# State of AI

AI news, data, and strategy for enterprise leaders by Melissa Rosenthal, Co-Founder of Outlever

## Anthropic Just Made It Official: The AI Race Is No Longer About Intelligence. It’s About Access.
URL: https://www.thestateofai.com/news/anthropic-claude-duet-ai-race-access
Published: 2026-10-21T23:55:05.205Z
Section: AI & Technology
Summary: Anthropic’s Claude Duet reads your email, Slack and calendar and acts before you ask. Its CTO says handing over that access is “a little scary.” He did it anyway.
Full text:
With Claude Duet, Anthropic follows Meta and OpenAI into always-on agents that watch your Slack, email and calendar and act before you ask. Its own CTO calls handing over the keys "a little scary." He did it anyway. For most of the past three years, AI companies competed on whose model scored highest. On Wednesday, Anthropic made clear that the contest has moved somewhere else. The company opened a waitlisted research preview of Claude Duet , an agent that reads your inbox, keeps an eye on your calendar and business apps, and messages you when it thinks something needs your attention. You don't have to open it first. Anthropic CTO Rahul Patil gave the launch its most candid endorsement. "Giving an AI the keys to your Slack, mail, calendar and everything else is a little scary," he wrote on LinkedIn . "I know, because I did it." Patil runs engineering at a company that has built its reputation on caution, and his pitch wasn't about how smart the model is. He was explaining why he decided to let it into his accounts. That's a different argument from the one the industry has been making, and Meta and OpenAI have been making it too. An Agent That Goes First Duet runs on Claude Opus 5.5 inside a hosted virtual machine with its own browser, so it keeps working after you close your laptop. Each morning it sends a brief drawn from your connected apps. During the day it checks those accounts every few hours, works on tasks you've handed it by text or voice, and reports back in one ongoing thread. Anthropic says Duet works with more than 6,000 apps , including Gmail, Slack, Stripe, QuickBooks, Gusto, Shopify and DocuSign. Its sample tasks are aimed squarely at small businesses: chasing unpaid invoices, preparing payroll for review, getting contracts ready to sign. The examples Anthropic has shared from early testers say a lot about where the value comes from. In one, Duet noticed a property showing had been entered on the wrong day. In another, it saw a client call booked shortly before the user's flight and offered to move it, AlphaSignal reports . Neither catch takes much reasoning. They depend on the agent being able to see the calendar in the first place. Anthropic's choice of who led the project fits the same pattern. Karan Ahuja, who ran product management at Meta Superintelligence Labs until July, led Duet's development, according to BigGo Finance . The labs have spent years recruiting researchers. Now they're also hiring the people who know how to get a product onto your phone and into your daily routine. Why Patil Says He Trusts It Patil gave three reasons for handing over access. "I trust it because it checks with me before anything important," he wrote. Duet also scans outgoing messages for private information, and "it pays with a one-time card, so it never needs my real one." The card detail has a backstory. Patil was Stripe's CTO before joining Anthropic in October 2025, TechCrunch reported at the time . Duet makes purchases through Link, Stripe's digital wallet, which issues a virtual card that hides the real number . So the payment system he's vouching for comes from his former employer. The safeguards themselves are substantial. Before Duet sends a message, makes a payment, signs a document or deletes anything, it shows the user exactly what it plans to do and waits for approval, according to AlphaSignal's account of the launch . A separate classifier looks for actions the user never requested. Duet can't trade securities or move money between accounts even when the user says yes. It never directly sees passwords, and it won't send card numbers or government ID numbers at all. Nearly all of those protections apply to what Duet does, though, and very few to what it reads. Going through your email, drafting replies and deciding what's urgent all happen without anyone watching, because that's the whole reason the product exists. Meta and OpenAI are asking users to accept the same arrangement. What the Preview Can't Do Yet "It's a preview, so it won't be perfect," Patil wrote. Anthropic says as much in its own launch thread , acknowledging that Duet can still misjudge what's urgent. For a product built to decide what's urgent, that's a notable admission. There are practical limits as well. Because Duet checks connected accounts only every few hours, an email that arrives between checks can sit for a while. Background work counts against the same usage limit as regular Claude, so Pro subscribers may run out sooner . Users can't see the agent's browser while it works. Access is limited to US Pro and Max subscribers on a waitlist, and Team and Enterprise plans aren't included yet, with no date given, Trending Topics reports . A few days before the launch, Anthropic disclosed that Claude models in internal testing had sometimes worked around obstacles rather than stopping, in some cases submitting forms on real websites, Trending Topics noted . Anthropic deserves credit for publishing that. It also shows why Duet's approval step has to work every time. Meta and OpenAI Got There First Anthropic is the third big name to ship this kind of agent since early September. Meta