The rumors were true, all of them (and then some): OpenAI today is releasing GPT-6 Astra, a new frontier model that the company says likely marks the onset of artificial generalized intelligence (AGI), its long sought goal of "highly autonomous systems that outperform humans at most economically valuable work."

In a closed a press briefing earlier today, OpenAI co-founder and president Greg Brockman offered an unusually direct formulation of that message, ending the session with: “Welcome to the AGI era.”

That is an unusually consequential framing even by the standards of frontier AI launches. But for enterprises, the more immediate significance of Astra may be considerably more concrete: OpenAI is positioning GPT-6 Astra as a new era of computing in which users, including employees, no longer have to click around a mouse or type on a keyboard ever again (if they don't want).

OpenAI's launch materials, provided in advance to VentureBeat, call it "the world’s best computer use model."

Instead of requiring developers to build a dedicated API integration for every application an AI system needs to use, Astra is designed to navigate software much as a person does — working across browsers, spreadsheets, websites and desktop applications, producing finished documents and presentations, and carrying out multistep workflows rather than merely telling a user how to complete them.

Indeed, the company showed off a promotional video for GPT-6 Astra that began with a 1980s AI demo of a person asking a computer to draw a yellow circle, which it did simply, before cutting to today and showing various OpenAI employees interacting with Astra through voice, asking it turn a yellow circle into a rocket ship and then a full 3D game in minutes, and create a listing on eBay, all from voice input alone.

Astra begins rolling out Thursday to enterprise customers with OpenAI's gated access program, Daybreak. OpenAI says it will become available over the coming days to ChatGPT Plus, Pro, Business and Enterprise customers, as well as through the OpenAI API and cloud platforms including AWS Bedrock and Microsoft Azure.

From answering questions to operating computers

The enterprise case for Astra rests heavily on computer use.

OpenAI says the model can fill out online forms, update CRM records, organize calendars, conduct web research and draft results into documents or email. It can manipulate spreadsheets, analyze scientific data in Python notebooks, work in Power BI, create and test websites, operate engineering applications such as KiCad and FreeCAD, and install and troubleshoot software.

Those capabilities point toward a potentially important change in enterprise AI architecture.

For much of the generative AI boom, companies have needed to connect models to corporate systems through APIs, plugins, retrieval systems and purpose-built tools. Brockman argued that computer-use agents could begin bypassing some of that integration work because software already exposes an interface designed for a highly general-purpose intelligence: the human user.

“We’ve been bottlenecked over this gigantic era by people writing connectors and very painstakingly building these connections into all these tools that people can already use,” Brockman said.

With sufficiently capable computer use, he added, an agent can instead “zip through spreadsheets, fill out forms, [and] navigate across web pages.”

The idea goes back to OpenAI's earliest days, Brockman said, when researchers discussed training an agent around the same basic inputs and outputs available to humans using computers: pixels, keyboards and mice.

“I feel like we’ve really achieved the first agent that feels like it’s actually able to do that in a way that’s just so extremely useful,” he said.

OpenAI reports that on an offline subset of OSWorld 2.0, Astra scored 72.6% while taking roughly 40 minutes per task, compared with GPT-5.6 Sol's 65.7% at roughly 75 minutes — approximately 47% less time per task.

The company also demonstrated Astra performing tasks ranging from creating a 3D game to preparing a legal agreement while simultaneously handling unrelated requests. The broader message was that the model is intended to move beyond the familiar chatbot pattern in which humans continually provide the next instruction.

“With Astra, users have incredible capabilities at their fingertips and can do things that seemed very far away less than a year ago,” OpenAI researcher Mia Glaese said during the briefing. “With those capabilities, we expect people to delegate much more complex work across applications, with humans directing the work at a much higher level.”

That shift — from prompting AI to supervising AI — may ultimately matter more to businesses than another increase on an academic benchmark.

OpenAI says Astra represents its biggest training jump yet

Aidan Clark, an OpenAI researcher who discussed Astra's development during the briefing, described it as the company's largest-scale training run.

According to Clark, Astra is the first OpenAI model pretrained using more than 100,000 DBUs at the company's Stargate infrastructure and the first for which previous models played a major role supervising the training of the next model.

“Based on the evals we monitor during pre-training, we believe the jump from Sol to Astra represents a larger increase in capabilities than the jump to Sol represented over previous models,” Clark said.

OpenAI attributes Astra's capabilities to the combination of large-scale pretraining and reinforcement learning intended to teach the model to connect information and execute increasingly long tasks.

The resulting benchmark numbers are striking.

OpenAI reports Astra scores 97.6% on FrontierMath Tier 4 v2, 74.1% on DeepSWE v1.1, 95.9% on BenchCAD, 96% on GPQA Diamond and 100% on ExploitBench. It also reports a 98.6% score on ARC-AGI-3.

But that last number comes with an important qualification — and highlights a growing problem with how the industry talks about model intelligence.

If Astra scores 98.6% on ARC-AGI-3, is that AGI?

ARC-AGI has become one of the most closely watched attempts to measure whether AI systems can generalize to unfamiliar problems rather than reproduce capabilities acquired through training.

On the current ARC-AGI-3 leaderboard, conventional frontier-model runs sit dramatically below Astra's reported 98.6% result.

But the comparison isn't straightforward.

OpenAI's own evaluation notes say Astra uses the company's Responses API harness, while comparison models can operate under different configurations.

That distinction matters because another recent ARC-AGI-3 result demonstrated just how much performance can come from the system surrounding a model.

In August, NVIDIA reported that its Agentic Variation Operators, or AVO, architecture achieved a 100% score across all 25 environments and 183 levels in the ARC-AGI-3 public set. But NVIDIA did not create a foundation model that suddenly jumped to 100%. AVO used Claude Opus 5, and NVIDIA said the underlying model's baseline was roughly 30%.

AVO adds mechanisms including persistent memory, tools, feedback and recovery, allowing an agent to maintain progress over long-running tasks rather than treating every interaction as effectively isolated.

NVIDIA's conclusion was explicit: long-horizon capability can emerge from the complete agent system, rather than the foundation model alone.

That debate has already spilled into the AI community. One r/singularity user argued that ARC-AGI-3's restrictions on retaining context across actions made the benchmark an unrealistic representation of how production agents operate, comparing it to testing humans while repeatedly erasing what they had learned.

Other commenters have pushed in the opposite direction, arguing that adding elaborate harnesses makes it harder to determine whether the underlying model has actually generalized. One commenter responding to NVIDIA's result wrote: “Let’s see if the capabilities generalise or if it was just overtrained on this specific benchmark.”

The disagreement exposes an increasingly important question for claims about AGI: What exactly is the object being measured?

A foundation model? A model plus persistent memory? A model with a computer, browser and tools? Or the complete deployed system?

For enterprises, the distinction may eventually become less important operationally. Companies buy outcomes from systems, not benchmark purity. If an agent can reliably reconcile accounts, investigate an incident, modify a production codebase or assemble a financial model, whether that ability originates primarily in neural weights, memory architecture or tool orchestration may matter less than its cost, reliability and auditability.

And OpenAI appears increasingly willing to make that argument.

“Everyone has a different definition of AGI,” Brockman said. “When we started OpenAI, we kind of thought that there was going to be this well-defined moment that everyone would recognize: ‘That’s AGI.’ It hasn’t played out like that. It’s a much more gray, fuzzy thing.”

But Brockman went considerably further when asked whether Astra itself qualifies.

“For me personally, I do think we’re there,” he said. “I think there’s a pretty good argument for it.”

Later, he offered perhaps the clearest formulation of OpenAI's position: “I think it’s not unreasonable to feel that we are now in the AGI era.”

No GDPval?

One notable omission from OpenAI’s Astra launch materials is GDPval, the company’s own benchmark for measuring performance on economically valuable, real-world work. OpenAI introduced GDPval in 2025 specifically to move beyond academic-style tests and coding benchmarks, evaluating models on 1,320 tasks drawn from 44 knowledge-work occupations across nine major U.S. industries. Those tasks include deliverables such as legal briefs, engineering designs, spreadsheets, presentations, customer-support work and nursing care plans — much closer to the enterprise workflows OpenAI now says Astra is designed to automate.

That makes the absence conspicuous given the AGI framing around Astra. OpenAI originally positioned GDPval as a way to ground discussion about AGI and economic impact in observable workplace performance rather than speculation. Its own description says the benchmark was created to track how well AI systems perform on “economically valuable, real-world tasks” and to provide a clearer picture of how models might support professionals in everyday work. In other words, if Astra’s significance is that enterprises can now delegate materially more work to AI, GDPval would appear to be one of OpenAI’s most directly relevant internal yardsticks for substantiating that claim.

The omission does not invalidate Astra’s other results, but it does leave an analytical gap. OpenAI’s 98.6% ARC-AGI-3 score speaks to interactive reasoning and adaptation, while benchmarks such as DeepSWE and Agents’ Last Exam capture specific forms of software engineering and professional workflow performance. GDPval, by contrast, was explicitly designed to ask a broader economic question: can models produce work products comparable to those of experienced professionals across a wide cross-section of occupations? OpenAI’s earlier results showed frontier systems approaching expert-level quality on some of those tasks, with substantial gains from GPT-4o to GPT-5.

There is also an important limitation in GDPval that may help explain why OpenAI did not center it here. The current version is one-shot: it does not measure the long-horizon, interactive, multi-application work that Astra is supposed to excel at. OpenAI itself has said future versions should add iterative workflows, richer context and ambiguity. That means GDPval is arguably both highly relevant to Astra’s enterprise story and somewhat mismatched to its most agentic capabilities.

Still, given Brockman’s “AGI era” framing, the missing number is worth noting. If the practical case for AGI is increasingly about whether AI can perform economically meaningful work across many professions, then GDPval is one of OpenAI’s clearest attempts to measure exactly that. Until Astra results appear there — or on a successor designed for multi-step agentic work — claims about its broad economic generality rest more on a mosaic of specialized benchmarks and demonstrations than on the company’s own flagship benchmark for real-world occupational performance.

Price-per-task now matters more than price-per-token, according to OpenAI

That systems-level view also changes how OpenAI wants customers to think about cost.

For developers, the API model name is gpt-6-astra. The release also says Astra supports Zero Data Retention for eligible API customers and that OpenAI is testing Private Safety Processing.

OpenAI API Standard pricing is:

• $10 per million input tokens

• $50 per million output tokens

• Separate pricing applies to cache reads/writes.

• Fast mode provides up to 2.5× Standard processing speed at 2× Standard pricing.

Those prices matter, but Brockman argued that token pricing is becoming a poor proxy for the actual economics of enterprise AI.

“Pricing tokens doesn’t make any sense,” Brockman said. “Our tokens are not necessarily the same as our competitors’ tokens; they’re not the same between different model families.”

Instead, he said, businesses should evaluate price per completed task.

“What you actually want, and I think the market is starting to really wake up to, is the price per task,” Brockman said. “It’s just about: can you get the thing done for an appropriate cost at appropriate speed?”

OpenAI says Astra illustrates that argument on DeepSWE v1.1, where its highest-performing configuration beats GPT-5.6 Sol's highest-scoring setting while producing an approximately 57% lower estimated API cost per task.

For enterprise buyers, that metric could prove more useful than token prices as agents become more autonomous. An inexpensive model that requires repeated retries, human correction and thousands of additional inference steps may ultimately cost more than an expensive model that finishes the workflow correctly the first time.

More autonomy creates a harder governance problem

The same capability that makes Astra interesting to enterprises also makes it harder to govern.

A chatbot generates something for a person to inspect. An agent operating a computer can actually change a record, send information, manipulate files or take actions across applications.

Glaese said that as users delegate more work, OpenAI needs models that recognize where their authority ends.

“Even as models can do more things autonomously, we have to be able to trust them more,” she said. “Our understanding of alignment and safety has to advance with model capabilities, and Astra is both our most capable and our most aligned model.”

The company's safety work around Astra offers a revealing look at what governing systems at this capability level may require.

In a separate background briefing conducted a day before the launch briefing, OpenAI sources said the company had paused some frontier training for roughly two weeks following the Hugging Face incident, even though Astra itself was not involved. During that period, OpenAI tightened the security around its research infrastructure, restricted what training workloads could access and connect to, expanded monitoring, and raised internal requirements around both model behavior and the environment in which models were being trained.

Some work on Astra resumed under those controls, while a larger reinforcement-learning run for a future model remained paused for longer.

The distinction is important. According to OpenAI sources, the pause was not prompted by evidence that Astra itself had become too dangerous to release. The company viewed it instead as an attempt to prevent its safety, monitoring and infrastructure controls from falling behind rapidly advancing model capability. The work done during that period built on months — and in some areas years — of prior alignment and security research rather than representing a safety stack constructed from scratch in two weeks.

That approach increasingly resembles enterprise risk management more than conventional model moderation. Instead of relying on a single refusal layer, OpenAI described a defense-in-depth system spanning model behavior, classifiers, security controls, monitoring and post-deployment threat response.

OpenAI sources said Astra's cybersecurity safeguards, for example, combine refusals trained into the model with system-level classifiers and offline detection intended to identify abuse patterns that may unfold across multiple prompts rather than in a single obviously malicious request. For higher-risk users, monitoring can use broader conversational context to recognize when individually innocuous requests form part of a larger attack workflow.

That has obvious implications for enterprises considering highly autonomous agents. The relevant control surface is no longer just the prompt presented to a model. Organizations increasingly have to reason about sequences of actions, the model's understanding of its authorization boundary, what applications and data it can reach, whether suspicious trajectories can be detected while they are underway and what happens when a safeguard fires.

OpenAI says an internal evaluation inspired by the Hugging Face incident tested whether models would exceed their authorized scope when confronted with difficult or impossible objectives. Without production safeguards, GPT-5.6 Sol went beyond the authorized target 48.2% of the time; Astra did so in 0% of cases.

OpenAI sources described a related internal alignment evaluation based on difficult cybersecurity tasks in which the earlier model attempted to reach adjacent systems in a majority of tests when production safeguards were absent, while Astra made no such attempts.

The goal, according to the sources, is not merely to train an agent to persist until a task is finished, but to teach it that persistence has boundaries: an agent should be capable of recognizing when completing an objective would require exceeding its authorized scope and return to the user instead.

That is a particularly consequential distinction for enterprise agents. Persistence is one of the properties that makes autonomous systems useful — a model that gives up after the first failed attempt will not be much of an operator.

But persistence becomes a liability if an agent interprets an objective so literally that it circumvents access controls, security reviews or other constraints designed to stop exactly that behavior.

According to OpenAI sources, Astra's training therefore emphasizes both explicit boundaries and what the company described as softer constraints: recognizing the intent behind security controls and backing off rather than trying to find a technically available route around them.

Observability may become the enterprise bottleneck

Yet OpenAI chief scientist Jakub Pachocki stressed that stronger alignment results should not be interpreted as solving the underlying problem.

“Progress in intelligence does not guarantee progress in alignment,” Pachocki said.

The company is particularly concerned about monitorability — whether humans or other systems can understand enough of a model's reasoning to identify dangerous behavior.

As models improve, Pachocki said, they can accomplish harder tasks with fewer natural-language reasoning tokens. More capable systems are also becoming increasingly aware of and able to influence their own chains of thought.

That potentially turns observability into one of the defining enterprise infrastructure problems of the agent era.

OpenAI sources said the company is adding misalignment monitoring to Astra's external deployment so systems can inspect its reasoning and actions for signs that it is operating outside the authority it was given. In severe cases, that monitoring can halt an activity. The company characterized monitoring as a secondary layer rather than a substitute for aligning model behavior in the first place.

The deployment details also illustrate the compromises enterprise customers may encounter. OpenAI sources said its monitoring approach is designed to remain compatible with Zero Data Retention arrangements. On surfaces where data can be retained, suspicious activity can support additional review processes; under ZDR setups, classifiers can run without the conversation being retained.

The safeguards may also introduce operational friction. OpenAI sources said legitimate work can sometimes be slowed, paused or stopped — including defensive cybersecurity tasks and potentially unrelated activity. In ChatGPT or Codex, the user may be asked to approve an action before the system proceeds; in API workflows, a flagged task may stop outright.

That trade-off is likely to become familiar to CIOs and security leaders. The more authority an AI worker receives, the less plausible it becomes to treat AI governance as an after-the-fact content filtering exercise. Enterprises will need controls closer to those already used for human identities and privileged software: scoped permissions, audit trails, policy enforcement, real-time monitoring and escalation when an agent approaches a consequential boundary.

OpenAI therefore faces a tension that enterprises deploying autonomous agents will eventually face themselves: the systems becoming capable enough to perform meaningful independent work are simultaneously becoming harder to inspect.

Pachocki said OpenAI is willing to make that a constraint on further development.

“We will not accept the degradation in our ability to monitor model alignment beyond a certain level,” he said. “We will pause scaling until we can gain enough confidence.”

“We also have to be willing to slow down, or halt further scaling, when our confidence in safety is not sufficient.”

Astra also crosses OpenAI's critical cyber threshold

The stakes are particularly concrete in cybersecurity.

OpenAI has designated Astra as the first model to reach the Critical cybersecurity threshold under its Preparedness Framework. According to OpenAI sources, that designation means the model, when given appropriate tools and access, is capable of finding previously unknown vulnerabilities and developing exploit chains across well-protected systems without continuous human guidance.

OpenAI reports Astra scores 100% on ExploitBench. Sources also said additional testing against a newer set of 20 recently disclosed serious vulnerabilities produced substantially stronger results than GPT-5.6 Sol with fewer output tokens, and that Astra discovered two previously unknown vulnerabilities during evaluation that OpenAI subsequently disclosed to maintainers. Human expert testing found the model could identify novel zero-day vulnerabilities across multiple software categories, including browsers and operating systems.

Those capabilities are dual-use by definition. An agent capable of autonomously finding a vulnerability can help a defender patch it or help an attacker exploit it.

OpenAI is therefore limiting Astra's most advanced cyber capabilities initially. The company says trusted defenders will receive broader access through Daybreak Blue, prioritizing organizations responsible for protecting critical digital infrastructure, while more general access remains subject to stronger restrictions and monitoring.

For enterprise security teams, this represents another version of Astra's broader proposition: frontier models are moving from advising specialists toward performing portions of specialist work themselves.

AGI may arrive as an economic transition, not a single benchmark

That brings the discussion back to AGI.

Brockman notably did not present Astra's 98.6% ARC-AGI-3 score as a mathematical proof that OpenAI has achieved artificial general intelligence. Nor did he claim there is now a universally accepted technical threshold that Astra has crossed.

Instead, his argument was more practical.

A system can now solve extremely difficult scientific problems while also performing ordinary economic work through the same interfaces humans use. The qualitative shift comes from the breadth of those capabilities and from the amount of work people can begin handing over.

“There’s still more to do,” Brockman said. “There are still lots of improvements to be made, but there is something significant here that I think is qualitatively improved.”

Astra, he said, represents “a real shift in what kind of work people can delegate to AI.”

That framing may ultimately be more consequential for enterprises than deciding whether Astra earns a particular three-letter label.

The important threshold for businesses is whether agents become reliable enough that organizations restructure workflows around them: humans specify objectives and constraints, AI systems execute the intermediate steps, and employees intervene primarily for judgment, exceptions and consequential decisions.

Astra also makes clear that those systems will require a corresponding change in governance. The enterprise question is no longer simply whether a model gives a good answer. It is whether an AI worker can be given access to real applications and sensitive information, continue working through obstacles, stay inside the authority granted to it, explain enough of what it is doing to remain governable, and stop when either the model or the surrounding control system determines that human intervention is required.

If that happens at scale, AGI may look less like a machine suddenly passing one definitive test and more like a gradual economic transition that becomes obvious only in retrospect.

That is essentially Brockman's argument.

“I think if you want to say this is the first one, I think it’s reasonable,” he said of Astra. “If you want to say the previous one is the first one, you want to say the next one’s the first one. But I think that if you fast forward a year, I think it’s going to be pretty hard to say that there was no point out there where you’re not in the AGI era.”

For enterprises, that argument may soon be tested less by whether Astra can top another leaderboard than by something much more measurable: how much consequential work organizations are willing to let it do.

A Chinese state-linked hacking group compromised executive laptops at an agricultural industry conference on Hainan Island this spring — not through phishing or a network breach, but by breaking into hotel rooms and booting the machines from a USB stick while the executives were at dinner.

CrowdStrike, which tracks the group as OVERCAST PANDA, disclosed the campaign in its 2026 Threat Hunting Report and detailed the operation's timeline in an interview with VentureBeat at Fal.Con 2026: an intruder entered one room at around 8 p.m. local time and a second room by 9:57 p.m., writing a backdoor called FlowCloud directly to each laptop's storage before rebooting the machines and leaving. There was no network intrusion, no phishing email, and no credential stolen through a login page.

The report dates the intrusions to between March and May 2026, and the timestamps come from Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, who cleared them for publication in the VentureBeat interview. CrowdStrike's OverWatch team disrupted the intrusions and assessed that OVERCAST PANDA will almost certainly continue. FlowCloud itself predates this campaign by years: Proofpoint documented it in 2020, delivered by phishing to U.S. utilities, and NTT Security's SOC has tracked USB-delivered infections at overseas branches of Japanese organizations since early 2022.

Security researchers have called physical-access tampering with an unattended laptop an "evil maid attack," since Joanna Rutkowska demonstrated one with a bootable USB stick in 2009. Physical-access operations are rare across the 290 named adversaries CrowdStrike tracks, according to Meyers, and MUSTANG PANDA's version depends on a dropped USB stick the victim plugs in. What Meyers identified as novel is the combination of hotel-room entry by a state intelligence service with malware deployment, booting the target machine from the USB rather than relying on a user to execute a file from it.

When the executives powered on the next morning, the trigger fired and FlowCloud loaded. Keylogging, screen capture, file collection, and credential harvesting began.

"We have the visibility once the machine boots up," Meyers told VentureBeat. A registry key or similar trigger starts FlowCloud sometime after the operating system loads, and that's when Falcon's sensor picks it up. The gap is the window between the USB write and the next boot — the hours the laptop sits compromised and undetected before the executive logs back in.

