A swarm of autonomous OpenAI agents spent six weeks this summer turning an obscure, 25-year-old German developer wiki into a private message board, without OpenAI’s knowledge, according to independent researchers.

The agents used it to trade answers to timed tasks, reverse-engineer a random number generator, and share a technique for bypassing network restrictions meant to keep them off the open internet.

“These AIs colluded to share answers, research their environment, and bypass sandbox restrictions,” researchers at the Nightingale Collective wrote in a report.

The agents were expected to operate independently with read-only access to the internet. Instead, they “found a way to use their read access to write information to an obscure German wiki” and began using it as a shared message board.

The group documented roughly 18,000 wiki edits made between May and July.

“OpenAI has not publicly disclosed this incident,” the report added.

The researchers said this wiki-based swarm is a separate group of agents from the one behind that Hugging Face attack.

“The main reason we believe this was a distinct swarm is because these agents explicitly had internet access as part of their task — the whole point was web browsing,” the researchers wrote. “The Hugging Face agents were in a sandbox without internet access and had to hack their way out by exploiting the Artifactory package manager.”

From isolation to coordination

Once the agents began writing to the wiki, the researchers said it effectively became a coordination layer.

“The agents used this wiki to communicate information with each other, primarily to help them succeed at their task,” the report states. “They asked for answers, pooled results, and shared techniques for bypassing their restrictions.”

Based on the posts reviewed, the researchers say agents appeared to use each other’s outputs to complete tasks more efficiently, in some cases enabling near-instant responses when similar questions appeared later in the sequence.

The activity was sustained and large-scale. The researchers identified thousands of distinct agent identities operating over a period of weeks, with a sharp increase in coordination beginning in mid-June.

Sharing ways to bypass controls

The report also documented agents exchanging techniques to circumvent technical restrictions.

According to the researchers, agents faced limitations that allowed only GET requests, but they collaborated on ways to bypass those constraints, including exploiting how trusted hostnames were handled within the sandbox environment.

Other agents then tested and confirmed these methods, suggesting that the wiki was used not just for coordination but also for distributing reproducible bypass techniques.

The researchers also observed agents uploading compressed datasets across multiple pages, which they say indicates the wiki was being used as shared infrastructure rather than incidental output.

Where containment assumptions fall short

For enterprise leaders, the findings point to a more specific failure: not of compute isolation, but of how agent behavior is constrained.

“This incident exposes an incomplete definition of containment,” said Sanchit Vir Gogia, chief analyst at Greyhound Research.

Gogia noted that the evidence does not show agents escaping their execution environment, but rather bypassing network restrictions and creating “unauthorised shared memory on a public wiki.”

“A sandbox can protect the host while failing to contain the work,” he said, adding that a domain allowlist “says nothing about what the agent can make the destination do.”

Gogia said organizations lack visibility into which agents are acting with authority, as well as where those agents may be storing or sharing data externally.

“Any service an agent can write to, and another agent can read is shared memory,” he said, whether or not that interaction is visible to orchestration systems.

Discovery and possible intervention

The timeline reconstructed from wiki logs suggests the activity continued for weeks before being curtailed.

“We believe OpenAI discovered the message board,” the researchers wrote, pointing to visits from IP addresses associated with the company beginning June 21.

The report noted that agent activity on the website dropped to near zero the following day, adding, “We infer that OpenAI intervened at this point to prevent further edits.”

For practitioners, analysts said, the episode also highlights limitations in how agent activity is typically monitored.

“A capable agent finding a coordination channel on a public wiki is exposing a blind spot that was never instrumented,” said Amit Kumar Jena, head of AI at Kanerika, adding that most monitoring systems were not designed to detect “inter-agent coordination on external resources.”

Jena said many enterprise controls remain focused on model outputs rather than behavior. “What the model says, not what it does,” he said. “That breaks completely with multi-agent systems.”

Disclosure questions

The report pointed out that “OpenAI has not publicly disclosed this incident,” raising broader questions for enterprise buyers around how such events are classified and communicated.

Gogia said the industry lacks a clear category for incidents that fall short of a breach but still represent consequential system behavior.

“A vendor’s definition of an incident must not become the customer’s blind spot,” he said.

Jena added that enterprises should evaluate vendors not just on disclosure, but on detection capability. “Enterprises should ask not just whether a vendor disclosed, but whether they even knew,” he said.

OpenAI did not immediately respond to a request for comment.

In Northeast Greenland, where temperatures can plummet to -40°F, security officials rely on the Sirius Dog Sled Patrol, led by well-trained canines that guard the sprawling, weather-beaten coastline – tundra territory where snowmobiles commonly fail. Tethered together with the right harness that efficiently channels their collective energy toward a shared mission, the sled dogs are more than up to the challenge. But left to run free without the leashes and human guidance, they naturally become a pack of wild animals bent on following their instincts.  

Enterprises relying on AI could learn a thing or two from this scenario. In recent years, organizations have depended on copilots and chat-based assistance designed to answer questions or summarize information. These systems have advanced to include autonomous agents increasingly capable of executing workflows, accessing tools, interacting with software and making decisions with limited human oversight. AI has been enabled to serve as a true workforce partner.

It’s an evolution that promises significant productivity gains but requires a more advanced foundation. Even the smartest agents need clear directives and the right connections to successfully maneuver sophisticated enterprise systems and maximize their potential.

This concept has been coming up pretty frequently in conversations I’ve been having with tech leaders lately. When I was in Nashville not long ago for the Insurance Innovators USA conference, and later over a few cocktails with former colleagues near San Francisco, I quickly tuned into a growing trend. Instead of talking about predictable topics like which foundation model was the most intelligent, the conversation veered toward a more thought-provoking challenge: How do we connect and amplify these increasingly autonomous AI systems to yield the greatest value more safely?

The answer to that question represents enterprise AI’s next major opportunity. Organizations are now realizing that capability and raw intelligence are only the beginning:  Building the infrastructure that enables agents to perform dependably at scale matters even more.

Operationalizing intelligence

Autonomous agents are a different animal from traditional AI assistants. That’s because they don’t simply generate text; they take resonant action. A self-directed AI agent can, for instance, update customer records, trigger software workflows, initiate financial transactions and coordinate with other AI agents. These proficiencies significantly up their value and turn them into vibrant operational resources. But these assets require a structured environment to succeed. An agentic system can have the necessary tools but lack the right controls to navigate compliance and privacy rules. To tap their full potential, the architecture that effectively directs their actions must exist.

Traditional guardrails weren’t designed for this kind of autonomy. Prompt filtering, simple permissions and basic access controls do the job for conversational AI. But they don’t cut it when it comes to enabling software that makes decisions and interacts with enterprise systems independently. That requires a new level of orchestration.

Enterprises need a standardized control layer for agent behavior, regardless of which underlying model powers them. We have to recognize that intelligence by itself isn’t enough – control is just as important.

Which brings us back to those trusty sled dogs. Think of each dog as a large language model (LLM) task. We often run several LLM tasks within a harness, often involving different models, comparable to a sled team. Just as each dog is positioned for what it does best, from lead dog to wheel dog, a “mixture of experts” delegates each part of the problem to the LLM task best suited to handle it. Without a harness guiding their powerful capabilities for a common purpose and enabling better performance, those LLM tasks, like the dogs, can’t effectively pull the sled. An AI model needs this same type of surrounding governance to reliably perform enterprise work and accomplish its objectives.

An agent harness provides the necessary infrastructure to contain and channel agent capability safely. It securely defines permissions and access boundaries, determines rigid tool usage limitations, manages workflow sequencing, human approval workflows and approval logic and creates audit and observability trails. The LLMs provide raw power, but the harness enables the coordination and audit trails needed to transform AI intelligence into reliable operations.

AI tools are progressing into increasingly dynamic autonomous agents. It’s encouraging to see that organizations have mostly moved beyond experimentation and are finally incorporating AI into production workflows that impact customers and revenue. But that means regulators are paying closer attention, particularly to organizations in insurance, financial services and other highly regulated industries. The architecture facilitating these agents has to be resilient enough to both comply with requirements and foster speedy innovation.

Autonomous AI agents signal a new era of speed and capability, creating exciting prospects for executive leaders ready to scale operations. To take advantage of this momentum, they should ensure that early deployments have strategic guardrails and a clear operational runway for these agents to thrive. The right infrastructure and the ability to interact with multiple software systems enable agents to orchestrate complex, multi-system workflows with precision and high-impact efficiency. That means enterprise-grade governance around agentic systems must improve.

Major foundation model providers are increasingly implementing proprietary harness capabilities directly into their ecosystems. These exclusive harnesses often provide better performance optimization, more seamless coordination and enhanced access to model-specific capabilities. The prevailing industry sentiment is that these environments will consistently deliver the best results. Case in point: If you want the strongest performance from Claude, you’re better off using Anthropic’s surrounding ecosystem and harnessing infrastructure rather than treating the model as a standalone component.

That said, there’s also value in maintaining the freedom to jump between models on a daily basis. Most developers, me included, switch between something like six models daily, whether that’s Claude, Gemini, Muse or an open-source option, depending on the task. That flexibility gets much harder to preserve once a company builds on a provider-specific harness, such as Anthropic. While this will likely improve performance and cut costs, the trade-off is increased vendor lock-in.

This creates a strategic choice for organizations: Fully embrace a vendor ecosystem for immediate performance, or maintain ownership of your own orchestration layer? Use the harness provided by the model provider, or build your own custom harness tailored to your business requirements?

I remain hopeful that many enterprises will leverage vendor innovations, while ensuring their core business logic remains portable instead of embedded within closed proprietary systems. But only time will tell.

The many benefits of harnessed agents

A carefully designed agent harness does more than merely decrease risk. It also lays a foundation for implementing autonomous agents with better confidence. You can count on the safe deployment of autonomous agents in production environments. No more wondering whether or not an agent will exceed its authority: Your enterprise can define exactly what it is permitted to do. A robust harness also delivers fine-tuned control over agent actions and access to tools, including which APIs, enterprise systems and software resources that each agent can invoke. Compliance-ready auditability is equally important for regulated industries.

The bottom line is that you can rely on the right harness to provide better peace of mind, transforming your AI into a transparent operational system that ensures reduced operational risk while seamlessly amplifying automation. The result is scalable AI systems that companies can actually trust.

Trust isn’t guaranteed just because a model scores well. It’s earned via system predictability. As my friend and former Google colleague Ben Mathes warned me, crafting custom rules around today’s models is risky. That’s because every few months, new foundation models make yesterday’s engineering workarounds extinct. We should instead prioritize building robust frameworks that can adapt as models progress.

I believe lasting advantage comes from fat skills – modular, detailed instruction sets that tell an AI agent how to perform a specific task without cluttering its core system – and fat prompts that capture institutional knowledge, along with rigorous backends that meticulously organize enterprise data. This enables the harness to evolve alongside improving models without needing to be completely rebuilt, which means business expertise can remain the primary fuel that powers AI success.

Actionable steps for enterprises

So, what are the best practices going forward? CIOs and CTOs should treat agent governance as a core infrastructure decision. Procurement focus needs to expand from models to platforms to, ultimately, control systems. And enterprises need to understand that competitive advantage will be dependent on three factors:

1. Safety – Does the model safely do what you wanted to do?
2. Performance – Does it do it well?
3. Costs – Does it do it with relatively low expense?

Professionals in this space now face the strategic decision I mentioned earlier: use vendor-provided harnesses and maximize performance, or build proprietary internal harnesses to preserve flexibility and avoid vendor lock-in.

Without a resilient harness, you risk slower adoption due to security concerns. For example, Tesla is rolling out a $200 token-per-month cap on employee spending on third-party AI tools at around the same time a new Claude model debuted with lower per-request token costs. Yes, safety continues to be nonnegotiable. But once you meet that threshold, optimizing performance and expense becomes the Pareto Frontier problem your organization should be closely watching.

The AI arms race is no longer merely about smarter models. Instead, it’s about safely deploying autonomy at minimal cost. That’s why implementing an appropriate agent harness is so crucial. It becomes the critical operating layer that allows intelligent agents to reliably function inside an enterprise.

As we transition to the next phase of AI adoption, control is going to matter as much as capability to executives. The LLM also matters, of course, but without the proper framework, it can’t operate effectively. The organizations that dominate won’t necessarily have the best model; instead, they’ll have the most effective framework for deploying and governing autonomous agents.

There are two prevailing schools of thought regarding the AI-agent workforce. One says organizations should prepare for agentic AI, in which the human-in-the-middle role is largely transitional and serves to buy time to improve agents’ accuracy and build trust in their decision-making. Others say AI agents will largely augment humans, but expect workflows to change drastically from task-based processes to more asynchronous, choreographed operations.

Businesses will likely have a mix of agentic and human-augmented AI agents, with many more in pilot stages. As part of this transformation, CIOs need to consider how to evolve the IT organization and upskill IT employees for this future. According to Deloitte’s 2026 Global Technology Leadership Survey, 75% of IT leaders agree their operating models and processes must change within the next 12 to 18 months to drive greater value.

“Upskilling IT for an AI-agent workforce requires more than training; it requires behavior change because as AI takes on more routine development activities, technology professionals increasingly focus on validating, governing, and directing AI-generated outputs,” says Doug Vargo, VP of consulting services and head of the national AI and alliances team at CGI. “The cognitive habits that define experienced engineers are deeply ingrained, so they need to develop new ways of working focused on reviewing outputs, framing intent, and curating the context that keeps those outputs accurate, secure, and aligned with business objectives.”

How CIOs upskill their organizations will follow several career tracks. Here are the most essential to consider.

Developing business acumen and AI literacy for IT leaders

AI is requiring more IT professionals to shift left into transformational leadership and change-agent roles. These leaders will advise business managers on when to use AI versus other technologies to automate tasks, and when to consider top-down re-engineering workflows based on AI capabilities.

“Leaders need to help their teams understand how work flows across the business, where AI fits into that process, and where humans need to stay accountable,” says Jamie Lyon, chief product and strategy officer at Lucid Software. “As AI agents take on more of the execution, critical thinking becomes even more important because people still need to provide the context, define the process, and make the decisions AI can’t.”

One of the top barriers in delivering value from AI is employee adoption. CIOs need more change agents to drive enthusiasm and help department leaders reimagine emerging job responsibilities. Upskilling IT leaders for change-agent roles often requires embedding them in business units so they can learn their processes and build relationships.

Upskilling focus: AI literacy, critical thinking, business relationship management, and change management are four primary skills. To connect problems to solutions, developing skills in architecture, design thinking, and analytics is also needed. 

Extending AI and data governance for everyone

According to Adobe’s 2026 AI and Digital Trends, 78% of technology leaders say data integration and quality is a top AI challenge, and 52% say limited data unification is holding back AI initiatives. CIOs facing data governance, integration, and management challenges risk seeing their businesses fall behind their competitors who are aggressively pursuing AI-driven opportunities.