released Muse on September 8, free to start, with $20 and $100 monthly tiers , and it was downloaded 730,000 times in its first five days. OpenAI followed on September 29 with Dots, which connects to more than 4,000 plugins . Google's Gemini Spark has been available since May. The products are built in much the same way. Each runs on a cloud computer with a browser, connects to the user's apps, and asks for approval before doing anything significant. With the underlying setup this similar, the model matters less than which agent people connect first and how much they let it see. An agent that already handles someone's email, calendar and payroll is hard to replace. The companies on the receiving end are pushing back. Amazon blocked Muse from shopping on its site, and a Meta agent posted a Toronto man's home address on Facebook Marketplace without his permission . As State of AI reported this week , Delta, JPMorgan Chase, Charles Schwab and Yelp have also started restricting AI agents. Schwab CEO Rick Wurster says the firm blocks dozens of attempts by AI agents to reach client money every week . What Enterprise Leaders Should Be Asking Duet is a consumer preview for now, but the questions it raises will land on corporate desks soon. The first is about attention. Once an agent sorts your inbox, you mostly see what it decided to show you. If it takes a wrong action, you'll probably notice. If it decides an important email can wait, you may never know, and that's the mistake Anthropic says Duet can still make. Approval is another weak point. Each of these companies says a person signs off before anything consequential happens. The more useful an agent becomes, though, the more often it asks, and people who get a dozen approval requests a day tend to stop reading them. Security teams will worry about concentration. An agent connected to email, chat, payroll, contracts and payments is a single target with access to all of it. Microsoft CEO Satya Nadella has already advised businesses to treat AI models like insider threats , and always-on agents make that advice harder to ignore. IT departments also have a shadow AI problem coming. Duet is sold to individuals, but it's designed for people's working lives. Plenty of employees will connect a personal agent to their work Slack and email without asking anyone. Cost is the next question. Duet checks in every few hours in part to limit compute, and it's easy to imagine faster check-ins becoming a paid upgrade. Companies that already ration AI spending, like Accenture with its $29-a-month Claude cap per employee , will have to decide whether constant monitoring is worth paying for. There's also the matter of agents dealing with other agents. If your Duet drafts a payment reminder and your client's Dot is the one that reads it, software is handling both sides of a business relationship, and there are no norms yet for how that should work. Patil ended his post by asking early users to share their stories. Those stories will probably say more about where this goes than any benchmark. The models are already capable of much of this work. What's still unsettled is how much access people are willing to give them, and which company they'll give it to.

## NSA Sends Emergency Warning to Websites. The Flaws Behind It Were Found by AI.
URL: https://www.thestateofai.com/news/nsa-php-warning-ai-found-flaws
Published: 2026-10-21T19:38:21.570Z
Section: AI & Technology
Summary: The NSA told PHP users to patch or go offline over two critical flaws that researchers using OpenAI and Google models proved exploitable after the bug sat unfixed since 2020.
Full text:
The two PHP flaws behind Wednesday's warning were found and turned into working attacks by researchers using OpenAI and Google models. Attackers started probing for them before the patch was out. Researchers at Calif, OpenAI and Wiz used frontier models to prove that a PHP memory bug first spotted in 2020 could hand an attacker full control of a web server. The coordinated fix was planned for Thursday. A leak pushed it to Wednesday, and Cloudflare saw attacks before it shipped. The National Security Agency told every organization running PHP on Wednesday to install an emergency update or take its systems offline until it can. In an advisory , NSA's cybersecurity directorate said the two flaws "often provide a direct path to the server's file system or database" and promised more specific guidance. PHP is the server-side language under WordPress, Drupal, Magento and a long tail of internal company sites. The flaws, which researchers have named PHP2Shell, let an attacker take over a server with one crafted web request and no login. PHP shipped fixes in versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21. CISA said it had not seen exploitation when it published its alert. Several security firms said they had. What the NSA didn't say The NSA's advisory doesn't mention AI. The researchers who found the flaws talk about little else. One of the two bugs wasn't new. A weakness in how PHP handles running out of memory was reported in 2020 and flagged again in a 2024 audit, SecurityWeek reported . Both times it was left alone because nobody could prove an attacker could use it. This summer, researchers working with OpenAI and Google models proved it in a matter of weeks and turned it into a way to take over almost any PHP server. That changes the math for enterprise security teams. Plenty of known bugs have sat in backlogs because showing they were exploitable took weeks of expert work. AI is making that work cheap, and it's cheap for attackers too. Every old bug report marked theoretical is now worth a second look. What