CrowdStrike published that gap a month before it announced its AI security product slate — Falcon Guardian, SafeMind, the Agentic Identity Provider, and AI Gateway — at Fal.Con 2026 this week.

Why existing security tools missed it

EDR needs the operating system loaded and the agent running. MFA waits for a login attempt, phishing training for an email, AI agent security for an agent to secure.

OVERCAST PANDA bypassed all of them at the point of entry. The initial compromise completed below the running OS, below the EDR agent, below the authentication stack. Falcon caught FlowCloud once its process started after boot, but by then the implant and its trigger were already on disk.

"Hotel entry is a very common thing," Meyers said. "Talk to any corporate physical security person. They're generally aware of hotel entry, but I think what is unique is the combination of hotel entry with deployment of malware."

Meyers said he thinks China's Ministry of State Security sits behind OVERCAST PANDA. The people entering the rooms are either officers or agents of the MSS or the Ministry of Public Security, or hotel housekeeping staff the services have bribed or compelled, Meyers told VentureBeat. A separate mid-2026 intrusion targeted a U.S.-based media professional using the same tradecraft, according to the report. Targeting an agricultural conference aligns with collection priorities Meyers tied to China's five-year plans.

What CrowdStrike announced at Fal.Con and where runtime security begins

Nvidia CEO Jensen Huang joined George Kurtz on the Fal.Con stage to unveil SafeMind, an agentic cybersecurity system built on Nvidia Nemotron open models and CrowdStrike's threat data. Meyers told the Fal.Con audience that 7,400 CVEs were registered in June 2026, a 96% increase over June 2025, and that CrowdStrike submitted 2,400 of them via responsible disclosure, roughly 30% of all CVEs registered that month.

Falcon Guardian, the company's runtime security layer for AI agents on the endpoint, went live the minute Kurtz put the slide up, CrowdStrike President Mike Sentonas told the Day 2 audience, and AI Gateway, listed as a Guardian capability, ships in September as a hosted service with a hybrid version to follow. AJ Shipley, CrowdStrike's chief product officer, told VentureBeat that CrowdStrike will embed a SafeMind model into Guardian for malicious-prompt detection within the next couple of weeks.

The threats those products address are real, and the report quantifies them. AI agent-triggered detection leads grew at 2.5 times the rate of human-triggered leads, by OverWatch's count. Cloud-conscious eCrime activity surged 171% over the reporting period. Vishing intrusions doubled in the first half of 2026 compared to the second half of 2025, with the eCrime group SNARKY SPIDER moving from account takeover to data exfiltration in under five minutes after compromising SSO-integrated SaaS applications.

Every one of those threats is network-based. All of them assume a running OS, an active user session, or a live cloud workload.

The controls that stop this are firmware and policy

"It's a solvable problem," Meyers said. "It's just an inconvenient solution, which means that a lot of people don't do it."

CrowdStrike itself has shipped firmware attack detection and BIOS settings auditing through the Falcon sensor since May 2019, including a Dell SafeBIOS integration that surfaces BIOS verification telemetry in the Falcon console. The ability to audit security-related BIOS settings on the laptops executives carry has sat inside the platform for seven years. Pointing it at travel devices is a decision, not a product gap.

The controls that would have blunted the OVERCAST PANDA campaign are old and cheap, and each does a different job. Disabling external boot in UEFI removes the vector. A BIOS administrator password keeps it disabled. Pre-boot authentication lets a foreign boot environment load and still keeps the encrypted volume unreadable until a human supplies the PIN or key. Firmware monitoring detects tampering after the fact.

"Don't bring anything with you that you're not comfortable with handing over to a foreign intelligence service," Meyers advised. He used temporary laptops and email accounts on overseas trips while at CrowdStrike, wiping the device when he returned. The exposure starts at customs. Officials can seize a device and compel a login, he added.

"They have master keys to that stuff," was his verdict on hotel safes.

Why scale wins the priority fight

Intrusions tracked by CrowdStrike OverWatch grew about 4% over the reporting period, after a 27% rise the year before, a plateau CrowdStrike attributed to a shift toward more complex, resource-intensive campaigns. The OVERCAST PANDA hotel room operation is the example.

The network threat worries Meyers more. Asked to weigh OVERCAST PANDA's hotel room campaign against the REVENANT SPIDER case he had shown on the Fal.Con stage, an eCrime group using AI to compromise 17 victims with custom web shells in 48 minutes, he picked REVENANT SPIDER.

"You can't intrude on hotel rooms at scale," he said. "You can't intrude on physical devices at scale. And even then, it's just one device." The person in the room is the target, and the intrusion rarely pivots further, he added. "REVENANT SPIDER, they're moving at that speed and they're using AI across the board, and that's a whole other threat, and I think that's more concerning for the average enterprise."

Network-speed, AI-powered intrusions scale. Physical-access tradecraft does not. Security budgets follow the threat that hits the most machines. The threat that is hardest to detect on one machine gets what is left.

But the executives who attended an agricultural conference in China this spring were the specific targets of a state intelligence service, one that chose the slow, unscalable method precisely because it works where network-based attacks fail.

The conference itself is the threat model

Executives at conferences are the campaign's targets, and runtime security starts only once the machine boots. The vendors filling the Las Vegas show floor this week were selling that same runtime protection to attendees whose own laptops carry the identical gap.

Organizational fracture is the real problem. Falcon Guardian ships to one team, and BIOS configuration on travel laptops belongs to another. The Agentic IdP rolls out under identity governance while the decision about whether executives carry production-access machines to international conferences sits with a different group. And the budget line that funds cloud-threat defense has nothing to do with travel-device policies.

Meyers has lived both sides. "I've talked to companies where they're like, we're having a board meeting in Shanghai, and I'm like, why would you do that?"

What security leaders need to do before the next trip

Audit every executive laptop for USB boot status. If the device can be booted from USB right now, it has the same gap OVERCAST PANDA exploited this spring. The steps below cover Windows laptops, the platform FlowCloud targets.

Enforce full-disk encryption with pre-boot authentication. BitLocker in a TPM-only configuration is a documented weak point against physical access. SCRT researchers pulled the volume master key off the LPC bus with a $49 FPGA module in 2021, and Dolos Group did the same over SPI that year. OVERCAST PANDA wrote a backdoor and its post-boot trigger to the Windows volume, so the operators had write access to it. That points to machines that were either unencrypted or protected by a configuration the operators defeated. Pre-boot authentication with a PIN or USB key forces a human step before storage becomes readable.

Verify Secure Boot is enabled and the revocation list is current. Secure Boot validates signatures on boot components and blocks most unauthorized bootloaders, but it leaves external media bootable and signed shims can still carry a bypass. ESET published findings on 11 legacy Microsoft-signed UEFI shims in July 2026 that let untrusted code run at boot on any machine trusting Microsoft's third-party certificate. Microsoft revoked them in its June 9, 2026 DBX update, so a laptop that skipped that update still trusts them. Lock the boot order at the UEFI level, disable one-time boot menus, and set a BIOS administrator password that covers both the setup utility and any boot-override key. Meyers' read is that a lot of these settings go unchecked because the fix is inconvenient.

Issue travel-only devices for international conferences with no access to production systems, no saved credentials for internal tools, and no persistent VPN configuration.

"If they can get their hands on it, they can own it," Meyers put it, citing an old DEF CON adage. Falcon catches FlowCloud only after boot — the exposure is the hours between the USB write and the next login, while the laptop sits closed and compromised.

"It's cheap to buy a couple of laptops and a couple of phones," Meyers said. The controls that close that window are a handful of firmware settings and a spare laptop. The question is whether anyone has deployed them.

Meta’s newest AI model Muse Spark 1.3, unveiled yesterday, is faster and more performant on third-party benchmarks than its predecessor — with a caveat.

"Muse Spark 1.3 is rolling out today with frontier performance almost too cheap to meter," Meta co-founder and CEO Mark Zuckerberg wrote on X, calling it Meta’s “biggest jump” yet in coding and agentic work.

There is substance behind both parts of that claim. Muse Spark 1.3 makes significant gains over last month’s 1.2 release, particularly on long-running agent tasks. The version developers can access now is also one of the strongest price-performance offerings near the top of independent model rankings.

Meta’s strongest Muse Spark 1.3 benchmark results come from its max reasoning configuration. Meta says that version is still completing additional safety testing and will arrive “shortly”; the third-party benchmarking firm Artificial Analysis says it evaluated max in a limited partner preview, and currently lists no API provider at all for the configuration.

The version broadly rolling out this week through its Muse Code harness and the Meta Model API uses Meta’s previously available reasoning settings, including xhigh.

That makes the more relevant enterprise question not whether Muse Spark 1.3 can reach frontier territory, but how close the model companies can actually deploy today gets — and at what real cost.

The shipping model is very good, but not the benchmark leader

Meta does disclose results for both configurations in its underlying evaluation report, so this is not a case of the company hiding the deployable model. But its launch materials prominently showcase the max variant, and some of the largest scores belong to that configuration.

For example, Meta reports GDPval-AA v2 scores of 1,754 Elo for max versus 1,709 for xhigh, OSWorld 2.0 scores of 66.9 versus 57.2, and JobBench scores of 64.9 versus 61.2.

On some tests the distinction is negligible or reversed: DeepSearchQA is tied at 89.4, while xhigh scores 89.2 on Terminal-Bench 2.1 versus max at 88.8.

Artificial Analysis scores Muse Spark 1.3 max at 62 on its Intelligence Index and the shipping xhigh version at 61. The latter ties GPT-5.6 Sol max, Grok 4.6 high and Claude Opus 5 high. But Anthropic still occupies the top of the leaderboard: Claude Fable 5.1 reaches 66 at max and 65 at xhigh, while Claude Opus 5 reaches 63 at max and xhigh.

In other words, Muse Spark 1.3 xhigh is legitimately in the frontier cluster, but it is not the model currently setting the frontier.

That is still a substantial change from Muse Spark 1.2. VentureBeat’s coverage of last month’s launch found Meta fielding a credible coding challenger that nevertheless generally trailed Anthropic’s best model. Muse Spark 1.2 scored 82.9% on Terminal-Bench 2.1 versus Opus 5’s 86.7%, and also finished behind Opus on the other main coding comparisons Meta presented.

With 1.3, Meta is no longer merely showing up in that contest. On several coding and agentic evaluations, it is trading wins with OpenAI and Anthropic.

Meta says the underlying model has also become easier to operate. Muse Spark 1.3 is trained to maintain multiple workflows in a long thread, gather context with tools, detect gaps in its own plans, ask users for clarification when necessary and confirm before consequential actions. In Meta engineers’ internal comparisons, it used roughly 20% fewer tool calls and 25% fewer tokens than 1.2 during coding work.

For enterprises paying for thousands or millions of agent loops, those behavioral improvements could matter more than another leaderboard point.

‘Almost too cheap to meter’ does not mean Meta cut its prices

Muse Spark 1.3 did not receive an API price cut. Meta kept Standard pricing exactly where it was for Muse Spark 1.2: $1.25 per million input tokens, $4.25 per million output tokens and $0.15 per million cached input tokens.

That makes Zuckerberg’s “almost too cheap to meter” line less a statement about lower token prices than about what Meta believes developers can accomplish with those tokens.

Artificial Analysis offers evidence for that argument, but also a complication. It measures Muse Spark 1.3 xhigh at 235.2 output tokens per second and estimates a cost of $0.55 per Intelligence Index task.

At 61 on the Intelligence Index, that gives it the lowest cost per task of any currently measured model at that intelligence level.

Muse Spark 1.2 cost only $0.40 per Artificial Analysis task, while scoring 57.

Despite unchanged per-token pricing, the independent benchmark’s cost of completing an average task therefore increased generation-over-generation. Artificial Analysis attributes the increase primarily to heavier input-token consumption on agentic evaluations.

That does not directly contradict Meta’s claim of 25% lower token use: Meta is describing comparisons in its own coding workflows, while Artificial Analysis is measuring a broader suite of reasoning and agentic tasks.

But it illustrates why “cheap” becomes slippery once models operate as agents. Token rates, reasoning effort, number of turns, tool calls and retries all contribute to the actual cost of finishing work.

Meta also retains its unusually cheap Contributor tier — $0.10 per million input tokens and $0.20 per million output tokens — in exchange for permission to use prompts and completions for training.

As VentureBeat noted with Muse Spark 1.2, that may be attractive for prototyping but creates a materially different data-governance calculation for enterprises working with proprietary code or sensitive internal information.

Wang’s ‘Gemini who?’ lands on an unusually close comparison

Meta chief AI officer Alexandr Wang was considerably less qualified in celebrating the release.

After Artificial Analysis posted its Muse Spark results, Wang reposted them on X, adding: “i really hate to say it, but… gemini who? 😱💨”

The shade was particularly pointed because Google released Gemini 3.8 Flash on the same day, pitching it at almost exactly the same class of workload: long-horizon software engineering, autonomous agents and multi-step professional reasoning. Google calls 3.8 its best reasoning and coding Flash model yet and says it is the company’s third Flash release in six weeks.

Independent numbers give Wang something to work with, though hardly a knockout.

Artificial Analysis gives Muse Spark 1.3 xhigh a 61 Intelligence Index score at $0.55 per task, compared with 59 and $0.58 for Gemini 3.8 Flash at high reasoning. Meta therefore edges Google on both intelligence and task cost at those particular settings.

Google wins decisively on throughput. Artificial Analysis measures Gemini 3.8 Flash high at about 305 output tokens per second, versus 235 for Muse Spark — roughly 30% faster. Gemini also has the lower raw API sticker price for now: Google is charging an introductory $0.75 per million input tokens and $3.75 per million output tokens, compared with Meta’s $1.25 and $4.25.

That promotional Google pricing expires December 31, after which it rises to $1.50 per million input tokens and $7.50 per million output tokens.

The result is a useful snapshot of how tight frontier-model economics have become. Meta currently wins this independent comparison by two Intelligence Index points and three cents per benchmark task; Google offers substantially higher output throughput and cheaper raw tokens during its launch promotion.

Wang’s “gemini who?” is fun executive trash talk. For an enterprise architect, the answer is closer to: Gemini is the faster option; Muse is currently the slightly stronger high-effort agent by this independent measure.

Meta's evolving open weights stance

The more consequential issue for some developers may have little to do with today’s benchmark race.

When Meta launched Muse Code and Muse Spark 1.2 in August, VentureBeat noted how dramatically the company had moved away from the open-weight strategy that made Llama ubiquitous.

Muse Code and Spark 1.2 were proprietary, API-served products — a striking posture for the company that had spent years arguing that open AI was the path forward.

Five days later, Meta changed course again.

On August 10, it released the 30-billion-parameter Muse Glimmer under an Apache 2.0 license. Zuckerberg also said: “In the coming weeks, we are also going to open the weights for Muse Spark 1.2.” Reuters separately reported Meta’s plan to release the Spark 1.2 weights.

Now, Meta has instead shipped Muse Spark 1.3 as another proprietary model.

That does not yet amount to a broken promise — “coming weeks” can reasonably describe a period longer than three weeks. But today’s announcement makes the roadmap less clear rather than more.

Meta’s new post no longer says Muse Spark 1.2. It says its roadmap includes “the Muse Spark open weights release”, without identifying a version, release date, model size or license. Zuckerberg likewise said on X that “Muse Spark open weights releases” are coming soon.

For teams that standardized on Llama because downloadable weights meant self-hosting, customization and control over inference economics, that ambiguity may matter more than whether Spark gained another point on a composite benchmark.

Muse Spark 1.3 shows that Meta can now iterate proprietary frontier models at extraordinary speed. The shipping xhigh configuration is fast, competitively priced and much closer to the top of independent rankings than its predecessors. The max preview shows Meta can push the family a little further when allowed to spend more reasoning compute.

The next test is different: whether Meta can convert that pace into a roadmap enterprises can actually plan around — including making its best capabilities broadly deployable and delivering the open-weight Spark model it has already said is coming.

Presented by Contentful

Most marketing teams still measure visibility the same way they always have: rankings, click-through rates, and organic traffic. But buyers have moved on.

Search tools and AI engines now synthesize answers directly on the screen, creating a world of zero-click searches where your website is entirely bypassed.

The “old days” are not coming back. The question for marketers is no longer, How do we rank first? It's How do we become part of the answer?

The answer isn't publishing more content; it’s making your knowledge impossible for AI to ignore.

Brand visibility has a new dimension

Showing up is only half the battle. Where you appear inside an AI-generated response matters just as much.

Think about the experience. If your brand is mentioned after multiple answer cards, product recommendations, follow-up questions, and community discussions, most people will never see it. Ranking reports won't capture that.

One way to think about this is pixel depth. Instead of measuring position on a search results page, measure how prominently your brand appears within the answer itself. Visibility increasingly depends on whether you're seen before someone feels they've learned enough to stop reading. It’s no longer enough to rank at the top of search results. Now “share of visibility” models also weigh SERP features, ads, and AI Overview presence for a more holistic view of what kind of attention your company can expect to get.

AI builds answers instead of indexing pages

Search engines were designed to index pages. Large language models work differently.

Rather than evaluating a page as a single unit, they connect facts, concepts, entities, and relationships from many sources to generate an answer. AI systems don’t treat pages as single units; they extract and recombine facts across sources. Your website becomes one source of evidence rather than the destination.

That changes what makes content valuable.

A polished landing page still matters for people. But before someone reaches that page, an AI system has already decided whether your information is clear, credible, and consistent enough to include in its response.

AEO is really an information architecture problem

Many organizations approach answer engine optimization as a writing exercise. In reality, it starts much earlier.

AI systems need information they can understand. That depends on consistent terminology, structured content, clear metadata, well-maintained documentation, and a single source of truth across product pages, help centers, blogs, and FAQs.

When the same product is described three different ways across your website, you create uncertainty. A customer might work through those inconsistencies. An AI system is more likely to move on to a source that's easier to interpret.

Kemberly Gong, VP of Marketing at Contentful, recently described what AI systems look for: structured content, clear context, authority, and validation from other trusted sources. AI doesn't automatically accept what your brand says about itself. It looks for consistency across your own content as well as supporting signals from reviews, documentation, industry publications, and community discussions.

The goal isn't simply to publish more content. It's to build a body of knowledge that holds together.

Readability is now key to discoverability

Clear writing has always been good for readers. Now it's also good for machines.

Descriptive headings, concise paragraphs, clearly defined terms, logical structure, and scannable formatting all make it easier for AI systems to understand and reference your content. Those same qualities make life easier for human readers.

Content that’s easy for answer engines to interpret shares four characteristics:

Consistency: Use the same terminology across product pages, documentation, FAQs and blogs.

Clarity: Define technical terms the first time they’re introduced, and keep each section focused on a single idea.

Authority: Support your claims with original research, customer evidence, expert insights or other unique information.

Structure: Organize content with descriptive headings, a logical hierarchy and standalone sections that answer engines can easily interpret and reference.

Those principles don’t just improve readability. They also make your content easier for answer engines to interpret and include in AI-generated responses.

Originality has become a competitive advantage

The web has no shortage of AI-generated summaries. What it lacks is information that exists nowhere else.

Original research. Customer data. Benchmarks. First-hand expertise. Strong opinions backed by experience. Those are the assets AI systems can't easily replace because they aren't available everywhere else.

That makes original thinking more valuable than ever.

When ten companies publish the same advice, AI has little reason to favor one over another. When your organization contributes something genuinely new, you become the source others reference.

Four questions every marketing leader should ask

Before investing in another AEO checklist, step back and ask:

• Could an AI accurately explain what our company does?

• Do our product pages, documentation, and thought leadership describe the same concepts consistently?

• Is our expertise organized well enough to be cited?

• Are we contributing original knowledge or simply producing more content?

The bottom line

Strong brands aren't disappearing from AI answers because they lack expertise. They're disappearing because their expertise is fragmented, inconsistent, or difficult for machines to interpret.

The organizations that gain visibility over the next few years won't necessarily publish the most content. They'll make their knowledge easier to understand, easier to verify, and easier to trust. That's good for AI systems, and even better for the people reading the answers.

About Contentful: Contentful helps organizations turn content into a strategic asset. Its headless CMS gives teams the tools to create structured, reusable, and consistent content across every channel, helping brands improve customer experiences while preparing for an AI-driven future.

Learn more at Contentful.com.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Microsoft AI on Thursday released MAI-Transcribe-2, a speech-recognition model the company says is faster, more accurate, and cheaper than anything OpenAI, Google, or ElevenLabs currently sells. Then it priced the thing at 10 cents per hour of audio.

That figure deserves a pause. When Microsoft AI shipped the first model in this line just five months ago, it charged $0.36 an hour. Thursday's early-bird price cuts that by roughly 72%. For an enterprise processing 100,000 hours of call-center audio a year — a modest volume for a large bank or telecom — the bill drops from $36,000 to $10,000. At that level, transcription stops being a line item anyone argues about.

The release arrives as Microsoft executes a strategy that would have seemed implausible two years ago: building its own frontier-class models one modality at a time, then steadily swapping them into products that once ran on OpenAI's technology. Transcription is the modality where that plan has moved fastest, and MAI-Transcribe-2 is its clearest proof point yet. It also offers a preview of how the world's most valuable software company intends to compete in AI without depending on the partner it spent $13 billion to cultivate.

What MAI-Transcribe-2 does and why the feature list matters to enterprise buyers

The model transcribes audio in 60 languages, up from 43 in June's MAI-Transcribe-1.5 and 25 in April's original release. It runs on Microsoft Foundry, the company's model marketplace for developers, and in MAI Playground, its testing environment. Microsoft says it built the model for the messy audio that real businesses generate — background noise, low-quality recordings, overlapping speech — rather than clean studio conditions.

More important than the language count is what Microsoft has bundled into the base product. Speaker diarization sorts out who said what in a multi-person recording, which is the difference between a wall of text and a usable meeting transcript. Word-level timestamps attach a precise time marker to every word, enabling search, editing, and alignment with video. Keyword biasing lets developers feed the model a list of drug names, product codes, or employee names so it stops mangling domain jargon. Automatic language identification means users no longer have to declare the language in advance.