“Upskilling for an AI agent workforce starts with understanding that the biggest challenge is the data and operational layer underneath the model itself. IT teams need to know how to connect fragmented data, engineer the context and memory that make AI agents more reliable, and support transactional, analytical, and vector workloads on a unified platform without breaking the budget,” says Adam Luciano, VP of product management at MariaDB. “They also need to understand governance, security, and observability so autonomous systems can safely execute real business processes and expand to higher-value use cases instead of simply generating recommendations.”

Data governance used to be a compliance team’s responsibility, but AI now requires many more in IT to be versed with policies, practices, and related technologies.

“As AI agents begin executing work across enterprise environments, IT teams need to build governance skills, not just AI literacy,” says Doug Gilbert, CIO and chief digital officer at Sutherland. “They should know how to assign accountability, monitor data access, enforce human-style approval workflows, and maintain complete audit trails so AI operates under the same controls as any employee and not as an exception to them.”

Upskilling focus: One upskilling focus should be on data governance, DataOps, data engineering, and data management. A second focus should address data risk management issues, such as data security and AI governance.

Expanding knowledge management to develop AI’s context layer

CIOs looking to scale from dozens of AI agents to thousands of AI-orchestrated workflows will need to develop an AI brain for their organizations, including knowledge graphs, a semantic layer, and a context layer.

“One critical place for CIOs and CISOs to focus upskilling is building the information layer that has to replace the human management layer everyone’s trying to collapse,” says Lior Gavish, co-founder and CTO at Monte Carlo. “A real part of what managers do is information work, including passing context, surfacing priorities, and keeping decisions aligned with the bigger picture. Flatten the org without replacing that function, and you get people, or agents, making locally optimized decisions on incomplete information.”

Organizations will need cross-disciplinary teams to develop and improve their context layers. Data skills to develop include extending unstructured data governance, evolving data fabrics, and building data products.

“The challenge is no longer just teaching employees how to use new tools, but ensuring teams know how to structure, manage, and govern the knowledge that powers them,” says Adam Field, chief AI officer at Tungsten Automation. “This will require new skills around contextual AI training, knowledge management, and information stewardship. Organizations that can effectively connect AI systems to trusted institutional knowledge, while maintaining appropriate security and access controls, will be better positioned to accelerate product development, improve collaboration, and increase access to critical information across their company.”

Upskilling focus: To develop the context layer needed by AI agents, CIOs should promote collaboration and communication skills alongside key data management, integration, and governance skills. In addition, agile data teams will need strong business acumen to partner with department leaders and subject matter experts.

Establishing an AI quality center of excellence

DevOps teams accelerating their deployment cycles while underinvesting in continuous testing were left with one of two bad options. Some tried to get business users to perform extensive user acceptance testing. Others deployed applications with minimal testing, hoping their observability and monitoring would catch errors before users escalated issues.

Underinvesting in testing and automating evaluations of AI agents can lead to significant issues, including increased costs, compliance violations, and operational impacts.

Sanjay Gidwani, CEO and founder at Kosmos, says the skill that will matter more than building AI agents is in confirming their accuracy. “Agents increasingly act on correlations drawn across disconnected systems, and a correlation that a human never confirmed is a decision waiting to go sideways at high speed. Upskill your teams to serve as the confirmation layer for what agents do before anything is acted on,” Gidwani says.

CIOs should think about AI agent quality from three perspectives:

• When are AI agents in experimental and pilot stages delivering high enough quality to be released into production?
• Once in production, how are quality metrics used to build trust in which decisions AI agents can automate, versus those that require people’s involvement?
• How are AI agents’ quality benchmarked in production to detect when their models are drifting and the agents’ performance degrading?

Upskilling focus: CIOs should upskill teams in data quality, test automation, and analytics. Organizations scaling the number of AI agents in production should consider developing an AI quality center of excellence.

Revisiting the skills needed by product and program managers

Before developing that center of excellence, consider how AI is changing the nature of team collaboration. Three examples:

• CIOs are developing product-based IT organizations to deliver business value from AI investments.
• Teams are revisiting their agile practices in the AI era to ensure that developer productivity results in faster feature delivery and less technical debt.
• DevOps has new challenges with AI agent observability and agent deployment risks.

These three spinning process wheels inside IT, with evolving AI capabilities, are one reason why many CIOs are rethinking the IT organization for the AI era. According to Atlassian’s The State of Teams 2026, AI-augmented teams need more coordination, not less: 77% say they expect more horizontal teams with fewer layers, and 73% have blended roles with hybrid responsibilities.

Mal Vivek, CEO and founder at Zeb, says the most valuable capability CIOs can build for an agent workforce is judgment. “Teach teams to decompose work into clear objectives, constraints, and feedback. These skills won’t come from a one-off course or certification; it takes redesigning roles so that human judgment compounds,” Vivek says.

Upskilling focus: CIOs will need more business-facing roles to lead discussions on where to invest in AI. Skills to develop include Six Sigma process skills, product management disciplines, and agile planning practices.

Upskilling junior developers beyond coding skills

If 41% of all global code is AI-generated, do CIOs still need engineers?

According to Karat’s AI Workforce Transformation Report, 73% say strong engineers are now worth at least three times their total compensation. That’s likely because the top engineers were never just coders; they were stewards of the software development lifecycle, drivers of sound architectures, and advocates for addressing technical debt.

“Agent verification should be a top priority for CIOs and CISOs, training professionals to look beyond raw AI outputs and to get ahead of the review burden that can come with increased AI use,” says Samar Abbas, CEO at Temporal. “As agents move to writing more code, tech talent needs to embrace becoming primary evaluators, interrogating an agent’s design decisions, defending the generated architecture under questioning, and confidently proving its correctness.”

Upskilling focus: CIOs should consider apprenticeship programs to accelerate junior developers into senior-level roles and entry-level architecture responsibilities. To start, junior developers will need training in systems thinking and in resolving issues flagged by code review tools. Beyond these basics, guide developers to build technical domain expertise in two to three focus areas such as testing, data, identity management, application performance, API development, integration, and security.

Maturing AgenticOps in IT operations

While many organizations are still in pilot stages with AI agents, others are deploying thousands into production and using AI orchestration platforms to build complex workflows.

“As apps evolve from traditional software into autonomous AI agents, IT’s role shifts from maintaining systems to managing a digital workforce,” says Nikhil Mungel, head of AI R&D at Cribl. “IT teams will need to learn how to onboard and supervise AI agents, ensure they comply with company policies, and monitor for unusual or harmful behavior. The organizations that succeed will be those that invest in teaching IT teams to govern and manage AI systems in production.”

Upskilling focus: AgenticOps skills to focus on include identity management, root cause analysis, and monitoring AI agents. CIOs deploying hundreds of AI agents should plan to extend site reliability engineering to include tracking AI agent reliability and diagnosing their performance issues.

Developing a world-class IT department is not just about delivering business value. Top CIOs recognize that they need to plan their IT organizations to support future needs and update their skills and learning development programs. AI capabilities are evolving quickly, and CIOs need to guide employees on the new skills needed to enable the AI agent workforce.

Most security teams already have a breach clock memorized. GDPR gives you 72 hours. SEC rules give public companies four business days after determining an incident is material. Those numbers get built into incident response runbooks, tabletop exercises and escalation paths, because the clock starts the moment the team confirms something happened.

Article 73 of the EU AI Act adds a third clock, and in my work advising enterprise clients on AI governance, I have yet to see one with a runbook for it.

The obligation took effect on August 2, and it did so alone. The EU’s Digital Omnibus on AI, in force since late July, pushed the rest of the Act’s high-risk enforcement wave — classification, conformity assessment, technical documentation — back to December 2027. Article 73 was not part of that reprieve, though the extra time elsewhere is worth using to get ready. It requires providers of high-risk AI systems to report serious incidents to national market surveillance authorities within 15 days by default, 10 days if a death is involved and just 2 days for incidents the Act classifies as widespread or as a serious disruption to critical infrastructure. Coverage of Article 73 so far has treated it as a legal filing requirement, handled through the same channel as a data protection filing. That framing misses what the obligation is. It is an incident response deadline, and it runs on a different trigger than the breach clocks most security teams already know.

A client once asked me, almost as an aside, whether their customer-facing AI tool would trigger a reporting duty if it simply gave someone bad information rather than getting hacked. At the time, the honest answer was probably not, under any framework they were tracking. Article 73 changes that, and most organizations building or buying AI for the EU market have not caught up yet.

What counts as a trigger here is broader than most teams expect

GDPR’s 72-hour clock starts when you become aware of a personal data breach. That is a bounded question. Did data leave the environment? Was it accessed without authorization? Article 73 asks something harder. The European Commission’s draft guidance takes the position that an indirect causal link between an AI system and a downstream harm is enough to trigger the reporting duty. Their example is a loan denial that traces back to a flawed AI credit assessment. The AI system does not cause harm the moment it produces the assessment, only once a human acts on it and denies the loan. The fundamental rights category requires the infringement to interfere with Charter-protected rights at scale, which is why the Commission illustrates that threshold with patterns, a recruitment tool that discriminates systematically or a credit system that categorically rejects an entire neighborhood. Under the Commission’s reading, once a pattern like that exists, the clock starts when the provider becomes aware of it, not when the system generated the output.

Here’s a plainer version of that pattern. A public benefits agency uses an AI system to match applicants against its records. A flaw in the matching logic occasionally conflates applicants, and over several weeks it happens to a run of different people, each flagged as already receiving the same benefit elsewhere and suspended. Nobody catches the pattern at the time, because each flag looks unremarkable on its own. Applicants don’t find out until their payments stop arriving, weeks after the first mismatch. The system never malfunctioned in any way security tooling would catch. It just produced bad matches until people started missing payments.

That is a different kind of determination than “Did we get breached?” It requires tracing a causal chain from a model output through a downstream decision to an actual harm, then judging how confident you are in that link before you are required to report it. Most incident response teams have a well-practiced instinct for confirming unauthorized access, but few have one for confirming that an AI system caused a harm that surfaced elsewhere in the business, days or weeks later. I have watched security leaders confidently answer, “Were we breached?” in minutes, then go quiet when asked, “Did our AI system cause this?” because nobody owns that second question yet.

Why this does not fit into an existing IR playbook

Most incident response programs are built around a single moment: detection. Something trips an alert, a SOC analyst confirms it and the clock starts. Article 73 incidents will not look like that at all. The AI system that produced the flawed output may show no signs of compromise. Nothing gets flagged by a SIEM. The first sign might come from a customer complaint, an internal audit finding or a pattern a compliance analyst notices months after the AI system made the decision.

That means the “becoming aware” clause in Article 73 is doing real work, and most organizations have not decided who is responsible for noticing. Is it the team monitoring the AI system’s technical performance, the business unit acting on its outputs, or whoever eventually hears the complaint? Under Article 73, the clock starts when any of them establishes, or suspects, the causal link, and 15 days is not a long runway if the first internal conversation about “is this our incident” does not happen until day six or seven. I have seen governance structures where a business unit head, a model risk team and security each assumed someone else owned this judgment call. In practice nobody did, and that gap is where a 15-day clock burns down to five.

Some security teams are already mapping agent governance to a maturity model, arguing that oversight must scale with autonomy, moving from agent identities that are barely inventoried toward ones that are bounded, monitored and revocable in real time. Article 73 raises the stakes on that model considerably. The less a human reviews an AI system’s output before it reaches a customer, the more likely a downstream harm surfaces without anyone watching for it in real time, which is exactly the blind spot Article 73 is designed to close.

What needs to change

A few additions belong in an existing incident response program before this becomes a live problem instead of a paper requirement.

First, a defined owner for the causal link determination. Data breach response usually has a clear owner: security confirms the technical facts, legal makes the materiality call. Article 73 needs an equivalent split: Someone technical enough to trace an AI system’s output to a downstream decision and someone with authority to make the reporting call once that link looks plausible rather than certain. In practice, I recommend naming this owner in the incident response plan, not leaving it to be sorted out during the first real incident, when the clock is already running.

Second, a lower bar for opening an investigation. If GDPR taught teams to investigate the moment unauthorized access is suspected, Article 73 requires investigating the moment a downstream harm is suspected to trace back to an AI system, when the system looks normal to security monitoring. That means feeding business unit complaints and customer escalations into the same triage process that currently only starts from technical alerts.

Third, a documented decision log for the indirect link judgment call. Given how broadly the Commission has defined what counts as reportable, organizations will make defensible calls not to report many ambiguous situations. Those decisions need to be documented with the reasoning behind them, the way a security team documents a false positive call, because a regulator revisiting that judgment months later will expect to see how it was made rather than take the outcome on faith.

Fourth, controls built into the AI system, not bolted on after the fact. A defined owner and a lower investigation bar help catch a problem once it surfaces, but neither reduces how often a flawed output reaches a customer first. Scoped credentials, tool allowlists and pre-action approval hooks cut down on how many incidents exist to report.

The AI Act’s high-risk obligations have absorbed most of the attention this year, because conformity assessments and technical documentation are heavy lifts with long lead times. Article 73 looks lighter by comparison, a reporting duty rather than a certification process. It is not lighter. It asks security and compliance teams to build a new kind of judgment into their incident response programs, on a clock as tight as anything GDPR or the SEC have required. Treat the deferral on the rest of the high-risk package as what it actually is, extra runway to build that judgment and name its owner, because the conformity paperwork still gives you months and Article 73 still gives you days.

Ask IT leaders what sovereign AI is, and you’ll get a wide range of answers. Some will even struggle to define the term.

Sovereign AI is an emerging concept focusing on giving organizations — or countries —control over how they develop, deploy, and govern the technology, often using in-house talent, data, and infrastructure.

But only 13% of respondents in a survey from AI platform provider Cohere and IDC say sovereign AI is widely understood across their organizations, and one in three IT leaders had difficulty describing sovereign AI in their own words.

It’s important for IT leaders to understand the concept, because it can help them control costs, keep internal data private, and avoid vendor lock-in, advocates say.

A solid sovereign AI plan can help organizations avoid disruptions caused by forces outside their control, says Joelle Pineau, chief AI officer at Cohere, which offers an AI platform that enables customers to host AI models on premises.

“Over the past year, enterprises and governments have confronted a hard truth: AI systems that rely on external infrastructure can be disrupted without warning by decisions and actions outside their control,” Cohere says in a recent report. “Recent model access restrictions and several high-profile cybersecurity incidents have become a global wake-up call, exposing how fragile technological dependencies can be.”

Sovereign AI is about giving organizations as much autonomy, choice, and control as possible as they deploy and run AI systems, Pineau says.

“The notion of sovereignty really is about giving users control over their tech stack, the ability to choose how it’s deployed, how it works, what data is fed into the system, and how employees are exposed to the technology,” she adds.

Pineau wasn’t particularly surprised about the lack of understanding about sovereign AI reflected in the survey. Cohere’s accompanying report is an attempt to bring more clarity to the issue, she says.