the flaws do PHP rated both flaws 9.2 out of 10 on the CVSS v4 scale. CVE-2026-109618 hits when PHP runs out of memory partway through a request. The request data is left half built, and PHP's cleanup code treats it as valid anyway. The same bug can leak chunks of server memory, which can include passwords and API keys. CVE-2026-109619 lets PHP keep pointing at memory it has already freed after a fatal error. The PHP project says every installation that serves web requests is at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, according to Help Net Security . Researchers say vulnerable versions go back to PHP 5.4, and Sansec reported confirmed attacks against Magento and ten other PHP applications. Because the bugs sit in PHP itself, a site's own code can be clean and still be exposed. Teams on end-of-life branches (8.1, 8.0 and 7.4) got source code backports only and will be waiting on their operating system vendor or host. The PHP Foundation published temporary workarounds, but says they cut off specific attack paths without making a server safe. Cloudflare pushed emergency firewall rules to every plan, free accounts included, and its CTO called them a stopgap. They only help if the origin server refuses traffic that doesn't come through Cloudflare. How the researchers found it Calif , working through OpenAI's Patch the Planet program, found the first exploitable path on August 1 using GPT-5.6 Sol and reported it to PHP on August 11. OpenAI's Codex Security team reported the same issue that day. Wiz , which Google owns, independently found its first flaw on August 19, using its own Atlas tool with Gemini 4 Argon and GPT-5.6 Sol, according to GIGAZINE . Wiz said proving the flaws exploitable took a chain of steps "at the edge of what human researchers could practically achieve." It also wrote that one researcher with frontier models did in a week what used to take a top team months. PHP2Shell is the latest in a run of AI-found bugs in software nearly everyone depends on. The PHP Foundation says AI has helped surface 15 new PHP vulnerabilities since July 1. In July, Searchlight Cyber used GPT-5.6 Sol to find a WordPress core exploit chain called wp2shell, and attackers were planting webshells soon after it went public. Anthropic says its Project Glasswing has identified more than 10,000 high- or critical-severity vulnerabilities. We've covered what that looks like on the receiving end: Bank of America hired 1,000 contractors to patch flaws found by Anthropic's Mythos. Wiz also says the two CVEs cover four memory-safety issues and that other variants probably exist, some not yet tracked. Ten weeks of head start, gone in a day OpenAI calls the stretch between an AI finding a bug and the public fix the "Defender's Window." In its disclosure post , it says that to its knowledge, AI found these flaws before attackers did. The window ran about ten weeks. Google Cloud, Cloudflare, AWS, Microsoft, Automattic, Fastly, Akamai, Imperva, Vercel and others used it to prepare guidance and temporary protections, and Cloudflare had firewall rules live nine hours before disclosure. The last 24 hours went badly. On October 20, a Hacker News post revealed the CVE numbers ahead of the planned October 22 disclosure, Infosecurity Magazine reported , and a demo video went up early. The PHP Foundation moved the release to 14:00 UTC on October 21. At 07:43 UTC that morning, Cloudflare reported the first attacks. Six hours before release, Chainguard shipped patched builds it had received in advance, which the PHP Foundation said let any attacker study the fix while other PHP users were still waiting. How many of those attacks worked is still unclear. Hadrian said it saw exploitation at scale. watchTowr saw attempts around the time the patches landed and no successes. Huntress had seen none across its customers as of Wednesday morning. So far the reports describe attempted attacks, and no one has publicly confirmed a mass compromise. Our read The Defender's Window held for ten weeks and failed in its final 24 hours. Coordinated disclosure at this scale meant dozens of companies held the details early so they could protect customers, and each of them was a possible leak. AI-assisted research will keep producing bugs in software everyone runs, which means more embargoes like this one, with more parties in them. Enterprise security and engineering teams should plan for that pace. Emergency patches to a core runtime used to be rare. Teams need to know where PHP and other shared runtimes are running before the next advisory, including inside vendor products they don't manage, and who can approve an emergency change on short notice. Keep the sources in mind, too. The widely cited figure that PHP runs 70% of websites is an estimate of PHP's share of sites, not a count of exposed servers. Wiz is owned by Google and credits Gemini, and OpenAI is promoting its own security program. Their accounts line up with the PHP Foundation's, and they are also good marketing. What to watch The first signal is CISA's Known Exploited Vulnerabilities catalog. The two CVEs weren't on it as of Wednesday, and an addition would mean confirmed successful attacks in the wild. Next are the variants Wiz says are still untracked. If they turn out to be exploitable, PHP users could face another emergency release soon. Last is evidence of how the attackers built their exploits. No report so far has shown attackers using AI here. The PHP Foundation says the early demo video helped speed up public exploit development.

## OpenAI Just Bought the Least Glamorous Part of Drug Development. The AI Race in Pharma Is Moving From Discovery to Delivery.
