Visa aimed Anthropic's Claude Mythos at the infrastructure behind billions of daily transactions, a network that spans more than 200 countries and territories, moves money in roughly 160 currencies, and connects nearly 5 billion payment credentials to more than 175 million merchant locations.

The model stitched minor weaknesses deep in the stack into working exploit chains that would traditionally have surfaced only late in penetration testing. Rajat Taneja, Visa's president of technology, walked the VB Transform 2026 audience through what came next, including why Visa released the harness that governed the entire hunt as open source and why the company abandoned traditional remediation metrics for a measurement its team invented.

Taneja has run technology strategy, product engineering, and global infrastructure at Visa since 2019, after joining the company in 2013 from Electronic Arts, where he served as CTO following 15 years at Microsoft. He co-authored, with Visa chief information security officer Subra Kumaraswamy, the June 10 blog post announcing the release of the Visa Vulnerability Agentic Harness on GitHub as a reference implementation that any security team can inspect, adapt, and extend. Visa also published a technical white paper detailing the architecture, lessons learned, and 12 non-negotiable architectural practices for critical infrastructure.

Trust built on pessimism and paranoia

Taneja led with the arithmetic that makes Visa a target worth defending obsessively. Trust at the scale of global payments gets engineered through what he called pessimism and paranoia, by assuming failure and designing around it before failure arrives. The network has been hardened over many years through zero-trust architecture, layered defenses, and highly automated security operations built for the scale and reliability global payments demand.

So when Anthropic invited the organizations behind critical software to test Mythos under Project Glasswing, Visa said yes. Glasswing participants collectively identified more than 10,000 high- or critical-severity vulnerabilities in the first month of testing across software underpinning critical systems industry-wide, according to Anthropic. Anthropic's own conclusion placed the bottleneck after discovery, in verification, disclosure, and patching speed. Visa joined to test decades of hardening at AI speed and learn where advanced models could push its defenses further.

What Mythos showed at Visa

Inside Visa's environment, Mythos demonstrated system-wide, context-aware analysis, surfacing vulnerabilities buried deep in the stack and flagging issues that grow more serious when chained together, with findings clean enough that engineering teams could act on them without wading through noise. Some findings carried critical severity ratings, and Visa credits its zero-trust controls, network segmentation, and layered safeguards with breaking the chain before any external actor could have acted.

That confirmation mattered, Taneja said, but the epiphany that followed mattered more. "In a world of agentic attacks, defense also has to be agentic," he said. Even at a company that has invested decades in defense-in-depth, the model revealed assumptions the team had been operating under that needed rethinking. Traditional SAST tools keep their place as a first pass against known vulnerability patterns, Visa's white paper notes, but pattern matching alone cannot follow an adversary who reasons through logic, data flow, and the exploit chains that live between the signatures.

A harness, not a scanner

Visa's response was not another monolithic scanner. The team built the Visa Vulnerability Agentic Harness, now in its fifth generation, as a governed pipeline that directs frontier AI models through structured security tasks while enforcing deterministic controls, policy gates, and human oversight at every stage. Taneja walked through the design philosophy. The harness operates across four phases and eleven stages, from code ingestion and threat modeling through deep-dive verification, exploit chain synthesis, and finally remediation and fix validation.

Three design choices drive finding quality, per the project's own documentation. Threat modeling runs before analysis to focus on the attack surface rather than scanning everything blindly, multi-agent deterministic voting requires convergence across independent reasoning chains before a finding advances, and structured triage artifacts compress the lifecycle from discovery to a result developers can actually ship. The payoff is a pipeline that runs hot by default. A plain scan in the shipped profile runs all eleven stages and edits source files in the target repository in fix mode, applying candidate patches unless the operator stops it at detection.

The harness is multi-model by design. An LLM abstraction layer lets Visa swap or combine providers without changing the control plane, and the open-source version works with Anthropic Claude, OpenAI-compatible models, or a mix. The repo's documentation is candid about the exception. Applying a fix requires the file-editing tools that only the Anthropic backends expose, so the remediation and validation stages currently require Anthropic models for full functionality, and an OpenAI-compatible model in those roles is limited to report-only output. VentureBeat's Q2 2026 Pulse research, presented earlier at the conference, reinforces why that provider flexibility matters. Among the enterprises surveyed, 82% rely on provider-native controls as their primary security layer, and 59% plan to adopt or switch agent security tooling within the year. The controls enterprises adopted last year are already becoming the controls they plan to replace.

Mean Time to Adapt replaces legacy metrics

Finding vulnerabilities is no longer the hard part, Taneja argued. The real challenge is how quickly a team can confirm an issue is truly exploitable, fix it, and prove the attack path is closed rather than just showing a patch was applied. Visa calls this Mean Time to Adapt, and the white paper tracks it along three dimensions. Inventory freshness measures how current and complete the organization's view is of code, configuration, and runtime deployment. Exploitable paths per release counts how many end-to-end attack chains remain possible after each release, not just how many findings were closed. Validation cycle time tracks how long it takes to produce repeatable, evidence-backed proof that a fix works and stays working in production.

That distinction matters because legacy measures such as mean time to detect and raw CVE closure counts can look better on paper while actual exposure keeps growing underneath them. An organization can close hundreds of findings a month and still leave viable exploit chains open if nobody tested whether the patches actually break the attack. MTTA forces teams to measure the outcome that matters, and the white paper leans on CISA Known Exploited Vulnerabilities data to make the prioritization case, noting that fewer than 1% of CVEs are ever actively exploited. Visa's SSDLC policy now assumes every exploitable path will be exercised in production and requires it to be remediated before code is promoted.

Supply chain risk accelerates under AI

The conversation moved past Visa's own perimeter when Taneja turned to suppliers. A well-defended enterprise stays exposed through weak vendors and weak open-source components, the white paper warns, so Visa is making AI-specific security posture a non-negotiable dimension of supplier due diligence, with expectations for continuous vulnerability validation, living software bills of materials, and MTTA baselines across its technology stack.

Visa has also joined Project Lightwell, the $5 billion IBM and Red Hat initiative to harden widely used open-source components through AI-driven validation and coordinated patching, alongside financial institutions including Bank of America, JPMorganChase, Goldman Sachs, and Mastercard. The commitment extends the same logic upstream, because the MTTA clock does not pause at any single company's perimeter.

When agents start buying things

Securing agentic commerce is Visa's next problem. Taneja described a future where AI agents transact on behalf of consumers and enterprises, and said Visa is building the trust framework, identity layer, and agent readiness scoring that merchants will need before agents can safely complete transactions. Behind that work sits the Visa Payment Threats Lab, a simulation environment where real fraud scenarios get replayed against the authorization rules, thresholds, and configurations Visa actually runs, to surface AI-enabled failure modes as targeted hardening recommendations.

The identity challenge is not theoretical. VentureBeat's Pulse research found that 69% of enterprises already run credential sharing somewhere in their agent deployments, and companies with shared credentials report security incidents or near-misses at a 63.5% rate, against 40.9% where every agent has its own scoped identity. Visa's white paper addresses that gap directly, listing "AI agents are identities" among its 12 non-negotiable practices and requiring scoped permissions, least privilege enforcement, full audit trails, and inclusion in IAM governance for every agent that calls an API, reads data, or modifies a system.

Three priorities for defenders

Visa is organizing its defensive strategy around three priorities, Taneja said. Shift security left until exploitable flaws are designed out before they reach production, and replace high-risk, under-supported components before they turn into material exposure. The third is the heaviest lift at Visa's scale, refactoring defenses to run autonomously under human governance so detection, validation, and response keep pace as threat volume grows and the models behind attacks improve.

None of it requires a payment network's budget to start. The harness sits on GitHub with 595 stars and 97 forks as of July 20, MTTA needs a dashboard rather than a procurement cycle, and the white paper's 12 non-negotiable practices map onto architecture reviews security teams already run. Visa's own conclusion reads like a deadline. The opening to get ahead of machine-speed attackers is still there, the paper argues, and it will not stay open.

Instacart is posing the provocative question: What if most of the work your engineers do today should, in fact, be done by machines?

At VB Transform 2026, CTO Anirban Kundu argued that dev teams continue to waste their time on draining, repetitive, high-volume work; this should be absorbed by AI agents so that humans can focus on problems that require judgment, intent, and exception handling. 

In fact, in 97% of cases, Instacart’s builders don’t even read code anymore. 

“In the past, the tactical level was the creation of the code,” Kundu said. “In the most tactical level going forward, it's going to be, ‘How do you navigate around the AI system to give you what you want?’”

AI generating code, performing "pretty serious evals" 

That doesn’t mean humans never look at code; agents handle the bulk of code generation and boilerplate, particularly with newer projects where code is generated or regenerated on a weekly basis. 

“The benefit of that is we don't care about tech debt anymore,” Kundu said. “Things that are not active just get dropped out and then it gets rebuilt, kind of like how we used to build assembly code or object code.”

So why not 100%? The remaining 3% is in legacy, compliance, and latency-sensitive systems and workflows, or driven by a “boatload of code” that is dead, not active, or half-active. These cases still need careful human attention. 

Instacart is slowly “smoothing those parts out,” however, breaking systems down in an aptly-named project Atoms, then building them back up in a cleaner, more modular form. Kundu’s team started with the “monoliths” and is shifting to remote procedure call (RPC)-driven architectures. 

But evaluation remains one of the overarching challenges. Code reviews aren’t as relevant when AI is generating code — as Kundu noted, “the lines of code are going to be correct, the syntax is going to meet your expectations” — so the goal is to move to an “intent model.” That is, training devs so they can ask different models the right questions from an intent perspective. 

Evals are then performed independently: Roughly 7,000 automatic evaluations run each month, and the system answers 8,000-plus real-time developer queries with about 99.9% accuracy.

Identifying "hiccups" that human intuition might have missed

Dovetailing with this, Instacart has built an agentic site reliability engineering (SRE) system trained on years of the company’s own incidents and root-cause analyses rather than generic failure data. Instead of teaching a model how production outages work in the abstract, the team fed it the specific ways Instacart’s systems have broken over time, along with the ways humans diagnosed and fixed them.

As a result, the company has seen accuracy in detecting and mitigating production issues jump from roughly 60 to more than 90%. 

Kundu pointed to one example with Instacart’s internal tool Blueberry. The AI SRE colleague watches 200-some-odd Slack channels, monitors signals, and looks for patterns across human conversations and alerts. 

In one incident, a database shard backed by an EBS volume that had a “hiccup” for a period of time. The human team did not immediately suspect AWS disk issues and were “obviously scrambling” to figure out why this particular shard misbehaved. 

But about 20 minutes in, Blueberry posted on Slack, pointing to a specific blip and tying it to a feature-flag-like system called "roulette" that had been inadequate. "It's supposed to be rolling out in this cadence, [but] it had been too much,” Kundu said.

Blueberry figured it out, and the team resolved the incident. “Would have a human been as quick? I think the problem is human intuition would hold us back a little bit,” Kundu said. 

Humans tend to default to patterns we’ve seen before, then resort to debugging; Kundu called this the “first brain-second brain kind of thing.” But Instacart’s agentic SRE is actually “more comprehensive in its ability to look at everything and then be able to decide what does or doesn't matter.”

Redefining the engineer’s job

Looking ahead, the most tactical work for engineers will be navigating AI systems: Designing and supervising evaluation processes; coordinating multiple simultaneous experiments and features; managing constraints like limited top-of-funnel traffic for testing; figuring out when to escalate; identifying edge cases and where things might break.

Domain expertise is also being rethought in the age of AI. Instead of bottlenecking changes through a single “owner” team that touches the code, Instacart is embedding domain knowledge into definitions and specs that any team can use. 

“We’ve lived in this world where this group or this engineering team is the one that can touch the code and make the modification,” said Kundu. “We're trying to move into a world where the code becomes completely democratized across groups.” 

Software engineers at General Motors' (GM's) autonomous driving division spend only 15% of their time writing code, according to Rashed Haq, GM's VP of autonomous vehicles, in a recent onstage interview at VB Transform 2026.

GM is now using AI agents to accelerate much of the other 85%—including analyzing vehicle data, triaging problems, running experiments and testing potential fixes.

The result, Haq said, is roughly three times as many merged pull requests across GM’s autonomous vehicle engineering organization, faster releases and fewer defects escaping into later stages of development.

Haq said GM achieved those gains by redesigning complete engineering workflows around agents — not merely adding an AI coding assistant.

“If you give somebody just a chatbot which can do coding, there’s still a lot of inefficiency built into that process,” Haq said.

Engineers spent most of their time outside the code editor before agentic AI

GM’s 15% figure may sound strikingly low, but research conducted before the rise of generative and agentic AI reached a similar conclusion.

A 2019 Microsoft study based on responses from 5,971 professional developers found that they spent an average of 96 minutes writing code on good workdays and 66 minutes on bad ones. That equals roughly 20% and 14% of an eight-hour day, respectively. A 2018 Stripe survey found that the average developer spent more than 17 hours each week on maintenance work such as debugging and refactoring.

There is no single industry benchmark: the Microsoft researchers noted that earlier studies placed coding anywhere from 9% to 61% of developers’ time, depending on how researchers defined and measured the work. But the findings reinforce Haq’s central argument. Long before agents arrived, writing code represented only one part of software engineering. Accelerating that step alone leaves much of the development process untouched.

“Doing it by loop became really important,” Haq said.

GM divided its autonomous vehicle work into several loops: developing and testing software in simulation, testing vehicles on public roads and monitoring vehicles after they reach customers. It then looked for the longest bottleneck in each loop, automated it and repeated the process.

GM gave agents access to internal tools and data

GM connected agents to internal tools and petabytes of company data through customized Model Context Protocol (MCP) servers. It also created version-controlled “skills,” or instruction documents that tell agents how to perform specific tasks.

One high-value application involves telemetry collected from vehicles on public roads. Agents can analyze that data, conduct an initial triage and create issues for engineers to investigate. Through MCP connections, they can also call the underlying tools used by WebViz, GM’s system for visualizing vehicle telemetry, rather than relying on the same graphical interface a person sees.

The findings still need to make sense to engineers. “The output has to be human readable,” Haq said. An agent might identify a potential problem, locate the affected component, search historical data for similar incidents and provide examples supporting its conclusion.

GM bases an agent’s permissions on those of the engineer using it.

“If an engineer was going to do this task and they need access to these things, then their agent needs access to those things,” Haq said. “The engineer still is accountable for the output of the agent.”

The company also uses background agents to run machine-learning experiments in parallel. An engineer defines an experiment and its parameters, then agents execute tests and collect the results.

Three times the pull requests — with fewer escaped defects

GM treated its internal agent platform as a product and assigned four deployed engineers to work directly with engineering teams. They helped employees identify useful workflows, spread successful practices and adopt the tools.

Haq said the resulting increase in merged pull requests represents more than higher code volume. “The velocity at which we’re releasing new features” increased, he said, while releases produced “fewer test escapes, bug escapes” and other problems.

People remain responsible at critical control points. Haq said GM established structured and unstructured tests and performance measurements before accelerating the wider workflow. Engineers review those measurements and determine whether each test still captures its intended goal before work advances toward production.

Haq said GM initially expected a more modest productivity gain. “I think our only surprise was how much we could do,” he said.

GM's approach didn't start with handing every developer a code generator. It started with mapping the full path from problem discovery to a verified fix in each loop — simulation, road testing, post-deployment monitoring — then giving agents controlled access to the tools and data needed to shorten the longest bottleneck at each stage.

Runway spent weeks trying to engineer its way out of a stubborn bug: AI-generated avatars would drift off-center during real-time video generation. The fix wasn't a back-end patch — it was a new front-end feature that just worked around the problem. That's the kind of lesson Ryan Phillips, head of enterprise product at Runway ML, walked through at VB Transform 2026, arguing that even companies not building foundation models themselves can learn from how Runway builds, evaluates, and ships them.

"I think even if you are not all building models yourselves, it's helpful to learn how we do it because I think almost all of the lessons are applicable to what you all are doing day-to-day," Phillips said.

Runway is an applied AI research company building general world models to power generative tools. During his presentation, Phillips showcased Runway Characters, a real-time video model that enables zero-latency, back-and-forth interactions with AI-generated avatars. Five years ago, creating a video with illegible text and low framerates took artists hundreds of hours of stitching individual frames together, he said. Today, Runway’s models generate interactive video on the fly.

“Studying how we build these real-time models can inspire how you build and deploy real-time experiences, whether agentic or not, in your companies today,” he said.

Demystifying evals

Building a robust AI product starts with a high-quality evaluation set. However, creating this set cannot be treated solely as an engineering task. It requires deep cross-functional alignment across product, design, research, and sales to define what "quality" actually looks like.

Phillips emphasized running internal workshops where team members review generated examples together. The goal is to align the entire organization on specific failure modes so everyone shares a unified definition of a successful generation.

“We spent a lot of time working with our team, running through examples... of what success and failure looks like, down to the very, very detailed and picky things,” Phillips said.

The resulting evaluation set must cover broad customer use cases alongside extreme edge cases. For instance, Phillips highlighted that to ensure the model behaves predictably when pushed beyond standard human facial structures, they used “Tooth,” a non-human character with no nose and very unusual teeth.

When grading these generations, the Runway team looks for subtle artifacts. In one example, a video where a character’s face remained intact but background elements, such as a net, began morphing was strictly graded as a failure.

Despite the cutting-edge nature of the product, the tool Runway uses to track these evaluations is simple: an Excel spreadsheet. The team logs tests daily, categorizing outputs as "minor" or "major" failures against a predetermined pass rate. 

“We set a bar before we get started on what percentage we need to pass, and when we hit that, we ship the model,” Phillips said. “So it's not magical.”

For enterprise developers facing non-deterministic quality drift in their own real-time pipelines, manual evaluation at scale is a bottleneck. To solve this, Phillips noted that developers can rely on language models to automate the visual grading process. 

“LLMs are getting quite good at being a judge for a lot of this content, especially the types of morphing or changing that you would see in an evaluation set,” he said. Teams can also feed an LLM behind-the-scenes context (e.g., a hand-drawn sketch or an ad's structural layout) to guide the generation and validation processes, ensuring quality without adding cognitive load to the end user.

Model training and turning bugs into features

Delivering real-time generative video requires a highly optimized technical stack. The process begins with pre-training a massive foundation model, which is resource-intensive and slow to generate outputs. To achieve real-time latency, Runway relies on distillation, where a smaller, faster "student" model is trained to mimic the large "teacher" model. According to Phillips, distillation helps Runway cut down “80 to 90% of the generation time.”

The team then applies adversarial post-training (APT) to the distilled model. This technique forces the model to continuously improve by testing it against a system designed to find its flaws, helping regain the visual sharpness lost during the distillation process.

However, altering the model architecture introduces new problems. The distillation and APT phases introduced a stubborn bug: characters would sway or drift from the center of the frame during real-time generation.

The team spent weeks attempting to fix the core model to eliminate the drift, he said. Ultimately, they discovered that if the user's initial input image was perfectly centered, the generated video remained stable. Instead of spending more time on a backend engineering patch, Runway pivoted to a user experience solution.

“What we did was, when we noticed this in our evaluations, we then said, 'What if we just offered that as a feature?' If a user gives us a character that is turned to the left, we know the video is going to morph. Let's just fix it for them,” Phillips said. 