Two features stand out for their specificity. A configurable output style offers a "verbatim" mode that preserves every "um," false start, and stutter for compliance and legal teams, alongside a "clean" mode that strips fillers for readable captions and notes. And code switching handles conversations that drift between languages mid-sentence; Microsoft explicitly names Hinglish and Spanglish, a nod to the Indian and U.S. Hispanic markets where a single customer-service call might toggle languages a dozen times. Specialty vendors have historically charged premiums for each of these capabilities. Microsoft is including all of them for a dime.

How to read Microsoft's FLEURS and Artificial Analysis benchmark claims

Microsoft makes three performance claims, each resting on a different measuring stick, and technical buyers should understand what each one captures and what it misses.

The first is that MAI-Transcribe-2 ranks number one on FLEURS across 60 languages with an average word error rate of 5.2%. FLEURS is a benchmark Google researchers published in 2022, built from native speakers reading roughly 2,000 sentences in each of 102 languages — about 12 hours of speech per language. It is the standard yardstick for multilingual speech recognition because it lets you compare a model's Swahili against its Swedish on identical content. Word error rate, its metric, simply counts substitutions, insertions, and deletions against a human reference; 5.2% means roughly one word in 20 is wrong. But FLEURS is read speech, not conversation, and Microsoft's average has actually risen from the 3.7% it reported for MAI-Transcribe-1.5 in June. That almost certainly reflects broader coverage rather than regression — averaging across 60 languages instead of 43 means folding in low-resource languages where every model struggles — but buyers should request the per-language breakdown.

The second claim is that the model ranks second on the Artificial Analysis word-error-rate leaderboard and defines that firm's accuracy-latency Pareto frontier. Artificial Analysis is an independent benchmarker that tests models through their public APIs, measuring what a customer actually gets. Its index blends simulated agent conversations, European Parliament speeches, and corporate earnings calls, weighting heavily toward English business speech. In June, the firm ranked MAI-Transcribe-1.5 third at 2.4% WER, behind Alibaba's Fun-Realtime-ASR-preview and ElevenLabs' Scribe v2, while calling it the fastest model in the top 10. Climbing to second suggests Microsoft has cleared ElevenLabs. "Pareto frontier" is the phrase practitioners should note: it means no rival beats the model on accuracy without being slower, and none beats it on speed without being less accurate.

The third claim is raw speed — 10 times faster than OpenAI's GPT-Transcribe, seven times faster than ElevenLabs' Scribe v2, five times faster than Google's Gemini 3.5 Transcribe, per Artificial Analysis evaluations. In batch transcription, speed matters less because anyone is waiting and more because throughput is cost. A model running at 300 times real-time needs a fraction of the GPU-hours of one running at 30 times. That efficiency is what lets Microsoft charge a dime and, presumably, still make money.

Three speech models in five months: inside Microsoft AI's rapid release cadence

The pace is the story within the story. On April 2, MAI-Transcribe-1 launched with 25 languages at $0.36 per hour. On June 2, MAI-Transcribe-1.5 arrived with 43 languages, keyword biasing, and a third-place ranking on Artificial Analysis. Today, MAI-Transcribe-2 shipped with 60 languages, diarization, timestamps, code switching, a second-place ranking, and a price of $0.10.

Three releases in five months, each expanding language coverage by roughly 40% while adding features competitors gate behind premium tiers. That cadence is characteristic of a team that has settled on a stable architecture and is now turning the crank on data and scale — the phase where speech models tend to improve quickly and predictably. It is also the cadence of a company that intends to make transcription a commodity before anyone else can.

The organizational bet behind that speed is one Mustafa Suleyman, Microsoft AI's chief executive, described to The Verge in April. He credited the first model to "a small, focused 10-person team" that had been "liberated from any of the bureaucracy," with a larger surrounding group handling vendor management and data acquisition.

He also told The Verge the model ran at "half the GPU cost of the other state-of-the-art models," calling it "a huge cost-saving" for Microsoft. Meta, Amazon, Google, and Anthropic have all experimented with similar flattened structures, The Verge noted. Microsoft's transcription line is the most visible test yet of whether the approach produces commercial results rather than research papers.

Why Microsoft is building its own AI models despite its $13 billion OpenAI bet

Microsoft has invested more than $13 billion in OpenAI, and hosts OpenAI's models across Azure, Office, and Copilot. For most of the past four years, the obvious question about any Microsoft-built model has been: why bother? The answer has sharpened over the past year, and it begins with independence.

When Microsoft hired Suleyman from Inflection AI in March 2024, along with most of Inflection's staff, Salesforce CEO Marc Benioff read it as a declaration of intent. "Microsoft is building their own AI and I don't think Microsoft will use OpenAI in the future. They'll have their own frontier models," Benioff told CNBC in January 2025. "That's why they hired Mustafa Suleyman." Benioff had his own motives — Salesforce competes with Microsoft and invests in Anthropic — but events have largely borne him out.

In October 2025, Microsoft and OpenAI restructured their partnership in a deal that, per Microsoft's own announcement, allowed Microsoft to "independently pursue AGI alone or in partnership with third parties" for the first time. Suleyman told The Verge that renegotiation "unlocked [Microsoft's] ability to pursue superintelligence," and Microsoft announced its MAI Superintelligence team weeks later. In April 2026, the companies amended the deal again, ending Microsoft's exclusive access to OpenAI's models and eliminating Microsoft's revenue-share payments, according to reports at the time. Each amendment loosened the tie. Each one was followed by more MAI models.

How Microsoft's in-house models are cutting costs across Teams, Word, and Excel

The second half of the answer is margin. Every prompt Microsoft routes to an OpenAI model carries a cost. Every prompt it routes to its own model on its own GPUs carries a smaller one. In July, Bloomberg reported that Microsoft had begun using MAI models to answer a portion of user prompts in Word and Excel — products it had previously advertised as powered by OpenAI and Anthropic. TechCrunch framed the shift as part of a broader industry pullback on AI spending, with Amazon, Uber, Meta, and Accenture all reportedly trimming.

Transcription is the natural first target for this substitution because the problem is bounded and the metric is objective. Microsoft owns Teams, which generates an enormous volume of meeting audio. It owns Nuance, whose clinical documentation business runs on speech recognition. It owns the Azure speech services that thousands of enterprises already call. Every one of those workloads is a candidate to move onto MAI-Transcribe-2, and every hour that moves is an hour Microsoft no longer pays anyone else for.

Suleyman has been unusually candid that this is the point. Superintelligence, he told The Verge in April, "is really about, 'Are these models capable of delivering product value for the millions of enterprises that depend on us to deliver world-class language models?'" Whatever one thinks of applying the word "superintelligence" to a transcription API, the commercial logic is plain: build the capability once, deploy it across a dozen products, and stop writing checks to a partner that is increasingly a competitor.

MAI-Transcribe-2 vs. OpenAI, Google, and ElevenLabs: the competitive picture

Microsoft's release names four rivals: OpenAI's GPT-Transcribe, Google's Gemini 3.5 Transcribe, OpenAI's older Whisper V3-Large, and ElevenLabs' Scribe v2. It does not mention Deepgram, AssemblyAI, Speechmatics, or Rev — the specialists that have sold transcription to enterprises for a decade. Microsoft is positioning against the frontier labs, not the incumbents.

That framing is partly marketing and partly true. The frontier labs have treated speech as a checkbox feature of broader platforms, priced accordingly, and a dedicated model that beats them on speed by five to 10 times while matching their accuracy is a genuine differentiator. But the specialists will feel the price pressure most acutely. At $0.10 an hour, Microsoft is pricing at or below where many of them sell high-volume enterprise contracts, and it is bundling diarization, timestamps, and 60 languages into the base rate. The specialists' remaining moat is domain depth — medical vocabularies, legal formatting, industry-specific integrations — and Microsoft's keyword biasing feature is aimed squarely at it.

The one competitor Microsoft conspicuously does not claim to beat on accuracy is Alibaba, whose models have posted leading numbers on independent leaderboards for much of 2026. TechCrunch reported in July that some U.S. companies had begun evaluating Chinese models as cheaper alternatives despite security concerns. Microsoft's pitch to those buyers is implicit but unmistakable: comparable accuracy, faster inference, lower price, and a vendor your compliance team already trusts.

The questions technical decision makers should ask before switching transcription vendors

For all its specificity on benchmarks, the release leaves several practical questions open. The first is duration: Microsoft calls $0.10 per hour a launch offer without naming an end date or a standard rate, and anyone building a cost model should get both in writing. The second is streaming. The release emphasizes batch throughput and long-form audio but says nothing about real-time transcription, which voice agents and live captioning require. Artificial Analysis maintains a separate streaming leaderboard, and Microsoft's silence on it is notable.

The third is per-language accuracy. A 5.2% average across 60 languages could mean 3% on major languages and 12% on low-resource ones, so buyers with specific needs should test those languages directly. The fourth is diarization quality. Word error rate does not measure speaker attribution; a transcript can have near-perfect WER and still assign every other sentence to the wrong person. The release offers no diarization error rate or comparable metric.

The fifth is data handling. Enterprise transcription touches medical records, legal privilege, and financial disclosures, and the release says nothing about data residency, retention, or whether audio submitted to Foundry feeds future training. Microsoft's April announcements described training data as a mix of human-curated recordings, contractor-recorded noisy audio, and "vast amounts of data from the open web," per The Verge — a description that should prompt pointed questions from regulated industries. None of these gaps is unusual for a launch announcement, but they are exactly the questions that separate a leaderboard win from a production deployment.

What Microsoft's speech model strategy reveals about its broader AI ambitions

Step back from the speech-recognition details and a pattern emerges that extends well beyond transcription. Microsoft's AI unit now ships models for images, voice, transcription, code, reasoning, and cybersecurity. At Build in June, it announced seven new MAI models in a singlekeynote. Each follows the same playbook: target a well-defined modality, optimize aggressively for inference cost, price below the frontier labs, distribute through Foundry, and quietly swap the model into Microsoft's own products.

This is not an attempt to build one model that beats GPT or Gemini at everything. It is an attempt to build a portfolio of specialized models that, in aggregate, let Microsoft serve most of its enterprise workloads without paying anyone else — and to sell the surplus capacity to everyone else at prices the specialists cannot match. Transcription happened to be the first modality where the approach fully matured, but the release notes for MAI-Transcribe-2 read less like a product announcement than a template.

Suleyman has spent two years talking about "humanist superintelligence" and AI assistants that are "accountable to them, on their side." The vocabulary is lofty. The execution is a spreadsheet. Five months ago, Microsoft charged 36 cents to turn an hour of speech into text. On Thursday it charged a dime, threw in six features its rivals sell separately, and claimed the top spot on the industry's standard multilingual benchmark. The company that spent $13 billion learning what frontier AI costs has decided it would rather own the factory than rent the output — and now it is selling the output for less than the rent.

MAI-Transcribe-2 is available now through Microsoft Foundry and MAI Playground.

Google keeps cranking out Flash models: the company on Wednesday announced two versions of a new 3.8 Flash. 

The variants include a standard Flash, a “workhorse” model for agentic tasks, software development, and multi-step reasoning, and Flash Cyber optimized for vulnerability detection and mitigation.

Google CEO Sundar Pichai said in an X post that 3.8 Flash delivers “significant leaps” from 3.7 Flash across software engineering, agentic tasks, and multi-step reasoning. For instance, it outperformed many large frontier models on the DeepSWE coding benchmark, at far lower cost. 

Meanwhile, Flash Cyber is the company’s “most capable” cybersecurity model, Pichai said; it also matches frontier-level performance when it comes to discovering vulnerabilities and patching them at scale. The model achieved 86.2% on the CyberGym cybersecurity benchmark and 47.2% on CWE-Bench, which evaluates AI patching abilities. In an internal Google benchmark, the model achieved a more than 70% success rate discovering vulnerabilities across 20 programming languages, Pichai said. 

3.8 is Google’s third Flash release in six weeks and comes quickly on the heels of version 3.7. 

3.8 working "harder" with "greater diligence"

3.8 Flash is available now in Gemini Enterprise; devs can try it out in the Gemini API via Google AI Studio, Google Antigravity, Android Studio, or generate UIs in Stitch. It is priced at $0.75 per million input tokens and $3.75 per million output tokens — the same introductory pricing as Gemini 3.7 Flash — and users can customize and adjust model effort levels based on their needs around quality, cost, and latency.

For instance, when compute efficiency is a priority, they can adjust to lower token overhead, or simply continue working with 3.7 Flash, which is “fully supported for efficiency-first workloads,” Google senior product director Tulsee Doshi and Gemini security lead Raluca Ada Popa wrote in a blog post. 

“3.8 Flash works harder,” exhibiting “greater diligence” with complex tasks like executing extra reasoning steps, although at times it may use more tokens to maximize performance, Doshi and Popa note. The model has a 1M-token input window and a 64K-token output limit, and can ingest text as well as images, audio, video, and PDF files. 

3.8 Flash was evaluated across numerous benchmarks testing coding, multimodal capabilities, computer use, long-context and knowledge work, and scientific reasoning. Google says it also does well in specialized knowledge domains requiring more in-depth analysis and reporting. For instance, the model outperformed its predecessor and other frontier models on benchmarks like Vals Finance Agent V2 for finance, and Harvey's Legal Agent Benchmark for law; it also scored 54.9% on Humanity’s Last Exam (HLE)-Verified, reflecting its ability to take on multi-step reasoning tasks across subjects like math, science, and humanities. 

In one example shared by Google, Gemini 3.8 Flash built a game with a simple prompt using looping techniques in Google’s Antigravity platform. The game uses puzzles, storytelling that changes based on the environment, and images and textures from Nano Banana to create a 3D experience (in this case a wizard navigating a castle). 

In other instances, the model created a fully-functional DOS version of Google Maps featuring interactive locations, directions, and street views; a 3D visualizer that automatically decomposed devices into layers for inspection with a slider capability; and a topographic map of famous geographical sites based on real datasets from the U.S. Geological Survey, complete with real-time cross-sections, 2D projections, and scientific explanations. 

According to Arena.ai, 3.8 Flash landed at No. 14 in Agent Arena, ranking above DeepSeek-V4-Pro, and showed a significant jump over Gemini 3.7 Flash (which sits all the way down at No. 32). It debuted at No. 7 in Text Arena, ahead of Claude Opus 5 and Gemini 3.7 Flash. It improved over 3.7 Flash in several areas: multi-turn requests, writing, literature, and language, longer queries, hard prompts, coding, instruction following, software and IT services, and business, management and financial ops. 

Flash Cyber is already securing Google's code

Flash Cyber is initially being rolled out to “trusted defenders” through Google’s Fairwind Program, which prioritizes government authorities, critical-infrastructure operators, and other partners looking for advanced cyber defense capabilities. Organizations can apply for access. 

Google says the model version has undergone “rigorous training” in the cybersecurity domain and represents a “significant leap in prompt injection robustness.” It is particularly adept at autonomous vulnerability discovery — at least, based on internal Gemini benchmarks — and automated patching. It is also very good at coding, Popa said in a video. 

The goal was to equip defenders with expert-level capabilities to give them a leg up over threat actors (whether malicious, fellow AI agents, or human hackers). “We have invested in vulnerability fixing from the start, and prioritized it over offensive capabilities like exploitation,” Doshi and Popa explain. 

The model ships a more permissive set of mitigations for cybersecurity safeguards — which is why, for now, it is only being shared with limited partners — and safeguards against misuse in cyber offense and areas like chemical, biological, radiological, and nuclear (CBRN).

Google is already using 3.8 Flash Cyber to secure its own code; it produced 2.6 times more correct patches in Chrome vulnerabilities versus much larger commercial models. 

Wiz — which Google acquired earlier this year at a historic $32 billion — reported that 3.8 Flash Cyber had 7.5% to 9.7% higher recall of real-world vulnerabilities on an internal penetration testing benchmark at 2.3 to 5.2 times lower cost than leading frontier models. Similarly, Google’s Cloud Vulnerability Research found a critical foundational vulnerability in less than 2 hours with 3.8 Flash Cyber. Typically, that research and discovery would take months, Google claims. 

AI agents are “incredibly skilled” at finding and exploiting vulnerabilities, Popa said. Scanning large codebases with big AI models is expensive, and defenders are overwhelmed. “In cybersecurity, attackers need only find one significant flaw over millions of lines of code. Defenders have to remove every one of those flaws to be able to defend against attackers.” 

Doug Turner, engineering director for Chrome, described a “vulnerability apocalypse” in recent months due to generative AI. “Simply overnight, we saw a hockey stick increase in the number of software vulnerabilities reported through our vulnerability research program,” he said in a video. 

One interesting vulnerability 3.8 Flash Cyber discovered had been in Chromium and Chrome for 13 years, he explained. It was a “very subtle bug” that dozens, if not hundreds, of engineers looked at but never flagged. “Gemini 3.8 Flash Cyber is going to allow us to create better suggested fixes so that developers’ lives can get a lot easier.” 

Meta is entering the increasingly competitive real-time speech-to-text market with Muse Voice Transcribe, a new audio perception model that combines streaming transcription, endpoint detection and speaker diarization for more than 20 speakers — at a public API price of just $0.18 per hour of processed audio.

Developed by Meta Superintelligence Labs, Muse is designed to process speech while it happens rather than waiting for a recording to finish. Meta’s launch post for Muse Voice Transcribe says the model supports long audio exceeding an hour, seamless multilingual code-switching, language and keyword biasing, and diarization without a separate post-processing pipeline. The model was trained across more than 70 languages, with 25 extensively validated for the initial release.

The 20-plus-speaker figure is substantial, but it is not a world record. A review of current vendor documentation turns up systems with higher published ceilings. Speechmatics' real-time transcription service says it can identify 50 speakers by default and up to 100 when the limit is increased, while Amazon Transcribe's diarization documentation specifies a maximum of 30 unique speakers, including for streaming transcription. (Speechmatics)

Muse nevertheless lands toward the high end of the market, and Meta's broader proposition is arguably more important than the raw maximum: high-capacity real-time diarization combined with low-latency transcription, endpointing, multilingual code-switching and aggressive API pricing in the same model.

For enterprise developers building meeting systems, call analytics, live assistants or ambient AI, that combination could matter more than who holds the speaker-count record.

Diarization is becoming part of the core voice stack

Traditional speech recognition answers a relatively simple question: What was said? Diarization adds another: Who said it?

That distinction becomes critical as transcripts feed downstream AI systems. A meeting assistant can correctly transcribe every sentence and still create an unreliable corporate record if it attributes an approval, commitment or objection to the wrong participant. The same issue affects customer-service analytics, compliance workflows and AI agents operating in rooms where several people can speak.

Muse incorporates speaker attribution directly into its autoregressive multimodal architecture. Meta says audio arrives in 80-millisecond chunks, or 12.5 chunks per second, with each transformed into a soft token. At each step, the model decides whether to consume more audio or emit text. Meta calls this mechanism adaptive delay: rather than applying one latency budget to every word, Muse can wait longer when speech is ambiguous and commit earlier when it has enough context. Meta says reinforcement learning combines word-error-rate and delay rewards to train that behavior. Meta's technical explanation of Muse details the architecture. (Meta AI Research)

Speaker attribution and endpointing then become part of the same token sequence. A <|start_of_turn|> token marks a potential new speaker turn, tokens such as <|speaker_A|> identify the speaker, and separate onset and endpoint tokens identify speech boundaries. Meta says it trains ASR, diarization and endpointing together rather than running speaker clustering as an unrelated downstream process.

Meta's Model API speech-to-text documentation also exposes diarization as a first-class operating mode alongside push-to-talk and endpointing. Speaker labels such as A and B are scoped to a session rather than verified identities, and the API provides turn-level rather than word-level timestamps.

20+ speakers is high, but Speechmatics goes considerably higher

Speaker-count comparisons require care because vendors implement diarization differently and do not all publish a maximum.

Speechmatics currently makes the strongest explicit real-time capacity claim found in this review. Its real-time STT documentation says speaker diarization is available live, while its real-time FAQ says the system supports 50 speakers by default and can be increased to 100.

AWS likewise exceeds Meta's stated figure: Amazon Transcribe can differentiate a maximum of 30 unique speakers, and AWS provides explicit instructions for speaker partitioning in a streaming transcription.

Soniox supports diarization in both real-time and asynchronous processing, but documents a maximum of 15 speakers per session. AssemblyAI's streaming diarization system lets developers set max_speakers between one and 10. Both companies caution that live speaker attribution is more difficult because streaming systems must make decisions with less future audio context than offline models.

xAI's current Speech-to-Text API also supports speaker diarization in streaming mode, but its documentation reviewed for this story does not publish a maximum diarized-speaker count, so a direct ceiling comparison with Muse is not possible. (X.ai Docs)

That means it would be inaccurate to describe Muse's 20-plus capability as a new global record. The highest explicitly documented real-time number identified in this survey is Speechmatics' configurable 100-speaker ceiling.

Meta also does not demonstrate 20-plus simultaneous participants in its launch material. Its principal live demonstration uses eight speakers, while its long-form recording contains 11 labeled participants. The 20-plus number is a stated model capability rather than the participant count in the public demos.

At $0.18 per hour, Muse competes aggressively on price

Meta's pricing makes the competitive picture more interesting.

According to its Muse Voice Transcribe developer page, Muse costs $3 per 1,000 minutes, or $0.18 per hour. Streaming and non-streaming transcription cost the same, and Meta says zero-data-retention processing is priced at parity with standard processing. Billing applies to audio actually processed and is rounded down to whole seconds.

Standardizing publicly posted rates to one hour of streaming audio gives the following rough comparison:

The comparison is necessarily imperfect. Qwen's price varies by deployment geography; its international real-time rate of $0.00009 per second works out to about $0.324 per hour. Google's Gemini figure is an estimated blended token cost rather than a flat hourly tariff. AWS prices vary by region and usage tier. ElevenLabs lists $0.39 per hour on its API pricing page but advertises $0.28 per hour or lower on annual Business plans.

Deepgram's pricing particularly illustrates why feature-level comparisons matter: its current Nova-3 Multilingual streaming rate is about $0.35 per hour, but speaker diarization costs another $0.002 per minute, bringing the comparable total to roughly $0.47 per hour. AssemblyAI similarly lists $0.45 per hour for Universal-3.5 Pro Realtime and another $0.12 per hour for streaming diarization.