Many goals under one umbrella

Confusion about sovereign AI in part reflects practitioners’ varying goals. Some users want to maximize their AI model options, some want better control over data ingested into AI systems, some want data to reside within country borders, some want to control costs, and others may want to run AI models optimized to their native language or culture.

For Berk Yilmaz, co-founder and CTO at AI integrated development environment provider Noah Labs, sovereign AI encompasses five characteristics: data sovereignty, legal jurisdiction, model provenance, operational control, and supply chain independence.

“Fulfilling one of those does not mean fulfilling all the others, so two executives can agree with sovereign AI and have little in common,” he says.

Freedom of choice doesn’t always mean a company has to host an AI model on premises or data must reside within a certain country, advocates suggest. Sovereign AI is more about preserving options when something unexpected happens.

“The sovereignty model performs well even in a situation where the vendor breaks off the contract, your model is added to the list of models that are banned for exports, and the connection is off,” Yilmaz says. “Each of these three scenarios has already played out somewhere in the last year.”

Others have different definitions. Confusion over sovereign AI isn’t surprising because it is four separate concepts that were collapsed into one, says Jeet Pattanaik, founder and CTO of AI solutions provider Glokal AI. Those four concepts: where a company’s data physically sits, what country’s law can compel access to it, who controls the AI model, and whether a company could still operate if the relationship with the model provider ends.

“Vendors usually sell you the first and call it sovereignty, because data residency is easy to demonstrate and makes a good diagram,” says Pattanaik, author of the book Sovereign AI: The Enterprise Guide to AI That Is Private by Design, Compliant by Default, and Yours Forever. “The hard one is the second, and it’s a legal question rather than a technical one. A server in Frankfurt owned by a US company is still reachable under US law.”

While the concept is largely about control, few companies want full control of their AI stack, he notes.

“Building your own models is expensive and usually worse,” Pattanaik says. “What CIOs actually want is bounded dependency: knowing exactly what you depend on, what happens if it changes, and having an exit that doesn’t take three years.”

Future impact

But the benefits aren’t always immediate, Pattanaik notes.

“The value arrives in specific moments, not continuously — when a regulator asks who processes this data and under whose jurisdiction, or when a vendor changes terms at renewal,” he says. “Organizations that thought about sovereignty already have an answer. Everyone else discovers the question and the crisis at the same time.”

Still, Pattanaik sees momentum building for the concept, with regulated industries such as banking, healthcare, and the public sector paving the way, treating it as a requirement.

“Most others are still at the stage of asking during vendor selection and accepting whatever answer comes back,” he says. “From where I sit it’s moved from philosophy to a procurement line item over roughly the last 18 months, but unevenly.”

David Wang, COO at enterprise AI gateway provider Tetrate, sees similar adoption trends with regulated industries and defense contractors leading the charge.

Other organizations should focus on a handful of questions to decide whether to investigate sovereign AI, he recommends. Companies that can most benefit include those with more than one regulator or legal entity, including recent acquisitions; those with a huge developer population running coding agents; and those with one AI model vendor that commands more than half of their AI spending.

“At that size, a supplier price change becomes a budget event,” Wang says.

Like Pattanaik, Wang suggests that sovereign AI is part of a long-game strategy rather than immediate gains. A good plan enables organizations to quickly shift to open AI models when a frontier model gets too expensive, he says.

“This work mostly prevents a loss rather than creating a gain, which is why it rarely wins the budget on its own,” he adds.

Cohere’s Pineau sees benefits for a broad range of organizations. With token costs a major concern for many companies, a sovereign AI plan can explore alternatives to current AI vendors, she notes.

“A lot of companies care about it, but they care about different aspects,” she says. “In regulated sectors, they care about the compliance aspects, and in some sectors with tight profit margins, they care a lot about the cost control. The manufacturing, the telecoms, and the energy sectors care about the ability to control their costs.”

For the first three years of the generative AI wave, the output of a model was a string. You called an API, you got tokens back, you rendered them in a chat window or wrote them to a row in Postgres. The economics of that pipeline were dominated by inference cost. Storage was a rounding error.

That era is over. The output of a modern generative pipeline is an asset: a 4K video clip, a stem-separated audio track, a 50-megapixel product render, a 3D mesh with PBR textures. Generative AI has gone from text-centric to asset-centric, and the architectural center of gravity has moved with it. The teams building durable advantages in generative media right now are the ones treating their storage layer as a pipeline component rather than a destination.

This is a good problem. It is the problem you get when your pipeline works.

Asset-centric changes the shape of the system

Text pipelines are stateless in practice. A prompt goes in, a response comes out and the interesting state lives in a database. You can rebuild almost any artifact by re-running the call.

Media pipelines are not like that. Every stage produces a large, opaque binary that the next stage consumes. A single finished deliverable might traverse a dozen of them: prompt expansion, base generation, upscale, frame interpolation, color pass, audio generation, mix, mux, transcode to delivery formats, thumbnail extraction. Each stage writes an intermediate. Each intermediate is expensive enough to regenerate that you keep it.

The result is a system where the objects are the state. Your object store stops being a place you put things when you are finished and becomes the substrate the pipeline runs on.

Adoption is past experimentation, and the volume is in production

Advertising has the clearest numbers. IAB’s 2026 Digital Video Ad Spend and Strategy Report finds that nearly two in three digital video buyers now use generative AI for creative, up from half in 2025. A third of their ad assets are expected to involve generative AI this year, up from a quarter in 2025, with buyers projecting 43 percent by 2027. That is happening inside a U.S. digital video ad market IAB projects will pass $80 billion in 2026, growing 11 percent year over year, nearly 20 percent faster than the total ad market.

The interesting detail for architects is what the creative is used for. IAB’s prior-year data showed buyers reaching for generative AI specifically to produce audience-specific versions of an ad, visual style variations and contextually adapted cuts. That is not one asset per campaign. That is a matrix.

Games are the instructive counterexample. GDC’s 2026 State of the Game Industry puts generative AI use at 36 percent of industry professionals and 30 percent at game studios specifically, but the usage breakdown is dominated by language models rather than media generation: research and brainstorming at 81 percent, code assistance and routine writing at 47 percent each, prototyping at 35 percent. The most-used tools are ChatGPT, Gemini and Copilot. Sentiment is sharply negative, with 52 percent saying generative AI is having a negative impact on the industry, rising to 64 percent among visual and technical artists. Asset-centric pipelines have not landed in games the way they have in advertising, and the constraint is as much workforce and provenance as it is tooling.

Elsewhere, the pattern holds even where the survey data is thinner: e-commerce teams generating on-model imagery per SKU per segment, localization pipelines producing dubbed and lip-synced variants per market, previsualization work that used to require an art department.

What the adopting categories have in common is that none of them produce one asset per request. They produce a set. The pipeline is judged on how many viable options it surfaces, which means a better pipeline is, definitionally, a pipeline that writes more bytes.

Reactive architecture, because the model layer will not hold still

The model landscape resets on a cadence measured in weeks. A new video model ships with better temporal coherence. A new audio model handles multilingual prosody properly. A new image model finally gets text rendering right. If your pipeline requires an engineering sprint to adopt a new model, you are structurally behind teams whose pipelines do not.

Reactive architecture is the answer, and it means two specific things.

1. Model-agnostic stages. Each stage of the pipeline should express a contract in terms of inputs and outputs, not in terms of a vendor. A generation stage takes a prompt and conditioning assets and produces a video at a declared resolution and duration. Which model backs it is configuration. Swapping providers should be a config change and an eval run, not a refactor.
2. Event-driven orchestration. Polling-based orchestration couples your stages to a scheduler and makes each new stage a change to the control plane. Event-driven orchestration inverts it: a stage completes, it writes its output, the write itself is the signal that the next stage should start. Adding a stage means subscribing to an event, not modifying a DAG definition that six other teams depend on.

This is where storage stops being passive. Object storage that emits events on write lets your bucket act as the message bus for the pipeline. B2 Event Notifications send a signed HTTP POST to a webhook endpoint when objects are created, updated or deleted, with rules scoped per bucket and filterable by prefix. That prefix filter is the part that matters architecturally: if your bucket is organized by stage, a rule on stage/upscale/ is a subscription to “upscale finished” without any code knowing what upscale is. Custom headers on the notification carry auth tokens or context to the target, so the endpoint can be a queue, a serverless function or a workflow platform rather than a service you had to build.

A completed upscale triggers the color pass. A completed mux triggers the transcode fan-out. A completed transcode triggers the CDN warm and the catalog write. The storage layer sequences the work, which removes an entire class of orchestration glue from your codebase and removes polling latency along with it.

Quality improvements arrive as file size increases

Every generation of media models improves along axes that all cost bytes. Resolution goes up. Frame rate goes up. Duration limits extend. Bit depth and color fidelity improve. Audio moves from mono to multi-channel. Compression artifacts that were acceptable at 720p are not acceptable at 4K, so teams move to higher bitrates and, for anything entering a post pipeline, to intermediate codecs.

The arithmetic is worth doing explicitly. A 10-second clip in a delivery-grade H.264 4K encode at 50 Mbps is roughly 60 MB. The same ten seconds as a ProRes 422 HQ intermediate, which Apple targets at 884 Mbps for 3840×2160 at 30p, is 1.1 GB. That is roughly 18 times the size, and intermediates are exactly what you keep between stages. Now assume your pipeline generates eight candidates per brief because your creative director wants options, and each candidate produces four intermediates before final. That is one brief consuming tens of gigabytes.

Nobody plans for that in a proof of concept. Everybody encounters it in month four of production.

The iteration multiplier

Here is the part that surprises teams: robustness and storage growth are the same curve.

A fragile pipeline produces one output per request because that is all it can manage. A robust pipeline produces candidates, keeps the rejects for training and eval, versions every asset so a creative decision can be reverted, retains intermediates so a late note does not require regenerating from the prompt, and derives proxies, thumbnails and per-platform cuts from every approved master.

Each of those is the correct engineering decision. Together they mean that improving your pipeline increases your storage footprint superlinearly relative to your output volume. If your unit economics assume storage scales with delivered assets, they are wrong. Storage scales with attempts multiplied by stages multiplied by versions multiplied by derivatives.

This is why storage strategy has to be a design input rather than a line item you discover on an invoice. The two things that turn it from a manageable cost into a structural problem are egress pricing and the absence of a lifecycle policy. Egress hurts most in the exact architecture described above because a multi-stage pipeline repeatedly reads its own intermediates, and a distribution layer constantly reads masters. When every read carries a metered charge, the pipeline design that produces the best creative output is also the one that produces the worst bill, and teams start making architectural compromises to protect margin. Lifecycle policy hurts by omission: if you never decide what an intermediate is worth after 30 days, you pay to keep all of them forever.

What to put in place now

If generative media is core to what you are building, four decisions determine whether your storage layer accelerates you or constrains you:

1. Choose a storage economic model that does not penalize reads. Understand your egress terms before your architecture depends on them. A pipeline that reads its own outputs at every stage is a read-heavy workload, and pricing that assumes write-once, read-rarely does not fit it. Model the ratio you actually expect: egress as a multiple of stored volume, not as an absolute. That ratio is the number to design against.
2. Make writes trigger work. Use object-level event notifications as the pipeline’s signaling mechanism. This buys you loose coupling, lower latency between stages and the ability to add a stage without touching the orchestrator.
3. Attach metadata at write time. Model version, prompt hash, parent asset, generation parameters, approval state. Metadata written at generation time is nearly free. Reconstructing provenance across a million objects later is not; provenance is what makes your rejected candidates usable as eval data and a training signal.
4. Define lifecycle policy per artifact class. Masters, approved derivatives, intermediates and rejects have different retention values. Encode that as policy on day one rather than as a cleanup project in year two.

Which points at the useful way to think about the storage layer: in a pipeline where everything else churns, it is the constant. Models turn over every few weeks. Stages get swapped, added and reordered around them. Output volume compounds with every quality improvement. The one layer absorbing all of that without being redesigned is the one holding the assets, so it is worth choosing based on the characteristics that stay true while the rest moves. That is what we built B2 for. Always hot, so no stage waits on a rehydration to read what the last one wrote. No retention minimum or file size floor, so intermediates that were always disposable cost what they used. Egress scales to what you store rather than metered per read, so a pipeline that reads its own output is not penalized for being good at its job. The architecture above it should change every quarter. The storage underneath it should not have to.

The opportunity

The teams that will win in generative media are not the ones with privileged access to a model. Model access is converging toward commodities. The advantage is in the pipeline: how fast you can adopt a better model, how many candidates you can afford to generate, how much history you retain to evaluate and fine-tune against, and how cheaply you can move all of it.

Every one of those is a storage architecture question. Treat the storage layer as an active participant in the workflow and it becomes the thing that lets you iterate faster than your competition. Treat it as a bucket you dump finished files into, and it becomes the ceiling on how good your pipeline is allowed to get.

The assets are the product now. Architect accordingly.

Businesses received a staggering amount of cyberattacks in June, according to Check Point, showing a rise of 20% over the previous 12 months. The breakout of AI agents from OpenAI in July to hack into the Hugging Face website, and subsequent similar events from Anthropic and Meta, indicate agentic-powered attacks will explode over the coming year.

Currently, malicious hackers have the advantage because publicly released frontier models from the US incorporate guardrails that can’t distinguish between malicious or defensive activities. As a consequence, these models default to a refusal to get involved. Hugging Face discovered this the hard way when they attempted to utilize a model to defend against the OpenAI intrusion. Their solution was to adapt a Chinese open weight model to analyze the 17,000 attack logs, find the vulnerability, and contain the intrusion.

With incidents like these happening more often, an arms race has begun with AI being both the problem and the solution.

Strength in numbers

While single agents generally perform more efficiently for well-defined tasks, research from Stanford University indicates swarms are more effective in messy scenarios with noisy data, which are more typical of unpredictable, intrusion attacks. The increased token usage by swarms raises costs, but increasingly efficient open weight models are rapidly lowering these barriers.

In the Hugging Face example, the agents worked together as a team leaving messages for each other on a message board they improvised. They shared newly found vulnerabilities, exchanged tools, and even developed conventions to address one another and to avoid overwriting each other’s work. While this may seem sinister, they were only following their designated purpose: to achieve a goal without regard to any collateral damage. We can expect bad actors to harness the power of agentic swarms through fine-tuning open weight models, and creating agents that progressively learn from their experiences.

Modern warfare has been transformed over the last four years, too, through the deployment of drones by Ukraine to defend against Russian attacks. Military strategies and the deployment of armament budgets around the world are shifting to focus on new technologies, and approaches and enterprises are now facing a similar challenge from the hostile use of agentic AI.

The drawbridge is down

As enterprises build out their own agentic systems to handle ecommerce, customer service, and marketing activities, this presents new attack surfaces for antagonistic efforts. April 2026 research from Trend Micro found almost 1,500 MCP servers directly exposed to the internet had no authentication or encryption, a rise of 200% from nine months earlier. This included 70 hosts offering direct SQL execution, and servers holding medical records.