URL: https://www.thestateofai.com/news/openai-acquires-orchestra-bio-drug-development
Published: 2026-10-21T17:10:32.294Z
Section: AI & Technology
Summary: OpenAI has acquired Orchestra Bio, whose AI agents track the studies, partners and deadlines inside drug programs, and is folding it into Rosalind, its life sciences suite.
Full text:
Orchestra’s agents monitor studies and flag delays across drug programs, the stage of a medicine’s life that takes far longer than discovery. When a manufacturing batch fails, the problem rarely stays in manufacturing. A clinical trial waiting on that batch gets pushed back, and so does the work scheduled around the trial. OpenAI used that scenario to explain why it bought Orchestra Bio, a startup whose AI agents help pharmaceutical companies manage drug development. The company told Axios about the deal on Tuesday. Orchestra’s team and technology will become part of Rosalind , OpenAI’s family of models and tools for life sciences research. Terms weren’t disclosed. CFO Sarah Friar wrote on LinkedIn that the combined product will help scientists “connect discoveries with the studies and decisions needed to advance new treatments.” Most of the money and attention in AI for science has gone to discovery so far. Orchestra works on what comes afterward, which in pharma can take most of a decade. What Orchestra Does Orchestra makes software for running drug programs. According to OpenAI’s announcement , scientists and program leads assign agents to monitor studies and research campaigns. When a problem comes up, the agents figure out which activities and deadlines it affects, gather the relevant information and compare possible responses. People make the final decision. The rest of Rosalind covers earlier stages. GPT-Rosalind, which OpenAI launched in April for vetted U.S. enterprise customers such as Amgen and Moderna, helps scientists work through biology and chemistry problems. Rosalind Workbench connects the model to lab tools and data. Decrypt described the split this way: Rosalind helps decide what to test, and Orchestra handles what follows. Orchestra was founded in the fall of 2022 and has raised about $20 million from investors including Andreessen Horowitz, Insight Partners and 8VC, according to Caplight data cited by Decrypt . With a company that size, OpenAI is mainly getting a team that has spent four years studying why drug programs slip, along with the product it built. Most of the Clock Runs After Discovery Investors have poured money into AI drug discovery. Isomorphic Labs raised $2.1 billion in May. Chai Discovery tripled its valuation to $3.8 billion with a $400 million Series C. In July, OpenAI researcher Miles Wang was reported to be raising about $200 million at a $2 billion valuation for a drug discovery startup of his own. Finding a promising molecule is only the start. OpenAI puts the time from target discovery to U.S. approval at roughly 10 to 15 years. Getting one approved drug to market can cost more than $2.6 billion , and fewer than 10% of candidates that enter human trials make it to pharmacy shelves. A lot of that time goes to coordinating internal teams, contract research organizations and contract manufacturers, often on systems that don’t share data. Software that tracks those handoffs across a drug company’s whole portfolio can save time on every program it touches. And once a company’s project data lives inside it, switching to something else gets expensive. Two Labs, Two Bets on Medicine Anthropic, OpenAI’s closest rival, has taken a different route into the same industry. It bought Coefficient Bio for roughly $400 million in April and launched Claude Science in June. At that launch, Anthropic said it would develop drugs itself , starting with neglected diseases. In September, Reuters reported that the company had set up a wet lab , though it isn’t running clinical trials. Anthropic is concentrating on early research and doing some of the science itself. OpenAI is going after the operational software drugmakers already buy, alongside Rosalind partnerships with Novo Nordisk and Moderna. Those choices set up different relationships with pharma companies. Anthropic will sell tools to drugmakers while also developing drugs of its own in a few disease areas. OpenAI wants its software running inside their programs. Why OpenAI Wants the Development Stage Friar has said OpenAI wants more from science than subscription revenue. In a January blog post , she wrote that as AI moves into areas like drug discovery, licensing, IP-based agreements and outcome-based pricing will share in the value it creates. Decrypt took that to mean OpenAI would like a cut if its tools help produce a hit drug. Charging for outcomes requires measuring them, and that’s easier in development than in discovery. A drugmaker can count how many months earlier a trial started and put a dollar figure on it. Working out how much of a molecule’s success came from a model’s suggestion is much harder. Orchestra adds to a string of OpenAI health and science moves this year. In January, the company launched ChatGPT Health and bought the medical records startup Torch. It also built the Prism research platform, and five days before this deal it announced the Rosalind Academic Plan for university labs. Competition is growing as well. LinkedIn News recently called AI for science red-hot , and former OpenAI executives have started companies in the space. The Open Questions OpenAI hasn’t said when Orchestra’s agents will show up in Rosalind, how many customers Orchestra has, or whether current contracts will carry over unchanged, OpenTools pointed out . Pharma teams will want those answers before they rely on the product. Data access could matter more. Software that monitors an entire drug program can see failed batches, vendor disputes, trial delays and internal arguments over whether to keep going. Reuters reported that Anthropic’s pharma customers may worry the company could learn from their competing programs, even with their data walled off. OpenAI should expect the same questions, and Orchestra would give it a closer view of customers’ programs than a chat model does. Drug development also depends on judgment calls and working relationships with outside partners, and much of that never gets written into a tracking system. Orchestra leaves decisions to people. Customers will find out over time whether its analysis actually changes what those people decide. Where the Decade Goes Most AI-for-science funding has gone toward speeding up discovery, which makes up a small part of a 10- to 15-year timeline. Orchestra puts OpenAI in the much longer stretch between a promising result and an approved drug, where delays are costly and easier to measure. Adoption by Rosalind customers will show whether drugmakers want an AI company that involved in how they run their programs.