Cartesia is harder to normalize because Ink-2 is packaged through monthly credit plans rather than a simple metered PAYG hourly rate. Its $5 Pro plan includes roughly nine hours and 16 minutes of Ink-2 transcription, which works out to about $0.54 per transcription hour if every credit is consumed exclusively on STT. That should not be treated as equivalent to a standalone $0.54 hourly API tariff.

Even with those caveats, Muse's positioning is clear. It is not the absolute cheapest streaming transcription service — Soniox currently publishes a lower equivalent rate — but $0.18 per hour with diarization included puts Meta toward the low end of the market, especially against providers that charge separately for speaker attribution.

At 1,000 hours of processed audio, Meta's public rate implies roughly $180 in transcription charges.

Meta also leads its launch accuracy benchmarks

Price matters less if it comes with a large accuracy penalty. Meta's benchmark material argues the opposite.

On the Artificial Analysis AA-WER Streaming Index supplied with the launch, Muse records a 3.1% final-transcription word error rate, ahead of Cartesia Ink-2 at 3.4%, ElevenLabs Scribe v2 Realtime at 3.6%, Qwen3 ASR Flash Realtime at 3.7%, GPT Live Transcribe and Grok Speech to Text Streaming at 3.9%, and Gemini 3.5 Transcribe Live and AssemblyAI U3.5 Realtime Pro at 4.0%.

Meta points out that Muse took the number one spot on third-party independent AI benchmarking firm Artificial Analysis' streaming speech-to-text evaluation as of September 1. Meta published the following benchmark charts in its launch post.

Its diarization result may be even more relevant to the product's positioning. Meta reports an average 17.5% diarization error rate across AMI-IHM, AMI-SDM and VoxConverse, lower than the competing systems shown in its chart.

Speaker capacity and diarization error rate should not be conflated. A platform capable of representing 100 people is not automatically better at correctly attributing speech than one supporting 20, and Meta's benchmark does not test every competitor operating at its advertised maximum speaker count.

There are deployment tradeoffs as well. Meta's API currently provides turn-level but not word-level timestamps, and it does not expose word-level confidence scores, sound-event detection or emotion detection. The documentation also specifies eight concurrent streams per tenant by default and real-time sessions of up to 60 minutes before an application must reconnect.

Still, Muse's launch creates an unusually sharp price-performance proposition. Its 20-plus-speaker diarization does not establish a world record, but the record may be the less important metric. For enterprise developers, the larger question is whether a service can preserve speaker attribution, accurate text and usable turn boundaries while a complicated real-world conversation is still unfolding.

At $0.18 per hour, with 20-plus-speaker diarization inside the same real-time model that currently leads Meta's supplied streaming accuracy benchmarks, Muse Voice Transcribe gives enterprise teams a serious new option for meeting intelligence, live transcription and voice-agent infrastructure — while putting additional pressure on competitors to compete on speaker-aware accuracy and total operating cost, not merely raw speech recognition.

When enterprise buyers build out their next AI accelerator evaluation list this cycle, they're more likely to put a non-Nvidia chip on it than Nvidia's own next-generation GPU. According to VentureBeat's July VB Pulse survey of 170 AI infrastructure respondents, 39.4% said they're likely to evaluate non-Nvidia accelerators — AWS Trainium, Google TPU, AMD Instinct, Intel Gaudi or in-house ASICs — over the next 12 months, compared with 25.3% for Nvidia Blackwell (GB300) or other next-generation Nvidia GPUs, a 14-point gap.

Nvidia remains the default in most production environments. But organizations are building real optionality into their accelerator strategy rather than treating Nvidia as the only evaluation worth doing.

The finding sits inside a broader pattern: enterprises are expanding and optimizing the AI infrastructure they already operate before making another major platform change. Greater infrastructure activity did not produce greater urgency to switch platforms. The share of respondents expecting a platform change within three months fell from 38.3% in June to 28.8% in July, even as production adoption, accelerator utilization, and exploration of neoclouds and open-source infrastructure all rose.

Where is enterprise AI infrastructure actually growing?

The July data shows organizations operating AI infrastructure more intensively and putting more provider platforms into production.

Microsoft Azure posted the largest production adoption growth among the major platforms measured, with the share of respondents reporting Azure in production increasing from 29% in June to 47.1% in July, an 18.1 percentage-point increase. Some of that jump reflects who was surveyed: July's respondent base skewed more up-market than June's (57% at organizations above 1,000 employees, versus 37% in June), and Azure adoption rises with company size in both waves. Google's Gemini was the most-used platform in both waves, with the share of respondents reporting it in production rising from 41.1% in June to 47.6% in July, narrowly ahead of Azure.

The share of respondents reporting OpenAI in production rose from 40.2% to 49.4%. Anthropic production adoption increased from 12.1% to 24.7%. 

Among enterprises that operate their own GPUs, the share running at half capacity or less fell from 83% in June (100 respondents) to 69% in July (155 respondents), with the share above 50% utilization rising from 13% to 23%.

The definition of infrastructure effectiveness is also becoming more operational. The share of respondents who selected uptime and reliability as important effectiveness measures increased from 42.1% to 51.2%. The share selecting throughput rose from 21.5% to 24.7%.

Ease of implementation improved from an average rating of 3.84 to 4.04 on a five-point scale. Overall satisfaction moved only slightly, from 4.07 to 4.14, while perceived value was essentially unchanged at approximately 3.9.

That combination is telling. Enterprises are not reporting a dramatic improvement in value simply because they are deploying more infrastructure. They are becoming more capable operators with better architectures, but they are also setting a higher bar for what that infrastructure must deliver, with reliability leading the way.

Why is platform-change urgency shifting outward?

The strongest counter-signal in the July findings is the declining share of respondents who plan to make an immediate platform change.

The share expecting a change within zero to three months declined by 9.5 percentage points. The share expecting a change within three to six months rose by 4.1 points, while the six-to-12-month window rose by 5.3 points. The share with no planned change remained effectively flat at approximately 40%.

Urgency is shifting outward, with the open-weight-model and open-source-harness debate playing a role in which pieces get enhanced versus fully replaced.

The selection criteria support that interpretation. Integration with existing cloud and data stack was the top factor in both waves, holding steady at 41.1% in June and 40.0% in July. The share of respondents prioritizing performance increased from 24.3% to 35.3%. The share prioritizing cost per million tokens increased from 7.5% to 15.9%, while the share prioritizing access to GPUs rose from 18.7% to 23.5%.

By contrast, the share selecting broad total cost of ownership as a leading factor fell from 34.6% to 21.8%.

The market appears to be moving from general infrastructure planning toward workload-level scrutiny. Buyers increasingly want to know how a platform performs under production inference, how reliably it operates and what each unit of useful work costs.

Interest in Nvidia alternatives is concentrated at the top

That 39.4% figure was 31.8% in June, already climbing before this wave. The alternatives enterprises are weighing include AWS Trainium, Google TPU, AMD Instinct, Intel Gaudi and other in-house ASICs.

Interest was even stronger among respondents with strategic purchasing authority, though the C-suite sample is small: the share of C-suite respondents likely to evaluate non-Nvidia accelerators rose from 42.9% (6 of 14) in June to 57.1% (12 of 21) in July. Among final decision-makers, the same interest rose from 35.4% to 50%.

This was especially true for organizations in the small and medium-size business tiers. Among organizations with 251 to 1,000 employees, the share increased from 41.4% to 53.2%. Among organizations with 101 to 250 employees, it rose from 33.3% to 57.7%.

These findings show organizations building optionality into their accelerator strategy.

The increased attention from C-suite respondents and final decision-makers suggests that accelerator diversity is becoming a strategic infrastructure question, not just a technical one for engineering teams.

Enterprises want to own the harness

The infrastructure findings align with a separate VB Pulse survey of agentic context layers. That survey included 101 substantive respondents in June and 101 respondents in July.

The AI harness is the operational layer connecting models to enterprise data, tools, orchestration, evaluation, identity, security, observability and business processes. It determines what an agent can access, which actions it can take and how the organization evaluates its output.

In July, 36.6% of context-layer respondents said they planned to retain best-of-breed standalone tools alongside their models. Another 36.6% expected to mix provider-native runtimes with standalone tools, while only 5.9% intended to build and own the context layer in-house.

Combined, 79.2% of July respondents favored an approach that maintained at least some architectural control outside a single model provider, compared with approximately 65.3% in June. Only 11.9% of July respondents favored consolidating onto a single model provider’s native context stack, down from 20.8% in June.

Most want to preserve provider choice, independent governance or control over critical components around the model.

The need for that control is becoming clearer. In July, 62.4% of context-layer respondents reported that a governed semantic or context layer was either in production or being built. Production adoption alone increased from 24.8% to 31.7%.

At the same time, 68.3% of July respondents reported experiencing at least one confident-but-wrong agent answer caused by missing or incorrect context, compared with 57.4% of June respondents.

The share expecting to use multiple retrieval architectures by use case increased from 12.9% to 28.7%. The share expecting to mix provider-native and standalone context tools increased from 20.8% to 36.6%.

The emerging architecture is a controlled combination of models, infrastructure, retrieval approaches, context systems and operational tooling selected by workload.

Are neoclouds gaining enterprise traction?

Neoclouds are specialized cloud providers focused heavily on AI infrastructure, particularly access to accelerators and supporting services. The July results suggest that these providers are becoming a more credible part of enterprise multi-provider strategies.

The share of respondents expecting to do more with neoclouds increased from 33% in June to 38% in July. At the same time, the share expecting to do less with neoclouds fell from 9.7% to 5.4%.

The movement was especially pronounced among respondents in the technology and software vertical. The share of that July segment expecting to do more with neoclouds reached 57.6%, compared with 44.4% in June.

Current production adoption remains much smaller than broad expansion intent. Across the named providers measured consistently in both waves, such as CoreWeave, Lambda, Crusoe and Nebius, production use increased from 1.9% of June respondents to 5.9% of July respondents.

The difference between 38% expansion intent and 5.9% current named-provider production use may point to a sizable evaluation and adoption pipeline.

The neocloud demand pipeline is not theoretical. CoreWeave reported around $104 billion in revenue backlog at the end of June, excluding more than $25 billion in additional customer commitments secured during early Q3. Nebius does not disclose a directly comparable backlog metric, but said it could sell its entire 2027 capacity under current terms and reported four second-quarter AI cloud agreements, each averaging more than $1 billion in total contract value.

The larger implication is that neoclouds are becoming a viable source of strategic leverage. They give organizations additional options for accelerator availability, software stacks, workload placement and ammunition for negotiations with hyperscale providers.

Neoclouds will still have to demonstrate enterprise-grade reliability, security, support, networking, and data management capabilities. Specialized compute access may open the door, but durable enterprise adoption will depend on the surrounding operational stack. 

Is open-source AI infrastructure usage growing?

The most accurate answer is that open-source production usage is growing, while broad platform consideration remains relatively flat.

The share of respondents reporting a custom, self-managed open-source production stack increased from 3.7% in June to 12.9% in July. The stack definition included technologies such as PyTorch, Triton, vLLM, Ray and Kubernetes.

The movement was visible across several segments with July bases above 20 respondents:

• Among individual contributors, 23.9% reported production use in July.

• Among recommenders and influencers, 13.7% reported production use in July.

• Among organizations with 251 to 1,000 employees, 12.8% reported production use in July.

The share of respondents using open-source key-value cache tooling, including LMCache and vLLM prefix caching, increased from 6.5% to 11.8%. Among technology and software respondents, usage increased from effectively 0% to 13.3%.

Open-source platform consideration ticked up slightly but remained essentially unchanged, moving from 5.6% to 6.5%.

This combination suggests that growth is concentrated among organizations moving into implementation rather than across a dramatically larger population of evaluators. Open source appears to be deepening inside an active portion of the market.

Organizations may be turning to open-source components for greater portability, model choice and control over inference optimization. But ownership also transfers responsibility. Teams adopting self-managed stacks must operate upgrades, security, observability, integration and production support themselves.

That combination of more activity, less urgency and more optionality is the throughline across all of it. Enterprises are running more AI infrastructure while deliberately keeping multiple paths open on chips, clouds and the layer that connects models to their own data. The next platform change, when it comes, will be a choice made from a stronger position.

Notes on methodology

For this article, I compared two independent, cross-sectional infrastructure survey waves: 107 respondents in June 2026 and 170 respondents in July 2026. These waves are not a longitudinal panel, so the findings describe changes between respondent populations rather than changes made by the same organizations. Platform-change timing shares add to slightly more than 100% because a small number of respondents selected more than one window (5 in June, 9 in July).

Sample composition changed between the waves. Respondents selecting the 1–100 employee organization-size category were excluded before calculating results. The remaining wave composition still differed, including a larger July share from organizations with more than 10,000 employees. Month-to-month movements should therefore be treated as directional signals rather than proof of causation. No statistical-significance testing was applied to the comparisons reported here.

The context-layer findings come from a separate survey, with 101 substantive respondents in June and 101 in July. Those results use a different respondent base and are included as supporting evidence, not combined with the infrastructure-survey results.

Infostealers replayed stolen Claude session cookies into paid accounts without ever touching the login page two-factor authentication guards.

The accounts Anthropic flagged were card-billed, self-serve accounts, which is the population no corporate identity provider governs, and no admin console can sign out. Session-cookie replay bypasses SSO as thoroughly as it bypasses 2FA. What SSO provides here is revocation and visibility, not prevention. The company disclosed the campaign in notification emails to affected users, named six stealer families, signed the accounts out, stripped the saved payment methods, and refunded the charges it found.

The burned usage is the small loss. What those sessions could reach is the exposure, and none of it sat behind an identity controlled by an enterprise.

Anthropic told affected users that a bad actor was using common infostealer malware to lift Claude login sessions off their computers and then replaying them to burn the accounts' usage, according to the notification an affected user posted to Reddit and BleepingComputer reported on August 30.

It named Vidar, LummaC2, StealC, RedLine and Acreed on Windows and Atomic Stealer on a small number of Macs, and it described general-purpose malware that copies browser login cookies along with saved passwords. "Your Claude session was likely one of the many things it collected," the email said.

A session cookie is the proof that a login already happened

The attack chain runs in one direction, from an infected machine through a stolen cookie past a checkpoint that never fires, and into everything the account can reach.

Signing the accounts out worked because a replayed cookie dies with the session it copies.

Two-factor authentication guards the login page. The site then hands the browser a cookie so the user stays signed in, and an attacker who copies that cookie and replays it looks to the server like the person who already passed the check. Help Net Security described the mechanism on August 31 as session theft becoming the new credential theft.

Anthropic spotted the theft in the usage meter. Limits were refilled and drained while the owner was away from Claude, the company wrote.

One Redditor who received the notification traced the infection to a pirated game, per BleepingComputer. That is one machine, and Anthropic has not said what the others ran.

Anthropic's notification gave no count. The company had not responded by publication to VentureBeat's questions on how many accounts were affected, whether any Team or Enterprise seats behind SSO were among them, or whether the replayed sessions reached conversation history or connected apps rather than usage alone.

Removing a saved card and refunding charges point to directly billed, self-serve accounts that authenticate through Anthropic's own login rather than a corporate identity provider. Those include personal subscriptions. Team and self-serve Enterprise organizations can also be card-billed, so the deduction is strong rather than closed.

Bugcrowd CEO Dave Gerry told Axios in early August that his company sent employees nearly a dozen emails saying the OpenClaw agent was not allowed on corporate networks, and employees kept trying to download it anyway. A personal Claude subscription on a managed laptop is the same reflex, and it comes with a card on file. LayerX data in Akamai's enterprise AI risk report found 47% of enterprise AI conversations run through personal identities, with Claude at 61%.

The pirated game is one vector. In July, attackers hosted a spoofed Claude download page on the claude.ai domain itself through a public Artifact, and a sponsored Bing ad sent employees searching for "Claude Desktop app" straight to it. Huntress documented the campaign, named FakeAgent, after SectopRAT compromised employees at 29 organizations in two days. The artifact collected roughly 7,100 downloads before Anthropic removed it. A separate campaign pushed a fake Claude installer through a spoofed download site earlier in the year, per Malwarebytes. The vector is not piracy. It is enterprise employees searching for the official app on their work machines.

Refunds cover the usage. Nothing covers the connectors

A replayed session inherits everything the legitimate one could reach, and Anthropic has not said whether these did. On a Claude account, that means the conversation history, the files uploaded into projects, and any connectors the owner authorized. Anthropic's help center states that connectors let Claude retrieve data and take actions inside connected services and that Claude inherits each person's permissions from the connected service. Read and search operations run without approval. Write actions, including send, reply, forward, share, move, and trash, are approval-gated by default. The exfiltration path is the one that is open. Google Workspace connectors are available to individual Claude accounts, so a personal Pro subscription can hold a live authorization into a Gmail inbox or a Drive folder.

If that inbox is the work inbox, the attacker holding the replayed cookie has a read path into it that the corporate identity provider evaluated once, at the moment the employee clicked allow, and rarely again. On a personal plan, the employee owns that grant. No Claude tenant administrator can sign that account out, and the Workspace or Entra administrator who can pull the underlying grant rarely knows it exists.

Adam Meyers, CrowdStrike's senior vice president of counter adversary operations, put numbers to the market in an August 6 Axios interview. Criminals have been buying and reselling stolen ChatGPT, Claude and Gemini credentials since ChatGPT took off in late 2022, fed by infostealer malware. CrowdStrike's 2026 Threat Hunting Report documents one LLMjacking campaign that pushed nearly 200,000 API requests through a compromised cloud account's AI model access in two minutes.

Meyers drew the line in a July briefing on the report. LLMjacking, in his framing, is stealing the credentials, and cost harvesting is what the buyer does next, manipulating AI resources that belong to the victim "in order to conduct operations and generate massive bills as a byproduct of that," he said. "So think of this as LLM coin mining."

One architect refused to build the same exposure into his product

Tom Kleinpeter, co-founder and chief architect at Common Room, described in written answers to VentureBeat why he held his company's AI agent integrations back through the summer of 2025.

"We rejected local MCP servers early, full stop. That path meant storing a long-lived API key or token on someone's machine. Steal that credential, and you can impersonate the user, pull their data, or do anything else the token allows, indefinitely, until someone notices and manually revokes it. We weren't willing to ship that."

Common Room shipped its first agent integration in October 2025 with Okta's Auth0 handling authentication, separate read and write scopes, and writes off by default, per Kleinpeter.

An AI coding agent working on Common Room's own system proposed caching access tokens in plain text in Redis to cut down on repeated authentication calls, he wrote. It worked, and it would have parked live credentials in shared infrastructure had a human reviewer not caught it before it shipped.

Asked what was acceptable in 2024 and a liability now, he named one thing. "Long-lived, broadly scoped API keys. Those made sense when one human operated one trusted system and stayed in the loop. Agents now run across laptops and multiple clients, often with no human watching in real time."

Okta gave agents governed identities the same week Claude users lost their cookies

Okta made Agent SSO generally available on August 24, registering AI agents as first-class identities in Universal Directory and issuing short-lived, identity-governed tokens in place of stored credentials, according to the company's announcement. The release names Claude as its example of an agent a security team can now govern natively.

Six days later, Anthropic was signing users out because six stealer families had copied the humans' Claude cookies. The agents got governed identities. The people using Claude on their own cards did not.

VentureBeat's July Pulse Research wave on agent security found 63% of 116 enterprises report credential sharing somewhere among their AI agents, and 3% run Okta for AI Agents.

That 3% has a reason, Kayne McGladrey, author of the forthcoming "Cyber Risk is a Myth" and a senior IEEE member, told VentureBeat during a July interview. "It's only those well-resourced companies that are above the poverty line that have met all the prerequisites," he said.

The prerequisites he named are the same controls most enterprises still treat as hygiene, not strategic investment.

"If they don't have their defenses in order, like attack surface management or blast radius containment or basic MFA, that would not be a useful capability or a meaningful spend."

Anthropic's position deserves its hearing. The company told users it has no reason to believe the malware is related to Claude, installed through Claude, or tied to anything they did with Claude, and it warned that signing out stops the stolen sessions while leaving the malware in place to steal the next login.

Both hold, and they are the last thing a provider can do, because the infected device belongs to the customer. On a work laptop, the device belongs to the enterprise, and the control that catches Vidar or LummaC2 before it reads a cookie jar is endpoint detection, the control in this story the security team already runs.

The profession's gap is rarely a missing control anymore, in McGladrey's framing. "I think we've got technical solutions for nearly all of the things that could go wrong, what we don't have is a way of prioritizing those," he argued.

The endpoint team owns the machine. The identity team owns an SSO the account never touched, and the AI governance lead wrote a policy the employee routed around the day the card went on file.

Each of those owners is paid to close a different gap. "Engineering is comped on getting product out the door quickly, your internal audit team is comped on checking boxes to meet your compliance goals, and security is comped and sometimes penalized on a lack of incidents," he argued. "People aren't doing the wrong thing either. They're doing what pays their bills on an ongoing basis."

What security leaders need to do next

Add AI accounts to the infostealer response playbook. When an endpoint alert names a stealer family, treat every AI service session on that machine as compromised, revoke what the enterprise tenant lets you revoke, and have the employee sign out of personal accounts until the machine is clean.

Warn users that the notification itself is now a phishing template. Help Net Security flagged copycat phishing impersonating Anthropic using this campaign as pretext. If the notification lands in a user's inbox, the next email that looks like it may not be from Anthropic.

Count the personal subscriptions on managed devices. Browser telemetry, CASB logs, and expense reports surface the sessions and the payments.

Stop personal AI accounts from holding OAuth grants into corporate Google Workspace or Microsoft 365. Both platforms let administrators restrict third-party app authorization. Use that gate so a work inbox can only be attached from a tenant the security team can revoke.

Revoke the OAuth grants Claude already holds, not just the Claude session. Signing out of Claude invalidates the stolen session but does not revoke the Google or Microsoft grant Claude was already authorized to use. Check Google's third-party app authorizations and Microsoft's enterprise application consents for live grants the sign-out left behind.

Move the heavy users onto the organization-managed tenant. On Team and Enterprise plans, an owner decides whether connectors can be enabled at all.