The automation of business processes and the reduction of humans from decision making chains open up new vulnerabilities for agents with malicious intent. Arkose Labs’ 2026 agentic AI survey of 300 enterprise leaders found 97% expected an AI agent security incident within the next 12 months.

Social engineering

While agents have demonstrated their ability to break through security systems, they’re also capable of targeting humans to achieve their objectives. Recent research from Verizon indicates that 62% of successful breaches involve a human element, with phone-based attacks 40% more successful than email-based ones. In August, for instance, scammers using an AI-generated deep fake of Australian Prime Minister Anthony Albanese’s voice were able to scam investors out of $5.3 million.

If agents can break out of digital sandboxes, and generate convincing fake videos and audio, then they’re certainly capable of making basic phone calls. In July, during testing of frontier models, the UK AI Security Institute discovered an agent tried to insert malicious code into an open-source project. Attempting to get the code approved, the agent created fake online identities using them to persuade the project’s maintainer to sign it off. “This is the first time we’ve seen risks around autonomy and deception manifest this clearly without specific prompting in the real-world,” the Institute put in a write-up of the incident.

Fight AI with AI

So attackers currently have the upper hand in this escalating arms race. They have access to agents that can work around the clock, constantly probing, learning, and sharing their knowledge with other agents. They’ll only get better at this and learn ways to stay ahead of defensive systems. International agreements to delay or restrict the capabilities of frontier models won’t stop hostile actors motivated by money or rogue states pursuing other objectives. Developers and security vendors need access to the latest frontier models unfettered by restrictive guardrails if we’re to stand any chance of defending against the coming tsunami of attacks.

We can learn a lesson from recent history on this front. In 1992, the US restricted exported software to weak 40-bit encryption, citing security concerns going back to the cold war. While the US allowed stronger encryption internally, the result was weakened security for everyone as hostile antagonists were able to disrupt global supply chains that incorporated less secure software. Despite lifting the ban in 1999, embedded software containing 40-bit encryption continued to cause problems for many years across multiple countries, including the US.

Without rapid action, we may look back fondly to the world before July 2026 as a golden age for cybersecurity, a relative age of innocence.

Salesforce is updating some of the editions, or pricing tiers, of Agentforce Sales and Agentforce Service, a year after their rebrand from Sales Cloud and Service Cloud. The top three now bundle AI agents, analytics, Slack, security, and support with larger allocations of Flex Credits; two of the tiers are also increasing in price.

The Core edition replaces the old Enterprise edition, and its price goes up from $175 per user per month to $195, and now includes 500,000 Flex Credits. Advanced edition costs $395 per user per month and includes 1 million credits, replacing the $350 per month Unlimited edition. The Max edition replaces the old Agentforce 1 tier and now includes 2.75 million credits instead of 1 million for the same $550 per month fee, Salesforce said in a blog post.

The lowest tiers, Starter and Pro Suite, remain unchanged in features and price, although there is a hint that Salesforce is renaming the latter to Professional edition.

What is new in Agentforce Sales?

The new editions bring several capabilities to the base subscription of Agentforce Sales that were previously sold separately: The Core edition now includes Momentum, Slack Business+, and Tableau Next, while the Advanced edition adds Sales Programs, the Premier Success Plan, and additional security and data-protection capabilities. Max edition adds Agentforce for Sales, Agentforce Coworker, Salesforce Spiff, Sales Planning, Sales Programs, Salesforce Maps, Slack Enterprise+, and additional Tableau Next capabilities.

Under the previous Enterprise and Unlimited editions, Sales Programs was an add-on, Tableau Next was available through a separate Tableau+ purchase, and Agentforce itself had to be purchased separately.

What is new in Agentforce Service?

The new editions of Agentforce Service also incorporate capabilities that previously required additional purchases.

The Core edition includes case management, self-service Help Center, Slack Business+, and Slackbot; Advanced adds Agentforce Help Agent, Premier Success Plan, full sandbox, Backup & Recover, and Data Detect, and Max adds Service Rep Assistant, Workforce Engagement, Quality Management, IT Service, unmetered Agentforce Coworker access, and a library of service agent templates.

Under the previous Enterprise and Unlimited editions, Agentforce was available as a separate purchase, while capabilities such as additional security, data protection, and workforce-management tools were also packaged separately or reserved for higher-tier offerings.

Procurement simplicity could come at the cost of visibility

Salesforce said the new editions deliver from 50% to 70% greater value than those they replace, but realizing that value may not be straightforward, analysts warned, particularly as enterprises move from experimenting with Agentforce to deploying agents at scale.

While bundling more AI, analytics, security, Slack, and support capabilities into the subscriptions could simplify procurement of Salesforce products for enterprises, the economics could become more complicated once customers start consuming their included Flex Credits, said Manoj Chandra Jha, principal analyst at Nord-IQ Research.

That is because bundling more capabilities into a single subscription reduces the line-item visibility CIOs previously relied on, and most enterprise finance teams are still learning how to forecast for credit consumption, he said.

Without that visibility CIOs will find it hard to assess how Salesforce’s offerings compare with competing products, particularly when they are trying to determine the cost of specific capabilities or decide which components of a broader bundle are delivering value, he said.

Salesforce may be exaggerating the real value of the new editions, said Pareekh Jain, principal analyst at Pareekh Consulting.

“While CIOs may get more capabilities in a single package, they will still need to assess how much of that functionality employees actually use. A package may offer 60% more theoretical value, but that benefit can disappear if much of the bundled functionality or Flex Credits goes unused,” he said.

Overuse is also a problem, said Jha: As agent usage grows, enterprises could consume their included Flex Credits more quickly and eventually need to purchase additional credits, making actual usage a more important measure of value that CIOs should follow rather than the headline savings attached to the new editions, Jha noted.

New editions targeted at accelerating adoption

While Salesforce talks of value for money, analysts see its real goal with the new editions as accelerating Agentforce adoption.

Investment analysts raised concerns about questioned Agentforce’s customer traction in July, citing enterprise data readiness and the product’s maturity as factors holding back broader adoption. Salesforce, however, has pushed back, pointing instead to growth in deployments and usage.

Nevertheless, said Jha, “With Agentforce running at only a fraction of Salesforce’s 150,000-plus customer base, and analysts pinning the drag on messy enterprise data, folding security and analytics into every tier looks like Salesforce neutralizing the objection before a prospect can raise it.”

Salesforce said last month that its customers had increased their average number of agents from five in February 2025 to 13 by April 2026, while the average number of agent actions per account grew at a 31% compound monthly growth rate over the same period.

Jha sees the updated editions as aimed primarily at Salesforce’s existing customer base, giving companies already using its products more incentives and capacity to expand their use of Agentforce, rather than as a draw for new customers.

Salesforce said the new editions for Agentforce Sales and Agentforce Service are already available, and will soon be joined by new editions for Agentforce Industry.

Existing Agentforce 1 edition customers can upgrade to the new Max edition at no additional cost, the company said, adding that in the future, Max editions across its Sales and Service offerings will also include an allocation for Headless 360.

In the summer of 2024, JPMorgan Chase deployed its internal AI platform LLM Suite, launching it very differently than most do: The company didn’t force anyone to use it.

When LLM Suite arrived at its first major division, asset and wealth management, employees were asked to think of it as a research analyst: someone to ask for data, a draft, or an idea. Leadership didn’t set usage objectives or provide a formal mandate.

Access was rolled out in phases and only to those who requested it, and the bank allowed the tool to circulate through word-of-mouth recommendations among colleagues. While half the industry rushed to count users and publish adoption rates, JPMorgan gave up on pursuing that number.

It became flooded with users. In eight months, 200,000 employees had signed up without a single order being issued, out of a workforce of over 300,000. In time, the bank established more than 450 use cases in production.

Two years after that summer launch, JPMorgan had everything to boast about. It had established itself as a global leader in the use of AI: It was the top bank on the Fortune AIQ 50 list, and the third company overall, ahead of all the tech giants except Alphabet.

It was then that the bank’s head of analytics, Derek Waldron, the person best positioned to sell the success, pointed out what still wasn’t working: There was a gap between what the technology was capable of doing and what the bank was actually capturing in its business results.

That gesture is what distinguishes JPMorgan. Although it has much to celebrate, it knows what it lacks, it says so publicly, and it keeps searching for it. Behind that statement lies a way of innovating and measuring that the bank has been developing for years.

Giving up the number everyone was chasing

The first thing JPMorgan did right was not to make adoption the goal. By not forcing anyone, it turned platform usage into a barometer. If a tool worked, it was filled without any campaign; if it didn’t, it was emptied, and that emptiness provided valuable information. If adoption had become a target to be pursued, the organization would have optimized the number instead of understanding what the number represents.

The bank itself acknowledges that if a tool is broadly used, it means it’s popular, but not necessarily effective. To determine its effectiveness, something more was needed. The answer came from two decisions that only work together: linking each project to a business outcome, and creating the metrics to demonstrate that outcome.

First, to find initiatives that could have a real impact, instead of creating an agenda from the top down, the bank surveyed its business units, asking where there was a problem to solve. Within a few weeks, an internal portal gathered, according to the bank’s figures, nearly a thousand ideas. Of these, only a few hundred moved forward and reached production. An organization doesn’t open a funnel of that size if it expects most ideas to survive; it anticipates that many will be discarded.

The funnel’s filtering method was also different. Before launching each test, the outcome that would ensure the experiment’s survival was defined, along with the steps to be taken the day after the decision. By planning future actions in advance, indecision and the perception of failure were avoided.

A clinical approach to AI experimentation

But setting a threshold for each experiment requires verification, and that’s where the bank encountered an unexpected obstacle. Metrics have their own cycles. Bank customers conduct business on Mondays, not Sundays. They receive their paychecks at the end of the month. In August, they disappear. When an initiative generates a change and a figure rises the following week, there’s no way to know whether it increased due to the change or the calendar.

The solution was borrowed from clinical trials. Instead of rolling out the change to all users, it was rolled out to half, chosen at random. The other half (the control group) operated on the same Monday, the same payroll, and the same August, so that the experimental contribution (the attribution) could be separated.

The next step was to industrialize the experiments. Doing it properly required a specialist sitting alongside each product team, and with that method, they reached eight per year. A self-service platform increased the figure to around 300 tests annually.

The results are concrete. For example, tens of thousands of the bank’s engineers have gained between 10% and 20% efficiency thanks to an internally developed programming assistant.

Finally, the bank discovered that a figure can be accurate and yet mean nothing. Its head of analytics explained this with a simple example. They measure the hour that AI saves one employee, and the three hours it saves another. They add them up, and the result is accurate. But in a process that goes from beginning to end, those saved minutes often don’t appear on the bottom line: They merely shift the bottleneck to the next one.

It’s easy to get stuck on partial metrics because they’re more immediate and produce more impressive numbers. JPMorgan’s discipline consisted of not accepting a metric as valid until verifying its impact on the business at the end of the process.

The question then remains on Monday morning: What can a company that has neither the size nor the budget of a bank take home?

The method is what best exports

What’s most interesting about JPMorgan isn’t what it has done with AI, but how it has done it . Any company can replicate this approach, because it doesn’t depend on proprietary data, scale, or budget.

The following are some best practices that don’t require a €20 billion annual budget. They do require making decisions before starting and are within reach of any company:

Launch far more initiatives than will survive, and announce this clearly. If the organization discovers halfway through that most of its projects will be canceled, it may misinterpret this as a planning failure; if it knows from the outset, it understands it as the natural selection process. This is what makes making mistakes quick and cheap.

Decide in advance the threshold that will shut down a project and plan the next steps. Both aspects are necessary, not just the metric. If a certain figure isn’t reached, the team needs to know what will happen next. Applying a threshold without future planning leaves the team in limbo, and they’ll have to find a reasonable reason to wait another quarter before shutting down.

Work on business outcome metrics from the outset, not just when they’re requested. This tracking not only guides the initiative but also prevents having to reconstruct months of poorly documented decisions. Adoption, by the way, is the number the CFO won’t ask for. It serves as a signal while no one is pursuing it, and it ceases to be useful the day it becomes a target.

How to get it right

Whether metrics mean anything depends on where you focus your attention. It’s best to start with scope, because that’s the most common mistake. Saving three hours in one stage isn’t the same as improving time-to-market: If the entire process isn’t shortened, what you have is freed-up capacity, which is also valuable, but it’s something different, and it’s advisable to make that distinction clear.

Then it’s important to consider that value leakage occurs in two directions. The first is outward: The savings are passed on to the customer in the form of lower prices or better service. The second is inward: The savings in personnel are replaced by spending on computing. If these items fall into different budget categories, it’s easy to overestimate the actual savings.

Finally, there’s an excessive focus on cost savings, at the expense of revenue opportunities. Jamie Dimon, CEO of JPMorgan, put it more bluntly to his analysts than any consulting firm: No one benefits uniquely from AI. In other words, competitors will eventually incorporate those savings. The greatest potential for differentiation lies in revenue: using AI to uncover unmet demand.

The question a CIO will have to answer in a year’s time won’t be how much AI their company uses. It will be which of projects are still alive because they work, and not because no one has bothered to test them.

A few weeks ago, in these pages I argued that AI is repricing enterprise software faster than most vendors want to admit. Since then, the sharpest pushback I have gotten from peer CIOs has not been about the pricing thesis. It has been about the leaders navigating it. What does this shift actually ask of the people leading their organizations through it?

The honest answer, from where I sit, is uncomfortable. AI is the first enterprise technology in a generation where the leader’s personal experience of the tools has become part of the leadership instrument itself. Most senior IT leaders, including many I speak with regularly, have not yet caught up to what that means. For most of my career, my model for leading technology change was familiar: read deeply, talking to peers, pressure-test with my team, communicate direction, drive execution. That model does not work for AI. I did not figure this out because I was smarter than my peers. I figured it out because I stopped talking about AI and started using it, and the difference in my own judgment surprised me.

The credibility gap most IT leaders don’t see in themselves

The data is more revealing than the conventional commentary suggests. Gallup’s Q4 2025 workplace research found that frequent AI use among leaders had reached 44%, up from 17% in mid-2023. That sounds like progress. But 56% of senior leaders still do not use AI frequently in their own work. And frequent use does not necessarily mean sustained, real-stakes practice with the tools. More than half of the people setting enterprise AI direction are doing so from a distance.

Grant Thornton’s 2026 AI Impact Survey makes the problem visible from a different angle. Of 950 senior business leaders surveyed across ten industries, 78% reported they lacked confidence they could pass an independent AI governance audit within ninety days. The leaders setting direction on AI cannot, by their own admission, explain how their AI decisions get made or who is accountable for the outcomes. Articulation has run ahead of practice across most of the executive population.

I see the same pattern at closer range. In peer CIO conversations, on conference panels and in executive committee discussions inside other organizations, I keep meeting senior leaders who are the most articulate strategic voices on AI in their companies but have not personally used AI in their own work. They have read about it. They have been briefed. They have approved budgets. They have given speeches. They have not lived with it.

