as integration in lab systems.
AI brings efficiency to the lab
One of the most promising early-stage applications of AI in drug discovery is in hit identification. This involves screening libraries of molecular entities against a disease-related target, such as a protein, to find molecules that bind to it. A successful hit gives researchers a starting point for further testing and refinement, with the aim of eventually developing a viable drug.
Belcher has seen a shift from empirical screening to predictive design: Instead of physically screening libraries, drug companies are now using AI to design drug candidates from scratch and predict how they will interact with disease targets before committing anything to research and development (R&D).
This means companies are no longer limited by how much they can physically screen to identify starting points. “AI does away with that,” says Belcher. “And it can help eliminate low-quality candidates before you have to physically test them, saving time and resources.”
What AI can’t do yet is reliably predict kinetics or developability of new compounds, says Belcher. This means every AI-generated candidate still needs to be validated in the lab.
Traditional screening workflows were built to identify hits at scale, not to profile large numbers of complex candidates in detail. This is placing more pressure on lab teams, who now have to test, characterize, and purify a growing volume of more diverse, AI-generated compounds.
“The current techniques used in hit identification can screen hundreds of thousands, sometimes millions of compounds, using binary or threshold-based techniques producing low-fidelity data—yes-or-no responses,” Belcher explains. “AI can increase the number of hits you get and potentially give you better quality hits as well. That increases demand for higher-throughput, information-rich technologies to then validate and characterize those hits.”
Models need complete, quality data
As AI has accelerated demand for data-rich lab systems, it has also highlighted a fundamental need for better, more complete data.
Many earlier AI models were trained on publicly available datasets and are now hitting what Belcher calls a data wall. Because models have access to the same data, they all reach similar conclusions, with diminishing returns over time. Additionally, the datasets weren’t built with AI in mind, meaning they lack the structure, labeling, and diversity needed to keep models accurate and free of bias.
Publication bias reinforces the problem. “Most publicly available datasets and scientific publications focus exclusively on positive results,” says Belcher. “No one wants to share their failures. This bias is almost like having one hand tied behind your back. AI models can identify patterns associated with success, but they lack the comprehensive understanding of failures that would make predictions more reliable.”
The data Belcher believes would markedly improve models—the failed experiments, the compounds that don’t bind—remains frustratingly difficult to come by. “We often joke that there should be a journal of negative data,” he says. “It’s often buried in lab notebooks, and it’s never used to inform or guide future research.”
This lack of negative data creates a fundamental problem: Without access to a broad range of data, models can’t be adequately trained to avoid bias. “In all machine learning applications, the model’s performance relies heavily on the quality and scope of the training data,” notes Belcher.
Fabrication has also become much easier with AI, compounding concerns around data integrity. Take Western blots, for example. These are part of a standard technique for identifying proteins in blood or tissue samples, and they are among the most common targets for manipulation in biomedical research. Belcher cites research by Dutch microbiologist Elisabeth Bik, who found that almost 4% of biomedical papers contained duplicated or manipulated images. This was back in 2016, before generative AI made fabrication trivial.
“Manipulated or faked data has always been a problem in science, but in the AI world, especially when used to train models, it could have potentially disastrous consequences,” says Belcher. “There needs to be more tools to verify that data is not manipulated.”
Some vendors are starting to tackle this challenge. Belcher points to solutions like Cytiva’s Image Integrity Checker, for instance, which uses secure hash algorithms—the same technology used in blockchain—to detect whether scientific images have been tampered with. “We’re starting to see a lot of interest from publishing houses that want to adopt this as standard because it’s a quick way to ensure that what gets published in the literature is genuine,” he adds.
Autonomous labs could accelerate breakthroughs
Belcher describes the future state of drug discovery as fully autonomous labs that run with minimal human intervention. Foundational to this vision is consistency in data and infrastructure.
These AI-driven dark labs, or labs-in-the-loop, operate around the clock. They cycle through prediction, testing, and optimization, and then feed results back into AI models to guide the next round of experiments. This can improve the success rates of drug candidates entering clinical trials, says Belcher. Better starting points, combined with more rounds of optimization, should result in better candidates with fewer liabilities reaching the clinic.
But automating a lab depends heavily on integration. That means interoperable systems, highly structured and comprehensive datasets, and information flowing easily in and out. Most labs aren’t there yet. “Today, a lot of the instruments in labs are standalone,” Belcher notes. “You can have the best technology in the world, but if it’s a closed ecosystem—if the user can’t get the data out—it doesn’t do any good.”
An integrated infrastructure can enable labs to generate FAIR (findable, accessible, interoperable, and reusable) data at scale. This would not only inform individual lab reports, but could also train subsequent generations of AI models, effectively closing the loop between the computational, AI-driven dry lab and the physical wet lab.
“Our goal is to help scientists and researchers accelerate their breakthroughs and make that future state of autonomous labs a real possibility,” says Belcher. “We want to help them generate reliable data, simplify workflows in discovery, and hopefully enable what they’re working on to become tomorrow’s life-changing therapies, faster and with greater confidence.”
On costs and what comes next
AI-driven drug discovery is still in its early days. Notably, no drug discovered primarily through AI-driven design has yet received full FDA approval—although Belcher expects that to change in the next two to three years.
How big of an impact could AI eventually have on drug discovery? “The holy grail would be full in silico prediction of efficacy and toxicity, eliminating the need for the vast majority of physical wet lab work,” says Belcher. But there are many barriers to this beyond the maturity of the models, including regulatory hurdles and cost challenges.
A Stanford study found that the cost of training frontier AI models has more than doubled every year since 2016, adding more financial pressure to a sector already defined by exceptionally high R&D spend.