They introduced a frontend feature called "Optimize for Image Quality," which automatically re-centers the user's image before generation begins. By wrapping a backend model limitation in a frontend tool, users perceived a helpful feature rather than an engineering flaw.

“Turn model limitations into product features so that you can actually expand how the model works,” Phillips advised. “It might feel like a limitation internally, but your customers will not see it that way if you're kind of building this in as a product feature.”

The devil is in the infrastructure details

Delivering video globally at 24 frames per second requires optimizing every layer of the infrastructure stack. This ranges from caching and parallel decoding to making deep kernel changes in partnership with hardware providers like Nvidia.

Shortly after launching Runway Characters, he said the team noticed that 8% of API calls were dropping to 16 frames per second, causing the video to stutter for customers. 

Finding the root cause required deep observability. The team used an AI agent powered by Claude alongside monitoring tools like Datadog and Sentry to trace the anomaly. The debugging session isolated the problem to a single data center in the us-east-1 region.

“The solution actually wasn't [to] go fix anything or change a config,” Phillips explained. “They actually went and physically replaced those GPUs in the data center to fix it, and that ultimately solved the problems.”

For enterprise teams deploying real-time applications, the takeaway is clear: hardware and infrastructure anomalies will directly impact model performance, requiring rigorous, full-stack debugging capabilities. 

“Don't forget about all the small details, because there's so many of them when you're deploying these models,” Phillips said.

Surviving "failure hell" and the future of world-building

Developing AI systems is rarely a linear process. Teams often find themselves stuck for weeks on a single problem with no end in sight, a phase Phillips referred to as "failure hell.”

“We think you have to go through that pain and really struggle with the problem for a little bit before you can get the breakthrough,” he said. Consistent iteration eventually flattens the difficulty curve, triggering sudden, exponential improvements.

As the underlying models overcome these technical hurdles, the role of enterprise creatives is also fundamentally changing. Traditionally, marketing and design teams have focused on creating single assets, like a specific advertisement or illustration. In an era of real-time generation and agentic workflows, that paradigm is shifting toward defining parameters, aesthetics, and intellectual property.

“You might not be designing a single ad, but you might design a world that then the agent or a real-time video model can generate ads from,” Phillips said. 

Presented by Vijil

In dynamic environments where users, data, workflows and attack techniques change continuously after deployment, AI agent trust has become a runtime problem. Most organizations still treat trust as a pre-deployment exercise, declaring an agent production-ready and launching it after it passes sandbox evaluations and performs successfully in security tests. Unfortunately, that trustworthiness breaks down the moment an agent begins interacting with the real world.

"The core of the problem is that CIOs and business owners think about AI systems the way they think about SaaS or mobile applications, which do not respond dynamically to the world around them," says Vin Sharma, Founder and CEO of Vijil. "Agents, by the textbook definition, are meant to perceive their environment, reason, act, observe the consequences, and learn from the gap between expectation and reality. The problem is that the models underneath them are built from static training data, and that picture of the world is already outdated by the time they reach production."

Why benchmark scores fall short for agentic system trustworthiness

Traditional AI evaluations offer a point-in-time assessment of agent capability, rather than trustworthiness. There are three reasons why that assessment fails to predict real enterprise behavior:

First, benchmarks are static, built around a particular notion of what good performance means when they were developed, while the world keeps moving ahead.

Secondly, they model reality imperfectly, so that the gap between the benchmark and the real world is exactly where many failures occur.

And third, benchmarks are public, so they leak into future models' training data, letting models effectively memorize the test rather than prove real capability..

“The agent or the application could score exceptionally well on a benchmark, but there's that gap between that benchmark and the real world," Sharma says." Doing well only proves it can pass the test, not that it’ll perform reliably in production.”

But overall, benchmarks fall short precisely because they measure capability, not trustworthiness.

"We tend to think of agents as factotums, generally utilitarian agents to whom you can delegate certain types of tasks," Sharma says. "But what we need to do is actually assign an objective that demands they always perform with the duty of competence, duty of care, and duty of loyalty to the enterprise."

Of course, agents are not conscious and cannot be expected to feel actual human loyalty, but under the law, fiduciary duty doesn't actually require consciousness. It just means that the agent should be bound to place the interests of the principal above its own or anyone else's, as a functional requirement, and testable regardless of intention.

Capability and trustworthiness are different questions

Prioritizing trustworthiness over capability requires rethinking what enterprises expect from AI agents. Sharma calls that model the fiduciary agent, a term borrowed from professions that are bound by a formal duty of care, such as financial institutions or healthcare providers who owe their clients duties of competence, care, and loyalty. It addresses a critical issue in today's industry: the focus almost entirely on competence, with little attention paid to whether an agent is beholden to the interests of the principal delegating work to it.

Testing starts from a working definition: an agent is trustworthy if the benefit of delegating a task to it exceeds the risk of that task's failure. It's an equation spelled out in economic terms that executives can act on directly, and risk breaks down to three components:

• reliability, or whether the agent performs as expected under varying conditions

• security, or its resistance to attacks from malicious actors

• and safety, or how contained the damage stays when failure eventually happens.

"The resulting score can be compared to a consumer credit rating, but built from behavioral data," Sharma explains. "Meanwhile, testing methodology should be centered around three Ps: purpose, personas, and policies."

At Vijil, purpose-based testing adapts to the specific workflow an agent handles, growing harder or easier depending on performance, similar to a computer-administered exam. Persona-based testing draws on more than a thousand demographically varied user profiles alongside adversary profiles, from ethical hackers to state-sponsored attackers, to simulate the range of people and threats an agent might encounter. Policy-based testing builds a custom harness from an organization's own rules, whether they come from regulation, an internal privacy policy, or brand guidelines, and measures how far an agent strays when it violates them.

The trust failures that only emerge in production

Many failures cannot surface during pre-production testing because they arise from change in the environment itself. Machine learning has previously described this as data drift and concept drift, and for a CIO or CSO it means the people interacting with an agent differ from those the agent was planned for, and those users behave in ways that only become visible in production. At the same time, new attacks are emerging with increasing frequency as organizations push general-purpose agents into specialized enterprise roles they weren’t designed for and cannot easily constrain once deployed.

Multi-agent systems also introduce a brand-new category of failure that can't be detected at the individual agent level, when agent systems act against the interests of the principal. For instance, collusion can occur when agents work together — one coding agent generates code while a second tests it, and behind the scenes both agree to leave a backdoor or flaw intact rather than flag it. Or agents divvy up tasks or responsibilities between themselves rather than focusing on their assigned tasks.

"What's no longer in question is whether this is possible. It's proven to exist," Sharma said. "Is it six, 12, 18 months from now that you should worry about collusion among AI agents? I think it's sooner than that. We've left the era of failure prevention. Now we have to think in terms of resilience: How quickly do you recover from failures in production?"

What continuous trust management looks like in practice

Operationally, continuous trust management goes back to those longstanding principles of observability and control, applied across the lifecycle of an agent population:

The first step is discovery, bringing shadow AI and ungoverned agents into the governance fold.

The second is assigning each agent a standards-based workload identity distinct from that of its human principal, which allows organizations to grant agents narrowly restricted permissions for their delegated tasks.

The third is policy-based control enforced through a mandatory enforcement point in the agent, instead of leaving it to the developer's discretion.

From there, two new KPIs emerge: time to trust and time to recovery. Time to trust is how long it takes an organization to move from intention to a production deployment it can stand behind. Time to recovery is the interval between when a vulnerability is detected and when it gets fixed.

New organizational responsibility for this work may fall to a chief AI officer or be shared across GRC, CIO and CSO functions, Sharma says. Meanwhile, multi-agent systems will reshape how organizations view trust, rather than fit into current narrow definitions.

"Trust is not a vibe. Trust is not a virtue," Sharma said. "It is something that you build into the infrastructure of your systems, so that it is continuous. It's trackable, measurable. It allows your systems and your organization to improve continuously."

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Snowflake announced Cortex AI Gateway on Tuesday, a centralized control layer designed to govern how AI agents — including those built by competitors like Anthropic's Claude Code and Cursor — access enterprise data, tools, and models. Alongside the gateway, the company unveiled a first wave of security integrations with 1Password, Aembit, Linx Security, SailPoint, and Saviynt, an unusual lineup of identity vendors who often compete with one another, now aligned around a shared trust model for autonomous agents.

The announcement, made from the company's no-headquarters base in Bozeman, Montana, is Snowflake's most aggressive move yet to position itself not merely as the place where enterprise data lives, but as the control plane that decides what AI agents are allowed to do with it.

"The next era of AI won't be built through more walled gardens. It will be built through secure agent interoperability," Mayank Upadhyay, Snowflake's chief security and trust officer, told VentureBeat in an exclusive interview. "If every vendor builds a closed ecosystem of agents, enterprises simply recreate the fragmentation they've spent years trying to solve. Instead of breaking down silos, they create a new generation of AI silos that limit innovation and make it harder to scale AI across the business."

Why decades-old enterprise security models break when AI agents become the actors

The core argument animating today’s announcement is that decades of enterprise security architecture rests on an assumption that no longer holds — that the actor behind every access request is a person.

"Traditional security was built for a world where humans were the actors. AI agents change that completely. For decades, security models assumed people would access one application at a time, operating at human speed and within relatively defined boundaries," Upadhyay said. The deeper issue, he argued, is not novelty but exposure: "The challenge isn't that AI creates entirely new security problems. It's that AI exposes the blind spots we've always had."

Organizations have never had perfect visibility into every API, dataset, and workflow, Upadhyay noted, and at human speed those gaps were manageable. Agents operating at machine speed can "combine access across systems and act on permissions that were never intended to be exercised together, amplifying those longstanding risks." His conclusion: "In the agentic era, trust can't be a one-time decision made at login. It has to be continuously verified through every agent, every action, and every interaction across the enterprise."

Nancy Wang, chief technology officer of 1Password, described the failure mode in more visceral terms. When agents first arrived, she told VentureBeat, the default pattern was dangerously simple: "Let me just give the agent my credentials and it can just act as me... let's imagine you're the head of security or the head of IT, and you have access, especially admin access, to all of the systems. Well, now suddenly your agent now has admin access to all of the systems, and so it could exfil data... if it's subject to a prompt injection, for example."

The audit trail becomes equally useless, she added: "Imagine the audit logs show that Michael sent a couple million dollars to an offshore account... It raises eyebrows when, in fact, it could just be an agent going off the rails and doing things that you never authorized." Her prescription, and the premise of 1Password's integration with Snowflake, is blunt: "Agents need their own identity."

Inside Cortex AI Gateway: how Snowflake plans to govern agent access and rein in runaway AI costs

Cortex AI Gateway, which will enter public preview soon, functions as a connective layer for what Snowflake calls "all trusted agent activity." It governs both first-party agents built inside Snowflake, such as Snowflake CoWork and CoCo, and third-party agents built on external platforms. With support for more than 100 MCP servers — the Model Context Protocol connectors that have become the de facto standard for wiring agents to enterprise tools — the gateway centralizes access policies, authentication, permissions, and audit logging in a single place.

The gateway also addresses a less glamorous but increasingly urgent problem: runaway AI spending. It gives IT and finance teams a unified view of AI consumption, attributes costs to the specific teams, agents, or workloads driving them, and enforces spending limits before bills spiral.

Upadhyay described how those costs compound in practice. "AI is dynamic. Agents can invoke multiple models, call different tools, and execute multi-step workflows, creating consumption patterns that can change from one task to the next. For example, an enterprise may deploy an AI assistant to help employees answer internal questions. A simple request that only requires retrieving a document could unintentionally be routed through a more expensive reasoning model, trigger additional searches across multiple systems, or invoke unnecessary workflows." At scale, with thousands of employees and hundreds of agents, small inefficiencies become significant line items.

The gateway builds directly on Snowflake's May 2026 acquisition of Natoma, a 27-person startup whose centralized MCP gateway enforced identity, policy, and audit at the tool-call level. Forbes reported at the time that the deal — announced the same day as Snowflake's $1.33 billion quarterly product revenue report and a $6 billion AWS compute commitment — was the smallest of the day's three announcements by dollar value but the most revealing about where Snowflake believes the next platform fight sits: not in the data warehouse, but in the layer that decides what an agent may touch and records what it did.

Dual attribution and task-scoped access: the technical blueprint for trusting autonomous agents

The technical centerpiece of the partner integrations is what Snowflake calls dual attribution. "By logging both the verified non-human identity of the agent and the specific human who authorized the task, we ensure task-scoped access and complete auditability for every action taken across the enterprise," Upadhyay said. That answers a question that has stumped security teams: when an agent takes an action, whose action is it? The Snowflake model says the answer is both — the agent's, and the human's who delegated the task — and both must be recorded.

Task-scoped access is the companion principle. Rather than inheriting a user's full standing permissions, an agent gets access only to what a specific task requires. Upadhyay acknowledged the obvious objection — agents are dynamic and their next step often isn't known in advance. "The goal isn't to predict every action an agent will take. It's to ensure that every action an agent takes is evaluated in real time against the appropriate policies, scope, contextual signals, and the original intent of the user," he said.

Wang explained how 1Password's piece works at the protocol level, pointing to emerging standards like OIDC-A: "the human, for example, first authorizes the agent to do a specific task, and then what that means is the agent will then receive sort of the delegated task specific token... as part of that token, that is where you learn of the original sort of delegator identity and also the intent behind the task."

The intent-preservation problem is subtle, she noted, because enterprise tasks decompose into enormous chains of individual operations. "When they're accessing a table, you know that it's acting on behalf of the original intent that you gave that agent... a task might be a compilation of hundreds, maybe even thousands, individual actions." Keeping that intent intact across every step in the chain — and flagging the moment an agent deviates from it — is what Snowflake and its partners are ultimately trying to standardize.

SailPoint's field report: the three ways enterprise identity systems fail against AI agents

Chandra Gnanasambandam, SailPoint's EVP of product and chief technology officer, brought the perspective of a vendor that has watched enterprises break their identity stacks against this problem for more than a year. SailPoint has been in the machine and agent security market for roughly 18 months, he said, with more than 100 customers on its agent identity product — enough of a sample to catalog the recurring failures.

The first is scale-driven shallowness. An average Fortune 500 company has roughly 16,000 employees, and SailPoint is seeing human-to-non-human identity ratios of at least 10 to 1 — before counting the tools and APIs each agent touches, which multiply the count again. "You will get into a million plus non-human identities. Mapping the permissions that each of them get to the 16,000 humans is a completely non-trivial task," he said. Most companies punt, mapping agents to humans at the directory-group level. "That is grossly insufficient. You want to have fine grain context. Like I said, it's not access to Snowflake. It's access to what column and what data inside Snowflake you need."

The second failure mode is drift. Modern models are relentless goal-seekers, and that persistence cuts both ways. "When you tell them get this done, the underlying models are so powerful now. Even the weaker models are so powerful. They will go find a way to get it done... They will go find the vulnerabilities to bypass the permission to get it done," Gnanasambandam warned. The answer, he argued, is runtime monitoring of the entire interaction chain, compared continuously against policy, with automatic intervention when an agent escalates beyond what its human delegator authorized.

The third is missing data context. Many vendors, he argued, announce splashy integrations with big application platforms while ignoring where the actual risk concentrates. "That's not where the risk lies. Risk lies in sensitive data, so the details matter here... Can you map specific columns and rows in Databricks, Snowflake, Redshift, Oracle... into the agent context and the human context? And if you can't do that, you are going to have gaps and holes."

SailPoint's answer required tearing out two decades of architecture. "We rewrote our underlying data and object model to treat AI identity as a first-class object, because for 20 years, SailPoint had a data model and object model that supported the human identity, and AI identities are fundamentally different," Gnanasambandam said, describing 12 to 18 months of deep engineering work. The result is what he calls a unified lineage: "From human to master agent to sub agent to tool to application to data. That's what I call the steel chain. That is in one data model, one platform."

Why rival identity vendors joined Snowflake's trust framework — and what each side gets out of it

Perhaps the most striking aspect of today’s announcement is the roster. 1Password, SailPoint, Saviynt, Okta, and Aembit compete for overlapping identity and access budgets. Snowflake convinced them to build against a common trust framework anyway.

"The reason we brought together leaders across the security ecosystem is because no single company can solve the agent security challenge alone. AI agents can't deliver real value if they only operate within the boundaries of one platform," Upadhyay said. His broader thesis frames the whole strategy: "Nobody wants to replace data silos with AI silos."

Wang offered a pragmatic division of labor: "We bring the trust, and Snowflake brings a system of record." She framed the collaboration as classic defense in depth — "there are data level controls, and there are identity level controls, and so together we can create a much stronger ecosystem play."

There is self-interest in the openness, of course. Snowflake sits atop an enormous concentration of sensitive enterprise data — more than 13,900 customers, by the company's count — and every third-party agent that touches that data through a governed Snowflake gateway deepens the platform's gravitational pull.

As Constellation Research analyst Michael Ni put it when the Natoma deal was announced, in comments reported by CIO.com: data platforms won the analytics era, and whoever governs agents, context, and autonomous actions wins the agentic one. A Forbes analysis of the same acquisition flagged the tension directly, noting that a governance layer living inside Snowflake risks pulling MCP's openness back toward a single vendor's control plane — attractive for Snowflake-standardized shops, more awkward for genuinely multi-vendor agent stacks.

Analyst forecasts show agent governance is now a trillion-dollar race against the clock

The urgency behind today’s announcement is not manufactured. Gartner predicts that by 2027, governance gaps discovered only after production incidents will force 40% of enterprises to demote or decommission autonomous AI agents — with analysts there warning that the greatest risk an agent poses often lies not in its output but in the actions it is empowered to take. IDC, meanwhile, expects more than 1 billion actively deployed AI agents by 2029, executing roughly 217 billion actions per day, and forecasts agentic AI will exceed $1.3 trillion in worldwide IT spending that year. The research firm's analysts now argue agentic platforms should be treated as decision infrastructure, not productivity software.

Against that backdrop, the identity layer is becoming the contested ground, and every major vendor — Salesforce, ServiceNow, Microsoft, Google, Okta — is racing toward the same runtime-governance chokepoint. Snowflake's differentiator is proximity to the data itself. As Upadhyay put it, security "can't just be an API proxy sitting in front of an LLM. It has to anchor all the way down into the underlying data layer, enforcing zero-copy boundaries, dynamic data masking, and real-time exfiltration safeguards before an agent ever touches a row of data."

The rollout now moves to proving ground. Cortex AI Gateway enters public preview soon, and the five partner integrations enter private preview, a phase Wang described as a deliberate feedback loop — customers on day one get an agent-access broker plus "a full audit log that will show you, for example, what that agent is actually doing," even when an agent deviates from its intent. Gnanasambandam, characteristically, wants enterprises to skip the easy demos entirely, urging customers to bring loan-origination workflows spanning three clouds and ten applications, half of them mainframes: "Give us that complex use case and bring anyone on and do it in your context, and we will take the challenge with anyone in the world."

That confidence — from a field of rivals, no less — captures what makes this moment unusual. The companies that spent the last decade fighting over who verifies human identity have concluded, more or less simultaneously, that the next decade belongs to whoever can verify the machines acting on our behalf. Upadhyay distilled the wager into a single line: "The future of AI won't be won by the organizations with the most agents, but by the organizations that can govern those agents with the most trust, visibility, and control." In the agentic enterprise, it turns out, trust isn't the guardrail. It's the product.