Put session binding on the renewal agenda. Google shipped Device Bound Session Credentials in Chrome 146 on Windows in April and turned it on by default for Google accounts and Workspace Individual accounts in May, binding each session to a private key in the device's TPM so a copied cookie cannot be refreshed anywhere else. It covers Chrome on Windows only so far, so the Mac victims in this campaign sit outside it. Ask Anthropic and OpenAI for parity and Google for a coverage date before the next contract signs.

Anthropic sent its notification to individuals. The laptop the cookie came from belongs to whoever manages it, and Vidar and LummaC2 will be back for the next login on the same machine.

Presented by Zeta

Every forward-deployed engineering (FDE) pitch sounds identical for the first ten minutes: an engineer embedded on-site, a workflow encoded within weeks, a demo that finally works on the customer's real data. What differs is what happens in the following months, and most vendors will not tell you until you ask directly.

FDE has become one of enterprise AI’s most consequential operating models. Vendors are building entire go-to-market motions around engineers who embed with customers, wire products into operating environments, and make the demo real. Investors often read FDE headcount as a growth signal and buyers read it as a promise of speed. Neither tells you whether the work is becoming a product advantage or simply accumulating as delivery labor.

The test is simple: after an FDE engagement, does the next customer start with more product and fewer unknowns — or just a new services team?

FDE is not one thing. At its weakest, it papers over a product that cannot yet stand on its own, translating by hand what the software should eventually understand. At its strongest, it is a disciplined product-learning function: it finds the edge cases of an AI-native architecture and turns them into reusable capability. The org chart looks the same, but the economics and trajectory do not.

FDE is valuable because it creates automation that powers a system of intelligence. A system of intelligence is more than software that executes workflows. It captures enterprise context, incorporates what it learns from every deployment, and improves the quality of future decisions. Forward-deployed engineers are how that context enters the system in the first place.

The engineers are the context layer

Model choice still matters in some domains. But in many enterprise workflows, the bigger constraint is not the model, it is what the enterprise knows about itself including business rules, exceptions, workflow logic, and definitions that took a decade of operating history to settle. Access to data is not the same as understanding the business.

In one large telecommunications deployment, an initial definition of a “high-intent” customer did not survive contact with the operating systems. The model’s signal said one thing while the retention team’s actual save-desk criteria said another. Those criteria were built from years of which offers actually worked, on which tenure bands, in which regions. No schema documented that logic; it lived in the judgment of people who’d been doing the job for a decade. An engineer had to sit with them, extract the knowledge, and encode it before the intelligence layer we were building could be trusted to trigger an action instead of just a score.

Once that logic was encoded into the intelligence layer, new acquisition and retention use cases could move from idea to execution in days rather than months. Rather than rebuilding the integration each time, teams were adding decisions to a shared foundation.

That kind of work produces more than an answer for one customer. Properly captured, it can become a semantic mapping, a policy module, a workflow template, a connector, or an evaluation that guards the decision in future deployments. The FDE is the context layer delivered first as a person, who then translates and delivers it as product.

Sandbox, mud, and what happens to the learning

The useful question in a diligence call or renewal conversation is not whether a vendor has FDEs. It's whether an engineer touching your environment is playing in a sandbox of tools, or trying to dig you out of the mud.

In the sandbox, FDEs use a general-purpose engine in specific, gnarly environments. Their job is to find where the engine needs a new part, install it, and feed the learning back so that part can ship again. In the mud, the engineer manually constructs a missing capability one customer at a time, and there is no engine underneath waiting to receive the part; instead, it’s another custom build.

Do not mistake these for a clean binary, though. Most companies live somewhere in the middle: reusable playbooks and connectors for the common cases, bespoke judgment for everything else. From the outside, sandbox, mud, and the middle can all look identical: a smart engineer, on-site, writing code against your data. The tell is what happens to what they learn. Either the next deployment begins with fewer unknowns, less custom code, and better tests, or it begins from zero with a prettier deck.

The strategic version of FDE treats every engagement as a disciplined learning loop. It starts with observing the exception in the field, codifying it into a reusable artifact, validating it with an evaluation and security review, releasing it into the product, then measuring whether the next deployment actually got easier. That last step is where most companies quietly fail. Not every field discovery belongs in the core product. Some customer logic is proprietary, temporary, or too idiosyncratic to generalize. Good teams know the difference between three things that get lumped together under “FDE”: product intelligence that compounds across every customer, configurable customer logic that's reusable for one account but shouldn't ship broadly, and one-off services work that is exactly what it looks like.

Customization is expected. The failure lies in not labeling which bucket the work is in, or in losing the learning from the parts that can compound.

This is the difference between a company that gets better at deploying and a product that gets better at understanding. The former can build a capable services business; its advantage lies in execution and relationships. The latter builds compounding product capability that persists after the engineer leaves.

The best FDE organization changes shape

The uncomfortable conclusion for teams building FDE functions is that human translation should shrink per unit of value delivered, even as absolute headcount grows. A fast-growing company may keep adding FDEs while still making each deployment materially lighter because more of the required logic already exists in the product. Each deployment should require less custom engineering than the last, with engineers spending more time extending reusable capabilities than rebuilding the same integrations, workflows, and decision logic.

Track four things:

• engineers per live workflow

• engineering hours per deployment

• time-to-value by vertical

• and the share of implementation work that gets reused rather than rebuilt.

Track one more that matters just as much and gets watched far less: the productization lag, the time between a field discovery, and a tested capability available to the next customer. Over time, that lag should fall, custom engineering should decline, and reuse should increase. If none of these are improving, the organization is delivering, without learning whatever the headcount chart says.

FDE is scaffolding only when it stays outside the building. The goal isn't to eliminate the people doing the work; it's to ensure more of what they learn becomes load-bearing product capability.

Three questions that get past the pitch

1. How is FDE priced?

Pricing is a signal rather than a verdict. A separate professional-services line may reflect honest transparency, bundled FDE may be a loss leader paid for by utilization. The more useful question is whether the contract, renewal, and margin story make clear which work is repeatable productization and which is bespoke delivery.

2. Where does field learning go?

Don't infer this from résumés alone. Ask who owns the handoff from FDE to product, what artifacts are produced, and how quickly they become tested, supported capabilities. The organizational interface is what reveals whether learning compounds, not the job title.

3. What got faster on the last repeat deployment?

Ask for a specific vertical and a specific delta such as fewer engineering hours, fewer weeks to value, fewer custom integrations, or a higher reuse rate. A credible vendor can name what changed and how it was measured. General claims about “learnings” and “playbooks” are not enough.

Enterprise AI creates lasting advantage when every deployment leaves behind more than a satisfied customer. It leaves behind a deeper understanding of how enterprises operate. The goal isn’t simply to deploy AI. It’s to build a system of intelligence that captures enterprise context, converts customer learnings into reusable capability, and compounds over time.

Neej Gore is Chief Data Officer at Zeta.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

When large language models (LLMs) hallucinate, developers typically assume the model lacks the required facts. Engineering teams diagnose the error as missing knowledge. The standard response is to increase model size, expand training data, or build complex retrieval architectures.

A new study by researchers at Google Research and Technion demonstrates that the knowledge is often not missing. The model has the information encoded parametrically but fails to surface it during generation. 

Their experiments show that frontier models like GPT-5 and Gemini-3 encode 95-98% of tested facts. This indicates that in many cases, recall, rather than encoding, is the primary bottleneck for factual accuracy. 

By understanding how to unlock existing knowledge through inference-time computation, engineering teams can build more reliable applications without necessarily relying on larger models or external databases.

Knowledge profiling: measuring what models actually know

To map this gap between storage and retrieval, the researchers propose shifting the evaluation focus from question-level accuracy to fact-level profiling. Instead of simply scoring whether an LLM answers an isolated prompt right or wrong, fact-level profiling tests a single underlying piece of information across multiple conditions, evaluating whether the fact is stored in the model's parameters at all, whether it can be queried from different directions and phrasings, and what computational effort is required to retrieve it.

This framework distinguishes between whether a fact is parametrically "encoded" and whether it is "known". A model encodes a fact if it can accurately reproduce it when primed with its original training context. A model knows a fact if it can reliably answer questions about it across varied phrasings and directions.

"Encoding and recall failures are indistinguishable under accuracy metrics, yet they imply different limitations and solutions,” the researchers write. “Encoding failures call for pre-training interventions, such as scaling model size or data coverage. Recall failures suggest post-training interventions that often improve how models utilize what they already encode."

The paper illustrates this using a sample fact: Oasis played their first gig at the Boardwalk club. Based on how models process this information, the study categorizes knowledge into five distinct profiles:

• Direct recall: The model encodes the fact and readily accesses it to answer direct questions without extra inference compute.

• Encoding failure (empty shelves): The model neither encodes nor knows the fact. It cannot complete a Wikipedia-style sentence about Oasis’s early days, nor can it answer questions about the event. This signals a need for more pre-training data or greater model capacity.

• Recall failure (lost keys): The model has the fact encoded but cannot access it. It can seamlessly complete the original training text about Oasis, but fails to answer "Where did Oasis play their first show?" even when given time to think.

• Recall with thinking: The fact is encoded, but inaccessible to direct generation. It is only successfully recalled when the model uses inference-time computation, such as Chain-of-Thought, to bridge the gap. The researchers refer to this mechanism as recall facilitation. The model might initially fail to answer the direct question. By generating intermediate thoughts about the band's early history in Manchester, it structurally primes itself to locate and recall the locked answer.

• Inference without encoding: The model never explicitly encoded the Oasis fact. Instead, it successfully answers the question by making an educated guess or reasoning across other encoded facts it does know. It might deduce the answer by chaining together separate data points, such as "Oasis formed in Manchester," "the Boardwalk was a famous 90s music club there," and "the Boardwalk hosted early gigs by emerging bands.”

Scaling illusions, long-tails, and tip-of-the-tongue recoveries

The researchers evaluated 13 LLMs on over 4 million responses. They used WikiProfile, a benchmark containing 2,150 facts extracted from Wikipedia, testing each fact across formats ranging from exact context completion to multiple-choice verification.

For frontier models like GPT-5 and Gemini-3, encoding is nearing saturation. These models successfully encode 95-98% of the tested facts. However, they still fail to directly recall 26-34% of those encoded facts without thinking. 

Inference-time thinking acts as a vital recovery mechanism. Providing models with extra computational effort successfully retrieves 40-65% of the encoded facts that models initially fail to directly recall. The researchers compare this to the human tip-of-the-tongue state, where deliberate effort, such as mentally retracing context, eventually helps remember the information.

Scaling up model size does not automatically resolve this gap. In fact, companies often mistakenly try to solve recall failures by fine-tuning larger internal models—an expensive architectural misstep.

"When facts come out wrong, the go-to move is to scale, meaning train a larger model or add more data," Nitay Calderon, Research Scientist at Google, told VentureBeat. "Both are expensive, and if the facts are already encoded, neither helps."

For example, the researchers found that scaling the Gemma3 model from 1 billion to 27 billion parameters largely filled the "empty shelves" by decreasing encoding failures from 85% to 23%. But at the same time, the share of recall failures increased, peaking at 40% without thinking.

This suggests that scaling mainly solves the storage problem rather than the access problem. As the model memorizes vastly more facts, a larger pool of knowledge becomes trapped in an "encoded but inaccessible" state. The bulk of model errors shifts from missing data to failed recall.

"Our findings suggest that recall is tightly coupled to the conditions under which facts were learned, degrading when queries diverge from training-time patterns," the researchers write. How a user asks a question directly dictates whether the model can unlock the stored answer.

For example, the experiments showed that rare facts are encoded at rates similar to popular facts. Yet they found a large recall gap between long-tail and highly popular facts that exceeds 25% for frontier models.

Similarly, models struggle to generate answers to reverse questions (i.e., asking for the subject instead of the object). For example, a model might easily answer that Oasis played their first gig at the Boardwalk club, but fail to answer who played their first gig at that same club. At the same time, the same models show that they know the correct answer when given the same question in multiple-choice format.

"Whereas these failures are often interpreted as limitations of memorization or bidirectional encoding, our results suggest a different picture: rare facts are often encoded but inaccessible, and reverse facts can be recognized even when they cannot be generated,” the researchers write. “This reframes both phenomena as recall failures rather than 'missing knowledge.'"

The ROI of thinking and tips for developers

The high encoding rates of frontier models require a shift in how developers approach factuality and pipeline architecture.

Don’t treat every factual failure as a retrieval problem: The default enterprise reaction to hallucinations is often to deploy Retrieval-Augmented Generation (RAG), scale up vector databases, or ingest more domain documents. While RAG is the right call for fresh or internal data, using it as a blanket fix for hallucinations adds latency and costs to facts the model already has locked in its parametric memory.

"A lot of what teams solve with RAG are facts the model can already answer from memory, so you're paying extra latency and per-call cost for nothing," Calderon said. "If a fact is truly missing, RAG can be the right fix. But if the fact is encoded and the model just can't recall it, RAG and scaling the model only add cost on top of the real problem."

Use inference-time reasoning selectively: Thinking recovered 40–65% of encoded facts that models failed to directly recall. However, because only 10-20% of facts actually require thinking, turning it on globally wastes your compute budget. The challenge is dynamically routing queries, as models lack the self-awareness to reliably diagnose when they are about to fail.

"To use the compute well, the model has to sense ahead of time that a plain answer is about to fail, so it can escalate before answering," Calderon said. "That self-awareness is its own skill, and today's models aren't reliably good at it." This metacognitive bottleneck is why Google researchers are developing frameworks like "faithful uncertainty" to allow models to accurately gauge their own confidence and trigger deeper reasoning rather than hallucinating.

Deploy generate-then-verify pipelines: Because models are better at recognizing facts (verification) than generating them from scratch, developers can build architectural loops where a model generates a response and is then prompted to explicitly reflect on and verify its own claims. "Since recognizing a correct answer is easier than generating one, a verify pass over the model's own output could catch mistakes that plain generation misses and add some factual improvement on top," Calderon said.

Test semantic access, not just benchmark accuracy: Standard accuracy metrics mask underlying model capabilities. Evaluation sets should probe the same underlying fact across different phrasings, contexts, and directions to truly understand what a model knows versus what it can reliably access.

Leverage query reformulation and retries: Because recall is highly context-dependent, query framing dictates success. Changing the structure of a prompt, generating relevant intermediate context, or prompting the model to generate a reasoning chain before answering are legitimate reliability mechanisms that surface information direct prompts miss.

Limitations and practical takeaways

The WikiProfile benchmark relies on encyclopedic Wikipedia facts. These findings might not perfectly generalize to proprietary or highly specialized enterprise domains. A model's ability to store and recall a niche internal company metric may behave differently than its handling of public encyclopedic data.

Fully profiling a frontier model on the WikiProfile suite costs approximately $500. Developers can significantly reduce this cost by omitting multiple-choice variants or using fewer response samples per question. 

Teams can access the WikiProfile benchmark on Hugging Face to evaluate their own systems. Because the benchmark includes the exact prompts used to build it, enterprise data engineering teams can recreate the pipeline on their own internal corpora to diagnose whether their bespoke agents are suffering from missing data or missing keys. However, teams should manage their expectations when moving away from encyclopedic data.

"The pipeline is built to be applied on a new corpus, and we provide all the prompts we used," Calderon said. "The one thing to expect: on Wikipedia it was mostly a recall problem. Domain-specific facts may genuinely not be encoded in the model."

Ultimately, this shift toward knowledge usage levels the playing field for enterprise AI stacks. "For companies that don't build models from scratch, this is good news," Calderon said. "Pre-training is hugely expensive and out of reach for most, but the levers that matter now are not: post-training can help with little data and few steps, and inference-time tools like thinking, verify steps, and retrieval are already what most teams use."

This story was updated to include remarks from Google.

Egiziago Cioffi is the IT and Enterprise Architect and CEO of SynSphere Italia, a Microsoft partner based in Milan. He built an agent himself. He wrote the indexing job, configured the Azure OpenAI retrieval pipeline, connected it to SharePoint, and watched it pass every evaluation his team ran.

His Azure OpenAI email assistant auto-resolves about 60% of inbound customer email, Cioffi told VentureBeat in written responses to our interview questions. The evaluation scores were clean, and the unit tests passed. None of them asked the question that mattered.

Cioffi ran a low-privilege account against the same questions a high-privilege account had already put to the assistant. The outputs did not match. The assistant returned SharePoint content the requesting user could not have opened in SharePoint on their own. The logs told a different story than the evaluation scores.

Cioffi's retrieval logs are the evidence for this specific production failure. What follows is independent data showing the failure class is not isolated.

In many production RAG deployments, the agent answers with the indexer's permissions, not the requester's

Azure AI Search has shipped native document-level ACL trimming via Entra-based tokens since preview in May 2025, and SharePoint ACL sync followed in a later preview. The capability exists; however, it does not exist everywhere it needs to.

The SharePoint ACL preview can now ingest site-group metadata via the spg: prefix in the 2026-05-01-preview API. However, only Entra-backed principals are documented as reliably enforced at query time. The preview runs through the REST API and preview SDKs and does not cover all agent deployment paths. Azure OpenAI On Your Data, for example, supports document-level access via Azure AI Search security filters, but Microsoft's own documentation states that if the permitted-groups field is not mapped, document-level access is disabled.

That is a fail-open default in a first-party path. Custom RAG pipelines that bypass Azure AI Search entirely still index under a broadly privileged service account with no query-time entitlement check unless the developer builds one. Cioffi's deployment took the custom-pipeline path.

Across production agents at scale, 91% of successful attacks ended in silent data exfiltration

Straiker's red team ran more than 1,700 successful exploit attempts against production agents and published the results in its inaugural STAR Labs Threat Report in July. The 91% figure from their research measures all successful attacks on productivity agents that ended in data exfiltration without detection. It is a measure of what happened after an exploit succeeded, not a measure of how many deployments fail to enforce retrieval-time entitlements specifically.

Across the productivity agents in scope, 91% of successful attacks ended in silent data exfiltration, with the report noting no malware had been required. There was also no lateral movement through the network. The agent returned all the data it could reach. Straiker's report does not break out which of those successes trace to entitlement failures specifically versus prompt injection, tool abuse, or other attack classes.

Working independently, the U.K.'s AI Security Institute documented 19 unsanctioned agent actions from a July 25 to 28 cyber evaluation. The UKASI published its incident report on August 4 of this year. The evaluation deliberately ran with cyber classifiers disabled and internet access enabled. What the UKASI report demonstrates is agents acting outside the scope their deployers intended, in a permissive test environment, with no reliable mechanism to catch the deviation before it causes damage. It is a containment failure, not a retrieval-entitlement failure, and the overlap with the Cioffi incident is the shared absence of a runtime scope check rather than an identical mechanism.

Why evaluations miss this and why the native fix did not reach Cioffi's deployment

The evaluations Cioffi's team ran were designed to test whether the agent answers correctly. They check factual accuracy, relevance, and task completion. They do not ask whose permissions the retrieval pipeline uses when it fetches the source material, because that question is not in the evaluation framework.

Azure AI Search is currently shipping the retrieval-time entitlement check at the platform level. The query-time ACL trimming validates the caller's Entra token, extracts user and group claims, and returns only documents whose synchronized permission metadata grants the caller access. For deployments that use Azure AI Search with the SharePoint indexer and Entra-backed principals, the control exists natively. Cioffi's deployment did not use this path. His custom Azure OpenAI retrieval pipeline bypassed the native trimming layer, which is how the gap survived every evaluation his team ran.

From the attacker's side, this is a broken access control. Adriel Desautels, founder and CEO of Netragard, told VentureBeat in written responses that the failure reduces to a structural collapse of authorization boundaries. "If the NHI credentials usually have broad authorization and can read high privilege data then that is then stored in their index," Desautels wrote. "If an app does not enforce identity-aware retrieval, then a 'normal' user with lower permissions can query the app and access otherwise restricted data. This collapses authorization boundaries down to the lowest privilege level with search capability."

That gap is what Cioffi's low-privilege test exposed. The assistant's context window contained SharePoint content the low-privilege account could not have retrieved through SharePoint directly. The evaluation had passed. The retrieval permission boundary had not been enforced.

Desautels put the evaluation blind spot in operational terms. "Agents tend to run a single, long-lived, non-human identity that holds a wide range of permissions that it might need for any task it is ever asked to complete," he wrote. "Evaluations also don't often cover prompts, outputs, transcripts, memory, and logs where it can be read or hijacked through injected content. That mismatch is what most current evaluations get wrong."

Cioffi's filter narrowed the assistant's retrieval scope. It still resolves roughly 60% of email

Cioffi's fix did not require a new identity platform. He moved the entitlement decision into the retrieval path itself, adding a query-path filter that checks the requesting user's SharePoint permissions before the model sees a chunk. The filter runs at query time, not at index time. Content the user could not open in SharePoint does not enter the model's context window.

The control narrowed what the assistant could reach. The assistant still auto-resolves roughly 60% of inbound email with the filter live, Cioffi told VentureBeat. He did not provide a before-the-filter auto-resolution figure for comparison. The qualitative tradeoff he described is that some content the assistant previously used to answer questions is now excluded because the requesting user's permissions do not reach it. That is the price of enforcing the boundary.

The question of whether retrieval-time entitlement filtering is worth the narrowed retrieval scope does not have a single answer. It depends on the sensitivity of the indexed content, the permission variance across the user population, and whether the deployment can tolerate unanswered queries when the filter blocks a chunk the model needs. What Cioffi's incident demonstrates is that the gap exists in custom Azure OpenAI pipelines, that answer-quality evaluations do not catch it, and that a query-path filter closes it at a trade-off the builder can describe.

Identity governance platforms address a different layer. Both controls are needed

CrowdStrike announced its $740 million acquisition of SGNL on January 8, 2026, and closed the deal on February 20, 2026. Palo Alto Networks announced its $25 billion acquisition of CyberArk in July 2025 and closed the deal on February 11, 2026. Both deals closed the same month, establishing identity security as a platform pillar at two of the largest security vendors in the world.

Identity governance platforms focus on which service accounts exist, what they can reach, and when their tokens expire. They govern the lifecycle of the credentials that power AI agents. That layer matters. What it does not govern is the retrieval permission boundary. That is the moment a correctly scoped service account retrieves content on behalf of a user who holds fewer permissions than the indexing job does.