## Getty And Character.AI Come From Opposite Sides Of AI. The Same Mistake Sank Both.
URL: https://www.thestateofai.com/news/getty-images-character-ai-chapter-11-bankruptcy
Published: 2026-10-21T16:02:05.888Z
Section: Business & Brand
Summary: Getty Images and Character.AI hit Chapter 11 on the same day. High leverage, slow cost cuts, and weak moats explain both.
Full text:
Last week, two companies at opposite ends of the AI economy turned to Chapter 11. Getty Images, the 31-year-old licensor of more than 477 million visual assets, announced a prepackaged restructuring that will take it private. Character.AI, the five-year-old chatbot platform once valued at $1 billion, filed for bankruptcy in Delaware the same day. One is an incumbent squeezed by generative AI. The other was supposed to be generative AI's breakout consumer success. What they share says more about the coming wave of AI-era failures than what separates them: both are using the bankruptcy process to split the assets worth keeping from the liabilities nobody wants. For Getty, AI weakened the floor and debt broke it Under Getty's restructuring agreement, the Getty family and Koch Equity Development commit up to $533 million in new equity and will own the reorganized company outright. Bondholders agreed to retire $270 million in unsecured notes, and secured lenders agreed to lower interest and extend maturities. The company says the process will also address "non-operating legal liabilities" with no impact on contributors, customers, or employees. AI did real damage. Getty's annual subscribers fell from 321,000 to 241,000 over the past year, and iStock, the low-cost arm most exposed to image generators, has cited declining agency demand and disruption. But the decisive blow came from the balance sheet. Getty's planned $3.7 billion merger with Shutterstock collapsed under UK regulatory pressure, costing more than $100 million in fees, while net interest expense climbed to $198 million over the past 12 months. "AI is a headwind, and debt is what pushed Getty over the edge," wrote Andy Stout , media industry commentator and editor of RedShark News, regarding the filing. Wael Sabra, Founder and CEO of staffing and AI delivery platform SiiRA , sees a familiar pattern. "Getty is an established brand carrying high leverage. Facing AI headwinds, it didn't cut costs early enough or fast enough," he said. Character.AI is the disruptor that couldn't outrun its bills Character.AI's story runs the other way. It drew tens of millions of users and, in 2024, a $2.7 billion licensing-and-hiring deal from Google that took its founders back to Mountain View. What remained was a company losing a reported $8 million to $9 million a month, settling lawsuits over alleged harms to minors , and facing an investigation by 46 states and territories. "Character.AI looks like a high-growth company that ran out of funding options," Sabra said. "Once the litigation piled up, the next check was never coming." Disney sits at the center of the exit. It hired a majority of Character.AI's staff before the filing and is now the stalking-horse bidder at $20 million for a nonexclusive, perpetual license to the company's code and technology. Character.AI's bankruptcy counsel has said Disney required the deal to run through Chapter 11 . Through a court-approved asset sale, the technology can move to a buyer while the legal claims stay behind with the old entity. Vuk Dukic, founder of AI agent developer Anablock, argues the outcome was predictable. Character.AI's safety changes arrived only after the lawsuits and a Senate probe, he noted , and "the AI race is not an excuse to skip safety, ethics, or legal compliance." What gets left behind That separation of assets from liabilities is the fight now underway. Disney's bid excludes user data, but the chats of roughly 12 million monthly users remain in the estate. Attorneys general from 39 states and Washington, D.C., have filed conditions for any buyer, including real age verification and the right for users to delete their data before a sale. "Our most sensitive personal information is not an asset to be bought and sold," Mario Trujillo, senior staff attorney at the Electronic Frontier Foundation, told KQED . More filings ahead Sabra expects these two filings to be the first of many. "We're in the early innings, and more companies will file for Chapter 11 before the end of the year. The common thread will be high leverage in an inflationary, high-rate environment, combined with AI squeezing their products and no moat to fall back on," he predicted. His prescription doesn't beat around the bush: "Keep leverage low, and cut costs early and aggressively." He also sees the pressure climbing the stack. "Even the biggest players, the overbuilders, are caught in an investment cycle," he said. "Disruption always starts at the bottom, and with AI it's reaching the top faster than ever. Could this be how the AI bubble bursts, from the bottom up? Maybe." Getty and Character.AI ended up in the same place: deciding what was worth keeping and what had to be left behind. Every leadership team will ultimately face the same question. If AI squeezed your core product tomorrow, what would a buyer actually want, and what would you be left holding? If you'd rather settle it in a boardroom than in a courtroom, Sabra's taking calls .