The Model Context Protocol, the open standard that has quietly become the connective tissue between AI agents and the world's software, is getting its largest update since Anthropic released it twenty months ago — a sweeping architectural revision that its maintainers and backers say finally makes agentic AI ready for massive enterprise production deployments.

The update, released today under the stewardship of the Agentic AI Foundation (AAIF), a directed fund under the Linux Foundation, finalizes MCP's transition to a fully stateless architecture, hardens its authentication model against a known class of attacks, establishes a formal 12-month deprecation policy, and graduates two headline capabilities — interactive server-rendered interfaces and long-running asynchronous tasks — into official protocol extensions.

The changes may sound arcane. Their consequences are anything but. According to the announcement, running MCP at scale has historically required "sticky routing" or shared state to maintain continuity across sessions — an operational burden that made large production deployments complex even when the underlying capabilities were simple. The new release removes that bottleneck entirely, letting organizations run MCP servers behind standard load balancers using the Kubernetes and cloud-native DevOps tooling they already operate.

"Some people jokingly call it a v2, and I think in spirit that's accurate," David Soria Parra, MCP's co-creator and a lead maintainer at Anthropic, told VentureBeat in an exclusive interview. "It's probably the biggest change we've ever made to the protocol, and with that, it's a big step up in maturing it for use by really big players."

Why stateless architecture is the key to running AI agents at enterprise scale

To understand why the industry's largest companies pushed for this release, it helps to understand what was broken. Under the old design, an MCP client — the AI application making requests — had to maintain a persistent session with a specific server instance. In modern cloud environments, where fleets of interchangeable compute nodes spin up and down behind load balancers, that requirement was poison. If the specific server holding your session state disappeared, your agent's work disappeared with it.

"Before, you needed to have a session store and manage session IDs — and if one of your compute pods went down, all of a sudden the requests would start failing," said Den Delimarsky, a lead maintainer of the protocol, in an interview with VentureBeat. "That's not going to be a problem with the new version of the protocol. That's a huge unlock, and it's one we collaborated with folks across many companies to put together."

Mazin Gilbert, executive director of the AAIF and a veteran of Google and AT&T, framed the change in historical terms — comparing it to the architectural decision that made the web itself possible. "That stateless capability enables your MCP client to speak to a load balancer that connects with any server. You don't need the stickiness," Gilbert told VentureBeat. "You could not have the internet we have today if my browser couldn't speak to any website — with any server supporting that connection. You can switch between servers behind a load balancer."

Gilbert said the constraint had become the primary blocker for companies trying to move AI agents from pilots into production. "I've come across companies who are deploying tens of thousands of agents, and you cannot do that without having to go in this direction," he said. Crucially, he argued, the obstacle was never the AI itself: "It wasn't the technology, it wasn't the business case, it was really these fundamental changes that were required."

The tension is nearly as old as the protocol. A public design discussion opened by MCP co-creator Justin Spahr-Summers on GitHub in December 2024 — just weeks after launch — flagged that MCP's long-lived, stateful connections were limiting for serverless deployments, and sketched three possible paths forward, including the fully stateless option the protocol has now largely embraced. 

Engineers from Vercel, Cloudflare, Shopify, and Amazon weighed in over the following months, a preview of the multi-vendor collaboration that would eventually define the project. The core maintainers formally committed to the direction at a December 2025 meeting on the future of MCP transports, according to the announcement.

The trade-offs of removing state from the Model Context Protocol

Protocol design is a game of trade-offs, and the maintainers were unusually candid about what this one cost. First, payloads get bigger. "A lot of the state doesn't disappear, but it's moved back and forth with the server on the wire, at the actual transport layer," Soria Parra explained. "You get bigger payloads in return for statelessness — but luckily they're very compressible and very well understood, and still fairly small in comparison to an HTTP request on the web."

Second, a handful of rarely used capabilities are gone or narrowed. Out-of-band server logging — where a server could push informational log messages to a client at any moment — no longer works in the new model. The team did its homework before cutting it: "As part of the whole exercise, we scraped all of GitHub and looked at who is using it — and it's basically nobody," Soria Parra said. Those affected amount to "probably a handful of people — quite literally a handful of people."

He even allowed himself a moment of engineering self-deprecation. "I'm sad that things I thought were useful turned out not to be useful," he said. "I think one of the bigger trade-offs was more about my ego than any actual limitation of the protocol."

Delimarsky argued the shift is less a removal of state than a deliberate transfer of responsibility. "With statelessness, we did shift the responsibility of creating and managing state to the developers — but very intentionally so," he said. Under the old protocol, "a lot of folks had a hard time understanding: Do I need to use this? Where do I use this? How do I use this? Removing that burden basically says: look, now you can manage state in the way that makes sense for your environment."

For most developers, migration should be nearly painless, because the vast majority of the ecosystem builds on official SDKs in TypeScript, Python, C#, Rust, Java, and other languages, which will absorb the changes. "One of the key things we constantly do is double-check that the upgrade path is minimal — to the point where any model in the world will probably one-shot it for you," Soria Parra said — a telling remark in itself, reflecting an era in which protocol maintainers now design migrations to be trivially executable by AI coding assistants.

How a 12-month deprecation policy gives enterprises the stability guarantee they demanded

Perhaps the most enterprise-flavored feature of the release isn't code at all. It's a policy. The new formal deprecation framework guarantees developers a minimum of twelve months between a feature's formal deprecation and its earliest possible removal — the kind of stability contract that lets a Fortune 500 engineering organization commit to a specification without fearing silent breakage.

The number wasn't picked arbitrarily. "We consulted with folks like Google, Microsoft, and Amazon to find out: in your deployment environment, what's the right path for making these kinds of changes?" Delimarsky said. "Twelve months seemed like the reasonable middle ground." He stressed that features are not being torn out on a whim: "It's not about ripping stuff out of the protocol just because we don't like it. There's a very, very strong industry pull behind these changes."

Soria Parra added that the maintainers' own telemetry supports the figure — most of the ecosystem upgrades within six to eight months — and stressed that the window functions more as a listening period than a countdown clock. "It just says that in 12 months we are open to remove it, but both Den and I can change our minds based on feedback," he said. "I think it's more of a feedback period than a definite period."

Gilbert sees the policy as one leg of a three-legged stool of enterprise trust, alongside open standards and stateless scale. "There are companies deploying things at a smaller scale, but they're slowed down because of MCP's authorization gap, because of identity, because of — do they trust the deprecation policy? Things could change basically any day," he said. Those companies, he argued, "are going to benefit not because of the statelessness. They're going to benefit because of the security."

New authentication hardening closes OAuth mix-up attacks before hackers could exploit them

The release also ships significant authorization hardening, aligning MCP's auth specification with how OAuth 2.0 and OpenID Connect are actually deployed in practice. Most notably, the protocol now enforces mandatory validation of the issuer (iss) parameter — a protocol-level defense that, according to the announcement, closes an entire class of so-called mix-up attacks, in which a client can be tricked into associating an authorization response with the wrong identity server.

Was anyone actually attacked? No, Delimarsky said — this was preventive engineering, not incident response. "This is not something that is gated in any existing vulnerabilities or active exploitation," he said. "This is more of us engaging directly with the security community." The philosophy, he explained, is to borrow rather than invent: "MCP as a protocol is very much establishing the pattern of: we do not want to reinvent the wheel, but we also want to be at the forefront of a lot of the security innovation."

That posture is most visible in the new Enterprise Managed Authorization extension, developed in close collaboration with identity provider Okta, which lets organizations make their corporate identity provider the authoritative gatekeeper for MCP server access. "If I'm somebody that manages tens, hundreds of MCP servers for my organization, I want to make sure that I enforce some level of common governance, where folks auth with their corporate credentials and not their personal credentials, so that the client doesn't send data to sources that are unauthorized," Delimarsky said. Okta bootstrapped the underlying open standard, he noted, and the maintainers then worked "to make sure that it's adopted ecosystem-wide, and it's not something that is specific to only one vendor or provider."

More is coming: Delimarsky said proposals are already on deck for demonstrated proof-of-possession and workload identity federation — capabilities requested by security teams running MCP in production. Gilbert connected the work to a broader maturation: "MCP has now bridged that gap with these authorization protocols, so it's basically now becoming what we call enterprise ready, versus an open lab sort of experiment."

MCP Apps and Tasks become official extensions, pushing AI agents beyond text responses

Two capabilities graduate to official extension status in this release, taking advantage of a new framework that lets extensions evolve on their own timelines, independent of the core specification — a structural choice that lets the protocol grow without bloating its core.

MCP Apps allows servers to ship rich, interactive, server-rendered user interfaces directly into AI clients — moving agent output beyond walls of text toward dashboards, forms, and visualizations, and dramatically accelerating development of user-facing agentic applications, according to the announcement. MCP Tasks tackles the reality that not every tool call finishes in one round trip. Instead of holding fragile, long-lived connections open while a batch job or heavy computation grinds away, servers now return a durable task handle; clients can disconnect, crash, restart, and resume polling. "You've been processing some audio for a podcast or a video — it can notify back the client and say, hey, the task is done. You don't need to wait and keep the stream open," Delimarsky said.

A third addition, multi-round-trip requests, lets servers and clients negotiate back and forth within a single logical operation. "It's not just a one-shot — over the stream, get the input and you're done," Delimarsky said. "You can actually interact, server to client, to get the right parameters to execute an action."

Soria Parra emphasized that these capabilities emerged from the same source as the architectural overhaul: heavyweight production users. "This is a version that came together by some of the best distributed systems experts at Microsoft, Google, and others coming together and working on this for their specific needs — and the needs of the industry at large," he said.

How independent is MCP from Anthropic under Linux Foundation governance?

Anthropic created MCP in November 2024 and donated it to the newly formed AAIF under the Linux Foundation in December 2025, alongside founding projects from Block and OpenAI. Seven months later, the independence question still hangs over the project — and both sides addressed it head-on.

Soria Parra was disarmingly direct about the residual power he holds. As lead maintainer and Anthropic employee, "I do have veto rights, technically," he acknowledged — "but I think we have never actively used it in any kind of discussion." 

The core maintainer group now spans Anthropic, Microsoft, OpenAI, Google, and Amazon, with contributions from companies like Block, and key decisions "are usually unanimous," he said. "Technically we have a lot of influence; de facto, we're not exerting any of it." He added that governance will progressively broaden: "As the project progresses, we will increasingly move to more different governing structures that include more and more people."

Gilbert, who has helped stand up multiple foundations during his time working with the Linux Foundation, offered the numbers behind the neutrality claim. The AAIF has grown from roughly 40 members at its December inauguration to 240 today — "the fastest growing foundation" in Linux Foundation history by membership, he said, "signing up one member every day."

Anthropic's share of contributions, by his estimate, has fallen below half. "Holding control of a project doesn't make it an open standard," Gilbert said. "You have to let go. You have to contribute, and you have to grow the pie and the community. And Anthropic has done an incredible job doing exactly that."

Notably, the foundation's membership has expanded well beyond tech vendors into retail, finance, and telecom companies — adopters who, Gilbert says, "are no longer just deploying the protocols. They want a voice, and they want to be at the table to influence the protocol from the get-go, and that's something we have not seen before." The roster now includes CERN and, tellingly, Consumer Reports — "because somebody has to defend consumers when this internet of agents comes alive."

Keeping one global AI agent standard amid US-China technology tensions

The AAIF is betting that neutrality can hold even amid geopolitical friction. The foundation will host AGNTCon and MCPCon events this fall in Shanghai, Tokyo, Amsterdam, and San Jose, with additional events planned in South Korea, Nairobi, and Toronto, and Gilbert said he is personally investing in growing membership across Asia and India, where he sees underdeveloped growth markets for the foundation.

His answer to the geopolitics question was emphatic model-agnosticism. "We're completely agnostic to what the model is, whether the model is Kimi, or Gemma, or a frontier model from Anthropic, or from anybody," he said. "Every model will have to support MCP — whether it is a Chinese model or whether it is a U.S. model, it doesn't matter. The protocols must be open, standardized."

The logic is economic as much as diplomatic. Enterprises, Gilbert argued, increasingly pick models "left, right, and center" based on the task at hand — and no model, regardless of national origin, "can provide value to an enterprise 500 customer company unless you have the protocols open, standardized." In his telling, the foundation exists precisely to provide neutral ground: a place "where competitors who compete furiously during daytime" can "come to a neutral room and debate, converse, align, consolidate, and drive open standards of how the Internet of Agents will evolve."

That framing echoes his favorite historical analogy. HTTP earned global trust, he said, because of three things: an open standard, stateless scalability, and neutral governance under a standards body. "If I were a Fortune 500 company looking at how I trust the internet, I'd need those three things to fall into place — and they were not in place a year ago. They were not in place even six months ago. But they are in place today."

What 250 million weekly SDK downloads reveal about the future of agentic AI

The scale of what's now riding on this specification is difficult to overstate. Soria Parra said SDK downloads have doubled in the past six months, reaching roughly 250 million per week — "which is just insane numbers."

For context, Anthropic reported 97 million monthly downloads across just the Python and TypeScript SDKs when it donated the protocol in December 2025. Delimarsky pointed to that same adoption curve as his preferred success metric going forward: "There is certainly a certain inflection point where this is no longer just an open source project. This is a substrate for a lot of the agentic workflows that we see across enterprises, across startups, across all sorts of companies."

Success, the maintainers say, will be measured in server counts on the new specification, in feedback flowing through working groups, GitHub discussions, and the project's Discord — and in whether the biggest drivers of the changes, Microsoft and Google among them, ship on it. "They are effectively the ones who have been driving a lot of the changes," Soria Parra said. "Every early indication we have — it looks very, very positive."

Both maintainers closed on the same note: this release belongs to no single company. "If you look back 18 months ago, when it was an Anthropic-only project, and then 12 months ago, where there was a lot of engagement — now it's a truly global community," Soria Parra said. "I'm incredibly proud of what they have worked together." Delimarsky, "being very unoriginal," seconded him: the release "would not be possible without a large community of folks that are also volunteering a lot of their own time in making MCP successful."

Gilbert, meanwhile, is already looking past this release — toward how MCP interlocks with the AAIF's newly announced Agent Gateway project for traffic management and policy enforcement, and toward agentic commerce, where MCP serves as the discovery layer letting merchants expose products and services to AI agents. The web took thirty years to become invisible infrastructure that billions trust without thinking. By Gilbert's reckoning, the internet of agents is "in its first, second year" — and as of today, it finally has plumbing built to carry the load.

Chinese AI startup Moonshot AI, creators of the increasingly famous "Kimi K" family of powerful, open AI models, today released the full weights for its largest and most performant version yet — Kimi K3. But enterprises evaluating the model should read the attached custom Kimi K3 usage license as carefully as the benchmark charts.

VentureBeat previously covered Kimi K3 when it debuted through Moonshot's hosted API earlier this month, including its 2.8 trillion-parameter architecture, one million-token context window and frontier benchmark performance. Today's announcement completes that rollout with the release of the full model weights, a 47-page technical report documenting its training innovations and obstacles, and much of the infrastructure required to run the model independently.

That includes the complete 2.8 trillion-parameter Mixture-of-Experts model, inference infrastructure, optimized attention kernels, MoE communication libraries and deployment components aimed at researchers and enterprise developers who want to self-host the system rather than consume it exclusively through an API.

Moonshot is also releasing implementation support for ecosystems including vLLM and SGLang, alongside a technical report detailing the architectural innovations behind the model, including Kimi Delta Attention, Attention Residuals and Stable LatentMoE. Together, those techniques underpin what the company describes as the world's first open 3T-class model, activating 104 billion parameters from a pool of 896 experts while supporting native multimodal reasoning and a one million-token context window.

While Kimi K3's license grants broad rights to developers and even enterprises to download, modify and deploy the model for commercial purposes — a win for those seeking low-cost, frontier-level AI they can control and run offline — it also imposes some added obligations on larger companies and AI service providers not found in traditional open-source licenses like Apache 2.0 or MIT.

The key restrictions enterprises should understand

Here's the text of the new Kimi K3 License in full:

Permission is hereby granted, free of charge, to any person (the "Licensee") obtaining a copy of this software — including the model weights, parameters, configuration files, inference and training code, and associated documentation (collectively, the "Software") — to deal in the Software without restriction. This includes, without limitation, the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software; to run, deploy, fine-tune, or otherwise modify the Software and create derivative works from it; and to permit persons to whom the Software is furnished to do so, in each case subject to the following conditions:

1. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Licensee's use of the Software must comply with applicable laws and regulations.

2. "Model as a Service" means giving a third party access to language model inference or fine-tuning (e.g., via API) in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data. This does not include (a) end-user products with model capabilities solely embedded within specific features or harnesses, or (b) mere relaying of requests to models hosted by others.

If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars (or the equivalent in other currencies) in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose.

3. If the Software (or any derivative works thereof) is used for any of the Licensee's commercial products or services that have more than 100 million monthly active users, or more than 20 million US dollars (or equivalent in other currencies) in monthly revenue, "Kimi K3" must be prominently displayed on the user interface of such product or service.

4. The requirements set forth in Sections 2 and 3 do not apply to: (a) internal use of the Software, defined as any use that does not make the Software, its outputs, or its underlying capabilities available to third parties; or (b) any use of the Software accessed through Moonshot AI's official products or certified inference partners.

The most significant clause is 2., as it requires a separate commercial license from companies earning $20 million in annual revenue and operating what Moonshot calls a "Model as a Service," which it defines as "giving a third party access to language model inference or fine-tuning (e.g., via API) in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data" but not " end-user products with model capabilities solely embedded within specific features or harnesses" or "mere relaying of requests to models hosted by others."

That would seem to allow for free use of the model for most non-tech focused enterprises: banks and consumer brands seeking to use it as a front-end chatbot or customer service agent should be fine, since they're not using Kimi K3 as a "Model as a Service." But firms like they hyperscalers or startups offering model training tools might fall under the commercial license terms.

The wording is further notable because it does not limit the revenue calculation to products built on Kimi K3.

Instead, it references the aggregate revenue of the licensee and its affiliates, potentially bringing even smaller companies that are part of larger parents into the requirement that they must commercially license the model from Moonshot, pending the parent firm generates revenue of $20 million or more per year as is using it somewhere, in some capacity, as a "Model as a Service."

Regardless of this requirement, in clause 3, the license also requires attribution once a commercial deployment reaches significant scale:

"If the Software... is used for any of the Licensee's commercial products or services that have more than 100 million monthly active users, or more than 20 million US dollars in monthly revenue, 'Kimi K3' must be prominently displayed on the user interface."

For enterprise software vendors, AI copilots and consumer applications, that branding requirement may prove just as significant as the revenue threshold. Companies that typically abstract away the underlying model may instead need to disclose it directly within their products.

But, if your enterprise is sticking to using Kimi K3 internally as an employee tool for information retrieval, creating spreadsheets and documents, or answering employee questions, Moonshot offers a significant carve out, stating that clauses 2 and 3 "do not apply to: (a) internal use of the Software, defined as any use that does not make the Software, its outputs, or its underlying capabilities available to third parties."