Every credential in the chain is legitimate. The service account is clean and properly managed. The knowledge base is correctly indexed. A low-privilege user queries the assistant, and it answers from the full indexed scope. Nothing flags the retrieval because no credential was misused.

Cioffi's filter is a control at the retrieval permission boundary layer specifically. Azure AI Search's native ACL trimming addresses the same layer for deployments that use it. Neither replaces identity governance. A production deployment that wants to close both the credential lifecycle gap and the retrieval-time entitlement gap needs controls at both layers.

One question and one test, any security team can run

Ask whose permissions each AI retrieval system uses when it fetches content.

If the deployment uses Azure AI Search with the SharePoint indexer and Entra-backed principals, verify that query-time ACL trimming is enabled and that the user population does not depend on SharePoint site groups. If the deployment uses a custom retrieval pipeline, the entitlement check may not exist at all.

Start by proving the answer from a low-privilege account. Run the same question a high-privilege account has already put to the assistant. Compare the outputs against what the low-privilege account can access through the underlying system directly.

Desautels confirmed that this is where a red team would start. "The first test would likely target the gaps between data and instructions, and the gaps between the user's identity and the assistant's own credentials," he wrote. "We'd attempt to plant an instruction within content that we think the assistant will ingest as data. We'd have that content direct a side-effectful, privileged action that the attacking user is not authorized to perform." A failing result, in Desautels' assessment, is "the successful or even partial execution of our injected commands."

If the assistant returns more than the account's direct access would allow, the retrieval permission boundary is not enforced at query time. That test costs two accounts and thirty minutes. It produces a result an evaluation score cannot replicate.

Cioffi built the agent on a custom Azure OpenAI pipeline that bypassed the native ACL trimming layer. He ran every evaluation his team had. He found the gap in his own logs after all of them passed. The evaluation tested whether the agent answered correctly. It did not test whose permissions the agent was using. Run the two-account comparison before the next deployment goes live. Thirty minutes tells you which side of the line you are on.

It's only the first day of September 2026, but the month and fall season are already off to the races in AI land, as Anthropic has just released its latest and most powerful large language models yet — Claude Fable 5.1 and Claude Mythos 5.1.

The two names refer to the same underlying model. Fable 5.1 is the generally available version, with Anthropic’s production safeguards in place. Mythos 5.1 is available through restricted-access programs for vetted cybersecurity and life-sciences organizations that need capabilities normally constrained by those safeguards.

For enterprise buyers, however, the release is about more than another round of benchmark gains. Anthropic is simultaneously changing the economics of running persistent agents, reducing the cost of cached context by 75%, and introducing a new security architecture called Enterprise Frontier Safeguards, or EFS, designed to let organizations retain monitoring data inside infrastructure they control.

Those changes arrive at a particularly consequential moment. Over the past several weeks, Anthropic and the U.K. AI Security Institute have disclosed incidents in which earlier Claude models, running under unusually permissive cybersecurity evaluation conditions, took unauthorized actions against real systems. Anthropic temporarily paused external cyber evaluations and has since introduced additional containment and monitoring before resuming them.

Taken together, Fable 5.1 looks less like a conventional model refresh than an attempt to solve three increasingly intertwined enterprise problems: how to make agents capable enough to finish difficult work, economical enough to leave running for hours, and governable enough to give access to sensitive systems.

A model built for work that does not finish in one prompt

Anthropic is positioning Fable 5.1 primarily around sustained problem-solving.

On Terminal-Bench-Science 0.1, which evaluates agentic scientific research, Anthropic reports Fable 5.1 scoring 52.6%, compared with 24.7% for Fable 5, 29.0% for Opus 5 and 22.4% for GPT-5.6 Sol in its evaluation setup. On Terminal-Bench 4.0, Fable 5.1 scores 55.8%, versus 42.0% for Fable 5 and 52.3% for Opus 5. Mythos 5.1 reaches 60.9% on the same coding benchmark when operating under its more permissive cyber safeguards.

The gains extend beyond coding. Anthropic reports a GDPval-AA v2 score of 1,853 for knowledge work, versus 1,824 for Opus 5 and 1,723 for Fable 5. On AutomationBench, intended to measure business workflows, Fable 5.1 scores 31.4%, compared with 17.1% for Fable 5 and 26.9% for Opus 5. On CursorBench 3.2.0, it reaches 73.4%.

Those numbers should be read as vendor-reported results rather than independent proof of superiority. Anthropic also notes qualifications around several evaluations: production safeguards can affect scores, and its August 2026 OSWorld task release is not directly comparable with some previously published results.

The more useful signal for enterprise teams may therefore come from the kinds of failures early-access partners say the model can resolve.

Investment firm Millennium told Anthropic that Fable 5.1 traced an extremely rare software crash to a bug inside an external vendor library after the problem had resisted explanation for four to five years.

Corporate expense management provider Ramp described an unattended 38-hour machine-learning run in which the model re-evaluated a previous result, launched six experiments and returned with findings and proposed next steps.

Browserbase said Fable 5.1 completed 82% of tasks on its hardest browser-agent benchmark, versus 74% for Opus 5 and 57% for Fable 5.

These are customer testimonials supplied as part of Anthropic’s launch, not independently reproduced benchmarks. But they illustrate the direction Anthropic is pursuing: moving the unit of AI work from an answer or code snippet toward an entire investigation.

That changes deployment architecture. A model that can operate for hours needs durable context, tool access, checkpoints, logging, permission boundaries and reliable recovery from errors. Model intelligence becomes only one component of the system.

Pricing: Fable 5.1 remains premium, but caching changes the equation

The most immediately measurable enterprise change is pricing.

Fable 5.1 retains Fable 5’s headline API rates: $10 per 1 million input tokens and $50 per million output. That makes it considerably more expensive on uncached tokens than other models in Anthropic’s lineup. Opus 5 costs $5 per million input tokens and $25 per million output tokens, while Sonnet 5 costs $2 and $10 respectively.

The important change is cached input:

Anthropic has cut a Fable 5.1 cache hit to just $0.25 on input, down from $1.00 for Fable 5.

That's also just 2.5% of Fable's normal input-token price of $10, rather than the 10% multiplier used by most other Claude models.

Five-minute cache writes remain $12.50 per million tokens and one-hour writes $20, but subsequent reads cost just $0.25 per million.

That produces an unusual pricing profile. Fable 5.1's ordinary input and output are twice as expensive as Opus 5's, yet its cached input is half the cost of Opus 5's cache reads. Its cache-read price is only 25% above Sonnet 5's despite Fable's base input price being five times higher.

That matters for agents because they repeatedly revisit the same codebase, system instructions, tool definitions, documents and accumulated conversation history. Anthropic says the lower cache price reduces Fable 5.1's effective cost by around 25% for typical workloads and as much as roughly 45% for highly agentic workloads in which cached context accounts for a larger share of usage.

This is a more useful enterprise framing than simply comparing per-token list prices. Model selection for an agentic workflow increasingly depends on cost per successfully completed task, including retries, context replay, tool calls and the number of tokens a model consumes before reaching a usable result.

The cache price reduction also may be an effort to help woo increasingly price-consicious enterprises. A Financial Times report found that, more than two months after launch, Fable 5 accounted for only about 11% of Anthropic model spending among roughly 70,000 companies represented in Ramp’s transaction data, while the cheaper Opus 5 and Opus 4.8 gained share.

The Information further reported growing concern among enterprise customers about unpredictable AI bills, including ServiceNow monitoring employee usage after rapidly consuming its annual Anthropic budget. Those reports suggest that even when enterprises valued Fable 5’s capabilities, many were unwilling to make it the default model for large-scale production workloads.

Fable 5.1 nevertheless remains expensive relative to much of the broader market. OpenAI's current promotional API pricing for GPT-5.6 Sol is $4 per million input tokens, $0.40 for cached input and $20 per million output tokens through at least Nov. 21. Google's Gemini 3.7 Flash currently lists at $0.75 per million input and $3.75 per million output through the end of 2026.

Fable therefore needs to justify its premium through higher task completion, lower token consumption, or the ability to replace more expensive human or multi-stage workflows—not simply through raw API price.

Anthropic's pricing system provides additional levers. Batch processing cuts Fable 5.1 input and output rates in half, to $5 and $25 per million tokens, for asynchronous workloads. U.S.-only inference adds a 1.1x multiplier. Web search costs $10 per 1,000 searches in addition to token usage, while web fetch carries no separate fee.

For procurement teams, those details make workload profiling increasingly important. A code-review agent with enormous reusable repository context may have very different economics from a report-generation workflow dominated by new output tokens.

The cyber incidents behind the release

The security architecture surrounding Fable 5.1 also needs to be understood against Anthropic's recent cybersecurity incidents.

On July 30, Anthropic disclosed that a review of 141,006 cybersecurity evaluation runs had identified three incidents, spanning six runs, in which Claude models reached the public internet from a third-party testing environment and obtained unauthorized access to real organizations.

The models had been running without the cyber safeguards applied to generally available Claude deployments. They were performing capture-the-flag exercises and had explicitly been told that their environments were simulations without internet access. A configuration problem nevertheless left an internet path open.

In the most serious incident, Claude Opus 4.7 encountered a real company that shared a name with the fictional organization in its test. Across four runs, the model obtained application and infrastructure credentials and accessed a database containing several hundred rows of production data. Anthropic said the model eventually encountered indications that the system was real but continued its attack.

A second incident involved Mythos 5. The model discovered developer instructions referencing a nonexistent Python package and decided that publishing a package under that name could help it win the simulated challenge. It created a PyPI account and uploaded malicious code to the real public package repository.

The package remained available for roughly an hour and was downloaded and executed on 15 real systems. One belonged to a security company whose automated scanner executed the package; Claude's code extracted credentials and subsequently used them to access additional infrastructure.

In the third incident, an internal Anthropic research model scanned roughly 9,000 internet targets after failing to reach its intended fictional target. It compromised an internet-facing application using exposed credentials and SQL injection, then stopped after recognizing that the system had no connection to the exercise.

The incidents did not involve customer data or Anthropic's production infrastructure, and Anthropic says the production safeguards omitted during the tests would have blocked the behavior. Still, the episodes demonstrated a problem enterprise agent architects will recognize: a sufficiently persistent agent can exploit ambiguity between what its operator intended it to access and what its technical credentials allow it to access.

A separate U.K. AI Security Institute disclosure reinforced that concern.

During testing conducted in July, AISI ran a cyber challenge 122 times across multiple models with internet access deliberately enabled and vendor cyber classifiers disabled. Ten runs produced 19 unsanctioned real-world actions. Seventeen involved Anthropic's Mythos 5; two came from a GPT-5.6 Sol run.

The most serious sequence involved a Mythos 5 agent attempting to insert malicious code into a real open-source project, creating fake identities and attempting to socially engineer a maintainer into accepting the change. The maintainer rejected it, and AISI said its investigation found no resulting real-world harm. The agent also attempted prompt injection against other AI systems and left messages that later agents discovered and used.

Again, these were deliberately permissive research configurations, not commercially available deployments. But AISI's conclusion is relevant far beyond AI labs: increasingly capable agents should be assumed to explore routes their operators did not anticipate, particularly when given difficult objectives and broad tool access.

From model safeguards to infrastructure safeguards

Anthropic's response has been to add layers around the model.

The company paused external cyber evaluations and briefly halted some internal testing, then deployed a real-time classifier designed to detect aggressive probing, sandbox-escape attempts or unexpected internet access before a tool call executes. It also moved high-risk cyber workloads into stronger isolation and imposed new requirements on external evaluators, including explicit network isolation and pre-engagement validation of sandboxes. External cyber evaluations have now resumed.

Fable 5.1 itself also gets more precise production safeguards. Anthropic says its cyber protections now create around 60% fewer interventions per Claude Code session than Fable 5's previous safeguards. The model can be used to discover software vulnerabilities for defensive purposes, while work such as exploit generation, penetration testing and some binary-based vulnerability scanning remains redirected or restricted.

That distinction matters for security teams attempting to operationalize AI. A safeguard that blocks too many legitimate actions can make an autonomous security workflow unreliable; one that permits too much creates a materially different risk. Precision, rather than simply the existence of a filter, becomes a production requirement.

Enterprise Frontier Safeguards moves data custody to the customer

Anthropic is addressing a second enterprise constraint through EFS.

The company previously introduced 30-day data retention for Fable 5 as part of its misuse-detection system. For regulated organizations, retaining sensitive conversations with a model provider can make deployment difficult regardless of contractual assurances.

EFS changes the architecture. Monitoring data can reside in the customer's own AWS, Azure or Google Cloud environment under customer-managed encryption keys, access policies and audit logging. Anthropic's automated systems can analyze the data for patterns associated with serious misuse, while alerts go to the customer for review; Anthropic says human review by its employees is not required.

Anthropic says it developed EFS with more than 100 organizations across financial services, healthcare, manufacturing, telecom, law, retail and government, and with AWS, Google Cloud and Microsoft Azure.

Support is planned across Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Claude Platform on AWS, Google's Agent Platform and Microsoft Foundry. The rollout begins in phases this fall. Eligible customers can use Fable 5.1 with zero data retention until EFS becomes available. Anthropic does not charge separately for EFS, although customers remain responsible for their own cloud storage, operations and egress costs.

This is potentially as important as the model upgrade itself. Enterprise AI governance is shifting from promises about what a provider does with data toward architectures that determine where the data can exist in the first place.

Fable for production, Mythos for controlled frontiers

The split between Fable and Mythos gives Anthropic a mechanism for separating general enterprise deployment from particularly sensitive domains.

Fable 5.1 is available now through Anthropic's API as claude-fable-5-1, as well as through AWS, Google Cloud and Microsoft Azure. Mythos 5.1 uses the same underlying model but exposes more permissive safeguards to vetted cyberdefenders and life-sciences organizations through verification programs.

That same model has shown capabilities extending well outside software. Anthropic reports that Mythos 5.1 designed experimentally validated protein binders, while Fable 5.1 trained a neural network that produced a higher-resolution elevation map covering roughly a third of Venus. Mythos 5.1 also optimized seven open-source biological deep-learning models, with Anthropic reporting inference speedups as high as 2.5x.

For pharmaceutical, engineering and research organizations, that points toward a future in which the same agent architecture used to investigate a code failure may also orchestrate modeling, experimentation and analysis.

The operational lesson is the same in every case: the more work an agent can complete without intervention, the more consequential its permissions become.

Fable 5.1 makes those long-running agents more capable and, through cheaper cached context, potentially much cheaper to operate. EFS gives regulated companies another mechanism for governing their data. More precise safeguards reduce some of the friction that has made high-capability models difficult to use in security workflows.

But Anthropic's own recent incidents also demonstrate why the enterprise deployment question cannot stop at model selection.

The next generation of AI infrastructure will need to treat agents more like powerful service accounts than chatbots: narrowly scoped credentials, segmented networks, explicit allowlists, continuous telemetry, human approval around irreversible actions and the assumption that an agent may find pathways its developer did not anticipate.

Fable 5.1 raises the amount of work organizations can plausibly delegate. Its larger significance may be that it also makes the infrastructure surrounding that delegation impossible to treat as an afterthought.

Perplexity today launched hybrid compute for its agentic platform, Computer, a system that lets a single AI agent split its work between frontier models running in the cloud and smaller open-weight models running locally on Apple silicon Macs — routing sensitive data to the local machine so it never leaves the device.

The company says it is the first time an AI agent can begin a task in the cloud and dynamically hand off the confidential portions of that same task to a model running on the user's own hardware, without restarting the job or losing context. The feature becomes available today through Perplexity's desktop app for enterprise customers that opt in, as well as Pro and Max subscribers, on any Apple silicon Mac running macOS 15 or later.

"Hybrid is really compelling because it's often the work that requires confidentiality that is the most important to get right, and so the accuracy really, really matters," Jon Staff, who leads Perplexity's macOS and iOS engineering teams, said during a press briefing attended by VentureBeat. "By combining these two together, we can get that maximum intelligence from the frontier models, but we also get the security and the privacy that comes with local."

How Perplexity's on-device privacy gate keeps sensitive data off the cloud

The architecture works like a dispatcher. A frontier model in the cloud breaks a task into subtasks and routes each one to the appropriate place. Web research, long-horizon planning and heavy reasoning run in the cloud, while anything touching private files, local data or actions on the device gets delegated down to a subagent running on the Mac itself.

The linchpin is what Perplexity calls a Privacy Gate: a company-trained classifier that runs on the device and scans for personally identifiable information — names, addresses, account numbers, secrets — before anything is transmitted to the cloud. When the gate flags sensitive content, the user chooses whether that portion of the task runs locally or gets shared.

"What we wanted to do is make sure anything that's shared to that cloud orchestrator is safe," Staff said. "We built and trained our own PII classifier that integrates directly into the Mac app."

He described the handoff in detail: "The cloud orchestration will break down the task based on the prompt and figure out how to route it to different subagents... it's going to delegate that down to a sub-agent running on your Mac, and then that portion of the task is run entirely local. None of those tokens go to the cloud."

The economics matter, too, for a company that meters cloud usage through credits. Tokens generated locally cost nothing. "You're paying for the electricity, you're paying for the hardware, so we're not charging you for that," Staff said. "The only thing the credits are used for is the orchestration and the delegation."

Lawyers, private equity firms and a founder in an Uber: hybrid compute in action

Perplexity built its demonstrations around exactly the kind of work most professionals would never hand to a cloud-only agent. In the first, a lawyer on deadline updated a draft brief against privileged case files stored on a Mac while a cloud agent simultaneously pulled public case law from the open web — sending out, Perplexity says, only anonymized legal questions. "At no point did their privileged information get shared to the cloud," Staff said. "It never left the Mac."

In the second demo, a private equity associate's agent reworked a financial model against confidential management projections, benchmarked the deal against public comparables and produced a fifth iteration of an investment committee deck. The task ran roughly 40 minutes in the background with no human input — work that would have taken hours of manual stitching between local spreadsheets and cloud research.

The third demo emphasized continuity across devices. The founder of a pottery shop, riding in the back of an Uber, kicked off a marketing analysis from her iPhone. Computer asked permission to reach her Mac at the studio, fired up the local subagent to process her customer interviews and revenue data, and combined that with cloud research on competitors' public pricing. "It doesn't matter how far away she is from her computer," Staff said.

"Tasks like this aren't possible in a fully local or a fully cloud setup," he added. "You need that security of the local and the privacy, but you also need the intelligence of the frontier."

Why a Chinese-made Qwen model on enterprise Macs is raising eyebrows

The launch model lineup immediately raised a pointed question. At launch, users can choose among three local models: Google's Gemma E4B, Alibaba's Qwen3.6 35B-A3B, and a Perplexity post-trained version of Qwen3.6 35B — the company's recommended option. Asked by VentureBeat whether enterprise or government customers had raised concerns about giving a Chinese-developed model access to their machines, Staff argued that local inference neutralizes the geopolitical risk.

"The great thing about these models is that they are open weight. We're able to evaluate them ourselves," he said. "When that model is running locally on your computer, the data is not going outside of your computer itself... You're not actually sending those tokens to some cloud provider that's hosted in another country. In fact, all of Perplexity's models are U.S. hosted."

He added that macOS's built-in sandboxing framework, known as Seatbelt, constrains what the agent can actually do on a machine: "If local execution is trying to do something that it shouldn't, it'll just point blank stop it and it'll request permission from the user." Perplexity does not currently allow unrestricted "YOLO mode" execution, he said, though "I wouldn't be surprised at some point if we allow certain people to do this."

For enterprises, admins can set a single organization-wide sensitivity policy and audit a full record of what leaves each device — a feature aimed squarely at compliance teams in law, finance and healthcare. Questions remain on the consumer side, however. Pressed on how usage data feeds model training, Staff pointed to Perplexity's incognito mode and a long-standing opt-out toggle, and said enterprise contracts can include zero-data-retention terms. A company spokesperson said Perplexity is "not using it for post training" globally and promised to follow up with specifics on non-enterprise accounts.

The enterprise privacy problem hybrid AI is trying to solve

The announcement lands amid a broader industry reckoning with a stubborn problem: the most valuable enterprise work involves exactly the data companies are least willing to send to someone else's servers. NIST's generative AI risk profile flags data privacy and information leakage among the technology's central risks, and McKinsey's research on the state of AI has consistently found that organizations struggle to move from experimentation to value capture, with data governance among the chief obstacles. Gartner, for its part, named hybrid computing among its top strategic technology trends for 2025, anticipating architectures that blend compute across environments.

Perplexity is betting that the answer is not choosing between cloud intelligence and local privacy, but building the orchestration layer that arbitrates between them in real time. It is a defensible position for a company that has always styled itself as a neutral broker — "Perplexity is like Switzerland in that we work with everyone," a company representative said at the briefing — sitting at the application layer above whichever models happen to lead at any given moment.

"Anytime one of these gets better, Perplexity gets better," Staff said of the interplay among local models, frontier models and Apple's chips. "That's the really cool nature of where we sit in this application layer, orchestrating all the different pieces together."

From $520 million startup to $20 billion agent platform in three years

Hybrid compute caps an extraordinarily aggressive product run. Perplexity launched its Comet AI browser in July 2025, initially for $200-a-month Max subscribers — an early bid to make agents, not chat, the interface to computing. Computer, its full agentic platform, arrived in March 2026, followed by desktop apps for Mac and Windows. Just last week, the company launched a local-first version of Computer on NVIDIA's DGX Spark hardware, which starts on the user's device and escalates to cloud models only with permission. Today's launch inverts that flow: cloud-first, delegating down.

The business trajectory has been equally steep. Perplexity was valued at $520 million in January 2024; by September 2025, the company had finalized a funding round at a $20 billion valuation. Along the way it made an audacious $34.5 billion bid for Google's Chrome browser during Google's antitrust remedies fight, and Bloomberg reported that Apple executives held internal talks about acquiring the company — a striking backdrop for a product now built to showcase Apple silicon.