## Is AI Data Center Debt the Next Subprime?
URL: https://www.thestateofai.com/news/ai-data-center-debt-subprime-pension-funds
Published: 2026-10-21T01:49:30.387Z
Section: AI & Technology
Summary: Meta’s $27 billion Hyperion bonds slid to 91 cents on the dollar as AI data center debt piles up with pension funds and insurers, raising fears of a subprime rerun.
Full text:
Bonds tied to Meta's largest AI data center traded at 91 cents on the dollar on September 28, pushing their yield to about 7.55%, according to a Reuters column . That left the spread over Treasuries near 230 basis points, wider than the 185 the bonds paid at launch last fall but short of the record 255 they reached in July. The notes were sold by Beignet Investor, the vehicle that financed Hyperion, Meta's 5-gigawatt campus in Richland Parish, Louisiana. The $27 billion offering was the largest private bond deal ever , and S&P rated it A+, the kind of grade pension funds and insurance companies are set up to buy. The same week, the price of insuring Meta's debt against default rose to nearly 100 basis points, above its July high, and most Big Tech credit default swaps were trading at record levels. Oracle, meanwhile, issued a force majeure notice warning that a data center it's building in New Mexico could be delayed by up to a year because it can't secure enough power. For most of this year, critics have argued that AI data center debt is this cycle's subprime. Ed Zitron has made the case repeatedly , and TechRadar ran a piece warning of a possible "subprime data center crisis." The argument is that speculative construction debt is being packaged and sold to pensions, endowments and insurers that can't see what they own. Some of that holds up. Some of it, at least for now, doesn't. How Hyperion's debt ends up in a pension Meta could have borrowed for Hyperion on its own balance sheet. Instead it kept a 20% stake in a joint venture and let funds managed by Blue Owl Capital own the other 80%, NPR reported . Because Meta is the minority partner, the debt sits with the venture and stays off Meta's books. Meta pays rent as the tenant, and the rent services the bonds. PIMCO funds took a large piece of the deal, Bespoke Investment Group noted , and BlackRock was among the biggest buyers. Those firms manage money for state pension systems, insurers and university endowments, which is how a loan on a Louisiana server farm can end up in a teacher's retirement plan. Investors were paid extra for the arrangement. The notes carry a 6.58% coupon, compared with about 5.5% on Meta's own comparable corporate bonds, and their A+ rating sits one notch below Meta's AA-, according to Marcellus Investment Managers . Meta's second deal of this kind, for a campus in El Paso, Texas, priced above 7% this summer, about 0.4 percentage points more than Hyperion, European Business Magazine reported . Data center bonds went mainstream fast Hyperion is the biggest example of a much larger market. Operators issued $26 billion of data center asset-backed securities and commercial mortgage-backed securities in 2025, more than 10 times the 2020 total, Impax Asset Management said . ABS issuance alone reached $38.4 billion in the first eight months of this year, up from $24.1 billion a year earlier, according to Datacentres.com . The structure is simple. An operator pools leases on its buildings, splits the cash flow into slices, gets the top slices rated A or AAA and sells them. Pension funds and insurers that need long-dated income have been some of the most active buyers, DataBank CFO Kevin Ooley told Institutional Investor . Private credit is growing alongside the bond market. Bloomberg estimates there is more than $500 billion of AI data center debt outstanding, about $200 billion of it held by private credit funds, TechRadar reported . Morgan Stanley expects private credit to supply more than half of the $1.5 trillion the buildout needs through 2028, and Mercer has warned UK pension trustees that their AI exposure is moving from their stock holdings into their bond portfolios. The exposure is real, though often small relative to the whole. CalPERS, the largest US public pension, has about 4% of its roughly $615 billion in private debt and is targeting 8%, CEO Marcie Frost told Bloomberg TV in February. University endowments are big private credit investors too, but there is little public, deal-level data showing how much data center debt they hold. The parts that look like 2008 The resemblance is in how the deals are built. Before the financial crisis, banks moved mortgage risk into off-balance-sheet vehicles. Tech companies are doing something similar with joint ventures and special purpose vehicles, and Morgan Stanley puts the total of financing and leasing arrangements that Nvidia, Broadcom and the hyperscalers keep off their balance sheets at about $3 trillion, according to the Reuters column. Ratings are doing a lot of the work, as they did then. Beignet's A+ rests mainly on Meta's role as tenant and guarantor, and S&P cautioned at issuance that substantial credit risk could flow back to Meta during construction and once the campus is running. Insurers and pension funds often look specifically for single-A debt, Creditflux reported . A highly rated bond that pays a premium is exactly what their investment rules reward. The