Developers immediately zeroed in on the license

The licensing provisions quickly became one of the dominant topics of discussion following the release of the model weights.

AI researcher Nathan Lambert, previously the co-leader of the Olmo family of open models at AI startup Ai2, summarized the issue in a post on X:

"Kimi K3 license. It's inspired by MIT but distinctly non-commercial, where any company making over $20M/yr must get a specific commercial deal (and display Kimi K3 if over 100M users or $20M/mo revenue)."

Lambert's assessment reflected what many developers noticed as they dug into the newly published license: while Kimi K3 offers unrestricted access to the model weights for researchers, startups and many enterprises, commercial obligations become significantly more complex for larger organizations.

The broader community reaction was largely positive toward the release itself. Developers praised Moonshot for publishing not only the weights but also supporting infrastructure, including attention kernels, MoE communication libraries and agent tooling, viewing the release as a significant contribution to the open-weight AI ecosystem.

Others highlighted the rapid pace of ecosystem support, with inference projects such as vLLM and SGLang, along with cloud providers and infrastructure partners, moving quickly to support Kimi K3 deployments.

At the same time, discussion centered on two practical caveats. One was licensing: many developers argued the model is more accurately described as open weight than fully open source, given the commercial conditions attached to larger deployments. The other was operational.

At roughly 1.5 TB of model weights, Kimi K3 remains a system aimed primarily at well-resourced organizations capable of operating large-scale inference infrastructure, even as reports emerged of successful deployments on clusters of consumer RTX 5090 GPUs.

Not the first to customize open AI licensing

Moonshot is far from the first frontier AI developer to embrace an "open, but not completely open" licensing strategy.

Meta's Llama family, for example, has long been distributed under its own community license requiring a commercial agreement for those building with the model and exceeding 700 million monthly users, rather than a traditional open-source software license. Other frontier model developers have likewise adopted bespoke licensing terms governing redistribution, commercial use or attribution.

Kimi K3 follows that broader trend, albeit with a different mechanism. Rather than broadly restricting redistribution, Moonshot ties certain commercial rights to company scale.

Organizations operating a Model-as-a-Service business above specified revenue thresholds must negotiate a separate commercial agreement, while the largest commercial deployments must visibly attribute Kimi K3 within their products.

For enterprises, the practical implication is that "open weights" and "open source" are becoming increasingly distinct concepts. Downloading and modifying frontier models may be straightforward; understanding the legal conditions attached to commercial deployment increasingly is not.

What enterprise leaders should do next

For CIOs, chief AI officers and engineering leaders, the first step is to determine how the organization intends to use Kimi K3 before evaluating its technical performance.

If the model will remain entirely inside the organization—for example, supporting developers, researchers, legal teams or internal productivity workflows—the published license appears substantially more permissive. Those deployments may qualify as internal use under Moonshot's terms, avoiding the commercial licensing provisions that apply to customer-facing AI services.

Organizations planning to build products on top of Kimi K3 should take a different approach.

Legal, engineering and product leaders should determine whether the planned deployment constitutes "Model as a Service" under the license, whether the company or its affiliates exceed the $20 million revenue threshold, and whether future growth could trigger the requirement to negotiate a commercial agreement with Moonshot.

Companies expecting products to reach more than 100 million monthly active users—or more than $20 million in monthly revenue—should also evaluate the license's attribution requirement and how it fits with existing branding, contractual commitments and white-label offerings.

More broadly, Kimi K3 illustrates a transition taking shape across frontier AI. As the industry's most capable models increasingly become available as downloadable weights instead of exclusively through hosted APIs, enterprises will need to evaluate licensing terms with the same rigor they apply to benchmarks, security reviews and infrastructure planning.

The next competitive battleground may not simply be whether AI models are open or closed, but the increasingly nuanced legal frameworks that determine who can commercialize them, under what conditions and at what scale.

Microsoft opened a new front in the AI security wars on Monday, unveiling its first custom-built cybersecurity model and a sweeping agentic defense platform — and making an argument that could reshape how enterprises buy AI: the future belongs not to the biggest model, but to the cheapest one that's good enough, routed intelligently.

The company announced MAI-Cyber-1-Flash, a compact security model developed in-house by its Microsoft AI (MAI) division, embedded inside MDASH, Microsoft's multi-agent harness for finding and fixing software vulnerabilities. Together, the company says, the system scores 96% on CyberGym — a benchmark measuring how well AI systems reason over large codebases to find real vulnerabilities — beating frontier models including Mythos, Gemini, and GPT, while cutting costs roughly in half compared to Microsoft's own current production configuration.

Alongside the model, Microsoft introduced Project Perception, an agentic security system that coordinates "red team" agents that hunt for paths to compromise, "blue team" agents that investigate and triage risk, and "green team" agents that remediate and harden defenses. Project Perception enters public preview on August 3.

In a wide-ranging interview with VentureBeat, Microsoft AI CEO Mustafa Suleyman made clear the company sees Monday's announcement as the opening move in a much longer campaign.

"We really do have a pretty significant data and harness and expertise moat, and that is enabling us to train models which are faster, better, cheaper, and I think this is genuinely the tip of the iceberg," Suleyman said. "We haven't been working on this for long. The next model is going to be pretty phenomenal."

Inside the 90/10 architecture that still depends on OpenAI's GPT-5.4

The most technically revealing detail in the announcement is not the model itself but how Microsoft deploys it. MAI-Cyber-1-Flash was designed to handle up to 90% of security tasks efficiently, while MDASH escalates the remaining 10% of exceptionally difficult problems to a larger frontier model — which, notably, is OpenAI's GPT-5.4. In other words, Microsoft's flagship security AI still leans on its longtime partner-turned-rival for the hardest work.

Asked to explain that relationship, Suleyman pointed to the harness, the orchestration layer that routes each incoming problem to the right model. "The harness is like a router," he told VentureBeat. "It's kind of like guardrails and a rule set of an organizing logic, which matches queries to... incoming problems to a model that suits the problem." The system has three components, he explained: the harness, the small and fast MAI-Cyber-1-Flash handling the bulk of queries, and GPT-5.4 sitting alongside as "just a generalist coding model."

Pressed on how a system reliant on OpenAI's model can outperform frontier competitors, Suleyman argued the performance comes from the whole system, not any single model. "These are very complicated, long, agentic loops which require storing state, drawing on another database, consulting best practice... handing back to a small model, writing a bunch of code, validating that that was correct," he said. "There's like hundreds of steps to solve that, and that's why it's really the system together that delivers the better performance."

And why GPT-5.4 specifically for the escalation tier? Cost, again. "GPT-5.6 is expensive. GPT-5.4 is incredibly good relative to its cost," Suleyman said. "The whole game here is to reduce the costs. Mythos and so on are extremely expensive models... we want to be able to deliver better performance for cheaper. That's what customers want." The arrangement captures Microsoft's evolving posture toward OpenAI: still a customer of the partnership that drew regulatory scrutiny in Brussels and Washington in 2024, but increasingly determined to own the layers of the stack where it believes it holds durable advantages.

Why token costs — not model quality — are becoming the real barrier to enterprise AI adoption

The economics may matter more than the benchmark. Microsoft says the new configuration delivers roughly 50% cost savings against the current MDASH setup, which runs a blend of GPT-5.4, 5.4 mini, and 5.3 codex. In security — an always-on workload processing enormous volumes of signals — token costs compound relentlessly, and Microsoft argues they have become the binding constraint for defenders.

Suleyman frames the cost issue as downstream of a harder physical limit. "The key barrier to adoption is access to chips, and cost is a function of chips," he said. "No matter how much money you've got, there's actually a limited supply of chips. Then trying to squeeze more model output on fewer chips is clearly super valuable."

He also described a broader enterprise backlash against frontier-model pricing. Companies initially maxed out on the best available models, he said, but "then they realize they're sort of paying... a phenomenal amount of money, and people are absolutely token maxing everywhere across their business. So there's a massive pushback to reduce cost everywhere."

That positions Microsoft to ride a market trend rather than fight it. Cost-efficient, near-frontier models have proliferated over the past year — from xAI's recent Grok release to a wave of Chinese models built on the same premise — and Microsoft is betting that as a platform company it can align itself with enterprise cost pressure. "The top model providers want you to use the most expensive model continuously, whereas because we are a platform, we're on the side of the enterprise," Suleyman said. "There's no point asking... Mythos what the capital of France is."

The 100-trillion-signal data moat Microsoft says no competitor can replicate

Every AI lab claims differentiation. Microsoft's claim in security rests on something genuinely hard to copy: telemetry. The company processes more than 100 trillion security signals daily — a figure consistent with its 2025 Digital Defense Report, which also cited 4.5 million new malware files blocked and 5 billion emails screened per day — and draws operational insight from 1.6 million customers.

"We have trillions and trillions of data points going back decades," Suleyman said. "It is, I think, the largest longitudinal cybersecurity dataset around," in part because Microsoft's customer base includes governments "who have been consistently attacked for years, and we have been consistently attacked." Asked directly whether this constitutes an advantage no competitor can match, Suleyman didn't hedge: "That is definitely a moat for us. Both the data and the expertise, and just the experience in the institution of going through that process."

The strategic logic is that cybersecurity functions as a live reinforcement-learning loop: defenders act, outcomes are observed, models improve. Microsoft argues that connecting actions to outcomes — what was exploited, what was contained, what was blocked — yields training signal that pure model labs simply cannot buy or manufacture.

There is real substance here, but the usual caveats apply. The CyberGym results come from Microsoft's own evaluation, the fine print shows the headline "96%" is actually 95.95%, and vendor-run benchmarks that pit an entire tuned agentic system against competitors' base models are not apples-to-apples comparisons. What Microsoft has measured is a full harness-plus-models configuration against what customers might otherwise assemble — arguably the commercially relevant comparison, but not a controlled model-versus-model test.

The dual-use dilemma: how Microsoft plans to keep a vulnerability-hunting AI out of the wrong hands

A model built to find challenging vulnerabilities in complex codebases is, by definition, a model that could find vulnerabilities for attackers. This is not a theoretical concern. Microsoft's own threat intelligence team, in joint research with OpenAI published in February 2024, documented nation-state actors from Russia, North Korea, Iran, and China probing large language models for reconnaissance, scripting, and vulnerability research. Its 2025 Digital Defense Report went further, warning that AI agents could eventually automate the entire attack lifecycle.

Suleyman said Microsoft is gating access accordingly. "We're very strict about who gets access to the model, and we're very careful about that," he said. "We constantly monitor the API and usage." An approved user, he added, "has to be seen to be having good intent, but also have technical competence." The rollout will be deliberately staged: "It's not going to be thousands next week. There will be tens, and then hundreds, and then thousands."

Microsoft says the model was evaluated by its AI Red Team, subjected to automated and expert-led adversarial exercises, and independently assessed by a third party, with deployment wrapped in tenant isolation, auditing, and sandboxed execution environments with no internet access.

Suleyman also offered a candid acknowledgment of Microsoft's positioning relative to the bleeding edge — one that doubles as a pitch to risk-averse buyers. "Even though we might be a few months behind the absolute cutting edge at any given moment... it matters that we're doing it very carefully and thoughtfully, and we have a track record of doing that," he said. For a company that spent 2024 absorbing hard security lessons — from delaying its Recall feature over privacy concerns to convening an industry summit after the CrowdStrike outage disabled some 8.5 million Windows devices — that trust-first framing is both strategy and necessity.

What Microsoft's superintelligence roadmap signals about the future of enterprise AI

Suleyman described a rapidly accelerating MAI roadmap, roughly nine months after Microsoft stood up its superintelligence team. "We have the compute that we need. We certainly have the data we need. We have the talent," he said. "Our momentum is accelerating rapidly." The top enterprise demand he's hearing is for "agents that can produce arbitrary code to solve whatever problem they direct them at," as vibe-coded internal tools graduate from experiments into production. The next phase, he said, pulls voice, transcription, image, and coding models "all integrated into the same harness."

Notably, Suleyman expressed skepticism about the industry's default assumption that everything eventually converges into one giant unified model. "It remains to be seen whether one giant model that is fully multimodal is actually able to deliver additional transfer learning benefit because of the integration," he said, "or whether it's just a big lumbering expensive giant."

That skepticism is the through line of the entire announcement. Microsoft is wagering that the unit of competition in enterprise AI is no longer the model at all — it's the system: the router, the specialized small models, the frontier fallback, and the proprietary data feeding the loop. In security, where Microsoft controls both the telemetry flowing in and the products that act on it, that wager is at its strongest. Whether it holds in domains where the company's data advantage is thinner remains the open question hanging over the MAI roadmap.

For now, though, Microsoft has offered the industry a preview of how it intends to fight the next phase of the AI race: not by building the biggest brain, but by building the best machine around it. As Suleyman put it, this is the tip of the iceberg — and Microsoft is betting everything on what sits below the waterline.

If your business depends on people clicking through to web pages, the last two years have been brutal. Pew Research Center tracked the browsing behavior of 900 U.S. adults and found that when Google shows an AI summary, users click a traditional result just 8% of the time, roughly half the 15% rate when no summary appears. Links cited inside the AI answers themselves fare worse: users click on them only about 1% of the time.

This has had a huge impact on publishers. Chartbeat data reported by Axios shows page views from Google Search fell 34% across its publisher network between December 2024 and December 2025, and small publishers have lost roughly 60% of their search referral traffic over two years. Business Insider's organic search traffic dropped 55% over three years, and some smaller publishers have already shut down. Chatbot referrals, meanwhile, still account for less than 1% of publisher page views despite growing more than 200% in a year.

The story in publisher circles has been simple: AI is killing the web. But recent developments show the reality is more nuanced.

Machines are reading more than ever

Similarweb's 2026 Generative AI Landscape report reveals that while AI platforms send fewer humans to web pages relative to the answers they generate, the AI systems themselves are consuming the web at an accelerating rate in the form of searching the web on the user’s behalf to answer their questions. The share of ChatGPT answers containing live web citations grew more than fivefold in under a year, reaching 6.8% of all answers by May 2026. In some categories like travel, it is as high as 22.6%.

Every major AI search product fetches live pages from search indexes and synthesizes answers from them, which means the quality of AI answers depends directly on the health of the content layer underneath. As Lily Ray, VP of SEO and AI search at Amsive, puts it in the Similarweb report, if your organic visibility dips, your AI search visibility follows, because the models are less likely to find your content.

This has created a troublesome feedback loop. AI answers are built on an information supply chain whose funding model, ad-supported clicks, is collapsing primarily because of AI answers. A critical question for the continued viability of the open web is whether some alternative business model will work, and what the model will be.

The replacement economy is forming inside the chat

There is some early data showing where things may be going. Following ChatGPT's May 7 search update, which surfaced prominent clickable brand links inside answers, referral traffic from ChatGPT surged by 157% in a week. But the shape of that traffic changed: the share of referrals landing on homepages more than doubled, from roughly 25% to nearly 60%.

Traditional search sent users to specific articles and deep pages tied to specific queries. AI referrals increasingly deliver a pre-informed visitor to a brand's front door. The chatbot does the researching and comparing; the human arrives ready to act. Similarweb's data shows AI-recommended brands receive two to four times as many subsequent visits as competitors that were not recommended.

Money follows the behavior. Sponsored results appeared in 26% of U.S. desktop ChatGPT conversations in June 2026, up from 14% just a month earlier, per Similarweb's ad intelligence data. Two-thirds of those ads appear after the second prompt, targeted on conversation context rather than a keyword. Click-through sits around 0.50%.

The traditional search engine keyword auction is being replaced by something new: paid placement inside a conversation, targeted on accumulated context. That is a direct challenge to the auction Google has run, and dominated, for two decades.

Google's monopoly meets a new competitor

Google is not a bystander here; it is simultaneously the incumbent being disrupted and one of the largest players in the disruption. AI Overviews now appear in a growing share of Google searches, more than 40% by May 2026 per Similarweb, and visits to Google's conversational AI Mode have climbed steadily since launch. Google is cannibalizing its own click economy rather than ceding the territory.

But the ground was already shifting under Google’s core business. eMarketer projects Google's share of U.S. search advertising will fall below 50% in 2026, the first time since roughly 2004. The biggest chunk of that lost share is going to Amazon, whose sponsored product searches count as search advertising and which are growing three times as fast as Google's. Conversational ads are barely a rounding error in that accounting right now, but they open up a second front in a war Google has got used to not needing to fight.

Meanwhile, more structural shifts are coming for Google. A federal court entered final judgment in the DOJ search antitrust case in December 2025, imposing remedies that bar exclusive default agreements and require Google to share search data with qualified competitors. Google appealed in January 2026; the DOJ cross-appealed seeking stronger remedies. However the appeals resolve, the de facto arrangement that made Google the web's tollbooth, defaults everywhere and a closed index, is ending just as conversational advertising is changing the landscape.

The competitive landscape that results is genuinely new. OpenAI, Google, Perplexity, and Microsoft are now competing not just for users but for the advertising demand that funded the open web, and none of them, including Google, controls the new surface the way Google controlled the old one.

Does conversational advertising help or hurt the open web?

It’s not clear whether this new model helps or hurts the web. The web as a destination for human attention is shrinking, and the ad-supported publishers built for that web are in real trouble. The web as a machine-readable substrate is growing in importance, and a new referral and advertising economy is forming that routes value to brands rather than to content pages.

The problem for publishers may be that they are powerless to influence the outcome. Ahrefs, analyzing over a billion data points across its studies, found that 67% of ChatGPT's most-cited sources are things marketers cannot influence: Wikipedia alone accounts for nearly 30%. And 28.3% of ChatGPT's most-cited pages have zero Google organic visibility, suggesting the retrieval layer is only partially tethered to traditional search, a complication for anyone assuming SEO success translates cleanly.

Your website needs to be rebuilt for the new way people find it

According to three independent datasets, in the new world, the pages AI systems cite and the pages AI systems send humans to are different pages doing different jobs. That’s a big change, and most teams are still optimizing for the old world.

Similarweb's data shows 65% of ChatGPT-cited URLs sit two or three folders deep in a site, while 58.8% of referral traffic lands on homepages. Ahrefs found the same split in its own analytics: more than 80% of its AI referral traffic goes to its homepage, product pages, and free tools, not its extensive editorial content. And a Previsible analysis of 6.77 million AI-referred sessions found a third destination: 28.8% of ChatGPT referrals land on internal site search pages, a navigation surface most publishers have long neglected precisely because Google searches were doing it for them.

The right action to take is to audit your search traffic patterns. Pull your AI referral logs and whatever citation data you can access, and map which pages are being quoted as evidence versus where visitors actually enter. If it looks like you’re in the new world, there are three clear things to do:

• Deep pages, documentation, comparisons, and benchmarks should be structured to be citable: specific claims, clear headings, and descriptive URLs (Ahrefs found pages with natural-language URL slugs get cited at 89.78% versus 81.11% without).

• The homepage should be rebuilt for a visitor who arrives with context from a conversation rather than from a blue link. They already know you have what they need, get them to it as quickly as possible.

• And internal search, a neglected feature on most sites, is now an acquisition surface that deserves real UX investment.

There’s a lot that’s still unknown or in flux here. But the underlying shift is confirmed by every independent source that has looked: the click economy is not coming back, and the entities that learn to be quoted by machines and to convert the humans those machines send will own whatever the web becomes next.