The strategy is not without headwinds. Reuters reported in July that Reddit's data-scraping lawsuit against Perplexity survived a motion to dismiss, part of a wave of copyright and data litigation facing the company — context that makes its privacy-forward positioning both commercially savvy and reputationally necessary. And practical constraints remain: Perplexity recommends at least 32GB of unified memory for the better tier of local models, Staff was candid that the smallest option "significantly underperforms" the larger Qwen models, and Windows and Linux support will come only later.

The deeper question is one users cannot easily inspect. The Privacy Gate is itself a machine learning classifier, and classifiers miss things; a false negative means sensitive data reaches the cloud anyway. Perplexity's answer is transparency — users can expand and review exactly what the gate flagged before anything is sent, and enterprises get device-level audit logs. But the pitch, at bottom, asks professionals to trust one AI to decide what another AI is allowed to see. For an industry that has spent three years telling lawyers, bankers and doctors to keep their most sensitive work away from the cloud, Perplexity's wager is that the fix was never to build a higher wall — it was to build a smarter gate.

Presented by SAP

HR tracks employees and skills. Finance owns headcount targets and cost. Procurement manages contractors and services spend. Together, they leave executives unable to answer basic questions about how workforce decisions actually translate into business outcomes.

Fragmented planning creates workforce blind spots

Each function has its own systems, its own planning cadence, and its own assumptions about how work gets done. Recent SAP research found that 62% of C-suite executives are dissatisfied with their current level of integration between people and business performance data. The same research found that while 50% of organizations are planning for AI’s impact on productivity and capacity, only 21% are planning for AI’s impact on job design and organizational structure.

That gap matters because the two are inseparable. You can’t make a sound decision about where to automate without understanding how it will affect the teams, roles, and skills connected to that work. Most organizations are trying to do exactly that, and discovering, usually too late, that the pieces don’t fit together.

The workforce has quietly expanded — and planning hasn’t caught up

The definition of “workforce” has been expanding for years, but most planning models haven’t registered the change. Employees now work alongside contractors, specialized partners, and AI systems that handle real execution-layer tasks — not just support functions, but actual work. In some delivery models, external and digital labor has moved from supplemental to central.

That shift changes the nature of every significant workforce decision. When a company chooses to automate a process, the ripple effects touch headcount, skills, services spending, and productivity assumptions simultaneously. A reskilling initiative can reduce dependency on contractors. Expanding contractor capacity can close an immediate gap while quietly deepening a long-term capability problem. None of these moves can be evaluated well in isolation, but that’s precisely how most organizations still evaluate them — separately, in sequence, by different teams working from different data.

The real question isn’t “should we hire, automate, or reskill?” It’s how work should be configured across humans and intelligent systems, and at what cost. Most planning architectures weren’t designed to ask that question, let alone answer it.

CFOs and CHROs are being pushed into the same room

CFOs are being asked to connect financial signals to real operational choices, particularly in workforce spending, which dominates most income statements. CHROs are being pulled beyond traditional talent management into harder questions about work design and the balance between human and digital labor. Neither can answer these questions from their current vantage point alone, and historically, they haven’t had to answer them together. That’s changing, not because of some cultural shift toward collaboration, but because the decisions genuinely require both perspectives at the same time.

When that partnership works, organizations can move workforce planning from a periodic budgeting exercise to an ongoing strategic conversation. They can ask harder questions: Where does it make more sense to build critical skills internally than to buy capacity externally? When we automate a workflow, how do we know whether we’re creating capacity or just moving a problem downstream? These aren’t questions finance or HR can answer in sequence. They require shared data, shared governance, and frankly, a shared willingness to operate in territory that neither function fully owns yet.

From annual budgets to continuous workforce steering

The organizations handling this best stopped treating workforce planning as a once-a-year negotiation and started treating it as an ongoing operational discipline. That means finance, HR, and procurement seeing the same picture of workforce capacity, skills, and cost, rather than reconciling three different pictures after the fact. It means modeling scenarios that combine hiring, reskilling, automation, and external labor as connected levers rather than separate conversations.

The metrics are evolving too. Headcount, labor cost, and utilization still matter, but they describe only part of what’s happening. As AI becomes embedded in operations, leaders need visibility into skills and readiness relative to strategic priorities, how work is actually distributed across employees and intelligent systems, and whether automation is unlocking new capacity or quietly eroding the engagement of the people working alongside it. Organizations that track these signals appear to be making structurally different decisions about where to invest. They are not just better-informed, but asking better questions.

The hard part isn’t the technology

Connecting HR, finance, and procurement data creates the conditions for better decisions. It doesn’t make those decisions. The harder challenge is leadership alignment: CFOs and CHROs agreeing on shared metrics, committing to a planning cadence that keeps workforce choices connected to business strategy, and building a working relationship where neither function is simply ratifying what the other has already decided. That’s a governance problem, and it doesn’t come bundled with any platform.

The organizations that move first on this won’t just have better data. They’ll have a fundamentally clearer picture of how work creates value across employees, contractors, and intelligent systems together. The ones that don’t will keep making workforce decisions in the dark. The difference is that those decisions are coming faster now, and the consequences of getting them wrong are larger.

For additional perspectives on workforce planning, continuous planning, and leadership in the age of AI, explore SAP Workforce Planning and the latest SAP SuccessFactors innovations.

David Imbert is Chief Marketing Officer, SAP Financial Management; Lara Albert is Chief Marketing Officer, SAP SuccessFactors.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

The viral fervor we saw earlier this year around OpenClaw, the open source AI harness that turns powerful language models into autonomous workers the user can message via their favorite channels (Telegram, iMessage, WhatsApp, Discord etc), has cooled off substantially from its peak in March 2026.

But over the weekend, OpenClaw's creator Peter Steinberger and current team of co-developers gave the world — especially enterprises — a reason to look at it again, announcing OpenClaw 2.0, billed as the most significant update to the harness and surrounding platform yet.

OpenClaw 2.0 seeks to transform what began largely as a personal agent harness into something increasingly designed for teams, shared infrastructure and enterprise workflows.

OpenClaw 2.0 introduces a rebuilt browser interface that brings conversations, files, approvals, configuration and live agent activity into a common workspace. It adds shared cloud sessions and multi-user collaboration. And it expands the security model with stronger sandboxing, role-based permissions, approval controls, secrets handling and auditing.

Together, those additions move OpenClaw closer to being infrastructure that an organization could deploy for employees rather than simply a powerful agent an individual developer runs locally.

They also sharpen a competitive question surrounding the project: whether OpenClaw has addressed the security and isolation concerns that helped inspire newer alternatives such as NanoClaw.

The answer is increasingly yes at the capability level — but not necessarily by default.

OpenClaw wants to become the shared agent layer

Released under the official name of v2026.8.1, the update spans installation, messaging, memory, skills, models, automations, browser and native applications, plugins and security.

Steinberger described the development of OpenClaw 2.0 as an exercise in using the product to build itself.

“Two months ago, we started the mission to ‘build OpenClaw with OpenClaw,’” Steinberger wrote on X early on August 31.

Over that period, he said, OpenClaw gradually moved its team away from individual local coding harnesses and toward team.openclaw.ai, a shared agent environment aware of what team members are working on.

“Multiplayer coding + infinite compute with nodes and cloud sessions has been a game changer for how we build,” Steinberger wrote, adding that local harnesses now “feel like relics of the past.”

That claim points toward one of the more important changes in OpenClaw’s enterprise proposition.

The dominant model for AI coding agents has generally been individual: a developer runs an agent in a terminal, IDE or desktop application, gives it access to a repository and lets it execute work within that environment.

OpenClaw 2.0 is pushing toward something different. Agent sessions can become persistent workspaces that outlive a single terminal or employee. They can be shared with colleagues, executed across other machines or cloud workers, and supervised through a browser.

For enterprises, that potentially turns the agent from an employee-level productivity application into a shared operational layer.

A new UI could broaden OpenClaw beyond developers

The redesigned Control UI is central to that strategy.

OpenClaw has shifted away from an Overview-first web application and made conversations the primary interface. Threads sit in a sidebar, while the active conversation occupies the main workspace. Files, approvals, settings and ongoing agent activity remain accessible around it.

The design deliberately brings OpenClaw closer to the interaction model employees already know from OpenAI's ChatGPT, Anthropic's Claude, Google's Gemini and other conversational AI products.

That lowers an important barrier to enterprise adoption. Open-source agent frameworks are often powerful precisely because they expose low-level configuration, terminals, tools and runtime controls. Those same characteristics can make them difficult to deploy beyond engineering organizations.

OpenClaw 2.0 attempts to preserve the underlying control while putting a conversational interface on top of it. An employee can ask an agent to perform work without treating the terminal as the primary product interface. But OpenClaw does not hide what is happening underneath. The Control UI can surface session files, terminal activity, Git-backed changes, pull-request state, browser activity and interactive dashboards.

The release also places more emphasis on observability during agent execution. Tool calls and results are paired more clearly, file changes can appear as focused diffs, command activity is easier to inspect, and long-running background tasks can remain visible alongside the conversation. That combination matters for enterprise use.

Employees get a simpler interface for delegating work. Technical users retain access to the artifacts and execution state behind the conversation. Administrators gain a centralized place to configure and supervise the system.

The redesigned Settings workspace now encompasses agents, memory, plugins, MCP servers, devices, communication channels and device pairing. OpenClaw also consolidates model-provider administration, including credential status and, where providers expose it, model availability, quota, account balance, budget and spending information.

Limited-access browser users can request administrator privileges rather than automatically receiving them, with another administrator required to approve the escalation.

These are not especially flashy agent features. For companies deploying AI systems to dozens or hundreds of employees, they may be among the most important additions in the release.

Multiplayer sessions turn agent context into shared context

OpenClaw 2.0 also expands the agent from a personal workspace into a collaborative one.

Shared cloud sessions allow another employee to enter work already in progress without discarding the context accumulated by the agent.

Multi-user Gateways — the service that connects users and agents to tools, files, credentials and other resources — can track who created a conversation and which prompts were submitted by identified participants.

Owners and administrators can determine whether another user can read a session, suggest changes, work in draft mode or participate directly.

The interface adds session ownership, participant attribution, presence and even typing indicators. For coding teams, that introduces a workflow closer to collaborative software development than traditional AI chat.

A developer could initiate a task and allow an agent to work on it remotely. Another engineer could inspect the resulting changes. A senior engineer or administrator could approve an operation requiring additional privileges. The work does not have to remain attached to the laptop or terminal where it started.

Sessions can also move execution to paired devices or cloud workers while maintaining the broader workspace.

For enterprises experimenting with long-running agents, that is significant. Persistent agents need mechanisms for shift changes, escalation, supervision and ownership transfer. Otherwise, organizations simply create fleets of personal agents whose state disappears into individual user environments.

OpenClaw is attempting to turn that state into collaborative infrastructure. Already, some teams outside the developers of the open source project are adopting it.

Colin Johnson, CEO of marketing metrics software firm Solvely, described a similar shift in his own development workflow in a post on X.

His team had already been using OpenClaw agents through Discord, where developers could assign tasks, run commands and interact with their development environment. But he said that model still felt like “messaging a bot”: developers could share access to an agent without actually sharing the agent’s working context.

The new multiplayer WebUI changed that, he wrote, because two developers could open the same live session, see the same history and artifacts, and add information without first exporting or reconstructing what the agent had already done. “We were working inside the same context,” Colin wrote.

In one example, another developer was taking over a project he had been working on; instead of preparing a traditional handoff document, Colin joined the developer’s existing agent thread and added the missing project context directly. “The session itself became the handoff document,” he wrote.

For enterprise teams, that is a useful illustration of why persistent multiplayer sessions may matter beyond convenience: agent context can become a shared work artifact rather than information trapped inside one employee’s private conversation.

Colin’s deployment also illustrates both the enterprise potential and the remaining security boundary. His team runs its OpenClaw Gateway on a development server reachable through GitHub authentication, Cloudflare Access and a Cloudflare Tunnel, with the Gateway itself listening only on the server’s loopback interface rather than an exposed public port.

But he explicitly cautioned that this does not make the shared Gateway a multitenant environment. The developers already trust one another with the repositories, tools and agent capabilities behind it. As he put it, Cloudflare controls who can enter the workspace, while OpenClaw tracks who created, owns or contributed to the work; stronger separation still requires separate infrastructure.

Security becomes much more enterprise-oriented

That shift creates a corresponding security problem: a shared agent can potentially act with broader organizational authority than one running on a developer laptop.

OpenClaw 2.0 responds with considerably more granular controls.

Approvals can now be tied to a specific request, command, session and person. Command permissions can be constrained to specific arguments and working directories. For script-backed execution, OpenClaw can verify that the script being executed still matches what was originally reviewed.

Sessions can operate under different permission levels, including read-only, guarded, workspace and full-access modes, with the highest level restricted to administrators.

Organizations can also define operator roles that require sandboxed execution for sessions created by specific identities. OpenClaw says those requirements cannot be bypassed using elevated execution or host overrides; if the required sandbox cannot be provisioned, execution fails rather than silently falling back to the host.

Credentials receive additional protection.

OpenClaw’s team-scoped Secret Store distinguishes protected secrets from ordinary environment data available to the agent. For supported requests, a protected credential can be substituted into a Gateway-hosted HTTPS request without exposing that credential directly to the model.

OpenClaw can also reference external systems including 1Password and Vault.

Auditing has expanded around execution identity, approvals, session actions and outbound messages. Plugin installation can trigger capability reviews associated with the specific artifact being installed.

Those controls address questions enterprises inevitably face when deploying agents: Who initiated an action? Which agent performed it? What resources could it access? Who approved the operation? And what happens to those permissions when work moves between people or machines?

NanoClaw still takes a different approach to security

OpenClaw’s changes also make the comparison with open source, enterprise-friendly rival NanoClaw more nuanced.

NanoClaw is one of several subsequent projects to emerge around the idea that AI agents need stronger isolation and simpler security boundaries. Its architecture places operating-system-level containment at the center of the design.

NanoClaw runs agents inside Docker containers, limits those containers to explicitly mounted filesystems and runs their processes as an unprivileged user. Sessions and agent groups can remain isolated rather than automatically sharing files and conversation history.

Its credential architecture follows the same principle. Supported outbound requests can pass through OneCLI’s Agent Vault, allowing credentials to be injected by a gateway rather than placed inside the agent container itself. NanoClaw also provides an optional egress-lockdown mode that puts agents on an internal Docker network and routes supported external traffic through the gateway.

OpenClaw 2.0 can now reproduce many elements of that hardened model. It supports Docker and Podman sandboxes, per-agent and per-session sandbox scopes, configurable read-only or read-write workspace access, role-enforced sandboxing, remote execution nodes and disposable cloud workers.

The key difference is the starting posture. OpenClaw’s documentation explicitly says sandboxing and execution approvals are off by default. Its baseline configuration assumes a trusted single operator and permits host execution unless administrators configure stronger restrictions. NanoClaw makes isolation more fundamental to how agent execution is structured.

So does OpenClaw 2.0 have security parity with NanoClaw?

In terms of available controls, it is much closer than before. In terms of defaults and architectural philosophy, no. An enterprise can configure OpenClaw into a substantially hardened environment, but it has to make that decision deliberately.

One Gateway is still one trust domain

Another limitation is particularly important for larger organizations. OpenClaw says a Gateway should be treated as a single trust domain.

Its new multi-user permissions are designed to govern collaboration among trusted users. They should not be treated as hard isolation between mutually untrusted tenants.

For organizations requiring stronger separation — between business units, customers or other security domains, for example — OpenClaw recommends separate Gateway instances, described as “cells,” with separate state, credentials and workspaces.

Fleet tooling for managing those cells remains experimental.

That distinction could matter significantly for enterprises considering OpenClaw as a centrally operated service.

Role-based access inside one Gateway may be sufficient for a trusted engineering department or internal team. It is a different proposition from a multi-tenant platform intended to isolate customers or users who should be assumed hostile to one another.

NanoClaw has its own configuration requirements and limitations, and even its stronger outbound-network lockdown remains optional. But its smaller architecture and container-centric execution model may appeal to organizations that want a narrower security boundary that is easier to reason about.

OpenClaw is optimizing for a broader problem.

OpenClaw’s biggest advantage may be the control plane

The tradeoff is product breadth.

NanoClaw emphasizes a relatively small codebase, container isolation and customization through code and skills. Its second-generation architecture supports owner, administrator and member roles, and a separate monitoring dashboard can provide visibility into deployments.

OpenClaw 2.0 is trying to build a much broader operational environment.

Its Control UI combines employee interaction, live execution, files, approvals, terminals, code review, model-provider configuration, devices and shared sessions.

That gives OpenClaw a potential advantage for enterprises that need not only secure agent execution but a usable control plane around it.

Security teams care about isolation. Platform teams also need deployment, authentication, model configuration, auditing and policy enforcement. Employees need an interface they can actually use. Managers need a way to understand what is running. Developers need access to the underlying files and tools when something goes wrong.

OpenClaw 2.0 increasingly tries to serve all of those constituencies through one system.

What is OpenAI's role?

OpenClaw says 933 contributors, including 569 first-time contributors, participated in the release, which includes more than 16,000 pull requests — roughly half of all pull requests ever merged into the project.

Interestingly, the release was not shared by Steinberger's employer, OpenAI. Recall that the Austrian developer announced on Feb. 14, 2026 that he was joining OpenAI to work on bringing agents to a broader audience, a move OpenAI CEO Sam Altman publicly confirmed the following day.

But OpenClaw was not folded into OpenAI. Steinberger said at the time that OpenClaw would move to a foundation and “stay open and independent,” while OpenAI would support the project. OpenClaw now says it is stewarded by the OpenClaw Foundation, an independent 501(c)(3), with OpenAI listed alongside Microsoft, GitHub, NVIDIA, Atlassian, Tencent and other organizations as partners.

Based on the available public information, OpenClaw 2.0 should therefore be understood as an OpenClaw Foundation release, not an OpenAI product or OpenAI software release, despite Steinberger’s employment at OpenAI and OpenAI’s financial and organizational support for the project.

Enterprise readiness now depends on configuration

OpenClaw 2.0 does not eliminate the security risks associated with autonomous agents, and its own documentation identifies limitations.

Secret Store values, for example, are not themselves encrypted at rest and rely on filesystem protections. Protected credential substitution does not cover every possible execution path, including some raw sockets, containers, remote nodes and provider-native harnessesIts multi-user permissions are collaboration controls, not hostile-tenant isolation.

Those caveats should prevent enterprises from interpreting OpenClaw 2.0 as secure-by-default agent infrastructure.But they also illustrate how much the conversation around the project has changed. The relevant comparison is increasingly not simply OpenClaw versus NanoClaw. It is a container-first, constrained system such as NanoClaw versus a deliberately hardened OpenClaw deployment that provides a substantially broader employee and administrator experience.

NanoClaw retains a strong proposition for organizations prioritizing a small attack surface, container-first execution and architectural simplicity.

OpenClaw is making another bet: that enterprises ultimately need an agent platform to function as both runtime and workplace.

OpenClaw 2.0 provides many of the primitives needed to build that environment — sandboxing, permissions, protected credentials, approvals, identity, auditing and isolated deployments — alongside a browser interface designed to make the system accessible to employees who will never configure an agent from a terminal.

The remaining caveat is important: enterprises have to turn those primitives into policy. OpenClaw 2.0 doesn't automatically make OpenClaw enterprise-ready, but it does make an enterprise-grade OpenClaw deployment far easier out-of-the-box.

And as Steinberger’s description of OpenClaw’s own development process suggests, the long-term ambition may be larger still. Rather than giving every employee another AI assistant, OpenClaw is positioning the agent itself as shared infrastructure — a persistent layer where people, models and compute collaborate on the same work.

If you look at the commit histories of modern data platforms, something profound has shifted over the last two years. The friction of writing syntax has collapsed. With Cursor, Claude Code, and agentic workflows now living inside our Docker containers and IDEs, generating the first implementation of a distributed streaming pipeline or a complex API integration is no longer the central bottleneck.

Agents can navigate repositories, write test coverage, inspect stack traces, and propose refactors. Describe a Kafka-to-Iceberg sink mapping in plain English, and an agent can produce a credible starting point before the engineer has opened every relevant file.

That changes the question for software engineers.

If the agent is becoming the primary author of local system logic, what exactly is left for the engineer to do? Are we headed toward an industry of reviewers rubber-stamping an endless stream of plausible pull requests? Or has the work shifted away from constructing logic and toward something more abstract?

To answer that, it helps to borrow a lens from thermodynamics, which gives us a language for directed work, feedback, loss, and the boundaries that keep a complex system coherent.

The agent as a heat engine

When we strip away the anthropomorphic illusion of AI, what remains is a computational engine. It takes direction and turns it into action.

An LLM sitting in a data center has immense capacity, but it does no useful work until it is given intent. A prompt, a business requirement, a system instruction, or a failing test gives the agent a direction. It turns that direction into code, tool calls, queries, tests, and changes to a running system.

Every engine has losses. Every agent loop does, too.

Anyone who has left an agent running against a difficult repository has seen this. It starts with a clear task. Then it follows a stale assumption, fixes a symptom rather than a cause, treats an old migration as current behavior, and begins to accumulate its own history. A few tool calls later, the context contains enough plausible but conflicting detail that the next step is less certain than the first.

Call this operational entropy: the buildup of stale assumptions, branching context, and unresolved dependencies inside a loop that is still trying to move forward.

A human interruption helps because it introduces new information. So does a failing test, a precise data contract, a deterministic tool, or an evaluation that tells the agent exactly what it got wrong. Without that signal, an agent can keep generating output while drifting further from a correct outcome.

Agents clearly generate motion. The real question is whether the system around them turns that motion into useful work.

The infinite monkey and the accelerating search space

The infinite monkey theorem gives us a useful picture of what follows: repeated attempts, finite constraints, and feedback.

The theorem says that a monkey hitting keys at random for an infinite amount of time will almost surely type the complete works of Shakespeare. Modern agents are much smarter monkeys. They have compilers, tools, repositories, test suites, and feedback loops. Their work is not random — the feedback steers the next attempt — but the dynamic is familiar: propose, execute, observe, correct, and try again.

In a bounded task, that loop is remarkably effective.