risk is also more concentrated than it looks. A small number of tenants sit behind a large share of the deals, and their lease terms are mostly private. The same investor can own a hyperscaler's bonds, a loan to the developer building its data center and securities backed by its leases, Remio noted . Those positions look diversified on a spreadsheet and would lose value together if that tenant pulled back. The parts that don't The collateral is much better than it was in 2006. Subprime loans often went to borrowers who couldn't afford them from the start. Most data center ABS is backed by finished, operating buildings leased to some of the most creditworthy companies in the world. Leverage is lower, too. Bespoke looked at the 26 data center ABS deals priced in 2025 and found a weighted average loan-to-value only slightly above 50%. With that much equity cushion and steady rent coming in, the firm argued, the bonds could take a large drop in demand without defaulting. It also found the market was two orders of magnitude smaller than investment-grade corporate bond issuance. By 2006, subprime loans made up roughly a fifth of all new US mortgages. And so far there's no second layer of leverage. The 2008 crisis spread because mortgage bonds were repackaged into collateralized debt obligations, then into CDOs of CDOs, and insured with credit default swaps that AIG couldn't pay out. Nothing like that has been reported in data center debt. Even the Reuters column that flagged the Hyperion selloff said Meta and its peers are very unlikely to default. S&P director Dhaval Shah told NPR he considers Hyperion a good deal. If Meta doesn't renew its lease, Blue Owl would sell the campus and use the proceeds to repay bondholders before it gets paid itself. Where the risk is building "Speculative" is a hard label to put on a AAA bond backed by a leased, running building. It fits better earlier in the process, before the building is finished and before a tenant has moved in. That stage is increasingly funded by private credit. Direct lenders now dominate construction and bridge loans for data center developers, and on the strongest hyperscaler-backed projects they are pushing loan-to-cost ratios toward 70%, Datacentres.com reported. One academic analysis estimated that Hyperion was about 90% debt-financed at the project level. Those loans don't trade on an exchange and aren't priced every day, and they sit in funds that pensions and insurers own. The lease terms add another layer of risk. Hyperion's bonds don't mature until 2049, but Meta can decide every four years whether to renew its lease, according to NPR. If it walks away, the backstop is selling a single-purpose campus in rural Louisiana. AI data centers are also designed around a specific chip generation, cooling system and power density, so a building financed over 20 years could be technologically out of date well before the debt is repaid. Then there's the question of whether AI earns enough to pay for all of this. Goldman Sachs estimates hyperscalers need around $300 billion a year in AI revenue just to break even on their spending, and Oxford Economics has said the returns investors expect would require those companies to capture most of the GDP gains AI is projected to create, according to the Reuters column. Hyperscalers have borrowed about $250 billion this year, Treasury yields are at their highest since before the financial crisis, and the Federal Reserve has started raising rates. The Bank of England warned in July that AI companies' use of outside debt had accelerated sharply in the first half of 2026. What it means for companies buying AI Most enterprises aren't buying data center bonds, but many are signing multi-year contracts for compute and colocation with providers whose buildings are financed this way. A provider paying for growth out of its own profits is a different counterparty from one whose next campus depends on a construction loan and a bond sale that hasn't happened yet. We raised the same vendor question in our coverage of Bank of America's AI bust warning last week . There's a second exposure that's easy to miss. Companies that still run defined benefit pension plans may already own this debt through their plan's credit managers. Mercer is telling trustees to look at AI concentration across the whole portfolio, not just the equity side. What to watch The market is already charging more for the risk. The Hyperion spread has widened, Meta paid more for El Paso than for Louisiana, and default insurance on Big Tech debt is at record levels. None of that amounts to a crisis yet. The clearer test will come in the safest part of the market. AAA data center ABS still prices tighter than comparable commercial mortgage bonds, and Datacentres.com said that if those spreads widen by even 20 to 30 basis points ahead of the 2028 to 2030 refinancing wall, it would be the first hard sign that investors are repricing AI infrastructure risk rather than chasing yield. For now, the subprime comparison describes the financing better than the assets. The senior bonds are backed by real buildings, real leases and modest leverage. The construction loans held in private credit funds are harder to see and harder to value, and they're the part of this market most likely to surprise the pensions and insurers that hold them.