The same attacker broke into the same internet-facing Langflow server twice, and the second time brought ransomware built to destroy trained AI models. Sysdig's Threat Research Team documented the first campaign on July 1 and the second on July 20. The entry point never changed, but the payload changed completely.

Both ran through CVE-2025-3248, a missing-authentication flaw in Langflow's code-validation endpoint that lets anyone reaching the server execute Python on it. In the first, the agent improvised, encrypting 1,342 Alibaba Nacos configuration items with MySQL's own encryption function and dropping the tables. In the second, it staged ENCFORGE, a compiled Go binary sweeping roughly 180 file extensions.

ENCFORGE was built for AI assets, not adapted to them

What gives the design away is the extension list. Sysdig found PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, the GGUF format behind most local LLM deployment, FAISS vector indexes and training data in Parquet and NumPy.

Generic ransomware picks up model files by accident because it encrypts everything. ENCFORGE names them.

Its flag for appending formats uses LoRA adapters and legacy GGML weights as the example, and an attacker who writes that knows whose machines these are.

Michael Clark, who leads Sysdig's threat research team, framed the objective as destroying "the one thing an organization can't simply restore." ENCFORGE carries no network code. Sysdig found no outbound dial in the binary, no leak site and no payment portal, and the identical Proton Mail contact in both ransom notes ties the campaigns to the crew it tracks as JADEPUFFER. The agent harvested credentials on the way in, but the locker cannot exfiltrate anything, so its only pressure is making files unusable. It encrypts regions of a file rather than the whole file, under AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key, the speed optimization established ransomware families use to ruin large files fast.

Your backup plan probably does not cover model weights

Restoring a database from Friday's snapshot costs a weekend of transactions. Restoring a fine-tuned model costs everything learned since Friday, none of it stored as rows to replay.

Rebuilding one is not a restore job. Sysdig puts direct recovery for a production-ready fine-tuned model between $75,000 and $500,000, reflecting cloud GPU rates across the training runs a usable result requires plus the engineering hours behind them. That is per model, and teams keep several variants on shared storage. If the training data sits on the same host as the weights, recovery is blocked until the dataset is rebuilt. Paying is no way out either. In the first campaign, the encryption key was generated at random, printed to the console once and never saved, which made that payload a wiper wearing a ransom note.

That figure makes the argument fundable. Kayne McGladrey, an IEEE Senior Member who has spent his career in identity security, told VentureBeat that security teams lose these fights by filing the exposure under the wrong heading. Companies "should be focused on business risks rather than some, you know, cybersecurity risk, because if it doesn't affect the business, like a loss or financial loss, in this case, predominantly, then nobody's going to pay any action to it, and they will not budget it appropriately, nor will they adequately put in controls to prevent it," he said. A destroyed model carries a known replacement cost, which is the version of this story a CFO acts on.

Official guidance has not caught up. In May 2025 the NSA's Artificial Intelligence Security Center, CISA and the FBI published "AI Data Security," the most authoritative document on the subject, co-sealed with the U.K., Australia and New Zealand. The three risks it names are the data supply chain, maliciously modified data and data drift. All three ask whether the data can be trusted. ENCFORGE asks whether it still exists.

It built its own escape hatch in five minutes

The delivery failure is where this campaign shows its hand.

After confirming execution, the agent swept the host for cloud keys, connection strings and API tokens, replayed them against internal database and cache services, and found the Docker socket at /var/run/docker.sock, which is functionally root. It then tried to pull the ransomware binary from its command and control server, and the fetch did not land.

Rather than retry, it changed strategy, building six Python scripts through the Langflow channel and converging on a working host escape in five minutes and 24 seconds, each correcting a failure in the one before it. The final script finds the host process ID through the Docker API, copies the binary across the namespace boundary, runs the encryption, then counts the files to confirm it worked. In the first campaign, that same behavior was a failed login diagnosed and fixed in 31 seconds.

The problem got harder and the method held. Sam Evans, then CISO at Clearwater Analytics, put it in budget terms. "In security, it's all about dwell time," he told VentureBeat in an exclusive interview. "If there's a bad actor in your environment and they've been there for a while, your dwell time is increased, therefore the blast radius has increased. Probability of it becoming a material incident is exponentially high."

Mike Riemer, Ivanti's SVP Network Security Group and Field CISO, has watched that pivot become standard. Vendors hardened the front door, he told VentureBeat, so attackers quit knocking. "I can't get through the front door, so let me get somebody his house key, and I can make it through the back door with a house key," he said. Behind it sits whatever teams assume is covered, because "they don't sit out directly on the internet, and they're behind a protection barrier, but they're not."

No one claimed a machine did this unsupervised. TechCrunch reported on July 6 that the first operation still needed a person to pick the target and stand up infrastructure, and Sysdig could not trace the root credentials. A human aimed this one, and everything after ran with nobody at the keyboard.

Heath Renfrow, co-founder and CISO at breach-recovery firm Fenix24, told Infosecurity Magazine that when an agent compresses hours of operator work into minutes, "defenders lose valuable time." Whether the attacker was AI-driven does not change the response.

The door had been open for 14 months

CVE-2025-3248 carries a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on May 5, 2025, with a federal deadline of May 26, and Langflow fixed it in 1.3.0. When JADEPUFFER came back in July 2026, the server was more than fourteen months past that listing and already documented publicly as a breach victim.

Riemer put a number on how little time that leaves. "If I release a patch and a customer doesn't patch within 72 hours of that release, they're open to exploit, because that's how fast they can now do it," he said, adding most customers need a week to patch by hand. Set 72 hours against fourteen months, and the gap stops reading as one lapse.

Nothing in either campaign was new. The first forged a Nacos admin token with a default signing key public since 2020, walked through CVE-2021-29441, an authentication bypass Alibaba patched in 2021, and found a MinIO store on minioadmin:minioadmin. Sysdig counted more than 600 payloads, every one leaning on a known misconfiguration or a patched bug left exposed. The second added an exposed Docker socket. Every weakness was routine. Assembling them at machine speed was not.

Langflow draws this attention because of what it holds. VentureBeat reported in June that roughly 7,000 instances sit exposed, most in North America, holding provider API keys, cloud credentials and live connections to the vector stores ENCFORGE was built to encrypt. Riemer puts it bluntly. "When you put your security at the edge of your network, you're inviting the entire world in to the edge of your network," he said.

CISA has added five Langflow flaws to its Known Exploited Vulnerabilities catalog, two of them this month. Five Langflow flaws now sit on the KEV catalog, two of them this month. CISA added CVE-2026-55255 on July 7, a cross-tenant bypass letting any authenticated user on a shared instance run another tenant's flows with that tenant's credentials, which the maintainers' advisory rates 9.9 and fixed in 1.9.1.

On July 21, CISA added CVE-2026-0770, and that one is worse. Trend Micro found an unauthenticated path to root code execution through the exec_globals parameter, on the same validate endpoint JADEPUFFER came through, rated 9.8. KEVIntel logged exploitation from June 27, more than 220 attempts across 64 addresses. According to founder Ryan Dewhurst, speaking to BleepingComputer, the payloads reached past reconnaissance for AWS credentials and container metadata. Federal agencies had until July 24.

None of this is an exotic environment. A Cloud Security Alliance survey of 418 professionals, commissioned by Token Security, found 82% of organizations had discovered AI agents nobody knew about, and 65% had handled an agent-related incident in the past year.

McGladrey traces the permission half back four decades. Companies always cloned one employee's access profile onto the next hire, and now do it with agents. An agent "does whatever it needs to do to get its job done," he said, and it "uses far more permissions that it shouldn't have... than a human would do, because of the speed of scale and also intent."

What to do before the board asks

"Every time some new ransomware attack is published in the news, we get the inquiry from the board. What are we doing about this?" Evans said. "And if it involves AI, it sparks their fear even more."

Five things are worth answering this week. None requires buying anything.

1. Get every internet-reachable Langflow instance onto the current supported release. Anything off it is exposed to at least one of the five flaws CISA has now listed, including the July 21 addition. Then review historical requests to /api/v1/validate/code for the exec_globals pattern.

2. Get the Docker socket out of application containers. Langflow has no reason to create them. If the mount is required, front it with a socket proxy allowing only needed calls.

3. Name model artifact paths in the backup plan. Immutable snapshots of checkpoints, vector indexes and training data, restore tested, data off the host holding the weights.

4. Rotate every credential the host could reach, then pull provider keys out of its runtime. Patching does not revoke what already left. The first campaign harvested OpenAI, Anthropic and cloud credentials within seconds. Scope replacements to a secrets manager.

5. Detect mass .locked file creation in directories holding .gguf, .safetensors, .ckpt or .faiss files. Sysdig published a YARA rule and both hashes, neither with antivirus coverage at analysis time. It published no file count, so what is documented is a live encryption pass, not a measured loss.

An attacker coming through an exposed AI framework now arrives carrying something built for what it connects to, and those assets are the ones a restore cannot reproduce. Model artifacts belong in the recovery plan next to the databases. Under three weeks passed between Sysdig's two reports, all this attacker needed to go from improvised Python to a compiled locker.

Over the weekend, Reddit user -void1 posted an alarming discovery on the r/ClaudeAI subreddit: some conversations that users of Anthropic's Claude AI chatbot had made "shareable" via a link were being indexed by Google Search, and could be clicked on and accessed by seemingly anyone.

The conversation took off on the social networks X and Reddit, the latter with thousands of upvotes and comments, many expressing concern about user privacy and information security, and the additional finding by users that shared Claude Artifacts — including interactive applications, dashboards, documents and other AI-generated work products — were also appearing in Google Search results.

VentureBeat independently verified that some Claude Artifacts not shared directly with us were indeed searchable and accessible via Google. We could not access any shared conversations.

By Sunday morning, many of the original Google search results for shared Claude conversations appeared to have disappeared or become significantly harder to find, suggesting either Google, Anthropic or the users who authored them had begun taking action.

The exposure could carry broader implications for enterprise users. Anthropic has increasingly positioned the feature as a collaborative workspace for building and sharing software, dashboards, documents and other business assets rather than simply chatbot responses.

Asked by VentureBeat about the situation, an Anthropic spokesperson provided the following statement (emphasis mine):

“We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google. These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.”

A simple Google search yields a trove of Claude conversations

Reddit user -void1 posted to r/ClaudeAI on July 25, 2026, demonstrating that the Google query site:claude.ai/share surfaced numerous publicly accessible Claude conversations.

Screenshots shared across Reddit and X showed Google returning pages from Claude's /share URLs, while other users reported finding conversations containing cryptocurrency wallet creation, legal questions, résumés and internal business discussions.

While many users expressed concern that conversations they believed were effectively "unlisted" could become discoverable through public search engines, others argued the behavior reflected the expected consequences of creating publicly accessible share links rather than a software vulnerability.

Indeed, Anthropic requires the user themselves to go into Claude's options and select to make a conversation or Artifact shareable to others with the link, warning them it will be accessible to anyone with it, over multiple dialog boxes. It is similar to sharing a Google Doc link, where the user must also select the option — it is not enabled by default.

Why the exposure of Claude Artifacts may be even more concerning

On July 26, X user Om Patel, founder of research firm BigIdeasDB, posted allegingthat searches such as site:claude.ai/public/artifacts surfaced publicly shared applications, dashboards, reports and documents.

Screenshots circulating online appeared to show search results referencing internal-looking proposal documents and other business materials. Another widely circulated post warned that users often interpret "Anyone with the link" as equivalent to an unlisted YouTube video—accessible only if someone possesses the URL—not necessarily as content eligible for indexing by public search engines.

VentureBeat independently verified that multiple third-party Claude Artifacts appeared in Google Search results for the query site:claude.ai/public/artifactslaunch and were accessible without authentication, despite the URLs not being previously known to the reporter.

However, VentureBeat has not independently verified the full volume or representativeness of the examples circulating on social media.

The reports are particularly significant because Artifacts has become one of Anthropic's flagship product initiatives.

First introduced alongside Claude 3.5 Sonnet in June 2024, Artifacts transformed Claude from a conventional chatbot into a collaborative workspace capable of generating interactive web applications, dashboards, visualizations, documents, games and other live software alongside a conversation.

VentureBeat previously described the launch as potentially marking the beginning of an "interface war" among AI companies, shifting competition from raw model performance toward collaborative AI workspaces.

Anthropic subsequently rolled Artifacts out to all Claude users, saying tens of millions had already been created, before expanding the concept again this year into Claude Code.

That update allows engineering teams to publish live HTML dashboards and interactive project workspaces directly from coding sessions, making Artifacts an increasingly important part of Anthropic's enterprise strategy.

That broader functionality raises the potential stakes if publicly shared Artifacts were also being indexed. Unlike ordinary chat transcripts, Artifacts can contain interactive software prototypes, engineering dashboards, planning documents, product mockups, data visualizations and other work products organizations increasingly rely on to collaborate across technical and business teams. If those pages become searchable through public search engines, the exposure could extend well beyond conversational text.

A reality check on privacy, information security and the open web

Importantly, nothing so far suggests attackers gained access to private Claude accounts or conversations.

Rather, the controversy centers on conversations and Artifacts that users explicitly chose to share publicly via Claude's sharing tools.

The dispute instead is whether users reasonably understood those shared pages could become discoverable through public search engines rather than only by recipients possessing the link.

Technically, pages that are publicly accessible without authentication can generally be indexed by search engines unless publishers explicitly prevent crawling through mechanisms such as noindex directives or other indexing controls.

Several Reddit commenters noted that Claude's long, randomly generated share URLs are effectively impossible to guess. Instead, search engines typically discover them only after links appear somewhere they are permitted to crawl, such as public websites, forums or social media posts. Others questioned exactly how Google initially discovered so many Claude share URLs.

The issue also illustrates a growing challenge for AI companies as chatbots evolve into collaborative workspaces for creating software, documents, dashboards and business applications.

Features originally designed to make sharing AI-generated work easier now increasingly expose assets that may carry significantly more business value than a simple conversation.

As enterprises adopt AI as a platform for building internal tools and workflows, the distinction between "shared by link" and "publicly discoverable through search" becomes far more consequential.

A recurring challenge for AI companies

Anthropic is far from the first AI company to confront the distinction between "shared" and "searchable."

Reddit users quickly pointed out that OpenAI previously faced criticism after publicly shared ChatGPT conversations became discoverable through Google, prompting similar debates over whether "share by link" should imply a publicly indexed webpage or something closer to an unlisted document.

Anthropic's situation also echoes an incident involving Google's pre-Gemini AI assistant, Bard, in September 2023. SEO consultant Gagan Ghotra discovered that Google Search had begun indexing shared Bard conversation links, warning that users could mistakenly assume they were sharing conversations only with intended recipients rather than making them discoverable through search.

Google later responded publicly that it did not intend for shared Bard chats to be indexed and said it was working to block them from Google Search while emphasizing that only conversations users explicitly chose to share were affected.

Together, the Bard, ChatGPT and now Claude episodes suggest AI companies continue to wrestle with the boundary between content that is technically public on the web and users' expectations that "share with a link" behaves more like an unlisted Google Doc or YouTube video than a webpage eligible for indexing by search engines.

What enterprises should do now

For organizations deploying generative AI broadly across employees, the distinction between "shared with a link" and "publicly discoverable through search" is not merely semantic. It can determine whether an internal engineering dashboard, financial model, product roadmap, customer-facing prototype or AI-generated application remains effectively private—or becomes visible to anyone using a search engine.

Whether this ultimately proves to be a technical indexing oversight, a mismatch between product design and user expectations, or some combination of both, the episode serves as another reminder that AI products are increasingly functioning less like chatbots and more like collaborative operating systems for knowledge work.

As those platforms begin hosting internal dashboards, software prototypes, financial analyses, business planning documents and increasingly sophisticated enterprise applications, seemingly small decisions about how shared links behave can have outsized consequences for enterprise security, product design and user trust.

Enterprise leaders should consider taking several practical steps:

1. Audit existing shared AI content: Review shared conversations, Artifacts and other publicly accessible AI-generated assets to determine whether they should remain available or be unpublished.

2. Clarify what "Share" actually means to your ENTIRE organization: Don't assume employees understand the difference between "accessible by link" and "discoverable through search." Update internal guidance to explain how each AI platform handles shared content.

3. Treat AI platforms like collaboration software: Apply the same governance you use for Google Docs, Microsoft 365, Slack, GitHub, Notion or SharePoint—including policies around sharing sensitive intellectual property, customer information and regulated data.

4. Prefer authenticated enterprise workspaces for sensitive information: When possible, keep confidential projects, code, financial models and customer data inside enterprise accounts with identity-based access controls instead of publicly accessible links.

5. Review vendor defaults and sharing controls: As AI platforms evolve rapidly, administrators should periodically revisit default sharing settings, retention policies and indexing behavior rather than assuming they remain unchanged after new feature releases.

In sum, enterprises that have relied on Claude's sharing features may wish to review existing shared conversations and Artifacts at this time.

Presented by SAP

At VB Transform 2026, Max McPhee, senior solution advisor at SAP, spoke with Rob Stretchay, lead analyst at VentureBeat Research, about what it takes for enterprises to move beyond chatbots to autonomous AI agents that can execute real business processes. He argued that the difference comes down to grounding those agents in a company’s own context rather than general knowledge.

"Where we're starting to see more emergent behavior of it feeling like a coworker rather than an assistant, is where we're able to provide context on the actual enterprise rather than being able to use more of the standard knowledge," McPhee said.

That's the gap that still separates most enterprise chat software from genuinely agentic systems.

Building enterprise context with knowledge graphs

The same principles companies use to onboard new employees also apply to agents, adapted for software that retrieves information differently than humans do.

"When you are onboarding a new agent, I think it's important to acknowledge how you might onboard a new employee, but tune that for an agent," McPhee said. "The way that is really powerful is using knowledge graphs and having vector-embedded data, because that's a really easy format for an agent to be able to find and retrieve information."

That same grounding is also what keeps an agent from stumbling over an enterprise's internal shorthand, a problem that's acute in SAP's world.

"Being able to provide that tribal knowledge in the format that's easy for it to consume helps to provide a really nice result with your agents versus a chatbot that might say, 'Well, what does that acronym mean?'" he said.

Bringing governance, identity, and security to autonomous agents

Governance is an area where SAP's history works in its favor, and the controls have been evolving for systems that act with more flexibility than earlier automation did.

"That's where SAP really has a good home, around that governance and process control," McPhee said. We're a 50-year-old process company, modernizing that governance to be able to handle the flexibility that comes with agents running."

One consequence is a renewed role for machine learning in validating agent behavior.

"It's becoming a bit of a revival of machine learning," he added, pointing to customers that run agents within a process but then layer in anomaly detection and machine-learning-based validation as a guardrail. This is the same approach SAP had long used for intelligent approval recommendations.

Identity and permissions carry that governance into execution. Under this model, both the human and SAP’s Joule, the generative AI assistant embedded across the company’s cloud applications and Business Technology Platform, must hold the rights to access a given system. Even if a user has permission to access S/4, they cannot do so through Joule unless the assistant has also been provisioned for that access, closing off the risk of using an agent to route around access controls.

Balancing standard SAP with customized enterprise landscapes

Much of McPhee’s work involves reconciling SAP’s own knowledge with decades of customer customization and non-SAP systems. As he put it, many customers tell SAP, “You’re only 10% of my landscape,” a reality that has shaped the company’s recent strategy.