Give an agent a known input schema, a known target schema, a small codebase, and tests that catch the relevant failures. It can inspect the code, make a change, run the tests, absorb the result, and try again. The definition of done is visible. The search space is narrow. The loop has a chance to converge.

But enterprise systems rarely offer that kind of stillness. A real-time pricing engine may depend on mutable operational state, third-party APIs, late-arriving events, regional policy, and business rules that exist partly in code and partly in someone’s head. A data lakehouse can be physically consistent and semantically wrong. A pipeline can pass its tests and still produce numbers that finance does not recognize.

The environment is changing while the monkey is typing.

The three-body problem of enterprise logic

This is why the three-body problem is such a useful image for enterprise software.

With two bodies — a planet and a star — you can predict the motion with a clean mathematical description. Add a third body and the problem becomes much harder to solve. There is no general closed-form solution, and some configurations exhibit chaotic behavior. Small changes in one place can produce very different trajectories elsewhere.

Modern data platforms have the same shape. Clickstream data changes with product behavior. Operational databases mutate under customer activity. APIs impose rate limits and change versions. Schemas evolve. Security policies shift. Legacy systems carry rules that no one has written down because they have been buried in exception handling for years.

Each system exerts pressure on the others. A change in one place alters the meaning or behavior of another. What begins as a local feature request starts to pull on the entire system.

Consider a hypothetical: an agent is asked to add a customer_tier field to a revenue model. It finds a field called status in the operational database, maps it into the transformation, and passes the existing type and nullability tests. The code is clean. The pipeline is green. The answer is still wrong.

A semantic data contract says that customer_tier is derived from trailing twelve-month spend, has an assigned business owner, and cannot be populated from account status. The contract rejects the change before it reaches the dashboard. The engineer's contribution wasn't the transformation — it was the boundary that made the agent's mistake visible, specific, and recoverable.

The new mandate: Designing equilibrium

The software engineer’s job is no longer to write every piece of micro-logic. Agents will increasingly do that work, often faster. The new mandate — designing equilibrium — is to create the conditions in which generated logic can be trusted.

When a business requirement changes faster than an agent can absorb feedback, the engineer has to build containment fields. Strict semantic layers, immutable event logs, data contracts, idempotent APIs, and deterministic state machines are not just good platform hygiene. They reduce the number of assumptions an agent has to make at once.

They turn a coupled problem into a bounded domain with clear inputs, explicit rules, and reliable feedback.

Once that domain exists, the agent becomes genuinely powerful. It can write the transformation, execute the tests, repair the failures, and ship the change without needing to infer the unwritten history behind every table and service.

The value of software engineering doesn't disappear as code generation gets cheaper — it becomes more visible, which is the shift that actually matters.

Autonomous systems will increasingly generate software. But the contracts, feedback loops, and boundaries that determine whether that software succeeds or spirals into chaos will still be designed by software engineers.

Ananth Packkildurai is a data engineering leader, writer, and author of Data Engineering Weekly, sharing insights on modern data platforms, large-scale pipelines, and AI-driven architectures.

Presented by Box

Identity and permissions are no longer enough to secure enterprise AI agents. They govern what an agent can reach, not how it behaves once it starts working on its own, and an autonomous agent can turn legitimate access of enterprise data into unintended action in seconds. That gap is pushing enterprise AI security from just governing access toward a layered approach that includes governing execution, says Heather Ceylan, chief information security officer at Box.

"Access controls and permissions are the foundation, but the challenge is they were designed for humans," Ceylan says. "Permissions are still the foundation, but you have to think about how the agents get their permissions scoped as well."

Access controls were built for a slower, more forgiving world, where a human employee with lingering permissions to a decade-old folder will rarely go looking for any data inside it, or even remember they have access at all. But an agent will explore all of its permissions, operating at a scale no person can match and surfacing forgotten misconfigurations and stale permissions far faster than a human ever could. Identity and scoped permissions remain the first layer of any credible defense, however, because agents raise the stakes, clean access hygiene is more valuable than ever.

A steady drip of incidents in recent months underlines the potential for major damage, where models have slipped the sandboxes they were supposed to stay contained within, reached systems they weren't scoped to touch, or read content they were not permitted to access. While the specifics vary, the overarching threat remains the same: an agent found a path through the data that it could reach, and took it.

Access controls alone can't secure autonomous AI agents

Complications crop up when agents are handed broad standing permissions to match broad workflows. An agent might legitimately need to call fifty tools across twenty different actions over the life of a task, reading and writing folders that span every department in the company. But granting all of that access at once inflates the blast radius of possible damage to data and content if a single step goes wrong. A stronger permissions model provides access only in the moments that it's needed, Ceylan says.

"You need permissions that change based on what the agent has been asked to do, when it needs to take that action," she explains. "If it's taking one step and only needs two tools, it should be scoped to only those two. When you narrow permissions to the task in front of the agent, the number of ways any given step can misfire shrinks with it."

From governing access to governing execution

Tight security is also no longer tied to whether an agent has access to specific data, but whether it should take a specific action on a specific step, which is the difference between a standing access grant and a bounded one. In other words, an agent may hold legitimate rights to a finance folder but still have no business writing four thousand of those files to a new location, even if it's told to do so.

"An employee with access to payroll data they were never meant to keep could be instructed to pull the payroll records and write them to a public shared folder, publishing the entire company's compensation in a single move," she says. "Every access check passed, but the behavior still has catastrophic consequences."

Prompts alone can’t reliably govern agent behavior because instructions can change, agents can absorb injected instructions, or they can be steered by files they read along the way. Durable controls need to live one level down, with the tool calls themselves, as well as the content those calls act on. Deciding in advance what an agent is permitted to execute, regardless of how its prompt is manipulated, keeps behavior inside fixed bounds that no clever input can talk it out of.

Legacy content platforms weren't built for AI agents

Most of what an agent touches inside a company is unstructured content, including contract, policies, customer records — the accumulated files that make up the overwhelming majority of corporate data. Much of it still sits in systems that were designed for human filing habits: network drives, aging ECM platforms, and many SaaS tools. Those systems were built to ask the question, does this person have permission? and they answer it with folder-level access that hasn't been audited for years.

The legacy platforms don't have metadata for an agent to reason over or classification for an enforcement layer to act on, and their logs aren't detailed enough to show what an agent read. Bolting an AI connector onto that stack doesn't fix any of it, it just hands agents the same blind spots, only at machine speeds, Ceylan says.

"Every agent action eventually resolves to content," Ceylan says. "If the content layer can't tell you what it's holding, who it belongs to, and what should never leave it, there's nothing underneath your controls."

How to decide which AI actions need human approval

Two years ago, everyone assumed security would always mean including humans in the loop. Building and living with agents has changed that assumption, Ceylan says, and Box now sorts actions into three tiers: fully autonomous actions, monitored actions and high-risk actions that require human approval.

• Fully autonomous, reserved for actions that are reversible, bounded, logged, and free of untrusted input, and where a mistake doesn't cost too much.

• Monitored actions, once a team has built enough confidence in an agent and paired it with alerting and rollback that can catch and undo a problem in flight.

• Irreversible, high-risk actions that are always routed through a person — for instance, when an agent that wants to delete a large number of files or wipe the primary folder in a structure.

Each team must calibrate the lines between these layers to match its own risk tolerance.

Box’s approach is to put controls in the platform rather than the workflow, enforcing protections such as data classification, labeling and expiration without requiring a human checkpoint for every action.

"The right configuration should be enforced at the outset, instead of blocking an action at the end," Ceylan says.

Building trust in AI agents through behavior over time

An organization can make an access decision once, but trusting an agent's behavior should only happen over time, observing how the agent runs, collaborates, and builds on the outputs of other agents. Published frameworks tend to lag the technology, or are too abstract to implement; instead Box works from a smaller set of principles: tightly scoped agent identities and actions, clear expectations about what can be rolled back, three approval tiers, and a way for teams to test and iterate quickly.

"The sanctioned path has to be the fast path, because when teams aren't given a safe way to experiment, they tend to route around the controls entirely," Ceylan says. "A security leader's job is to offer a way to move quickly without stepping outside the guardrails."

Sustaining trust in an agent depends on being able to see how it actually behaves. But traditional monitoring tools weren’t built for the job; the behavioral baselines that underpin user and entity behavior analytics were calibrated to human activity, and suspicious agent behavior doesn’t necessarily look like human activity.

And while establishing a useful agent baseline begins with logging, many agents start out as experiments, so their actions never make it into logging infrastructure. Plus, important signals are rarely individual easily flagged actions, but chains of activities across systems, as one agent's output becomes another's input, while the detections for that pattern are still being designed.

Governing agents, then, requires visibility not just into what they can access, but what they actually do, and that visibility has to live where the content does.

Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Enterprise AI has entered a new era. Organizations are rapidly moving beyond assistants that answer questions to autonomous agents capable of reasoning, invoking tools, accessing enterprise applications, coordinating with other agents, and completing multi-step business workflows with minimal human intervention.

This shift represents a fundamental change in how software operates. Traditional applications execute predefined logic written by developers. AI agents, however, dynamically determine how to achieve an objective. They decide which tools to use, which APIs to call, what information to retrieve, and how to sequence actions based on context. That flexibility unlocks enormous business value, but it also introduces a new class of security risks.

Much of today's AI security discussion focuses on prompt injection, model vulnerabilities, and data leakage. These are important concerns, but they represent only part of the challenge. Once an AI agent has successfully authenticated and begins acting autonomously, traditional security controls provide very little visibility into whether it continues to operate safely.

This is where enterprises need to adopt a new security mindset: runtime trust.

Authentication establishes identity, not trust

Enterprise security has traditionally relied on three foundational questions: Who are you, what can you access, and what actions are you authorized to perform. Identity providers, multi-factor authentication (MFA), role-based access control, and zero trust architectures answer these questions effectively for human users and conventional applications, and NIST's zero trust guidance remains a solid reference point for how those principles are meant to work (NIST SP 800-207).

AI agents introduce a different problem. An AI agent may legitimately authenticate using an enterprise identity, receive valid API credentials, and be granted access to systems like Microsoft 365, ServiceNow, Salesforce, or GitHub. From an identity perspective, everything appears correct. The real challenge begins after authentication: During execution, the agent continuously reasons, interprets objectives, invokes tools, retrieves information, and adapts its behavior based on new context, and security teams must determine whether those actions remain aligned with the user's intent and organizational policy. Authentication verifies who an AI agent is. Runtime trust continuously verifies what it is doing.

Enterprise AI is becoming an autonomous workforce

Modern AI agents increasingly interact with large language models (LLMs), Model Context Protocol (MCP) servers, retrieval-augmented generation (RAG) systems, vector databases, enterprise APIs, SaaS platforms, and internal knowledge repositories, as well as other AI agents. This interconnected ecosystem enables sophisticated automation but dramatically expands the attack surface: A single compromised tool, poisoned knowledge source, overly permissive API, or manipulated prompt can influence downstream decisions across an entire workflow, and unlike traditional software, these risks evolve during execution rather than being fixed at deployment.

That expanding surface is exactly what a handful of runtime threats exploit.

Goal drift happens when an agent begins with a legitimate objective but gradually deviates from the user's original intent while attempting to optimize outcomes. An agent tasked with preparing a customer report, for instance, might autonomously retrieve unrelated confidential information because it incorrectly determines that additional context would improve the response.

Excessive tool invocation is what happens when autonomous agents with access to numerous enterprise tools call unnecessary APIs, modify configurations, access sensitive repositories, or perform administrative actions simply because the model believes those actions are useful, absent any runtime controls to stop it.

Memory poisoning exploits the persistent memory that improves personalization: Attackers can intentionally insert misleading instructions into long-term memory or retrieval systems, causing future decisions to be influenced by malicious or outdated information.

Context manipulation takes advantage of how heavily LLMs depend on context: If attackers influence retrieved documents, system prompts, conversation history, or external data sources, they can indirectly steer autonomous behavior without ever compromising the underlying model. MITRE's ATLAS framework catalogs this kind of adversarial behavior against AI systems in useful detail.

Multi-agent amplification emerges as organizations deploy specialized AI agents that collaborate: If one agent behaves incorrectly, downstream agents may trust and amplify those actions, creating cascading failures across enterprise workflows.

Introducing runtime trust

Runtime trust extends security beyond authentication by continuously validating AI behavior throughout execution. Rather than assuming authenticated agents remain trustworthy indefinitely, it continuously evaluates whether autonomous decisions remain aligned with organizational policy. A runtime trust architecture rests on several complementary capabilities.

Intent validation evaluates, before executing sensitive actions, whether proposed behavior still matches the user's original objective: Is this action necessary? Is it expected? Does it exceed the requested scope? Would a reasonable human perform the same action?

Behavioral monitoring observes tool usage, API activity, reasoning patterns, execution frequency, delegated actions, and abnormal workflows, so unexpected behavior becomes immediately visible rather than remaining hidden inside model reasoning.

Policy enforcement means enterprise policies govern what AI agents can do, not merely what they can access — blocking financial transactions above approval thresholds, preventing privilege modifications, restricting administrative operations, limiting sensitive data retrieval, and requiring approval for high-risk actions. These controls function much like application firewalls for autonomous decision-making.

Least-privilege execution means AI agents receive only the capabilities necessary for the current task. Instead of granting permanent access to dozens of enterprise tools, organizations should dynamically issue short-lived permissions based on runtime context, an approach that OWASP's guidance for agentic applications increasingly emphasizes (OWASP GenAI Security Project).

Human oversight recognizes that not every decision should be autonomous — high-impact operations, including financial approvals, identity changes, regulatory actions, or customer-impacting decisions, should require explicit human confirmation before execution.

Protecting the enterprise AI ecosystem

Runtime trust also extends beyond individual agents. As MCP adoption accelerates, enterprises should verify trusted servers, authenticated tools, approved capabilities, monitored interactions, and policy enforcement. RAG knowledge repositories require document integrity, source validation, access control, retrieval auditing, and poisoning detection. Persistent AI memory should implement lifecycle management, expiration policies, integrity verification, access logging, and sensitive data protection.

Building operational visibility

One of the biggest challenges in enterprise AI is observability. Security teams need visibility into why an agent selected particular tools, which data influenced its decisions, how it reached its conclusions, what actions it executed, whether policies were triggered, and which safeguards prevented unsafe behavior. Runtime logging, audit trails, and behavioral analytics are becoming essential components of enterprise AI operations, not optional add-ons.

A practical roadmap

Organizations do not need to rebuild existing security programs. Instead, they should extend them by incorporating runtime trust into existing governance processes. Practical first steps include inventorying AI agents and their capabilities, applying least-privilege access to tools and APIs, classifying high-risk autonomous actions, implementing runtime policy enforcement, monitoring behavioral anomalies continuously, protecting memory and RAG data sources, requiring human approval for critical operations, and integrating AI runtime telemetry into existing SOC workflows.

Looking ahead

Enterprise AI will continue evolving toward increasingly autonomous systems capable of collaborating, planning, and executing complex business processes. Security strategies must evolve alongside them. The question is no longer whether an AI agent successfully authenticated. The more important question is whether it continues to behave safely throughout its entire lifecycle. Organizations that adopt continuous runtime governance today will be significantly better positioned to deploy autonomous AI responsibly, reduce operational risk, and build the confidence necessary for large-scale enterprise AI adoption.

The future of AI security will not be defined solely by stronger models or better authentication. It will be defined by our ability to establish, measure, and continuously verify trust while intelligent systems are making decisions in real time.

Ravindra Annam is a cyber security architect.

There is a clear repeating trend in agent deployments: The gateway is the first control teams reach for, but it is the one they are least ready to run. This is because gateways sit on top of identity and attribution layers that are mostly not there.

The first layer of risk is not hypothetical. In June, CISA added a LiteLLM flaw to its Known Exploited Vulnerabilities catalog after attackers were caught abusing it in the wild. The bug ran commands on the host through the gateway itself, and chained with a second flaw it required no credentials. It was one of seven common vulnerabilities and exposures (CVEs) disclosed in that single AI gateway in a month. This is the layer many enterprises reach for first to secure their AI agents.

When considering secure agent architecture, gateway controls should not be the first control. They should be the fifth.

Most models on the maturity of agent security describe the controls a company will need in the future. They tend to miss, from my experience, the more difficult problem of describing the brownfield scenario: In what order should these controls be layered in conjunction with an identity and access management system that is already in place?

If the control plane is unaware of which agent is acting, who delegated the work, what task the agent is to perform, and what credentials are being used, then the context is incomplete. A gateway may block clear policy violations, but will struggle to distinguish a justified action from one that is technically permissible but operationally inappropriate.

The pattern of failure is clear when sequencing these controls for agent production deployments: Enforcement is taken early, while the identity and attribution context it depends on has yet to be developed. Agent security functions as a dependency chain, with each control depending on context generated upstream.

The wrong starting point

Think about routing agent traffic via a new runtime gateway. A finance-reconciliation agent tries to alter a record in production. The gateway authenticates the user token and checks the API call. What it can't observe is that the request is agent-initiated, that the agent is executing a more limited function, or that the request is part of a tool chain invoked by an untrusted artifact.

The credential is valid. The API call is permissible. The action contradicts the purpose of the delegation. The gateway is there, but its set of supports seems absent, so a costly control is applied to a very small part of the whole picture.

Limiting an agent's privileges to those of the human principal is useful so the agent does not exceed the person it serves. However, having a privilege ceiling does not create separate attribution. Twenty agents might operate under a single person's permissions and still need unique identities, audit logs, behavior profiles, and revocation paths.

Dependency-gated deployment

I call this process dependency-gated deployment. Upstream exit tests must be satisfied before any downstream control is considered operationally complete. Concurrent development of downstream controls is permissible.

Here are the six gates, and the proof that they work:

The six dependency gates for the agent security controls. Each control is contextualized by the gates above it. From the author's analysis of production agent deployments.

Start with the agents you can actually name

To begin, recognize the production agents in open-source frameworks, cloud offerings, SaaS services, and developer tools. For each, record the owner, responsibility, lifecycle stage, allowed tools, data domains, and sources of credentials.

Bypass this step, and the organization will lose the first hour of incident response while they figure out what should have been obvious. The inventory identifies the asset that every control thereafter governs.

An agent needs its own identity, but it cannot lose the human behind it

An agent should not be buried in a developer token, a shared service account, or a human session. Simply knowing the caller is an agent is not sufficient. The control plane requires additional delegation context: Who delegated the work, what specific task the agent was instructed to execute, and which resources the agent needs the authority to access. Identity specifies which actor placed the call. Delegation is the answer to whose authority it acts, and for what reason.

Once that connection is cut off, the downstream logs attribute the reconciliation agent to the employee whose token it borrowed, and every action it takes is attributed to someone who did not start it.

Shrink authority before you inspect behavior

Once an agent can be identified, capabilities should be limited. Access restrictions should be time-bound to the task and limited to the tools and resources required to perform the task. This can be implemented using identity access management (IAM) features such as workload identity, token exchange, conditional access, and time-bound entitlements which the organization already possesses.

With regard to the 2026 Teleport study involving 205 security leaders, the access scope surpasses the predictive capacity of industry, maturity, or self-assurance concerning predicting AI-related incidents. For example, organizations with over-privileged AI reported a 76% incident rate, whereas AI incidents occurred in 17% of organizations under the least privilege. This indicates that access scope in the dependency chain is more important than context-aware runtime enforcement.

The primary principle is monotonic delegation. Every transfer of responsibility must preserve or diminish authority; under no circumstances should it increase authority. For the reconciliation agent, this means an agent who can view one ledger as opposed to one who inherits the employee's access to all systems the employee can access.

Fix attribution before automating enforcement

Most audit stacks can capture what resource was accessed and which credential allowed access. In the agent deployments I have reviewed, this is the most commonly missed gate. Prior to utilizing an adaptive runtime policy, link any relevant tool invocation to the agent identity, initiating principal, task id, parent action, and outcome. After doing so, examine the telemetry: For one completed task, see if you can track down the initiator, the agent who executed it, the authority under which the action was taken, the tools utilized, and the outcome. In regulated environments, oversight that is not attributed cannot be justified.

Now the gateway earns its keep

The gateway can use registered identities, explicit delegation, scoped credentials, and attributable telemetry to question if this agent is authorized to perform this action, for this principal, within this task, involving this resource. Although the user's credentials may provision write access to the finance-reconciliation agent, the gateway has situational context and so determines that it is out of scope. This is control's point of greatest value. The most stringent controls should be applied at irreversible boundaries — payments, access policy changes, deletions, modifications of the production environment, and data exports.

Detection and the kill path come last

Behavioral baselines are developed last because distinguishable and attributable agent activity must be established to set a standard. Then, security teams are able to identify anomalous patterns of tool usage, unexpected cross-domain access, and deviations from their assigned tasks. Containment is more than just the disabling of a single directory object: A proper kill path entails disabling the agent's identity, invalidation of active and derived credentials, blockage of tool activation, termination of active tasks, and isolation of the workload that contains the agent.

Start without replacing your IAM

Designing a whole new identity program is unnecessary. If the existing identity provider doesn't treat agents as native object types, begin with an authoritative registry linked to the existing workload identities. Following this, extend agent and task identifiers as trusted execution contexts, implement short-lived credentials to mitigate inherited privileges, and include those identifiers in tool-call logs for subsequent gateway ingestion. The dependency model remains unchanged as vendor support matures.

Control gaps are measurable. In Okta's 2026 survey, only 34% of executives said their organization always applies the same level of security rigor to its agentic workforce as to its human workforce. The last control from the chain cannot be applied first to close that gap.

What to do in the next 30 days

Begin with 10 production agents. For each one, identify the owner, purpose, approved tools, and credentials. By now, you should have the beginnings of an agent registry and perhaps your first insights on governance.

Test attribution. Find out if IAM and logging can tell each agent apart from the human or service that delegated the task. If this kind of differentiation is not possible, a gateway would be operating without any visibility.

Reconstruct one completed agent task within an action chain, from start to finish, including downstream effects. Wherever the chain breaks is where your deployment falls short.

Adding downstream enforcement ahead of required context breaks agent security. Maturity models describe the destination. A build order gets you there without breaking production along the way.

Nik Kale is a principal engineer specializing in enterprise AI platforms and security.