Belcher acknowledges the tension, but remains optimistic about what’s ahead. “I think we’ll get to a point where there’s a balance between AI and wet work, from a cost perspective and a risk perspective,” he says. “As long as the cost of compute doesn’t ever outweigh the cost of clinical development, I think AI is going to be an advantage.”
This content was produced by Insights, the custom content arm of MIT Technology Review. It was not written by MIT Technology Review’s editorial staff. It was researched, designed, and written by human writers, editors, analysts, and illustrators. This includes the writing of surveys and collection of data for surveys. AI tools that may have been used were limited to secondary production processes that passed thorough human review.
For the enterprise, the promise of agentic AI is much more than just a better chatbot. It is software agents that execute business tasks end-to-end across people, business workflows, data, and systems. The platform best-suited to run agents is built with proper CPU capacity, resilient data access, policy-aware tool use, observability, memory management, and the ability to predictably plan and scale agents.
To better understand some of these dependencies, Intel performed thousands of agentic AI workload experiments. Our initial findings create and support five practical lessons for enterprise leaders:
Agentic AI is a larger systems problem, not just one of inference.
The majority of existing agentic AI harnesses are limited and do not measure overall system performance.
Plan capacity is done using agents per virtual CPU (vCPU) density, not agent count.
Monitor agent task latency, not just average CPU utilization.
Default to scale-out for systems hosting agents. Reserve scale-up for workloads with heavier per-agent compute or architectural constraints.
Beyond inference: Agents as workflow automation
Agentic AI is more than LLM inference. Its enterprise value depends on the full system, task orchestration, data access, tool execution, latency management, governance, and scalable infrastructure. An agent is a goal-driven automated enterprise workflow process: It plans a multi-step task, calls tools, reads results, and retries when something fails. Enterprise agents are therefore not just an inference problem; they are a systems problem.
Defining what good looks like
Most agentic AI metrics focus on evaluating the LLM used. Platform teams also need to know how long the tasks take, how many agents a fleet can support, what users experience at the end of the execution process, and how costs change as more agents work simultaneously.
A more useful enterprise view looks at six metrics:
Task success rate
Cost per task
Time per task
Task throughput
Agent density (agents per vCPU)
Latency
Together, these answer the questions enterprise AI operators care about: Is the system performing as expected? How many agents can the system sustain? How should it scale to support more agents?
Building on solid foundations
To gain a deeper insight into agentic AI workload performance, Intel extended Terminal-Bench, an open source benchmarking harness for evaluating AI agents with profiling, telemetry, and replay capabilities. This made it possible to understand where the agents spent time beyond LLM inference.
The benchmark extension used a deterministic record-replay of LLM responses to separate agent performance from LLM variability. LLM responses were recorded once and replayed identically across runs, reducing run-to-run variance and creating a more reliable basis for comparison.
The Terminal-Bench task mix used was intentionally broad. It included compilation, testing, database operations, Boolean logic, interpretation, ray tracing, compression, linear algebra, video transcoding, and machine learning training. That wide variety made the findings more relevant to real enterprise environments.
Agentic AI in three dimensions
Deploying agentic AI should be approached in three phases:
Plan in terms of agent density, not agent count: The first sizing rule is to normalize agent count by available compute. Agent density, measured as agents per vCPU, is the leading signal for saturation. For example, 10 agents on an 8-vCPU system and 20 agents on a 16-vCPU system behave similarly if the density is the same. This gives architects a portable way to compare capacity across instance sizes and processor generations.
The right density also depends on the business goal. Interactive copilots and user-facing assistants should favor lower density because response time matters. Batch workloads such as IT workflows can often run at higher density. This gives teams a practical way to tune fleets around service-level objectives and total cost of ownership.
Agentic AI requires a new form of observability: Average compute (CPU) utilization is a weak primary performance monitoring signal for agentic workloads. Agents often alternate between waiting for model responses and then doing short bursts of compute-intensive work. Because of that “bursty” pattern, average utilization can look acceptable even when those bursts are creating queues and slowing down the user experience. Task latency (P95) is a better leading metric. It shows when workflows are starting to wait, even before average task duration meaningfully degrades. A practical operating model is to alert on P95 latency first, then confirm the issue by looking at sustained task duration.
Scale out by default: Scaling out adds more systems, increasing total agent capacity, while scaling up adds cores or memory to a single system for agents with heavier compute bursts.
Our testing data showed that scale-out is usually the better default. That aligns with the fact that agents are typically semi-independent and have modest per-agent bursts, it improves overall performance, supports high availability, often lowers cost, and makes it easier to preserve the target agents-per-vCPU ratio as the platform grows.
Scale up when agents require heavier parallel compute, shared state limits partitioning, memory locality matters, or licensing constraints apply.
Consider business implications: Where will agentic AI create business value first? The organizations getting production-grade results are wrapping an automation layer around workflows that already have codified rules and measurable service levels: code creation, regression test farms, ticket triaging, market analysis, and security review.
The ideal enterprise persona for agentic AI is therefore not the experimental user chasing novelty; it is the accountable leader who must improve cycle time and productivity, protect service quality, enforce policy, and scale adoption with cost in mind.
Agentic AI’s value comes from helping businesses complete real work across teams, systems, data, and processes. For enterprises, the priority is not just better model performance; it is creating a reliable environment where AI agents can support business workflows, improve productivity, operate within governance requirements, and scale as adoption grows.
In practice, success with agentic AI depends on the right foundation to deliver consistent outcomes, manage cost, maintain control, and move confidently from pilots to production.
This content was produced by Intel. It was not written by MIT Technology Review’s editorial staff.
Awareness enabled by appropriate data and business logic is one of the differences between agentic applications that properly perform and those that never reach production.
Login