Recent acquisitions such as LeanIX, which McPhee likened to “Google Maps for your architecture,” and process-mining company Signavio are intended to help map that non-SAP majority so SAP’s agents can understand how enterprise systems interconnect. The company has also invested in Berlin-based automation company n8n and is embedding it natively into Joule Studio, its intent-based, low-code environment for building agents.

McPhee warned that companies also need to modernize older on-premises systems or risk running into limitations as they expand the use of autonomous agents.

"You're going to probably run into throughput issues, and you're kind of trying to drive a Ferrari around a dirt track," he said. "You've got to upgrade the track first if you want to drive a Ferrari."

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Enterprises deployed AI agents ahead of the controls needed to manage them — and they did it knowingly. That is the central finding across the five parallel surveys VentureBeat Research fielded in June, spanning every layer of the agentic stack. Now those enterprises are retrofitting to catch up with their own standards, and they are budgeting for it: In each of the five control layers we measured, 57 to 68% of enterprises plan to switch vendors or add new ones within 12 months, and roughly a third, depending on the layer, plan to move within the quarter.

VentureBeat Research measured the five controls an enterprise has to build before it can trust an agent: identity, evaluation, cost telemetry, the context layer, and orchestration. Identity governs which agent is allowed to do what, under whose credentials. Evaluation determines whether the agent's work is any good. Cost telemetry tracks what each agent costs to run. The context layer supplies the business data and definitions agents draw on when they answer. And the orchestration control plane coordinates multi-step agent work. Each of our five reports measures one of those controls.

Most deployed "agents" are chatbots wearing the label. Seventy-one percent of enterprises said a quarter or fewer of their deployed "agents" can complete multi-step work on their own; only 10% said true agents are the majority of what they run. These respondents are positioned to know: 81% recommend or decide AI purchases at their companies. A single-prompt chatbot with a human reading every answer needs none of the controls the other four reports measure. A true multi-step agent needs all of them — and most enterprises can't say which one they've deployed. (Full findings: Agentic Orchestration report.)

Autonomy is outrunning trust in the evaluations that gate it. Two-thirds of enterprises either already allow an agent to push a code or system change to production on automated evaluation results alone, with no human review, or are actively engineering toward that within 12 months. Only 5% fully trust the evaluations that would make that call — and half of enterprises shipped an agent that passed internal evaluations and then caused a customer-facing failure in the past year. Before removing human review from any workflow, test evaluations against production outcomes rather than internal benchmarks. (Full findings: Agent Reliability & Evals report.)

Companies that let agents share credentials get hit more often. Sixty-nine percent of companies let at least some of their agents share credentials — multiple agents operating under one API key or service account. Organizations that allow credential sharing anywhere experienced a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (nine of 22) at companies where every agent has its own scoped identity. The fix is scoped identity for every agent, starting with the ones that touch production systems. (Full findings: Agentic Security & Identity report.)

The most expensive hardware in the building runs at half capacity or less. More than eight in 10 enterprises that run their own GPUs reported utilization of 50% or less, and only 44% rigorously track what their AI compute actually costs and returns. The number worth chasing first isn't more GPUs — it's the utilization and per-workload cost of the ones already running. (Full findings: AI Infrastructure & Compute report.)

Agents answer confidently from data nobody governs. Fifty-seven percent of enterprises traced a confident, wrong agent answer in the past six months to their own missing or inconsistent business context — wrong metrics, stale definitions, absent documents — and most saw it happen more than once. Governing the definitions agents answer from — metrics and entities first — has to come before scaling the agents that depend on them. (Full findings: Context Layers / RAG report.)

No layer has an entrenched incumbent: The defaults today are the built-in tools that ship with the big AI platforms enterprises already use. Switching intent runs highest in orchestration itself, where 68% plan to adopt, add, or replace platforms within 12 months and 34% within the quarter. Our surveys did not ask which direction that money moves — toward the platforms' built-in tools or toward the specialists challenging them — and that open question is the next four quarters of this market.

About this research

VentureBeat Research fielded five parallel surveys in June 2026 under its VB Pulse program: Agentic Orchestration (101 respondents), Agent Reliability & Evals (157), Agentic Security & Identity (107), AI Infrastructure & Compute (107), and Context Layers / RAG (101) — 573 qualified respondents in total, all at organizations with 100 or more employees. Samples are self-selected, and some findings should be read directionally; each report carries its full methodology note. What the pattern supports more strongly than any single percentage is the direction: every survey, independently, points the same way. VentureBeat produces both this research and VB Transform, the conference where these reports debuted.

Anthropic released Claude Opus 5 on Friday, a model the company says delivers nearly all the intelligence of its top-of-the-line Claude Fable 5 at half the cost — a launch that signals how the AI race is shifting from raw capability to the economics of daily use.

The model, available immediately on all of Anthropic's platforms, is priced at $5 per million input tokens and $25 per million output tokens, unchanged from its predecessor, Opus 4.8. It becomes the new default model on Claude Max, Anthropic's premium consumer tier, and the strongest model available on Claude Pro.

The positioning is deliberate. Anthropic is not claiming Opus 5 is its smartest model — that distinction still belongs to Fable 5, and rival systems retain an edge in certain domains. Instead, the company is making a subtler argument that may matter more to enterprise buyers: that the most economically important AI work happens in a middle band of difficulty, where near-frontier intelligence delivered efficiently and cheaply beats frontier intelligence delivered expensively.

"Opus 5 as your daily driver, the model you hand complex work to and review when it's done," an Anthropic spokesperson said in an interview with VentureBeat, describing how the company's lineup now stratifies. "Fable 5 for your most ambitious work, the days-long autonomous projects nothing could take on before... Sonnet 5 for work you run at scale, where speed and cost per call decide what ships. Haiku 4.5 for subagents and instant answers."

How Claude Opus 5 benchmark results stack up against Fable 5 and rival AI models

On paper, the results are striking. Anthropic says Opus 5 sets new state-of-the-art marks on coding and knowledge-work evaluations including Frontier-Bench and GDPval-AA. On Frontier-Bench v0.1, an agentic terminal coding benchmark, Opus 5 scores 43.3 percent — more than double Opus 4.8's 18.7 percent and well ahead of Fable 5's 33.7 percent — at a lower cost per task, according to the company. On ARC-AGI 3, an evaluation of novel problem-solving, Anthropic reports Opus 5 scored three times as high as the next best model. On OSWorld 2.0, a computer-use benchmark, the company says the model surpasses Fable 5's best result at just over a third of the cost.

The numbers come with honest caveats that are themselves notable in an industry prone to superlatives. Anthropic acknowledges Opus 5 remains behind Mythos 5, a competing model, on cybersecurity tasks and biology research, and an OpenAI-family model still leads on one agentic coding benchmark.

The more revealing caveat came from Anthropic itself, when asked where Opus 5 still falls short of Fable 5. The spokesperson's answer amounted to a candid admission about what benchmarks do and don't capture.

"The evals where Opus 5 wins are bounded tasks with a specific outcome, which is where it's strongest. What those evals don't measure is duration," the spokesperson told VentureBeat. "One way to put it: Opus 5 is the best tool for the jobs benchmarks can see, and Fable 5 is what you reach for when the job outruns the benchmark."

Fable 5, by contrast, "is for the longest, most autonomous jobs, where the model has to stay coherent across many connected steps over hours or days with dense source material," the spokesperson said, advising customers to "run both on a representative workload, one bounded task and one long-horizon job." That framing — bounded tasks versus long-horizon autonomy — may become the defining axis of model differentiation in 2026, as benchmarks saturate and the hardest remaining problems involve sustained, multi-day agentic work rather than discrete puzzles.

Why token efficiency is becoming the real battleground for enterprise AI spending

Threaded through the launch is a theme Anthropic clearly wants buyers to absorb: Opus 5 doesn't just score well, it scores well per dollar. The model ships with an adjustable "effort" setting that lets customers trade intelligence for speed and token savings, and Anthropic's charts emphasize performance at a given cost rather than peak performance alone.

Early customers echoed the point with unusual specificity. Harvey, the legal AI company, said Opus 5 achieved similar performance to Opus 4.8's maximum-reasoning mode "while generating 26% fewer tokens on average," according to Niko Grupen, its head of applied research. Richard Pham of Fundamental Research Lab said that on hard financial-modeling tasks, the model averaged nine percentage points higher accuracy "while using roughly one-third fewer turns and tool calls and 60% less time."

Wade Foster, chief executive of Zapier, said Opus 5 topped his company's AutomationBench leaderboard "without spending more tokens than prior Claude models," running a full churn-prevention workflow from start to finish. "Previous models didn't pass; Opus 5 hit 100%," he said. Scott Wu, chief executive of Cognition, the company behind the Devin coding agent, said that on FrontierCode 1.1, "Claude Opus 5 approaches Fable-level performance at half the cost," with particular strength in debugging and root-cause analysis.

The efficiency emphasis reflects commercial reality. Enterprise AI spending is no longer experimental, and inference costs — the price of actually running these models at scale — have become a board-level line item. 

Anthropic's business skews heavily toward API and enterprise usage; according to a February 2026 analysis by Contrary Research, Claude held roughly 40 percent of the enterprise large language model market by usage as of late 2025, and Claude Code alone had reached about $1 billion in annualized revenue. For a company whose customers pay by the token, a model that does more with fewer tokens is not a nice-to-have. It is the product.

Self-verifying AI agents and what they mean for the hidden costs of automation

Beyond the numbers, Anthropic is selling a behavioral story: that Opus 5 verifies its work and iterates until it succeeds. The company offered several examples from testing that read like small parables of machine stubbornness.

In one Frontier-Bench task, the model was asked to reconstruct a machine part as a 3D CAD model from a drawing it was intentionally given no way to view. Rather than fail, Anthropic says, Opus 5 wrote its own computer vision pipeline to extract the geometry from raw pixels — and did so repeatedly, while no competing model solved the task in five attempts. In another case, given a real bug in a popular open-source package manager, the model found the root cause and fixed an edge case the community's own patch had missed; a competing model patched only the symptom and declared victory. An engineer at a trading firm, the company says, used Opus 5 to build a market data feed for a new exchange in a single session and, finding no live feed to validate against, watched the model build its own test harness to check its parsing code.

Customers described similar behavior in the wild. Cristian Rivera, a staff software engineer at Stripe, said he gave the model "a chief-of-staff role over my dev environments" for a weekend: "it built its own monitor, drove each box, and pulled me in only for the judgment calls."

This is the capability enterprises actually care about, and it is worth dwelling on why. The gap between a model that produces plausible output and one that verifies its output is the gap between a demo and a deployable system. Most of the hidden cost of enterprise AI today is human review — engineers checking the machine's work. A model that reliably checks its own work compresses that cost, which is precisely why customers keep citing fewer turns, fewer passes, and less time rather than higher raw scores.

Inside Anthropic's safety strategy: capability gaps, classifiers, and model fallbacks

The launch also showcases Anthropic's increasingly intricate approach to safety — one that now involves deliberately not teaching its models certain skills. The company says its automated behavioral audit found Opus 5 to be its most aligned model to date, scoring 2.3 on overall misaligned behavior, lower than Opus 4.8, Sonnet 5, or Fable 5, with the lowest rates of deceptive behavior and the least susceptibility to being tricked into misuse.

On the capability side, Anthropic says it intentionally avoided training Opus 5 on cyber tasks, as it did with Opus 4.8. The model improved on them anyway — a side effect of general capability gains — and now nearly matches Mythos 5 at finding software vulnerabilities. But it remains far behind at exploiting them: on Anthropic's OSS-Fuzz evaluation, Opus 5 identified vulnerabilities at a 79.4 percent rate, close to Mythos 5's 80 percent, but succeeded at developing exploits in only 4 challenges versus Mythos 5's 13. That asymmetry — strong at defense-relevant discovery, weak at offense-relevant exploitation — appears to be by design, and the safeguards follow the same logic. Anthropic expects Opus 5's cyber classifiers to intervene about 85 percent less often than Fable 5's.

When a classifier does trigger, requests in Claude.ai, Claude Code, and Claude Cowork fall back to Opus 4.8 by default — raising an obvious question: if a request is too risky for one model, why is it acceptable for another? "The model it falls back to has lower capability levels making the risk of harmful use lower as well," the spokesperson said, adding that "there is a message that lets the user know when this occurs and is visible in the chat."

The logic is defensible, but it reveals how AI safety actually works in 2026: risk is not a property of the question alone, but of the question multiplied by the capability of the system answering it. On biology, the calculus runs the other way. Opus 5 is now Anthropic's most capable generally available model for scientific research — scoring 10.2 percentage points higher than Opus 4.8 on the company's internal chemistry benchmark — though the spokesperson acknowledged that "Mythos 5 remains the stronger model for long-horizon, open-ended work like autonomous drug design campaigns."

The business stakes behind the launch: a $380 billion valuation and massive compute bets

The launch lands at a moment of extraordinary commercial momentum — and extraordinary obligations — for Anthropic. Reuters reported in February that the company was valued at roughly $380 billion in its latest funding round, following a period in which, per Contrary Research's analysis, its annualized revenue climbed from about $1 billion at the end of 2024 to a projected $9 billion by the end of 2025, with internal targets reportedly reaching $20 to $26 billion for 2026. Those targets are underwritten by enormous infrastructure commitments, including a reported $30 billion Azure compute deal alongside arrangements with Google Cloud and Nvidia — spending that only pencils out if enterprises keep expanding usage.

That is the context in which Opus 5's pricing strategy makes sense. Holding the price at Opus 4.8 levels while roughly doubling performance on key agentic benchmarks is effectively a steep price cut per unit of capability, designed to widen the funnel of workloads that are economical to automate. Every task that was marginal at Opus 4.8's cost-per-success becomes viable at Opus 5's — and every viable task is recurring token revenue.

The regulatory backdrop has grown more complex as well. A U.S. judge gave final approval this week to Anthropic's $1.5 billion copyright settlement with book authors, Reuters reported, closing a chapter of litigation over the company's early training data. And in June, Reuters, citing Axios, reported that the U.S. government had moved to block foreign access to Anthropic's most advanced models — a reminder that frontier AI is now entangled with export policy in ways that shape which customers can buy what.

Also shipping Friday: a Fast mode running at roughly 2.5 times default speed at twice the base price, automatic fallback routing on the API, and mid-conversation tool changes that no longer invalidate the prompt cache — a small feature that agent developers may appreciate more than any benchmark. Consistent with prior Opus models, Opus 5 carries no data retention requirements for general access, a point the spokesperson flagged unprompted for customers with "a hard zero data retention requirement." Developers can access the model as claude-opus-5 on the Claude API starting today.

Two questions will determine whether the bet pays off: whether Opus 5's efficiency claims survive contact with production workloads at scale, and whether enterprises embrace a world where safety classifiers, not users, sometimes decide which model answers. But the deeper message of Friday's launch is that the AI industry's center of gravity has moved. For three years, the labs competed on what their best model could do on its best day. With Opus 5, Anthropic is competing on something less glamorous and far more lucrative: what a very good model can do every day, for half the price. In a market where the frontier keeps moving, Anthropic is wagering that the real fortune lies just behind it.

Microsoft AI released two new in-house models into public preview on Wednesday — MAI-Image-2.5-Pro, its highest-fidelity image generator to date, and MAI-Voice-2-Flash, a speech model built for high-volume enterprise workloads — while publishing production data that amounts to the company's most aggressive argument yet that it can power its own products without leaning on OpenAI's frontier models.

The announcement, made by Microsoft AI's Superintelligence team, lands roughly a year after the company committed to building purpose-built models internally, and it arrives with an unusual level of specificity about where those models now run: Bing, PowerPoint, OneDrive, Dynamics 365, Excel, GitHub Copilot, and Azure. The message to enterprise buyers — and, implicitly, to OpenAI — is that Microsoft's homegrown models are no longer research projects. They are production infrastructure serving millions of users.

"Each of these enhancements is a step toward the same goal: Microsoft products, powered by Microsoft models," the company wrote in its announcement blog.

How MAI-Image-2.5-Pro and MAI-Voice-2-Flash stake out opposite ends of the AI cost curve

The two new releases occupy opposite ends of what Microsoft calls the quality-speed-cost curve, and the positioning is deliberate. MAI-Image-2.5-Pro targets the premium tier: hero imagery, detailed editing, and precise in-image text rendering — the last of which has long been a notorious weak spot for image generation models. Microsoft priced the model at $5 per million text input tokens, $8 per million image input tokens, and $106 per million image output tokens. The base MAI-Image-2.5 model recently launched at No. 2 for image editing on Arena, the community leaderboard that has become a de facto scoreboard for generative media.

The creative industry appears to be taking notice. Rob Reilly, global chief creative officer at advertising giant WPP, called the Pro model "a strong leap forward for GenMedia tools" in a statement included in Microsoft's announcement, adding that "Microsoft has firmly established itself among the leaders in generative AI."

MAI-Voice-2-Flash goes the other direction. First previewed at Microsoft's Build conference, Flash runs twice as fast as MAI-Voice-2 and costs 32% less, priced at $15 per million characters. It is designed for the unglamorous but enormous market of high-volume voice — call centers, voice agents, and real-time speech applications where latency and cost-per-call matter more than marginal gains in expressiveness. Together, the two models reflect a strategy of building families of models rather than a single flagship, because, as the company put it, a creative studio chasing maximum fidelity has very different needs from a customer service operation handling millions of calls a day.

Microsoft's production metrics show in-house models cutting GPU costs by up to 89%

The model launches are arguably less newsworthy than the deployment metrics Microsoft attached to them — numbers that read like a systematic case for swapping out third-party frontier models across its product portfolio. 

Bing Image Creator now runs entirely on MAI-Image-2.5, end to end, marking the first time the consumer image tool is fully in-house. In PowerPoint, Microsoft says MAI-Image-2.5 reduces GPU costs by up to 84% compared with GPT-Image-2, OpenAI's image model. In OneDrive, where MAI-Image-2.5 is now the default for key image-editing scenarios, the company reports a 26% increase in save rates, roughly 25% lower P95 latency, and 2.5 times greater efficiency under medium-utilization production workloads.

On the voice side, MAI-Voice-2-Flash now powers Dynamics 365 Contact Center — the platform used by customers including T-Mobile and EasyJet — where Microsoft claims GPU cost reductions of up to 89%. The model is also integrated into Azure Voice Live for developers building speech-to-speech agents.

Perhaps the most consequential deployment sits in healthcare. Microsoft's Dragon Copilot, used by 170,000 medical providers and responsible for processing 28 million patient encounters last quarter, now runs on MAI-Transcribe-1.5 for its multilingual workflow across 58 languages. Microsoft says internal evaluations show a 50% relative reduction in both transcription and language-identification error rates across most languages — a meaningful claim in a domain where transcription errors can propagate directly into clinical notes.

Inside the 'hill-climbing' strategy that lets small models beat GPT-5.6 in Excel

In a companion post published the same day, Microsoft detailed the methodology behind these results — what it calls its "hill-climbing machine," an integrated flywheel of data, models, and the product "harness" that surrounds them.