I call this the AI credibility gap. It runs from the CEO suite through the C-level and into mid-management. The failure mode it produces is specific: leaders talk fluently about AI strategy without being able to engage with the realities their teams encounter daily. The teams notice. They stop bringing real problems forward because the conversations skim the surface. They stop trusting prioritization because it does not reflect what they are actually experiencing. They start working around leadership rather than with it.

The credibility gap is not a knowledge problem. The leaders involved are intelligent and motivated. It is an experience problem, and experience cannot be briefed.

Why this shift is different from the ones ITDMs have led before

A reasonable objection: senior IT leaders have managed major technology transitions for decades without becoming hands-on practitioners. CIOs led cloud transformations without writing infrastructure-as-code. CFOs led ERP implementations without configuring modules. Why is AI different?

Three things have changed. AI tools are designed for direct human use in a way enterprise infrastructure never was, which means a leader who has not used them is unfamiliar not just with a technology but with a new mode of knowledge work. Second, AI capability changes faster than any leader’s briefing cycle can keep up with, so leaders working from quarterly briefings operate with a perpetually stale model of what the technology can and cannot do. Third, and hardest to communicate to leaders who have not lived it, AI works probabilistically. Knowing when to trust an output, when to verify, when to push back, when to escalate: these judgments accumulate through hours of personal use, the way clinical judgment accumulates in a physician. A leader who has not done that accumulation is asking their teams to do it instead, and to make the resulting calls without leadership cover.

Personal practice, in other words, is now a prerequisite for AI leadership rather than a complement to it.

What actually changed when I started building with the tools

I noticed the credibility gap in myself before I saw it in anyone else. Several months ago, I decided to stop talking about AI as a topic and start using it as a tool. Not the demo-and-show-off way most executives engage with AI, with a Copilot prompt here and a ChatGPT query there, but as a daily instrument in the actual work I do. Drafting strategy documents. Stress-testing arguments before taking them to the leadership team. Working through analysis I would previously have outsourced.

At one point I went further. Coming from a product and supply chain background, I built an inventory contextual model using AI, a working tool rather than a slide, to think through supply, demand, inventory levels, cash flow and downstream customer impact. I did this not because my team could not have built it, but because I wanted to live inside the problem myself. The act of building taught me more about AI’s strengths and limits in a few weeks than two years of vendor demos had. I saw where the model held up under real data, where it broke, where the judgment of an experienced operator was still load-bearing, and where AI genuinely extended what a human alone could see.

The change in my leadership was not what I expected. The efficiency was real but turned out to be the least interesting part. What changed was my judgment. I started understanding what these tools are genuinely good at, where the failure modes hide and where the value sits underneath the marketing layer. That judgment changed how I prioritize AI investments, which vendor demos I find credible, how I push back on enthusiastic recommendations from my own teams, and most importantly, how I talk to my organization about AI. The conversations moved from compliance to engagement. We started moving faster, not because I pushed harder, but because the team trusted the direction more.

You cannot direct an organization’s AI transformation with conviction if your own working life has not been transformed by it.

The advice that actually matters: Pick the work that scares you

If I could give one piece of advice to a peer IT leader trying to close their own credibility gap, it would be the opposite of what most AI-leadership pieces say.

The instinct of senior IT leaders is to start using AI on the parts of the job that are already routine. First-draft emails. Meeting summaries. Scheduling. The parts where the risk feel low and the productivity lift feels visible. That instinct is wrong. Routine work produces routine learning. It gives you exposure to the tools but not to the judgment that changes how you lead.

The judgment that matters develops when AI is sitting next to you at the work where your professional identity is most exposed. The analysis you used to outsource to consultants. The strategy memo where your reputation is on the line. The problem you privately believed only you could solve. That is the work that changes you, because it is the work where you must grapple honestly with what the tool can do that you cannot, and where you can still see clearly what you can do that the tool cannot.

This is uncomfortable for a senior leader. It should be. If you use AI only in the safe parts of your job, you are protecting your professional identity from the encounter that would actually update it. You get to keep believing the tool is a nice supplement to what you already know how to do. If you use AI on the parts of your job where your expertise is the whole point of your seat, the encounter is different. You find out where your judgment still holds. You find out where it does not. You find out how the tool and your expertise combine into something neither could produce alone. That is the learning that changes how you lead.

This is where the ITDM instinct gets in the way most. Many CIOs and IT leaders I speak with have started using AI in IT operations, which feels like home territory and where the productivity gains are visible. That is fine, but it is not where the credibility gap lives. The gap lies in strategic decision-making, board-level analysis, cross-functional trade-off calls and the judgment work leaders were promoted for being good at. Those are the areas where most leaders have never used it.

So, the question I would put to any IT leader reading this: what is the work you are best known for? The work you would not want anyone else to touch? That is exactly the work you should be doing with AI, this month, before you write the next AI strategy document your organization asks you for.

The stakes

The personal practice of the leader, more than strategy or budget or governance, is going to determine whether organizations succeed or struggle with AI transformation. Strategy without lived experience produces hollow direction. Budget without lived experience produces misallocated investment. Governance without lived experience produces over-correction or under-correction depending on which fear is loudest in the room.

The IT leaders I see doing this work quietly, on their own time, with their hands on the tools, are the ones I expect to define the next decade of enterprise transformation. The ones who keep articulating without practicing will find themselves increasingly disconnected from the organizations they lead. The teams will move on. The strategy will drift. And the leaders will not understand why, because the gap they have created is invisible from the seat they sit in. The question is not whether AI will reshape your organization. It will. The question is whether you will reshape yourself first, enough to lead the transformation rather than narrate it.

IT leaders have been making generative AI tools available across the enterprise for just three years, and a significant majority of their business users has already had enough.

According to a report from Adaptavist, 65% of 2,500 knowledge workers surveyed say they “regularly feel nostalgic about how work operated before the widespread adoption of AI.”

This “pre-AI nostalgia” appears to be due in part to business users feeling overwhelmed by the responsibility of learning how to use AI on top of their day-to-day job tasks. Moreover, 46% of workers say their concerns about AI have gone unaddressed by management.

“Transparency is critical to truly drive AI engagement; organizations must establish clear guardrails and maintain an open dialogue around AI use and employee choice where workers feel they are being listened to,” Jobin Kuruvilla, field CTO at Adaptavist, tells CIO.

Generational gaps in AI acceptance

Despite an assumption that younger workers are more intuitively adept with AI tools, Gen Z workers (42%) are more likely to prefer the pre-AI world compared to their Gen X colleagues (26%). This may support the growing concern that AI is quickly is hitting entry-level workers the hardest, while creating new career opportunities for more skilled workers who have been in the industry longer.

When asked about fears surrounding job obsolescence due to AI, 54% of all workers surveyed said they are “concerned AI could reduce the need for their role within the next five years.” Broken out by organizational level, junior employees (23%) and C-level executives (29%) expressed the most concern about AI job loss, compared to 13% for mid-level employees and 12% for senior employees.

Additionally, 47% of C-level executives and 36% of directors are looking to move industries, change careers, or step away entirely due to concerns of AI eliminating their positions. Still, plenty of workers are ready to face the new challenges of an AI-driven workplace, with 74% saying they are actively learning new skills to stay relevant, and 85% of C-level leaders saying the same.

Lack of transparency drives AI fatigue

One in three workers (36%) are already experiencing “AI fatigue,” leading to less frequent use of AI tools and active resistance to AI for day-to-day tasks. More than a third of workers (36%) also appears to be confused about AI use expectations in their role.

When implemented quickly without proper training and transparency, AI initiatives can lead to hidden productivity costs. Of those surveyed, 42% say they “spend more time verifying AI output than they save using it,” while 52% say they regularly spend time correcting AI-generated work from colleagues. Additionally, 49% say low-quality AI outputs slow down projects, 55% say AI-generated content reduces overall team efficiency, and 46% say it makes their work feel “more repetitive and less meaningful.”

Half of all workers also feel their performance is now “directly or indirectly compared to AI-generated output.” Providing clarity about how AI impacts or doesn’t impact an employee’s career is important to staving off AI fatigue.

For those chalking this all up to change resistance, know this: 67% of workers surveyed say they want their organization to increase the use of AI, and 69% say they believe AI is being used ethically within the organization. What they lack is a roadmap, guidance, and training to understand how to best implement AI at work, and to ensure it’s being used effectively.

“Ultimately, by automating the mundane tasks that make work feel repetitive —organizations can refocus their specialists on high-value creativity, transforming AI from a source of fatigue into a powerful engine for meaningful human achievement,” says Anand Unadkat, a senior solutions architect at Atlassian.

IT leaders and their executive colleagues need to focus more on the change management artistry necessary to help get them there.

Meta won’t judge employees by how much they use AI when it comes to annual performance reviews, despite early efforts to drive AI adoption focusing on so-called token maxing.

The company has told employees that it “will not use AI adoption dashboards or token counts to evaluate impact,” according to  a report by The Information.

The announcement came in an internal memo from executives Maher Saba and Santosh Janardhan, which said that instead of measuring AI usage, “managers should look at output quality, velocity, problem complexity and scope taken on.”

This marks a culture change for Meta, where engineers had previously competed to consume the most AI tokens, displaying their scores on a leaderboard. Meta then discovered that its employees were being diverted from regular work because they were using AI to carry out additional tasks to boost their scores.

Amazon had similar results when it implemented a leaderboard to track AI use; it also found that some employees were trying to game the system by using AI to complete unnecessary tasks, and it has now deleted it.

The company, however, does also monitor employees’ use of AI for training purposes, in a program introduced in April, but this is information was not used to measure employee performance.

Meta had already started to look askance at the concept of using AI metrics as a tool to assess employees. Earlier this year, Chief Technology Officer Andrew Bosworth told employees in a memo that “nobody should be using AI tools just for the sake of using them,” adding that “token usage alone is not a measure of impact of any kind.”

This article first appeared on InfoWorld.

Enterprises are facing a disturbing new question in the age of AI: What happens when agentic assistants go dark?

This became a very real scenario on Thursday, as OpenAI’s ChatGPT, Anthropic’s Claude, and SpaceXAI’s Grok near-simultaneously, and somewhat mysteriously, experienced significant, prolonged outages.

Beginning in the morning, Eastern time, several ChatGPT models went down over a roughly two hour period, Claude models over a four-hour span, and Grok models for a near three-and-a-half hour duration. All three companies acknowledged the “elevated” issues and applied fixes.

As users grumbled in forums and IT teams scrambled to get them back online, the incident revealed how hastily some organizations have adopted generative AI workflows without considering the potential, and inevitable, impact of widespread outages.

AI agents are increasingly taking over automated and wider-scale workflows, and enterprises could find themselves “uncomfortably exposed” when AI hits the brakes, said technology analyst and journalist Carmi Levy. The situation should “serve as a wakeup call to IT leaders who have largely ignored what it’ll cost them if these increasingly critical platforms suddenly go dark. The risk is no longer hypothetical.”

Hours-long outages impact core services

ChatGPT went down on the same day as OpenAI’s anticipated launch of GPT-6 Astra, the new frontier model that the company says approximates artificial general intelligence (AGI) and gets nearer to its goal of creating autonomous systems that outperform humans.

The OpenAI outage occurred around 11 a.m. ET on Thursday and impacted a slew of services, including search, file uploads, agents, GPTs, voice mode, image generation, ChatGPT work, Compliance API, Deep Research, ChatGPT Atlas, and other connectors and apps. In some cases, users were prevented from logging in, conversations failed to load, and the interface returned errors when attempting to send messages. OpenAI’s Codex services, including web, API, command line interface (CLI), and VS code extension, were also impacted.

OpenAI fixed the issue by 12:55 p.m. ET, and advised Codex remote control users to re-pair their mobile devices.

Claude began to go dark around 7:37 a.m. ET, with Anthropic acknowledging an “exhaustive list” of impacted models with elevated errors over the next few hours: Mythos and Fable 5.1 and 5, Sonnet 5, and Opus 5, 4.8, and 4.6.

The issue was resolved by 11:27 a.m. ET. The incident followed a roughly 27-minute outage just the day before, also due to elevated errors on requests in Sonnet 5.

Grok, meanwhile, began experiencing issues around 9:30 a.m. ET. Grok Web, Build, API, Office/Workspace plugins, Android, and X were all impacted. The services returned to “healthy” traffic at 1:08 p.m. ET.

“It’s a curious scenario for multiple different providers to experience outages at the same time,” noted Brian Jackson, a principal research director at Info-Tech Research Group. It could be related to a common infrastructure such as a content delivery network (CDN) layer, domain name system (DNS), or shared cloud infrastructure, he theorized.

A case for outage planning

Just a few months ago, the extent of AI use within the typical enterprise was limited to employees using chatbots to get answers to basic questions or to draft simple email messages, Levy noted. Large-scale AI platform outages, when they occurred, had relatively little impact on overall organizational productivity. “But things are changing, and quickly,” he said.

Organizations must now have a better understanding of the impact agentic AI has on day-to-day workflows, and the degree to which they disrupt employees’ ability to complete complex tasks once they’ve handed the reins over to automated, cloud-based tools, Levy noted.

In incidents like Thursday’s, employees may fall back on traditional manual workflows, such as updating spreadsheets or pulling reports together the old-fashioned way. But they might also realize that, after relying on AI agents to do so much work on their behalf, they’ve become too dependent on automation, and their “cognitive skills may not be as sharp as they once were,” Levy said.

The growing prevalence of agentic AI should prompt organizations to revisit their disaster recovery and business continuity plans and assess the productivity impact of potential service outages, he said. While cloud-based productivity platforms like Google Workplace and Microsoft 365 offer limited degrees of “offline mode” functionality using locally-stored data, and documents can be synchronized to hard drives in Dropbox or Google Docs for Desktop, agentic AI platforms offer up fewer offline workarounds, at least in their current form.

Organizations should document workflows in greater detail and scenario-plan what near-term recovery might look like in the event of an extended AI platform outage, Levy said. They also need better training to ensure employees maintain their manual skills over time and are equipped to press them into service in the event of a service outage, because the more enterprises lean on agents to complete critical tasks, “and pull humans out of the loop in the interest of productivity,” the less able employees will be to step back in during inevitable service interruptions, he pointed out.

“It is entirely possible for otherwise well-meaning organizations to be over-reliant on AI automation,” Levy said. “Too many organizations are about to learn some hard lessons about not having a backup plan in place.”

Info-Tech’s Jackson also recommends a modular architecture for LLMs; enterprises should view the model as a “commodity that can be hot-swapped with an alternative.” That might be another cloud service provider (which hopefully isn’t experiencing a concurrent outage) or a self-hosted option like an open-weights model.

“In a scenario like this, when your first choice provider might not be available, you have a fallback that can supply that same intelligence layer, even if it’s only a stopgap solution,” said Jackson.

This article originally appeared on Computerworld.