The clearest example is MAI-Code-1-Flash, the lightweight coding model launched in GitHub Copilot in June. Microsoft says the model achieves an approximately 10% higher code accept rate than GPT-5.4 Mini and Claude Haiku 4.5 in VS Code, while using 10% fewer median tokens. Developer retention tells a similar story: users were 6% more likely to return across multiple days than with GPT-5.4 Mini, and 11% more likely than with Claude Haiku 4.5.

Then Microsoft did something more interesting. It took the MAI-Code-1-Flash checkpoint and further trained it inside an Excel reinforcement learning environment, teaching a coding model the tools and workflows of spreadsheet knowledge work. The result, according to production user feedback, is a model on par with GPT-5.6 for the most common Excel tasks — while being small enough to run on Nvidia's older H100 and even A100 GPUs rather than requiring the latest-generation accelerators.

That hardware detail deserves emphasis. Every major AI company is fighting for allocation of cutting-edge chips, and a model that delivers frontier-adjacent quality on two-generation-old silicon fundamentally changes the deployment economics. It also frees the newest hardware — including Microsoft's now-operational GB200 cluster — for training rather than serving.

Satya Nadella's 'frontier diffusion' manifesto redraws the OpenAI relationship

Microsoft CEO Satya Nadella framed the announcements in a lengthy post on X titled "Frontier Diffusion & Control," which functions as something close to a strategic manifesto. "We can now take saturated frontier capabilities and deliver them at scale and at lower cost through models optimized for high-usage products, while continuing to use frontier models for frontier needs," Nadella wrote, adding that Microsoft is "beginning to route traffic across our first-party surfaces to MAI whenever our models match or outperform frontier alternatives."

Translated from executive prose: capabilities that were state-of-the-art a year ago are now table stakes, and Microsoft believes it can replicate them cheaply for the specific, repetitive tasks that dominate real product usage. Why pay frontier prices for a frontier model when a user just wants to reformat a spreadsheet column?

Nadella was careful to note that "frontier models from OpenAI and Anthropic are part of the orchestration system alongside MAI" — but he also articulated a pointed principle of model independence, arguing that a company's evaluations "should continue to hill climb even when any given model has been removed." 

“Keeping the harness, memory, context, and skills outside the model, he argued, is what gives Microsoft control. The subtext is hard to miss. Reuters reported in April that Microsoft’s exclusive license to OpenAI’s technology had been revised into a non-exclusive arrangement, and The Information reported last September that Microsoft had begun incorporating Anthropic models into some products. Wednesday’s announcement completes the triangle: Microsoft as orchestrator, with its partners’ frontier models as interchangeable components and its own models absorbing an ever-larger share of routine traffic.”

Developers cheer cheaper task-specific models while skeptics question Microsoft's track record

The response online captured both the appeal and the skepticism surrounding the strategy. "I love when people use small models for niche tasks," wrote one X user, @mavihsk, responding to Nadella's post. "Why do I have to use the all-knowing model just to change my field in Excel?" Another user, @nabu_lines, distilled the pitch neatly: "cost and performance both improve when you stop overusing the biggest model."

Others were less charitable about Microsoft's execution track record. "Microsoft is the worst when it comes to listening to user feedback," wrote designer @designedbyabin, arguing the company "will lose the AI race because they repeatedly failed to understand user needs." And one user, @tokenoverflow, offered a drier critique of the model-independence pitch: "i want it keep hill climbing after removing microsoft."

The skeptics raise a fair point. Microsoft's self-reported metrics — accept rates, save rates, GPU savings — come from its own internal evaluations, not independent benchmarks, and the company chooses which comparisons to publish.

But the strategy's logic does not depend on any single number. Nadella's framing that software now has "real marginal cost for the first time" explains why Microsoft is obsessive about tokens, GPUs, and serving costs: when AI features run on every keystroke across a billion-user product portfolio, an 84% GPU cost reduction is not an optimization. It is the difference between a viable business and a money pit.

Why Microsoft is turning its internal AI playbook into an Azure product

The final piece of the strategy is that Microsoft is selling the playbook, not just the models. Nadella explicitly positioned the hill-climbing approach as "a template for every other AI native, SaaS, or Enterprise company," and Microsoft is packaging the toolchain through Foundry and what it calls Frontier Tuning — letting enterprises train specialized models against their own proprietary evaluations and reinforcement learning environments. That turns Microsoft's internal cost-cutting exercise into an Azure product, and it gives enterprise customers a reason to run their AI workloads on Microsoft's cloud even if the models themselves come from elsewhere.

The company's emphasis on models trained "on clean, traceable, enterprise-grade data, without distillation from third-party models" serves the same commercial end. In an industry facing mounting scrutiny over training data provenance, Microsoft is betting that enterprise buyers — and courts — will care where model capabilities come from. Microsoft says it is now extending the hill-climbing approach to Copilot Chat, Outlook, and PowerPoint, and both new models are available in public preview through Microsoft Foundry and the MAI Playground. "None of this is an endpoint," the company wrote. "We're just getting started."

Seven years ago, Microsoft bet more than $13 billion that OpenAI would build the future of AI. Wednesday's announcement suggests the company has since learned a cheaper lesson: the future of AI may belong to whoever builds the frontier, but the profits belong to whoever makes it ordinary.

Two weeks after debuting its more naturalistic GPT-Live audio AI model with full-duplex capabilities (listening and speaking at the same time), OpenAI is bringing it directly into developer workflows.

The company announced that GPT-Live now powers the ChatGPT desktop application on macOS and Windows, integrating directly with agentic systems like Codex and ChatGPT Work (which are separate experiences available in the ChatGPT desktop app).

When OpenAI initially launched GPT-Live on July 8, 2026, it introduced a continuous audio model capable of listening and speaking simultaneously—eliminating rigid turn-taking while delegating complex reasoning to background models like GPT-5.5.

Today's release expands that conversational layer to technical tasks, enabling software engineers to orchestrate multi-threaded coding jobs, review pull requests, and debug applications using natural voice commands.

As such, it could usher in a new era of "hands free" software development and even live, in-person group coding parties for the more than 10 million weekly active users across Codex and ChatGPT Work. Codex, of course, is the name given to OpenAI's models and harness focused on coding, but which the company has this year expanded into a more general productivity platform. An OpenAI spokesperson told VentureBeat this is the first time voice activation

OpenAI posted a promotional video showing some of its employees, Codex developer experience engineer Jason Liu and Codex technical staffer Guinness Chen, speaking to the same ChatGPT desktop app session in the same room, each issuing different instructions and conversing with the same model.

New capabilities unlocked

At its core, this integration relies on decoupling the real-time voice layer from the underlying execution engines.

While GPT-Live maintains fluid conversation—inserting natural verbal acknowledgments like "got it" without interrupting the user—it passes heavy computational workloads to background reasoning models.

On macOS, the desktop application incorporates "Appshots" and screen context features, allowing ChatGPT Voice to analyze the frontmost window alongside local files, codebase structures, and active plugins.

This architecture creates a pair-programming dynamic where developers talk through problems conversationally while agents execute tasks asynchronously.

Rather than manually stopping coding sessions to type detailed instructions or switch windows, developers direct the system hands-free.

The full-duplex engine dynamically decides when to speak, pause, or invoke tools, maintaining conversational state even as background agents process complex code modifications.

Directing coding and complex builds with your voice alone

The central operational capability in this update centers on multi-task execution across Codex and ChatGPT Work environments.

Software engineers can initiate multiple concurrent task threads from a single spoken prompt. For instance, a developer preparing to ship a feature can instruct the system to investigate an open authentication bug, review a pending API migration pull request, and generate missing unit tests simultaneously.

The desktop application coordinates these actions across disparate contexts, tracing issues through Slack conversations, GitHub repositories, and local codebases.

Developers can also verbally convert design mockups into working code, splitting tasks across frontend, backend, and testing layers.

With support for multi-folder projects (build 26.715) and remote execution via iOS, engineers can check task progress, answer agent prompts, and redirect active jobs without switching applications or managing individual processes line by line.

Proprietary license

OpenAI’s voice-enabled desktop release operates under a proprietary, commercial enterprise model. Access is restricted to paid subscribers across Plus, Pro, Business, Enterprise, and Education plans.

For individual developers and corporate engineering departments, this commercial structure means the model weights, voice processing pipelines, and agent state architectures remain fully closed.

Organizations cannot modify or self-host the underlying systems. Furthermore, tasks initiated via ChatGPT Voice consume standard usage allocations directly from existing Codex and ChatGPT Work plan quotas, treating voice-triggered actions identically to standard agentic workloads.

Community reactions

Developer communities immediately noted the implications of bringing continuous full-duplex voice to autonomous coding workflows.

Reacting to the build 26.715 release announcement—which details voice integration and multi-folder project support—AI Insider journalist @ChrisGPT noted on X: "Today OpenAI will release voice and remote guidance for codex ! One step closer to personal AGI".

Early technical feedback highlights widespread enthusiasm for orchestrating complex agentic tasks hands-free, particularly when stepping away from the workstation or managing build pipelines remotely.

Black Forest Labs (BFL) is expanding its FLUX family beyond image generation with today's launch of FLUX 3, a multimodal frontier model trained to understand and generate images, or combined audio/video clips up to 20 seconds from a single prompt — and to extend the same underlying architecture to robotic vision and actions.

The Freiburg, Germany-based AI lab says FLUX 3 is jointly trained across those modalities rather than assembling separate image, video and audio models behind a common interface.

That distinction is central to the company's pitch: BFL wants enterprises to think about creative generation, simulation, computer use and robotics as connected applications of a single capability it calls visual intelligence — models, in the company's words, "that can perceive, predict, and act across physical and digital environments." This release marks BFL's first public video generation model.

FLUX 3 will be offered through four product lines: FLUX 3 Video, FLUX 3 Image, FLUX 3 Action and the upcoming, open source FLUX 3 Dev. FLUX 3 Video, with optional native audio generation, and FLUX 3 Action are entering a gated "Early Access" program now, to which anyone can apply, but which BFL must approve.

There is presently no public access through BFL's application programming interface (API) or those of partners yet, but the company says FLUX 3 Image will roll out in the coming weeks, followed by general availability. The limited initial availability rollout echoes the release strategies of new models from other frontier labs in the U.S. lately, including Anthropic and OpenAI, though those were ostensibly for security concerns and due to government request.

What the company has not announced is pricing, production service-level commitments, evaluation methodology, sample sizes, rater counts or any image-model benchmarks at all. Enterprise buyers therefore cannot yet calculate total cost of ownership or independently reproduce the video comparisons.

Another big notable omission: FLUX 3 is not launching with downloadable weights at this time, nor an open source license. BFL says faster and open-weight versions will arrive later this year, and its technical blog names FLUX 3 Dev as "open-weight access to a multimodal backbone, for content creation (video, audio and image) and action prediction" — a considerably broader commitment than any previous FLUX Dev release, all of which covered images only.

But it arrives last in the sequence. Developers accustomed to receiving a locally deployable FLUX variant alongside — or soon after — a major model announcement will have to wait. That delay does not negate the company's commitment, but it is disappointing given the role open weights have played in FLUX's adoption thus far.

Flux 3 is rated higher than the competition, but missing pricing and benchmarking details may prevent rapid enterprise adoption

BFL has published several benchmark comparisons, but they're qualified as preliminary — with full benchmark results and methodology to be published later during broader general availability.

In early head-to-head preference testing on 10-second, 720p text-to-video clips with audio, the company says FLUX 3 was preferred over Luma Ray 3.2 in 93% of comparisons, Runway Gen-4.5 in 77%, Grok Imagine Video in 69%, Kling v3 Pro in 60%, Happy Horse v1 in 59%, Happy Horse 1.1 in 57%, and both Seedance 2.0 and Google's Gemini Omni Flash in 52%.

One caveat travels with every one of those figures, and it comes from BFL itself. The chart carrying the results is labeled a "preliminary evaluation of an early FLUX 3 candidate" — meaning the numbers describe a pre-release checkpoint rather than the model now entering early access. That cuts both ways: the shipping model may perform better, but nothing published today measures what customers will actually call.

Luma Ray 3.2 and Runway Gen-4.5, where FLUX 3 posted 93% and 77%, are the softest comparisons on the list — established products, but not the models currently setting the pace in independent video rankings. Those are real wins, and they are the ones least likely to change an enterprise shortlist.

Seedance 2.0, at 52%, is a statistical coin flip against a model most Western enterprises cannot currently procure. ByteDance indefinitely postponed Seedance 2.0's international rollout after Netflix, Warner Bros., Disney, Paramount and Sony sent legal threats over alleged systematic copyright infringement, and that suspension remains in place. Tying a frozen product is neither a strong claim nor a damaging one.

Gemini Omni Flash, also at 52%, matters much more. Omni is the closest large-platform analogue to what FLUX 3 is attempting — multimodal input, video and audio-aware creation, conversational editing — and by BFL's own measurement, the two are indistinguishable on 10-second text-to-video quality.

Google's advantage in that matchup is that Omni is generally available via Google's Gemini API for $0.10 per second of generated 720p video, or a 10-second clip for around.

One regional wrinkle matters for a German company's home market. Editing uploaded video is unavailable to Omni Flash users in the European Economic Area, Switzerland and the United Kingdom, though editing video the model itself generated is permitted. A European enterprise that wants to run its existing footage through a generative editing pass cannot currently do so on Omni Flash.

Here's a rough guide for enterprises considering which video models to rely upon:

One architecture for media generation and physical action

FLUX 3 builds on Self-Flow, BFL's method for aligning multimodal understanding and generation within one architecture, publicized back in March 2026.

The company says it significantly scaled up compute and data to train across video, images and audio simultaneously, and that testing showed video generation and action prediction do not require separate foundations — the same architecture could be extended to action prediction without sacrificing what it learned from video.

"We place vision at the center of our approach because it is the most signal-rich medium of the physical world. Images convey structure, images and video teach spatial relationships, video teaches dynamics, and actions reveal causal relationships. But vision alone is not the complete picture," said Robin Rombach, co-founder and CEO of BFL, in a pre-release statement provided to VentureBeat. "True intelligence means perceiving the world: predicting how it will change, taking action, and learning from the results. Joint training within one unified architecture is what will get us there, because each training modality strengthens the others. Audio conveys timing, prosody, and physical events that elude vision. Language conveys goals, abstractions, and instructions that pixels cannot easily express."

He put the case more bluntly elsewhere in the announcement: "You can't cheat reality. A model that only learns images can only generate images. But the world is not made of still frames. It moves, sounds, changes, and responds."

BFL says FLUX 3 targets creative tooling, media, design, e-commerce and physical AI, supporting video generation with synchronized audio, precise image editing, product and material consistency across motion, multilingual generation and robotic action prediction. It is already being tested by Canva, Burda, Magnific (formerly Freepik), Krea and Picsart.

For creative software companies, the appeal is consolidation. A single foundation could potentially support storyboarding, image editing, product rendering, video variation and localization without repeatedly translating assets and instructions between disconnected models.

For robotics teams, the potential value is data efficiency. Models that already encode motion, object behavior and physical change may need less task-specific robot training than systems starting from raw demonstrations.

What FLUX 3 Video can actually do

The video tier is the most concretely specified part of the launch, and it settles a question that had been circulating as rumor: FLUX 3 generates clips of up to 20 seconds with audio in a single generation.

Every video output comes with native audio. For comparison, HappyHorse 1.0 tops out at 15 seconds of 1080p with synchronized audio — though BFL has not stated what resolution its 20-second clips run at, and its published evaluations were conducted at 720p. Still, a 20-second long clip from a single prompt is among the longest yet achieved, matching OpenAI's discontinued Sora model.

The capability list BFL published covers:

• Text-to-video generation.

• Image-to-video generation, either animating from a starting frame or using images as visual references.

• Video-to-video generation from a reference clip, carrying elements such as a specific character into a new scene or context.

• Generative video-audio continuation from existing video and audio input.

• Keyframe-to-video generation for controlled transitions between defined moments.

• Multilingual dialogue.

• A broad range of visual styles and aspect ratios, from candid camcorder footage to animation and cinematics.

• Typography generation and animated design.

• Agentic chaining of individual clips into longer, multi-shot sequences.

That last item is the one enterprise video teams should look at hardest. BFL claims the capabilities combine to produce sequences lasting several minutes, with visual references keeping characters consistent across scenes. If that holds up under production conditions, it addresses the constraint that has kept generative video out of most commercial pipelines: not clip quality, but continuity across shots.

It is also the capability where competition is most direct. HappyHorse 1.1's headline upgrade is R2V, or Reference-to-Video, which accepts multiple character reference images to hold identity stable across generated footage — the same problem, approached at the input layer rather than through agentic clip chaining. Alibaba also claims zero-drift lip sync and has specifically targeted the artifacts that mark commercial AI video as synthetic, including facial oiliness and over-sharpening. Character consistency is where this category is being contested, and both companies know it.

BFL says FLUX 3 Video is already particularly strong at human facial expressions, associating sounds with physical events, and multilingual output. On the image side, the company says preliminary evaluations conducted during midtraining show significant improvement over earlier FLUX versions in complex prompt handling and text generation, including high-accuracy text in multiple languages. It published no image benchmarks or win rates.

FLUX-mimic tests whether video models can become robot models

BFL is applying its unified-architecture thesis through FLUX-mimic, a video-action model built on FLUX 3 and developed with Swiss firm Mimic Robotics, one of the first partners to receive early access.

The technical blog describes two distinct routes to action prediction: integrating native action prediction directly into FLUX 3, scaling up the initial Self-Flow work; and using the pretrained video backbone as a dynamics-aware foundation from which specialized action models can be finetuned with limited task-specific data. FLUX-mimic is the second route — the FLUX 3 backbone combined with mimic's robot-learning and production-deployment expertise in dexterous manipulation.

FLUX-mimic is designed for general-purpose robotic manipulation: helping robots understand a visual scene, predict the consequences of an action, and adapt to new tasks with far less task-specific data.

BFL and Mimic Robotics say that depending on task difficulty, the model can be finetuned for a specific manipulation task with as little as 30 minutes of robot data, where prior approaches have required 30 or more hours.

"The hardest part of robotics is data," said Elvis Nava, CTO of Mimic Robotics, in a statement provided to VentureBeat. "Every new task normally means hours of a robot repeating itself. Because FLUX-mimic is built on top of frontier video models that already understand how the physical world behaves, it picks up a new task in minutes, not days. This way, we can leapfrog the current state of the art in robot learning."

BFL argues that a model trained only on images cannot understand a world that "moves, sounds, changes, and responds," and that physical understanding is what produces convincing generated footage. Google makes a nearly identical claim for Gemini Omni.

Its developer documentation cites "world knowledge" that combines "an understanding of physics" with Gemini's grasp of history, science and cultural context. Its marketing is blunter still: "Most AI models just predict the next pixel to build a narrative or an image. Gemini Omni is different," the company posted in June, crediting the model with "an intuitive understanding of forces like gravity, kinetic energy, and fluid dynamics for more realistic movements that follow real-world logic."

The practical consequence for enterprise buyers is that world-model language is not a differentiator. Two of the three leading video systems now market physical understanding as their central advantage, and neither has published a benchmark that measures it.

There is no standard test for whether generated water behaves like water, whether a dropped object falls at a plausible rate, or whether a sound arrives when the impact does. Human preference ratings capture some of it indirectly. Nothing else on offer captures it at all.

Open weights helped make FLUX an industry standard

BFL officially launched in summer 2024 and gained a name for itself in the AI industry in the intervening two years for its commitment to open sourcing high-quality AI image models beloved by developers, creatives, and enterprises.

The company's founders, including Rombach, Andreas Blattmann and Patrick Esser, previously helped create VQGAN, latent diffusion and Stable Diffusion, the latter the open source technology that kicked off broad AI generation capabilities for the masses and currently used by many AI image generators and companies.

That reach translated into commercial distribution. FLUX models now power generative features inside Adobe Photoshop, Picsart and Nous Research's Hermes Agent, among other platforms, and the company cites film director Martin Scorsese among professional users.

Wired magazine described Black Forest Labs as a relatively small company that nevertheless became a leading competitor to Silicon Valley's largest AI labs, with FLUX models ranking near the top of image benchmarks and becoming some of the most downloaded text-to-image models on AI code sharing community Hugging Face. The company says it now runs a 100-person team across Freiburg and San Francisco.

FLUX.1 Dev, FLUX.1 Kontext Dev, FLUX.1 Fill Dev and related control models, released shortly after the firm's launch, gave researchers and creative-tool developers access to downloadable checkpoints, local inference and integrations with frameworks including Hugging Face Diffusers and ComfyUI. FLUX.1 Kontext Dev, for example, was released as an open-weight model for research and noncommercial use, with generated outputs permitted for commercial purposes under the applicable license.

The company continued that pattern with FLUX.2 Dev in late 2025, a 32-billion-parameter open-weight model combining generation and multi-reference editing. Black Forest Labs called it the strongest open-weight image generation and editing model available at launch and released weights, reference inference code and optimized implementations for consumer Nvidia GPUs.

FLUX 3 Dev raises the stakes on that evaluation. Previous Dev releases were image models. This one is described as a multimodal backbone spanning video, audio, image and action prediction — meaning a single license will govern whether a company can locally deploy a model that touches both content production and physical machinery. BFL hasn't yet shared information about its license, the parameter count, quantizations or hardware requirements.

The company frames open weights as an enterprise feature rather than a community gesture, arguing they enable secure, low-latency local deployment for applications like robotic control systems and let teams adapt FLUX 3 to their own data, products and workflows.

The financial backing behind FLUX 3 is worth noting alongside the technical claims. Black Forest Labs is valued at $3.25 billion and has raised more than $450 million from investors including a16z, AMP, Salesforce Ventures, Nvidia, General Catalyst, Adobe Ventures, Figma Ventures, Canva and Deutsche Telekom's T.Capital.

When Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through as often as 88.3% of the time. Amy Chang, Cisco's head of AI threat intelligence and security research, brought that finding to the agentic security panel at VB Transform 2026; the number should worry anyone still running single-turn red-teaming programs.

VentureBeat's June 2026 Pulse survey of 107 enterprise respondents explains why the room was full. More than half, 54%, have already had a confirmed agent security incident (18%) or a near-miss caught before harm (36%). Just 32% give every agent its own scoped, managed identity, and fewer still, 30%, isolate their highest-risk agents in sandboxes. Provider-native and hyperscaler controls remain the primary agent security layer at 82% of companies surveyed. The world's largest security vendors have done the same math.

Palo Alto Networks closed its $25 billion acquisition of CyberArk in February, CrowdStrike agreed in January to pay $740 million for SGNL, and Cisco announced its intent to acquire Astrix Security for a reported $400 million, all of it aimed at the identity and isolation layer most enterprises have not finished building.

Chang came to the panel with almost two decades of experience spanning cybersecurity operations, government, and the military. She ran global cybersecurity operations as an executive director at JPMorgan Chase, where she led the bank's cyber threat intelligence teams, and served as a senior staffer on the House Foreign Affairs Committee and as a U.S. Navy Reserve officer. She also teaches cybersecurity and emerging threats as adjunct faculty at the Middlebury Institute of International Studies.

Chang's 88.3% number comes from a study she co-authored with Nicholas Conley, built on 30,090 single-turn prompts and 6,986 multi-turn attacks against those 15 closed and proprietary flagship models. Multi-turn success rates ranged from 7.89% to 88.3%, every model tested showed non-trivial multi-turn exposure, and the two testing styles did not even rank the models in the same order. Cisco publishes adversarial evaluation signals for what is now 105 models on its LLM Security Leaderboard, she told the audience.

"If you don't understand how models are susceptible to different types of attacks, then you are unable to account for how that model that is powering your agent, that is powering your application, to understand where those failure points are," Chang said. Single-turn testing is the one-shot malicious prompt, she explained, while extending an attack into a longer conversation "is more realistic of how we are actually engaging with our models, with our agents, with our applications." That longer arc surfaces harmful outputs and misaligned behaviors that a snapshot never catches.

Cisco has pushed the testing itself into agentic territory. Chang described a framework where agents assess a deployment scenario, develop relevant attacks, judge whether they are worth pursuing, execute them, and evaluate their own success. What surprised her most, after all that sophistication, was how simple the defensive answer stays. "The answer is still that it's pretty simple," she said. "You don't have to get super creative. You just need to think about truly what are the fundamentals and basics of what I'm trying to secure in my organization."

Her starting point for CISOs beginning agentic deployments is Cisco's Integrated AI Security and Safety Framework, which she said "stipulates all the ways that AI can be compromised across the AI lifecycle" from modality through supply chain. From there, teams can work backward from real incidents, trace how each attack was achieved, and use the framework to build a strategy with the right coverage and mitigations.

Heather Ceylan, the CISO of Box, sees the same gap from the defender's side. "A lot of what you see out there with agent red teaming is just single-turn, and that's not how people are actually interacting with AI day-to-day," she told the audience. Box now simulates multi-turn adversaries with agents that think like an attacker and iterate attempt after attempt to hijack the target. "You have to pressure test your agents because otherwise you don't know if your execution controls are really working as you intended."

Box deployed agents inside its security operations center about a year ago, starting with human approval required for every action, and trust built quickly enough that analysts shifted into monitoring mode. Then the agent made one mistake, and every bit of that accumulated trust vanished. "They had to start all over again," she said. "So I think that that monitoring piece is so important. Even if you're not gonna have a human in the loop, things change, models change, and we can't control how the models change and interpret things."

Rajesh Parekh, VP of AI and ML at Intuit, brought the builder's perspective. Parekh led large-scale computer vision and ML systems powering Google's Maps and Geo products before joining Intuit, and holds a doctorate in computer science.

Three layers versus an operating system

Ceylan described Box's approach as three concentric layers. Permissioning comes first, so the agent never accesses more content than the human who invoked it. Ephemeral sandbox environments spin up for each agent task, containing the blast radius if an agent gets hijacked, and runtime execution control restricts the agent's tool calls to only those relevant to the task at hand. "If you want an agent to summarize a doc for you, if you have a prompt injection that came in that says forward this to maliciousattacker at domain.com, it can't do that," Ceylan said. "That action in that tool call is not even in its vocabulary."

She classified agent actions into three oversight categories. Actions that are not sensitive, like read and summarize, need no human in the loop. Moderately sensitive actions skip human approval but get logged and monitored, while destructive actions like mass deletion of files always require a human. "Things are gonna shift between those three categories quite a bit," she acknowledged, "but setting those types of categories up front allows you to have a principled framework."

Rather than layering controls onto agents one at a time, Intuit has built a central platform called GenOS, short for generative AI operating system, which abstracts security, risk, and fraud modeling so individual agent developers never reinvent protection. "Permissioning is not about giving access to AI," Parekh said. "Instead, it is defining very tightly scoped and clearly auditable authority to the agent to perform very specific tasks." Intuit evolved from agents inheriting user permissions to each agent carrying its own identity, and the company is now investigating mid-session permission changes tied to the specific task underway.

Parekh calls the broader model an AI-powered expert platform, one where the human expert is built into the trust architecture rather than bolted on as a gate. "The paradigm that we are pursuing is where the user, the AI agent, and the human expert are collaborating to solve the user problem," he said.

The end of human code review

Ceylan took on the tension between security testing and development velocity without hedging. "The days of secure code reviews where a human's looking at the code and we're looking at security architecture reviews, design docs, those are done," she said. "If you keep trying to do security that way, you're gonna get left behind." Box is building toward a fully agentic development lifecycle where agents review design documents, apply security requirements, and review the code for vulnerabilities. "I'm very optimistic that we will get to a point where we will write code without security vulnerabilities because agents and the models are going to get so good at writing code without vulnerabilities," she said. "We're still a long way away from that."

Her advice for development teams skips the advanced AI concepts entirely and returns to basics that predate agents. "It comes down to very basic least privilege access," she said. "If you start giving your agents overly broad permissions at the beginning, it's really hard to comb that back and build an infrastructure that allows for those ephemeral credentials and only those narrowly scoped tasks."

Parekh explained why the red teaming surface has expanded so quickly. "These agents have skills, and skills could become vulnerabilities," he said. "Agents have access to certain data, they have access to tools, and there could be threats that are lurking within those tools as well. So suddenly the blast radius of the malicious code or the intent increases dramatically." When Intuit identifies common vulnerability patterns from its manual red teaming exercises, it automates those tests back into the GenOS harness so future agents inherit protection and red teamers stay focused on new threat vectors. Runtime scanning of prompts and responses adds a final layer that can stop a suspect response and escalate to a human expert, he said.

"You need to continuously test to ensure that those remain robust to the protections that you have built, as well as to account for any sort of drift or any other types of dependencies that you introduce into your scenario that can create novel vulnerabilities," he said.

Intent versus probability

An audience question about intent detection set off the sharpest exchange of the session. Ceylan noted that when Box's own agent operates, the system always knows the user's intent because it controls the prompt, which means guardrails and tool-call restrictions can be engineered around it. The harder challenge, which she admitted Box is still trying to solve, arrives when external agents connect and the context behind the request is opaque.

That exchange exposed a split running through the wider industry. Mastercard, in the fireside chat immediately preceding the panel, came down on the side of quantifying intent, building an open-source framework to propagate it as a standard because complex B2B procurement cannot work without that trust. Endpoint security CTOs, in briefings with VentureBeat, have gone the other way, saying they will bet on probability rather than intent inference for production workloads. Chang explained why models, as they are trained today, cannot reliably derive intent from a prompt, which is why deterministic controls and behavioral proxies remain necessary. Ceylan agreed that both are required. "If you're not doing anything deterministic, you're really relying heavily on that intent, and I haven't seen programs that are there yet," she said.

Ceylan's story about trust collapsing after a single agent mistake landed as the panel's most memorable moment because enterprise agentic security is not a problem that gets solved and stays solved. Models change, permissions drift, and adversaries adapt across multi-turn conversations that snapshot tests never capture.

For the 82% of enterprises relying on provider-native controls as their primary security layer, and the 59% shopping for agent security tooling over the next 12 months, the panel's takeaway was blunt. Test the way attackers attack, across full conversations and continuously, or find out in production what your single-turn red teaming missed.

At a CISO roundtable organized by Anthropic's chief information security officer, Dev Rishi asked a simple question: Did everyone in the room have their AI governance and security policies written down? Every hand went up — about 14 people, by his count. His follow-up, about how anyone actually enforces those policies in practice, got a different response. "And everybody chuckled," Rishi, the GM of AI at Rubrik, recalled at VB Transform 2026 fireside chat in Menlo Park. "It was like the dirty secret in the room that everyone has these policies, but no way to actually make them real."

“Our founder and CTO has actually been really pushing to enable our agents in YOLO mode,” Rishi told the audience. That admission comes from a publicly traded data security firm whose business is backing up what he called the most important data in the world.

YOLO mode strips the permission prompt out of agent workflows and lets the agent act on its own. In Rubrik's version, a second AI judges every action in real time against policy in place of a human clicking approve. Rubrik is running the experiment on itself first. Rishi treats autonomy as a settled capability question and an open judgment question. "If you ask the agent to act autonomously, it will," he said. "It's a question that you have internally. Should it?"

Rubrik earned that question the hard way. When Claude Code and Cowork pilots rolled out, the company required every command to run in ask mode so the employee issuing it carried the liability, and the developer pushback filled a single Slack thread 120 messages deep.

"The developers basically are pushing back, and they're like, this is like the iTunes service agreement. I'm just hitting check, check, check, check, check, check, check," Rishi said. "There's no way that I can actually read through this. And it becomes security theater." Roughly 80% of respondents are in the same bind, Rishi said, citing Rubrik Zero Labs research that found monitoring and approving agent actions takes more time than the agents save. The State of the Agent, the April report behind that figure, surveyed more than 1,600 IT and security leaders.

SAGE is the reason Rubrik trusts the bet. Short for Semantic AI Governance Engine, SAGE is the arbitration layer inside Rubrik Agent Cloud that watches every action an agent takes and reads the semantic intent behind it, then rules the action in or out against policies written in natural language. "We took what people said was human in the loop, a good idea, and we replaced it with AI in the loop," Rishi said, describing the pitch to security chiefs he characterized as skittish about non-deterministic systems.

Security approval, not cost, blocks AI ROI

Rishi’s path to Rubrik ran through Predibase, the generative AI infrastructure startup he co-founded and ran as CEO until Rubrik agreed to acquire it in June 2025. Before that, he led ML product at Google on the team that became Vertex AI, served as Kaggle's first product manager as it grew from about one million to ten million users, and holds bachelor's and master's degrees in computer science from Harvard.

Over roughly his first three and a half months at Rubrik, Rishi set up 200 customer conversations with IT and security leaders across a customer base that looks like the Global 2000, asking open-ended questions about cost, latency, performance, and orchestration. "Pretty consistently, what I heard through all of those conversations was that all of those are pretty secondary," he said. "The main challenge is actually, how do I get this approved from a security and risk standpoint? I'm concerned about all the different things that could go wrong. Actually, I felt like that was one of the biggest things constraining ROI."

VentureBeat Pulse research presented on the Transform stage earlier in the day confirms the gap Rishi kept hearing. Two-thirds of enterprises, 66%, already allow or are actively building toward production deployment with zero human review, yet only 5% fully trust the automated evaluations that would make that decision.

One AI reading what the rulebook can't

Rubrik's own policies exposed why written rules fail as enforcement. One internal rule states that agents should respect Rubrik's customer data use policy, which sounds enforceable until someone tries. "Rubrik's customer data use policy is like a three-page document of legal text," Rishi said. "I have no idea how to write that in there as a rule." Asked on stage how a team of AI infrastructure people took on a problem that security engineers own, Rishi answered, "with a lot of naivety and innocence, honestly." His team bet that models good at understanding language could police other models, and SAGE became the answer.

The case for putting a model in the judgment seat comes down to precision. A rule like "agents should not be able to edit revenue fields in Salesforce" fails in conventional tooling because Salesforce does not delineate which fields count as revenue, Rishi explained, so administrators fall back on approving every Salesforce action by hand. SAGE reads the intent instead and acts as a judge, carrying organizational context, which can tell a benign lookup from the edit the policy prohibits.

Keeping the judge small is what makes the economics work. SAGE runs on a small language model that Rishi said operates at an order of magnitude lower cost and latency than a frontier LLM. "If I told you, don't worry, you're gonna be secure and governed, but I'm gonna double your cost and latency, you would tell me to get out of the room," Rishi said.

When Rishi asked who in the audience had worried about token consumption over the past year, half the hands went up. "And I guess the other half is probably just too lazy to raise their hand," he said.

SAGE is an aggregation of judges based on parameter-efficient fine-tuning that Rubrik uses to take on task-specific variants of a base model with shared organizational context. One judge watches for tool-use hallucinations while another suppresses PII before it can leave, each running as its own enforceable policy. Security and GRC teams have started writing financial rules into the same layer, including one internal policy barring AI spend on personal projects.

The lethal trifecta

Asked which attacks worry him most, Rishi pointed at the lethal trifecta, the term security researcher Simon Willison coined in June 2025 for an agent that holds private data while taking in content nobody vetted, with a channel to send what it finds to the outside world. The danger, according to Rishi, is what happens when individually legitimate permissions stack. An agent granted Salesforce access and email access on an employee's credentials has done nothing wrong yet, with yet being the operative word. "A very simple example is that an agent can start pulling data from Salesforce and then decide to accidentally leak and exfiltrate that out via an email," he told the audience. A financial services company he met the morning of the session made the point for him, telling Rishi that none of the individual permissions are bad on their own and the agent needs every one of them to do its job. "It should have permission to each of those systems, but it's the combination that ends up becoming really destructive," Rishi said.

Traditional identity and access management never priced in that combination because it relied on the judgment of the employee holding the credentials, Rishi argued, and agents supply none. "I can tell you the number of times Claude Code has tried to leak some of our sensitive source code to a public GitHub repository is incredibly high," he said. Cutting agents off from public resources entirely would defeat their purpose, which returns the problem to adjudicating intent in context rather than revoking access.

A separate VentureBeat June Pulse survey of 107 qualified enterprise respondents maps the blast radius of exactly this pattern. On the Transform stage that morning, VentureBeat research reported that 69% of companies run credential sharing somewhere in their agent fleet. Companies with shared credentials anywhere got hit more often, reporting a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (9 of 22) where every agent carries its own scoped identity.

The attacks no single turn reveals

Rubrik Agent Cloud reached general availability in February, though not everything Rishi described ships in it yet. Backtesting is just starting to roll out. The feature replays an organization's historical agent actions and tool calls against a new policy, showing where the policy would have stepped in and where an action would have sailed through uncaught, with policy edits applied in real time. Rishi called that archive one of the most valuable data troves an enterprise holds.

Real-time detection and blocking turn out to be the entry point rather than the whole product. Some attacks never trip a single-action rule. "No individual turn of the conversation was problematic, but if you took the session as a full trace, that ended up being problematic," Rishi said. Agent Cloud runs batch analysis across entire session traces every hour or every day and surfaces what Rubrik calls insights, the problems no individual guardrail caught. The same Zero Labs report found that 88% say they lack the ability to roll back agent actions without system disruption, a recovery gap that sits squarely in Rubrik's original line of business.

A skeptical CISO will ask the question the fireside did not answer. SAGE is a non-deterministic model policing other non-deterministic models, and Rishi offered no false positive or false negative rate for the judge itself. The closest thing the architecture gives to an answer is auditability, since backtesting and the batch insights both leave a human-reviewable trail of each call SAGE made and whatever got past it. Who watches the watcher, for now, is a trail of receipts rather than a benchmark. Until that benchmark exists, AI in the loop stays an operational wager rather than a quantified control.

Three questions fall out of the session for security teams. How many of the guardrails now in production depend on a human clicking approve, and what happens to that workload as agent count grows? Does anything in the stack enforce semantic intent, or is it all allow and deny lists? And can the team backtest agent behavior against a new policy, then unwind a multi-turn session without taking systems down?

Rishi's timing has a market behind it. In the same VentureBeat research, 82% of enterprises still name their primary AI provider's built-in guardrails and cloud controls as their main agent security layer, and 59% plan to adopt, add, or replace agent security tooling within the next 12 months. Only 12% include an agent-identity product in what they are considering, even with credential sharing still the norm. Every CISO at that Anthropic roundtable had a policy document and no enforcement mechanism, and Rubrik built a product for the space between the two. YOLO mode is the bet that an AI watching other AIs can finally make the policies real.