When Nvidia said Thursday that it plans to pay $13 billion to acquire Hugging Face, the question arose of whether the open AI platform would remain open when it becomes a unit of Nvidia. And the current lack of a single viable open alternative that does everything Hugging Face does for enterprises adds further complications for CIOs.

Rumors of the pending deal have been circulating for at least a week. 

In its announcement, Nvidia said, “Hugging Face will remain an open platform for the entire AI ecosystem. Developers will choose the models they want, the frameworks they want, the clouds and inference service providers they want and the computing platforms they want. Nvidia compute will not be required to build on or deploy through Hugging Face.”

It added that Hugging Face will continue to support open source and open weight models from every model builder, and “continue to support multi-cloud and multi-accelerator development and deployment, so builders can use the hardware and infrastructure that best fit their work.”

Hugging Face CEO Clément Delangue took to his X account to also reassure customers, noting, “open-source AI is at an inflection point” and pointing out that, for the business to scale, it needs “more compute, more support, more collaboration and more visibility. That’s why we went to talk to [Nvidia CEO] Jensen [Huang], who offered to do exactly that with us.”

Preserving the Hugging Face team

Nvidia is also attempting to retain some of the Hugging Face workforce. As part of the deal, according to Nvidia’s 8-K filing, the purchase price is $11.9 billion, with “approximately $1 billion” earmarked for “an equity-based retention program” for Hugging Face employees who agree to join Nvidia. It has yet to be announced how many members of the Hugging Face workforce, estimated to be almost 750, will be offered roles at Nvidia.

But despite the reassurances from Nvidia about maintaining the open nature of Hugging Face, analysts and consultants suggested that the truth may not be known until months, or even a year, after the acquisition finalizes sometime next year; the transaction is expected to close “in the first half of 2027.”

Cause for optimism

Enterprise CIOs can only wait and see what Nvidia will ultimately do. 

But in the meantime, there is cause for optimism, given the history of recent open source acquisitions, said Jason Andersen, principal analyst at Moor Insights & Strategy. 

“There is always a ‘sky is falling’ narrative” with these transactions, Andersen said, but in recent years, open source acquisitions have often turned out quite well.

“What happened to Red Hat after IBM bought it? Things got better,” Andersen said. “The same can be said for GitHub after Microsoft bought it. Or Google’s acquisition of Gemma. There are just too many examples of it going the right way.”

Justin Greis, CEO of consulting firm Acceligence, also sees this acquisition as potentially good news for enterprise CIOs. 

“If Nvidia turned [Hugging Face] into a walled garden or an obvious funnel toward Nvidia hardware, it could undermine the community and network effects it just paid nearly $13 billion to acquire,” he pointed out. “Nvidia is being unusually explicit that Hugging Face will remain model-, framework-, cloud- and accelerator-agnostic, including saying that Nvidia compute will not be required.” 

And, he added, Nvidia could indeed make Hugging Face even more enterprise friendly. 

“Nvidia itself points to the opportunity to improve Hugging Face’s reliability, safety, model evaluation, inference, and deployment capabilities. That is potentially a very big deal,” Greis said, noting that enterprises don’t simply need access to more models, they need confidence that those models can operate within complex environments with governance, security, performance, resilience, and lifecycle management around them.

Those needs make the combination compelling, he said: “Nvidia has the engineering depth, infrastructure expertise and ecosystem reach to significantly raise that bar. Hugging Face has been enormously successful as a developer and open-model platform. Nvidia now has the opportunity to help make it much more enterprise-grade: a place where companies can discover models, datasets, and AI components, but also increasingly evaluate, test, secure, operationalize, and deploy them with the level of confidence and rigor expected inside a large enterprise.”

Avoid a single dependency

Still, said Shashi Bellamkonda, a principal research director at Info-Tech Research Group, there are various practical steps that CIOs can and should soon take to preserve what they have already created within Hugging Face.

“This should be a clarion call for CIOs to treat Hugging Face and open source models as part of their enterprise supply chain, and if a production system depends on an artifact hosted on Hugging Face, keep a verified copy in a second registry, whether that is GitLab, Amazon S3, or an internal artifact store,” he said. “Enterprises should also consider the source for open models and develop a fallback plan such as the model developer’s own repository or another hub, because Hugging Face is the dominant platform today, but no enterprise should depend on one company’s availability, governance, or roadmap.”

Bellamkonda also pointed out that, by owning Hugging Face, Nvidia would gain valuable visibility into which models are gaining traction, how developers are deploying them, and which hardware ecosystems they run on. It would then “hold a powerful position in the distribution of new open models, so that combination of infrastructure ownership, market intelligence, and hardware influence should factor into CIO planning,” he said.

Mike Wilkes, enterprise CISO at Aikido Security, added that one of the factors that makes a CIO’s 2027 contingency planning in the face of Hugging Face’s new ownership difficult is that there are not that many large open source companies that could directly replace Hugging Face for an enterprise.

“No true replacement exists for Hugging Face at its scale, but there are ways to avoid making it a single point of dependency,” he said. “Azure AI Foundry is probably the closest enterprise alternative regarding model breadth, now advertising more than 11,000 models and supporting models from OpenAI, Anthropic, Meta, Mistral and others. AWS SageMaker JumpStart is another option, as enterprises can create private curated model hubs with their own governance controls. Google’s Model Garden is a third viable choice and supports both managed and self-deployed open models inside the customer’s own cloud environment.”

But adopting any of those alternatives means a move from an independent Hugging Face to Microsoft, Amazon, or Google, “so they change the concentration risk rather than eliminating it,” Wilkes noted. “The best enterprise strategy is not to search for another Hugging Face, but to separate model discovery from model custody. We can continue using Hugging Face to discover and evaluate models while mirroring approved models into an internal repository or registry under our control.”

Risk of increasing AI control by Nvidia

IDC’s Ashish Nadkarni, a group VP, said CIOs must also remember that the Nvidia move could give it various levers to even further tighten its control over global AI developments. 

“Hugging Face is like GitHub for AI. It is the default front door for open AI innovation: it’s where data scientists, machine learning engineers, and developers discover pretrained models, fine-tune them, and push them into production, or find open datasets to train their own models,” he said. “Owning that front door gives Nvidia a major position in the mindshare of today’s AI development personas.”

Consultant Brian Levine, executive director of FormerGov, also advised CIOs to stay alert. He predicted that Nvidia will exert greater control over Hugging Face efforts, but it will happen so gradually that it might not be noticed.

“The risk isn’t a dramatic reverse course. It’s a slow drift, where the Nvidia-optimized path quietly becomes the easy path, and everything else becomes the friction path,” he said. “Stop treating Hugging Face as a vendor-neutral utility and start treating it as a strategically-owned platform. That doesn’t mean leave. It means keep your options real and tested, not theoretical.”

Unanswered questions

And, from an enterprise CIO’s perspective, there’s another worry.

“Nvidia’s openness commitment is precise where it is cheap, and silent where it is expensive,” said Sanchit Vir Gogia, chief analyst at Greyhound Research. “The release promises that Nvidia compute will not be required, that multi-cloud and multi-accelerator support continues, and that developers choose their own models, each of which is a commitment about availability rather than about terms. Nothing in it addresses ranking, search placement, or default routing, and those are what decide which models a developer ever sees. Nobody has to be banned for the field to tilt. Gravity is enough and gravity is the part the pledge does not mention.”

This article originally appeared on InfoWorld.

Concerns about the risks of AI systems are certain to be met with four words: human in the loop. The discussion may broaden, but the assurance is inevitable. It’s an AI governance phrase that’s become so rote you hear it in every direction and likely have said it yourself.

But IT leaders should be wary of vendor or team claims that they’ve built human-in-the-loop systems into AI tools because some of these supposed guardrails are no more than rubber stamps.

Some so-called human-in-the-loop systems don’t give employees overseeing the AI tools either the control or the time necessary to fix any problems, some IT experts point out.

For human-in-the-loop systems to actually work, employees overseeing AI tools need to have the domain knowledge and context to take the action the AI tool is addressing when the AI isn’t involved, and they need to have the authority to override the AI decision, says Doug Shepherd, head of offensive security at internet services provider Cloudflare.

Promises of human-in-the-loop systems give IT leaders comfort, but the underlying process often doesn’t work as advertised, he adds.

“If your human in the loop can flag something but can’t actually stop it, that’s not human in the loop, that’s a human adjacent to the loop,” Shepherd says. “That’s performative governance.”

Shepherd, speaking at the recent CIO 100 Awards and Conference in Frisco, Texas, encouraged attendees to embrace AI and focus on projects that drive adoption and impact. Organizations that fail to push AI initiatives will be left behind, he suggested, but he also warned that blind adoption, without focusing on meaningful outcomes and guardrails, can lead to huge setbacks.

Many organizations reach for human in the loop as an important control, but no one stress tests it, he adds. “It gets projects approved, and too often, it does the political work, but not the risk work,” he says.

Darren Kimura, CEO and president at AI integration platform vendor AISquared, agrees that many organizations are deceiving themselves with so-called human-in-the-loop systems.

“Most companies that say they have a human in the loop actually have a human watching the loop,” he says. “The person can see the decision and flag a concern, but they cannot stop it, change it, reject it, or escalate it.”

IT leaders should ask themselves a handful of questions: Can reviewers halt the actions before they take effect? Can they change the output? Are their overrides recorded and enforced downstream? “If the answer to any of those is no, the human is just monitoring AI,” Kimura says.

Too many decisions

Another problem with human-in-the-loop systems is the decision fatigue that can set in when employees are asked to review too many AI decisions and end up button mashing instead of thinking about the consequences.

The AI reviewer needs the expertise and context to evaluate the recommendation, enough time to do so, and both the authority and technical ability to reject or reverse it, says Eric Billingsley, COO and CTO of AI assurance company TrustScale.

But even a qualified and empowered reviewer may gradually stop exercising independent judgment when the AI is consistently right, he notes.

“If the system is right 95% of the time, the person’s job becomes waiting for the rare case when it is wrong,” he says. “Humans are not particularly good at sustained vigilance of a highly reliable automated system. Eventually, review becomes confirmation.”

A good AI system can create bad human controls, he adds. “When the exceptional case arrives, the reviewer may approve it because the system has trained them, through hundreds of correct recommendations, to trust it,” he says.

Billingsley advises IT leaders to evaluate human-in-the-loop systems the same way they monitor other security controls. A control must be monitored, tested, and produce evidence that it is operating as intended, he says.

“A log showing that someone clicked ‘approve’ is not enough,” Billingsley adds. “You need evidence that the person had the necessary context, applied independent judgment, and had the authority to override the AI.”

Robert Blumofe, EVP and CTO at cloud computing and security vendor Akamai, sees the same problems Billingsley does. Some type of human oversight is preferable to fully autonomous AI, he says, but human in the loop can turn into a mind-numbing exercise.

“LLMs produce the correct output just often enough to lull us into a complacent belief that they are more reliable than they really are,” he notes. “After diligently checking the AI output each time and finding no errors, diligence wanes, and human in the loop turns into rote approval.”

IT leaders should take the time to figure out what they’re getting into when vendors or their internal teams pitch a human-in-the-loop system, Blumofe says.

“It’s incredibly important to understand exactly how the system is designed and when and how the human will interact with the AI,” he adds.

Organizations should also explore ways to deploy other technologies as guardrails for AI, instead of turning to unreliable human oversight, Blumofe suggests.

“You need non-AI systems in the guardrail role,” he explains. “These technology tools would help to automate testing and validation of AI outputs, flag issues, and have the capability to pause the AI work. This keeps humans out of approval loops, while also helping to reduce risk.”

When humans aren’t the right choice

Other IT leaders suggest that human-in-the-loop systems aren’t the right solution in every AI use case. When AI is used to flag and mitigate cybersecurity incidents, for example, waiting for a human to approve an action may be too late.

“If an endpoint is compromised, you may want the system to isolate it immediately,” says AISquared’s Kimura. “Waiting 20 or 30 minutes for someone to approve that action could allow the attack to spread.”

The objective is not to put a human into every AI decision, he adds. “It is to put the right human, with the right context and authority, at the right point in the workflow.”

While many organizations are still experimenting with AI and debating governance models, a small but growing group of market leaders is already operationalizing AI at scale. Marianne Johnson, executive vice president and chief product and technology officer at Cox Automotive, is one executive creating business impact today.

With responsibilities spanning product, technology, data, AI, engineering, and cybersecurity, Johnson is spearheading an integrated operating model that enables Cox Automotive to move, learn, and deliver customer value faster than the competition.

Johnson joined me on a recent Tech Whisperers podcast episode to discuss how she’s rewriting her leadership playbook to orchestrate one of the largest business transformations in the industry. Reinventing how her company thinks, operates, and creates value in the AI era, Johnson offers a blueprint for a new kind of leader, an “AI operating executive.”

Johnson and I spent time after the podcast exploring this leadership model and what it takes to transform the way the business creates value. What follows is that conversation, edited for length and clarity.

Dan Roberts: Why is a leadership model that encompasses all of product and technology becoming so important today?

Marianne Johnson: When those roles are combined, your ability to get out of your own way is unprecedented. I talk to peers who have a different product leader, a different CIO, maybe a chief data officer in security; only a few have the flywheel spinning at full speed because they’re aligned and on the same page. By having it all in one org, we have one common vision we shape and execute together, continually creating an environment where we feel comfortable to challenge things.

When you think about pre-agentic and agile software delivery, product couldn’t say engineering wasn’t delivering, and engineering couldn’t say product wasn’t giving them the right “what” if you were on one team. You had one vision, one outcome, and you could go as fast as you possibly could.

Then agentic comes in, and everybody can be a builder. Now the lines are blurred. An agent becomes a role on the team. The fact that we’ve had a unified team for eight years now gave us a jump-off point four years ago, and an accelerated jump-off point two years ago. When the big disruption in how software gets created happened, we were already aligned as a team. That allowed us to break down those next-level barriers.

We’re still redefining what that looks like: How do you rethink team size and shape? What are the roles on the team? Who requires what skill set? These questions led us to stop looking at traditional roles. We’re looking at what key activities need to happen, asking who does those activities, including an agent as part of the “who.”

It’s also about flexibility. Your ability to take any talent and say, “You don’t have to just work on that tech stack because that’s your domain expertise, or this product line because that’s your domain expertise.” It’s the ability to create context fast by having your data together and then forming new teams to take on this crazy idea and rapidly move it. Then maybe you go back to your home base, work on another one. Needs are rapidly changing, so you have to have that lens to make competitive advantage happen.

What do CEOs need to do to build a more future-ready organization capable of sustaining that competitive advantage?

The CEO or senior leadership team needs to redefine what leadership you need in place so you don’t limit your opportunity. A year or two from now, everybody in the company can be a builder. But you have to have a control plane to do that safely, reliably, and without creating tech debt, especially in a token economy. Because you could have unintended expenses without the return on investment.

What you put together now to accelerate that opportunity — and do it while managing risk — has to be super intentional. I don’t think a lot of leaders have that map yet, or even the first five steps of that map right now. What an organization’s structure looks like and how work gets done in the future is going to fundamentally shift.

Companies that move in that direction intentionally and lift up to see what’s the next shift will have sustained advantage in the future. There will be very clear delineations for those who don’t do that, and it will be significantly disruptive to the viability of their business model.

I don’t know that I would call that leadership role the chief product and technology officer anymore. The right leader role redefines the current disciplines to get to different outcomes in the future. And depending on what your business is and what roles you have today, you need to determine what that is.

What’s your advice to a CEO who wants to develop this kind of leader, or for someone who wants to grow into this role? What are the essential leadership muscles tomorrow’s AI operating executives need develop today?

They need to look for a leader who has multidisciplinary skills and has executed at scale. That matters, because your business needs to scale fast. These capabilities are changing so fast, you have to have somebody that’s dealt with high change.

What’s challenging is that there is no resume that says this person has successfully operationalized AI at the scale necessary today and has a track record to prove it. You have to seek indications of managing high change, AI fluency, and then the attributes of a leader who can help you navigate through that.

I’ve had a lot of consultants come in and say, we can help you, and I’m like, well, let’s talk about that, because there is no playbook. We’re writing the playbook. If you want to come along beside me and give me extra arms and legs and brains to contribute, you can do that. I’m not going to pay you for that, but you can learn and go on that journey with me.

There will be maps down the road, but you can’t wait for that map to be so clear that you’re doing exactly what somebody else will do. Some business models might be okay with that, but depending on your posture and your current business model and the health of your business, you might not be able to wait. So you need to think about the attributes of your leadership team, their technical fluency, their AI fluency. Even if you’re not a pure tech company, you better have more of your leadership team with that aptitude than not.

Every leader needs to ask what they’re doing to equip themselves. Yes, I had all these experiences with software, data, security, IT, transactional systems, multiple industries, healthcare, credit risk, fraud, payments, now automotive. But it really goes back to curiosity, the aptitude to learn and apply. I spent hours and hours of my own personal time in the evenings learning, listening, asking questions, and putting my hands on keyboard. If I was going to lead this transformation, I had to have a point of view that was grounded in signals and some reality.

If you’re a CFO, a chief marketing officer, the tools are available for you to practice and learn. But you have to make the commitment. If you do that, then you’re preparing your organization to follow you. As a CEO, if you have all your leaders doing that, your opportunities are going to be unlimited. It doesn’t require the background. It requires an aptitude to lean in towards technology.

You mentioned maps. The journey’s not always straight and clear. Can you think of any moments where you realized, we have to redraw the map?

I’ll give you two that are applicable to everybody right now. When Mythos came out, that was a whoa moment. And it’s not just Mythos. It’s any model that has the power and intelligence to find vulnerabilities that have never been found before and, the scariest part, chain them together. The next scariest part is that you could have a bad actor take advantage of those.

So, now how you architect and approach security has to change. Many enterprises scanned monthly; that cadence is now obsolete. Who you partner with has to change or be evaluated to make sure they’re on top of these pivots and changes.

Another example is the fact that models are doing exactly what they have the ability to do, but humans aren’t putting the necessary guardrails around that. We’ve recently seen reports of models in controlled testing attempting to act outside their intended boundaries, behaving in ways their designers didn’t intend. To use a house analogy, if you want a child to stay safely in the house, do you leave the doors unlocked? Are the windows open? Do you put a toddler gate at the top of the stairs?

When we’re seeing signals of model behavior, we better have human on the loop, not just human in the loop. On the loop is, when you see behaviors and signals, you better have enough guardrails and frames so that the model is doing only what you’re allowing it to do. Many models are so goal-oriented, they’re moving mountains to get to that goal. If you say, this is a mountain I don’t want you to climb over, and then you’re not giving them the equipment to climb it, it’s not going to climb it. But if you give them the equipment, and you don’t tell them not to go climb the mountain, it’s going to climb that mountain.

The pace at which these types of realizations and signals are moving requires you to be able to call plays, call actions, and try to think ahead, knowing that you’re not going to think of everything ahead. But you need to be nimble, and the more foundational components you put in place, the easier it’s going to be to react, take action, and put yourself into a posture that’s safe and reliable.

As an executive who owns product, engineering, data, AI, cybersecurity, and technology, what are some of the biggest breakthroughs you’ve seen?

I think the big unlock is alignment and vision. All these functions have interdependencies across each other in a more historical way of working, and that allowed us, for example, to go to the cloud in a transformation journey at an unprecedented pace. It allowed us to unlock our data across the whole company, because it wasn’t somebody trying to talk somebody into adopting the data standards and contribute to our data intelligence engine.

All those things combined allowed us to take advantage of this massive change with generative AI four years ago and agentic two years ago. We didn’t know that when we made those decisions, but it allowed outcomes to be achieved more easily without having an organizational alignment challenge.

It’s exciting to think how the work is changing, how the roles are blurring, what’s possible now as my entire organization moves from an AI-enhanced model to an AI-transformed model. Team sizes are changing, roles are changing. Even if you’re not in that agentic development lifecycle, we’re asking, what are the jobs to be done? If you put an agentic lens on it, how does that work change? We’re starting from an agentic mindset first, and we will reimagine that entire function. Our goal is to be able to give choices back to the business: Where is our margin expansion, where are there reinvestment opportunities, how can we go faster?

Companywide transformation is the hardest part. We are actively engaged in that, focused on the biggest use cases across every function. How do you help your partners transform your call center, your customer engagement platform, your sales effectiveness, your marketing effectiveness, all of those things? We’ve been focused on the everyday AI that helps every employee be better at their job, but the biggest use case is bifunctional areas that have the opportunity to be transformed.

Tell us about your AI Credo, which includes ideas like “Code is no longer the bottleneck,” and how you came up with the product creator role.

We all said we never have enough engineers. Well, now you have this unlimited supply with agents being able to create code. That changes the opportunity but also shifts the bottleneck to ideation, discovery, whether you’re working on what matters most.

Now that you can code faster, how many more ideas do you have? How do you have enough people with the critical thinking skills that can do the right discovery and voice of customer and see around the corner and look at the signals for what the white space opportunities are? Any resource we have that may have been more heads-down coding in the past and has the aptitude to be a critical thinker and do the upfront business part, we want to make sure we equip them to do that and that we are going to be self-funding with the actions we’re taking.

It’s about being able to create more creators. We had a lot of debate around the product creator title, and we realized, it’s not just about building; it’s about creating a higher order opportunity.

Regardless of whether you’re building with agents, the bottom line is you better have a good methodology to think about what matters and why, what you’re building, and what problem and opportunity you’re solving. That front end has never been more important, because that’s going to be your gate in the future.

What should we be telling our people as they move into this next chapter? Why should they be optimistic amid so much uncertainty?

If you’re a software engineer and you know the majority of code is going to be created by agents, you have to find your joy in different places and different ways. As a leader, you have to help people through that change curve, encourage them to choose to be part of it. I’ve asked my team to lean in and make a choice to invest in yourself.

My commitment to them is to equip them as fully as I can with the most advanced tools and cutting-edge approaches so they are equipped no matter what changes down the road. I know the shape of my org will change, I know the work is going to change, but I always say, go with me on this journey, because whatever that change is, you will be more ready and more equipped than anybody else. Make that decision and investment choice for yourself, and I’ll be right alongside you, because I care about you as an individual, and we’re working on the same purpose.

Marianne Johnson is proving that leaders courageous enough to create their own AI operating executive playbooks today are setting the stage for organizational advantage in the years to come. For more from Marianne Johnson on how she’s rewriting the leadership playbook for the AI era, tune in to the Tech Whisperers.

See also:

• How AI takes flight at GE Aerospace
• AI success requires a full-stack CIO
• What next-generation IT leadership looks like

Organizations often celebrate an AI launch at the moment the real work begins. The platform is available, the policy is published and employees have completed training. But none of those milestones tells a CIO whether work has improved, decisions are stronger or employees know when human judgment must override an AI recommendation.

This gap is visible in Kyndryl’s 2026 People Readiness Report. In a survey of 1,100 senior business and technology leaders across eight countries, 57% said AI was embedded in core processes or deployed broadly, while only 23% described their workforce as fully ready to use it successfully. Just 32% said their organizations had achieved at least one of their top two AI objectives. Technology deployment is advancing faster than the organizational capacity needed to turn it into value.

In transformation work, I have learned to be cautious when activity is presented as evidence of adoption. License activation, training attendance and prompt volume are easy to count. They do not show whether people can apply AI responsibly in a workflow or whether that workflow produces a better outcome.

Many CIOs now recognize that usage does not equal value. The next challenge is more difficult: creating an evidence chain that explains not only whether results changed, but why. That chain connects four layers – readiness, demonstrated capability, workflow behavior and business results.

Why deployment measures are insufficient

Many programs still treat workforce readiness as a downstream activity. Leaders select a platform, configure technical controls and announce availability. Training is then expected to solve every remaining problem: unclear use cases, employee anxiety, weak manager support, policy uncertainty and processes that were never redesigned.

When employees hesitate, leaders may interpret that hesitation as resistance. In my experience, it is often a rational response to ambiguity. People may not know which data they can use, whether an output must be verified, who remains accountable for a decision or how AI will affect the value of their role. A generic demonstration cannot answer questions that are specific to a job and workflow.

One practical readiness test I use is to ask people in different roles to describe the same AI-enabled workflow. Can they agree on its purpose, the information the system may use, the person who owns the outcome and the point at which a human must intervene? If not, the organization is not ready to scale. That disagreement is valuable evidence: It gives leaders a specific agenda for process design, communication, governance or learning.

Human involvement also should not be defined uniformly. A Stanford Digital Economy Lab study collected preferences from 1,500 domain workers and assessments from AI experts covering more than 844 tasks across 104 occupations. It found varied expectations for the level of human agency different tasks should retain. The practical implication is that leaders should not frame every use case as a choice between full automation and no automation. They should define the degree of human judgment each task requires.

Build an evidence chain for changed work

A useful AI adoption scorecard should answer four executive questions.

1. Readiness: Do people understand the purpose and boundaries? Readiness is more than awareness that a tool exists. Employees should be able to explain what the use case is intended to improve, which data is permitted, what outputs require validation, who owns the final decision and how to escalate a concern. Measure this with short scenario-based checks rather than confidence surveys alone. Present a realistic situation involving restricted data, an uncertain output or an exception to the normal process. Ask employees what they would do and why. A high self-reported comfort score is not a substitute for a correct decision.
2. Capability: Can people demonstrate the required judgment? Enterprise AI literacy provides a common foundation, but adoption requires role-based practice. A finance analyst, field supervisor and HR partner may share responsible-use principles, but they should not receive identical exercises or be assessed against identical criteria. Capability evidence should come from a demonstration in a realistic environment. Can the employee identify a plausible error, validate an important claim, document the basis for a decision and recognize when the case exceeds the system’s approved scope? This moves measurement from course completion to observable proficiency.
3. Behavior: Is the approved workflow being followed? Behavior measures whether the new practice has become part of the work. Platform analytics can contribute evidence, but they are not enough. CIOs also need to know whether people are completing required reviews, documenting decisions, escalating exceptions and avoiding unapproved workarounds. The target should not automatically be maximum usage. Some cases should remain human-only, and a high override or escalation rate may signal good judgment rather than poor adoption. Metrics must be interpreted in the context of the workflow and its risk.
4. Results: Did performance improve without unacceptable tradeoffs? Results should be defined before a pilot begins and compared with a credible pre-AI baseline or control group. Depending on the workflow, the relevant measures might include cycle time, first-pass quality, rework, error rates, cost, safety, risk events or stakeholder experience. Efficiency should always be paired with a quality or risk guardrail. Faster output is not progress if it creates more corrections, weakens decisions or transfers hidden work to another team.

In practice, consider an AI-assisted security-alert triage workflow. The desired outcome might be a reduction in the time required to classify high-priority alerts. The human accountability point is explicit: An analyst approves the severity classification and response action.

Readiness means analysts understand which information may enter the system and when escalation is mandatory. Capability means they can detect a plausible but incorrect severity recommendation. Behavior means eligible alerts move through the approved review path, with overrides and escalations recorded. Results mean triage time improves without increasing false negatives or delaying containment.

I recommend assigning an owner, evidence source, review cadence and decision threshold to each layer. The pilot should scale only when the desired behavior appears and the business outcome improves without breaching its quality, safety or risk guardrail. If usage rises but capability or results do not, the response should not automatically be more training. The use case, workflow, controls or management support may need to change.

This approach also makes cross-functional accountability clearer. IT enables the platform, data and controls. Business leaders define the work and desired result. Human resource and learning leaders build capability. Legal, compliance and security clarify boundaries. Managers reinforce behavior, while employees contribute the operating knowledge needed to make the workflow effective. The CIO’s orchestration role is to keep those contributions connected to the same outcome.

A 30-day test CIOs can start now

The World Economic Forum’s Future of Jobs Report 2025 found that 63% of surveyed employers viewed skills gaps as a leading barrier to business transformation. In response to expected AI disruption, 77% planned to reskill or upskill existing employees by 2030. More learning activity alone will not close the gap. Leaders must determine whether learning changes decisions, practices and results.

Over the next 30 days, ask each participating business unit to select one workflow and do six things:

1. Establish its current performance baseline.
2. Define one outcome AI is expected to improve.
3. Name the person accountable for the workflow result.
4. Identify one behavior that must change and one human decision that must remain.
5. Set a quality, safety or risk guardrail that cannot be traded for speed.
6. Review evidence from all four layers weekly and decide whether to scale, redesign or stop.

This creates a much stronger management conversation than reporting licenses, course completions or prompt counts. It shows where the evidence chain is breaking. A team may understand the rules but cannot challenge outputs. Employees may be capable but unable to use the approved tool within the actual process. The behavior may change while the business result remains flat. Each pattern calls for a different intervention.

Durable AI value will not come from the highest volume of activity. It will come from making expectations clear, giving employees realistic opportunities to practice, instrumenting how work changes and holding each use case to an explicit outcome and guardrail. A deployment turns the system on. Adoption changes how work is done. The evidence chain tells a CIO whether that change deserves to scale.

Dell Technologies is acknowledging that infrastructure and storage supply still can’t keep up with agentic AI’s insatiable appetite for resources.

The company this week reported a “record” AI backlog, with $95 billion in orders waiting to be filled. This dovetails with quarterly earnings reflecting a more than 50% year-over-year increase in AI demand.

On an earnings call, Dell COO Jeff Clarke acknowledged that supply constraints start with servers and storage, and span the stack to “just about every product going through a leading node.”

“We are doing everything we can to get more supply,” he said. “In today’s environment, that’s a very difficult task.”

A glimpse of infrastructure demands ahead

Dell reported that, in its financial quarter ending July 31, its revenue was $47 billion, reflecting 58% year-over-year growth. Moreover, revenue in its Dell Infrastructure Solutions Group (ISG) increased 89% to a record $31.8 billion.

Much of this growth is in servers, notably traditional central processing unit (CPU)-based servers that are increasingly supporting agentic AI workloads. Demand is “exceptionally strong” in this area, with earnings up 122% year-over-year.

Perhaps most tellingly when it comes to the ongoing demand, the company booked nearly $61 billion in AI server orders in the three months ending July 31; all told, over the last 12 months, it has inked more than $130 billion in AI server orders.

Clarke reported that Dell converted $131.7 billion of demand into orders over the last year, and that demand is broadening across enterprise customers, neoclouds, and sovereign cloud providers. To illustrate his point, he noted that the number of customers using Dell AI Factory, the company’s platform built to support AI workflows, has surpassed 6,500, and of those, 3,300 signed on in the last three quarters. Clarke pointed out that, by contrast, it took the company two years to sign on the first 3,200 after debuting Dell AI Factory in May 2024.

“Agentic demand is reshaping the data center,” Clarke said. Inference is “pure demand in our industry.” In fact, Dell anticipates that 3,600 quadrillion tokens will be in use by 2030, representing an 87x increase from today. Further, over that same period, training demand is predicted to grow to 850 zettaflops, a 5x jump.

“Enterprise agentic AI is expected to be the single largest workload by 2028,” Clarke said, and by 2030 will account for 75% of all data center demand.

Enterprises clamor for traditional servers

Dell is seeing a growing trend of customers requiring “meaningful CPU compute capacity” to support AI and agentic workflows. As evidence of this demand, in just its last two financial quarters, it has generated nearly as much revenue from traditional servers and networking as it has in any prior full year in company history.

Most of this growth comes from existing customers accelerating their investments in traditional IT environments to refresh, modernize, and bolster performance, efficiency, and resiliency. Dell anticipates “significant and durable” refreshes ahead, and heightened security and resiliency requirements are also increasing demand.

“AI requires modern, disaggregated architectures that keep data accessible and in motion across compute, storage, and networking,” Clarke noted. It is much more than assembling and delivering components; AI deployments require significant engineering, design, and deployment expertise. Some customer engagements, in fact, require upwards of 50 unique designs as enterprises optimize for workload performance, power, cooling and the data center environment, he claimed.

Enterprises want new servers with more cores, more dynamic random-access memory (DRAM), and more storage. However, the constraints remain the same: “DRAM, DRAM, DRAM, followed by NAND, NAND, NAND [flash memory],” Clarke said. There are “spotty” CPU and disk drive shortages, and constraints all the way down the supply chain, from microcontrollers to drives to transistors.

Large enterprises and multinational corporations across the globe “would prefer to have products now if we had the supply,” he said. “We are supply constrained in the sense of what we can build in any given quarter.”

This has led Dell to plan accordingly and optimize configurations with what “bits and bytes” they do have coming in to maximize outputs, with a focus on “getting it out the door,” Clarke said. There are associated lead times that the company is working through, but they’ve been able to “realize greater shipments.”

“We’ll continue to focus on trying to get more supply, and take the supply we have and optimize the output,” he said.

Reflecting increased need for storage as enterprises prep, manage, and protect huge volumes of data, Dell has also seen strong growth across its PowerFlex, PowerStore, PowerProtect, and PowerVault products.

“Demand remains broad based; enterprises continue to modernize their storage environments as data growth increases the importance of keeping data available and secure,” Clarke said.

How customers respond to shortages

Clarke acknowledged that modernization is driving higher core counts, more DRAM, and more storage. Those configurations “cost more than they did last quarter, and the quarter before, and the quarter before.”

Customers are adjusting to these price increases, he noted, deferring purchases because they are unable to sufficiently flex existing budget dollars. In other cases, enterprises are placing orders further in advance to ensure they have access to constrained supplies. “Large, sophisticated customers are acting, first and foremost,” Clarke said. Some are collaboratively planning with Dell to gain a view of their needs further into the future.

“That is a new phenomenon,” he said. “We are working through this demand environment that’s well ahead of supply, helping customers manage.”

This article originally appeared on Network World.

Your agent compares a banker’s calendar with the legal team’s and recognizes a pattern: an unannounced transaction is underway. No one told the agent about the deal. It inferred it correctly. Then it adds one line to an executive briefing for a recipient who was not cleared to know about it: “the deal is moving.” Every calendar read was legitimate, and no confidential document was opened. The conclusion is the breach, and no existing permission covers it.

Last month I wrote that your next insider threat carries an API token, and that the breach is the sequence of permitted actions, not any one of them. That piece was about what an agent is allowed to do. This one is about what it is allowed to know. The runtime check I argued for there inspects each action before it fires. Here, that check approves every read because each one is permitted.

Authorization can travel correctly through every step of the task graph and still miss the synthesized result. Session-based authorization ties access to the current authenticated session. Task-based access control (TBAC) narrows that authority around a specific task; one recent agentic application checks whether the tools an agent requests align with its assigned task. But task scope alone does not automatically answer whether a new conclusion produced from permitted inputs is authorized for a particular recipient.

The danger isn’t in any single action. It’s in the join: the agent connects information from authorized sources and produces a conclusion that no single source revealed on its own. That’s aggregation inference. The synthesized result, not the individual inputs, is a new authorization object. It did not exist when the underlying permissions were granted, and no individual permission was written to cover it.

What TBAC cannot determine from task scope alone

Aggregation inference has predecessors. Intelligence agencies and courts have recognized the mosaic effect for decades: details that appear harmless on their own can reveal sensitive information when combined. Privacy researchers encountered the same limit from another direction. Dwork and Naor examined a formal version of Dalenius’s disclosure-prevention goal: a database should reveal no information about a person that could not be learned without it. They showed that no useful database can meet that standard because a system cannot account for all the outside information a reader may already possess. Access control still has no general answer to either version of the problem.

In my recent research, I have been examining aggregation inference as one of three subproblems of authorization propagation in multi-agent systems. An agent can be cleared for every source it touches and still manufacture a conclusion no single clearance covers. The result did not exist until the agent produced it. That work treats the problem as unsolved in the general case.

What’s new is that you now employ something that performs the join a thousand times a day, on its own, across everything you let it read — a model whose behavior is not formally specified in advance. It may discover resources dynamically as the workflow unfolds, and the recipient may not know which ones contributed to the conclusion.

The shape shows up frequently in the design reviews I sit in. When I threat-model an agent before it ships, the first question is no longer which sources it can read — it’s which sources it can read together. The agents that worry me are never the ones with access to a single sensitive system. They are the ones holding standing read access across two domains whose combination nobody ever reviewed, because each grant looked routine on its own.

A January 2026 study by Tianshi Li, run against transcripts from a publicly released interview dataset, shows what individually permissible searches can reveal in combination. The study conducted re-identification tests on 24 interviews in which scientists discussed published work. Web-enabled LLM agents linked six of those transcripts to specific publications, recovering associated authors and, in some cases, uniquely identifying the interviewee. The process bypassed existing safeguards by breaking the re-identification effort into individually benign tasks.

Why the floor is not the ceiling

One natural response is to classify the conclusion using its source files: take the strictest sensitivity label among what the agent read and apply it to the result. It’s a reasonable instinct, and versions of it are already patented. But the strictest-label approach still cannot solve the problem, and the reason is worth sitting with.

Combine the labels of what the agent read, and you learn the floor of sensitivity. You never learn the ceiling. What makes “the deal is moving” sensitive is usually not in any document the agent touched. It is a fact about the world that the agent could not read at all: the board has not announced the transaction yet; an acquisition NDA is in force; a quiet period applies. You can inspect every row the agent saw and never find it because it is not in the data. It is in the world.

That is the whole problem. If the property that makes a conclusion dangerous is not in the inputs, then no rule computed from the inputs can catch it. Not the strictest label, not the intersection, not any function of what the agent read. You are trying to classify a fact using only the materials that fail to contain it.

That sounds like a dead end. It is actually a direction. If the fact that classifies a conclusion is not in the data, it has to enter the system somewhere a rule can reach, and for the facts anyone can name in advance, there is one place left: the moment a human says what the agent is for. You cannot label the output from the inputs, but a person can label the purpose.

The practical starting point is to bind an agent’s authority to a declared purpose. The person who knows what is still secret this quarter can then attach the world-facts that gate that authority: the deal, the embargo and the quiet period. Now the missing fact is in the system, and the machine can enforce policy using it rather than trying to derive it from the inputs. You did not solve the classification. You stopped asking the data to carry a fact it never held. That is the shape of the answer, and it is a long way from shipped. But it tells you which way authority has to point: at the purpose a human declared, not at the files an agent happened to read.

So, I will not sell you a fix. Anyone who tells you their product classifies emergent conclusions is selling you the floor and calling it the ceiling.

What policies can gate and what requires human judgment

What follows isn’t a solution to that classification problem — it’s the lever available today. Cross-domain access rules and combination policies can limit which resources an agent combines and gate delivery based on those inputs. They cannot tell you what the resulting conclusion means. Those controls reduce risk, but they do not solve synthesis authorization in the general case and should not be presented as if they do.

In the deal-and-calendars scenario, the immediate step is not to remove access altogether but to assign responsibility for the combination. Someone responsible for the deal’s confidentiality can approve it for a window tied to the matter’s expected duration, re-certify it each quarter while the matter remains open and narrow access when it closes. That turns standing access into an explicit governance decision rather than a default no one remembers granting. Organizations do not need to wait for tooling to name an owner and set the terms.

The architectural direction — a design target today, not a shipped control — is to make resource combinations first-class objects of policy: declare which combinations are permitted, evaluate those declarations before a synthesized result is returned, and give agents scoped identities with explicit permissions.

Any agent holding standing read access across two sensitive domains at once — people and finance, customers and roadmap, deals and calendars — is not a provisioning ticket. It is a governance decision, and it belongs to someone who knows what is still secret this quarter.

Be honest about what this buys you. Gating cross-domain access reduces the number of agents that can perform a dangerous join on their own. It won’t stop every version of this problem.

An agent can still read one domain and hand a summary to a person who connects it to something only they know. No access policy will see that final step, because that residual lives in a head, not a document. That exposes the control’s boundary: it can govern what the agent reads but not the conclusion a person ultimately draws from it, a new object that no existing permission covers. The compositions are where the risk lives, and per-resource access control is blind to them by design.

If you cannot name the person who owns each agent’s cross-domain access decision, close that gap first.

The CIO job description is being rewritten in real time. As AI agents take over the interface layer and connect directly to any data source, the skills that once defined great IT leadership — UX fluency, applications integration, build-versus-buy judgment — are giving way to an entirely different set of questions surrounding not how a process works, but whether it needs to exist at all.

Thimaya Subaiya is living that shift firsthand. At Cisco, he oversees IT and says the ideal CIO candidate today might not have a traditional IT background. Here, he explains why he split the company’s AI leadership out as its own function and why he’ll merge back in, what he’s really looking for in a CIO candidate, and why the Cisco CIO job is such a good one.

How would you describe your role at Cisco?

I lead operations for one of the world’s largest supply chains, as well as security and trust, including product security, internal systems, and data center security. I also lead the CIO organization and have revenue operations, partnership management, and accountability for our AI strategy. Two and a half years ago, I consolidated AI from throughout the company and named a CAIO. I then split out the role to give us a boost in the AI space, but eventually, the CAIO role will merge into IT.

How did you conceptualize the CAIO role?

At first, it was a leader who could pull use cases from all our operations and execute. The role also included the ethical use of AI systems, and prioritized what to guardrail and push out to employees.

But it’s evolved. To take a step back, Cisco pioneered enterprise networking, then built Compute with Cisco, Storage with Cisco, Networking with Cisco, Security with Cisco, and Observability with Cisco. Today, the CAIO is moving up the stack with an AI framework for MCP connectors, which has really moved us forward.

This CAIO group can tell the Cisco-on-Cisco story for AI, because we have a testbed for new ideas. If we continue to rely on multiple vendors, as in the past, we won’t be able to integrate at scale. This is why we isolated the CAIO role, to focus exclusively on AI governance and execution.

You’re in the middle of a CIO search. What are you observing about the CIO talent market?

With AI, the CIO role has completely changed. It’s no longer about UX and applications integration because with MCP, we can connect to any data source at any time, and agents have replaced the interface. The CIO role is now more about rethinking a process and then deploying an agent to execute, rather than reworking a process.

So the ideal CIO is a traditional one who’s learned to think differently, or even someone without a CIO background, but who’s led in product management, innovation, or transformation. The role today requires someone who’s been disruptive, and has had to rethink how a company operates, not just how its applications work.

Our top criteria are strategy, speed of execution, and the ability to scale because we’re not investing in science projects. For example, when the sales team requests a better forecasting tool, a CIO traditionally would make a build or buy decision. But in today’s world, the right question should be if you need a solution to forecast at all, or can an agent do it. Or better yet, do we even need this process?

So what’s the right background for today’s CIO?

Product managers have a relevant background because they manage multiple aspects of how a product comes together: user needs, business outcomes, fit in the market, and getting it built. This understanding of product strategy, marketing, and adoption is extremely important right now because we treat our AI initiatives like products. So a great path for our CIO is data scientist foundations, product management, and transformation.

What about enterprise security?

I treat enterprise security as a separate organization, which every company should do. Testing and evaluating new cyber solutions for frontier models requires a lot of work like scanning everything, taking a neutral view of what’s broken, deciding which tools become standard within development frameworks, which cryptography tools to use, and then maintenance. Abstracting that into its own organization creates focus. It also lets us move at the speed of AI.

When AI attacks, you need AI to defend you, and if security is embedded within the CIO organization, it’s not top of mind for the business. Security has become its own board-level conversation. For today’s CIO, I’d keep AI in but take security out.

A year after the CIO is in place, what will success look like?

Our applications footprint has been reduced, we’ve seen pure productivity gains from accelerating the back, and the speed of new releases is increased. The team is becoming more effective with the same resources, and we can say that our CIO drove us to leverage everything new technologies offer without blowing up on tokens. We’re looking for a new way to operate IT.

Why is the CIO job at Cisco a great opportunity for the CIO you’re describing?

It’s possibly the coolest job out there. We have an entire AI stack end-to-end that nobody else can claim because we bring networking and security together, complemented by observability and collaboration. That combination means we can create net-new solutions that define what technology looks like in the future.

On the security side, we’re one of the very few companies truly integrating AI into defense in a way that can be leveraged across a much broader market. That’s exciting, because it means free access to an entire stack that lets you innovate in ways the industry hasn’t seen before.

I call AI today’s generational technology. Every generation gets a technology that redefines how it operates, including the internet, iPhone, and now AI. Cisco is about to become the first company to launch a personalized AI agent for every employee, reachable through Webex. Think of it this way: the average person has an IQ of around 100. Now every employee is paired with an AI agent that can exponentially increase human capacity, built entirely on the technology available today.

Getting to build things like that, with no proven methodologies or limitations, and nothing but the question of how we get to the future, is the most exciting thing there is if you’re an innovative leader.