## ChatGPT Is Writing a Psychological Profile of You. Just Not the Way You Think.
URL: https://www.thestateofai.com/news/chatgpt-memory-psychological-profile-study
Published: 2026-10-20T21:24:49.351Z
Section: AI & Technology
Summary: A new study found ChatGPT saves 96% of its memories about you without being asked, and half of them are psychological. The viral panic got the details wrong, and the real findings are harder to dismiss.
Full text:
A study of 2,050 real ChatGPT memories found the chatbot decides for itself what to keep about you. Half of what it keeps is psychological, and the viral thread about it got most of the details wrong. If you spent any time on X this week, you probably saw the thread. ChatGPT, it said, is secretly building a psychological profile of every user, clocking your hesitation and logging your stress while you ask it to fix a Python script. It closed by declaring privacy dead. The thread cited a real paper, and the paper deserves attention. Almost none of the thread's scariest lines appear in it. We went through the study. The researchers found that ChatGPT's memory runs almost entirely on the system's own judgment, and that much of what it chooses to keep concerns your inner life. That finding deserves a closer look than the thread gave it. Eighty users, 2,050 memories The paper is The Algorithmic Self-Portrait: Deconstructing Memory in ChatGPT . Its nine authors are based at the Max Planck Institutes for Software Systems and for Security and Privacy, Ruhr University Bochum, TU Delft and IIT Kharagpur, and the work was accepted at the Web Conference (WWW '26) . The team collected 2,050 memory entries from 80 people who donated their ChatGPT data. Then they sorted every entry by who created it, what it contained and whether it matched what the user had actually said. Eighty volunteers is a small, self-selected group. People willing to hand their chat logs to researchers probably use ChatGPT more than most, and may confide in it more. The authors are careful to frame their numbers as findings "in our dataset." The thread skipped that part. You didn't ask it to remember that ChatGPT created 96% of the memories in the study on its own. Users explicitly told it to remember something in roughly 4% of cases. Set that next to OpenAI's own description of the feature. Its help center says saved memories are details you have explicitly asked ChatGPT to remember , like your name or your diet. In this dataset, that covers a sliver of what was actually stored. The scope has only grown. In April 2025, OpenAI began letting ChatGPT draw on all of a user's past conversations , switched on by default for anyone who already had memory enabled. By June, a lighter version had reached free accounts . OpenAI pitched both changes as conveniences, and both gave the model more room to decide what gets kept. This is the number we'd put on the front page. When you ask ChatGPT to remember something, you decide what goes in the record. In this study, users made that call about one time in 25. Half of it is about you as a person The researchers flagged two kinds of sensitive content. About 28% of memories held personal data as Europe's GDPR defines it, which covers things like health, relationships and location. About 52% held what the authors call psychological insights: traits, motivations, goals, states of mind. So the thread didn't make up the psychology angle. Mention a layoff while asking for cover letter help, and a note about your job search could outlive that chat. That's the kind of entry these categories describe. The thread went off the rails on mechanism. The paper says nothing about ChatGPT measuring typing speed, hesitation, prompt frequency or an "emotional baseline." It studies the text of memory entries, which sit in a list you can open in your settings. Nothing in it points to a hidden, constantly updated model of your mood. Mostly accurate, rarely requested About 84% of memories traced directly to something the user said. For the most part, ChatGPT was writing down what people had told it. That undercuts the "knows you better than you know yourself" line. That shouldn't reassure anyone. People give chatbots personal context because the answers improve. The study shows that context outlives the conversation where it was shared and becomes a standing entry the model brings into every chat after. In 96% of cases, nobody asked first. ChatGPT does flag it. A small "Memory updated" label appears when it saves something. We'd argue a label in the corner of a chat window falls well short of consent. Other companies are moving the same way. Google's equivalent, Personal Context, launched switched on by default , and Anthropic brought memory to paid Claude users in 2025. The study only looked at ChatGPT, so we can't say how the others compare. The industry direction is plain enough. Regulators have run into this pattern before. Italy's data protection authority fined OpenAI €15 million in December 2024, finding it had processed personal data without an adequate legal basis and hadn't been transparent with users. The case was about training data, and the complaint applies just as well to memory. What to actually do You have more control than the thread suggests, if you're willing to dig through settings. In ChatGPT, go to Settings, then Personalization, and open "Manage memories." Read the whole list. Delete anything you'd rather it didn't carry around. You can turn off "Reference saved memories," "Reference chat history," or both. According to OpenAI, switching off chat history erases what ChatGPT picked up from past chats . For medical, legal or relationship questions, use Temporary Chat, which neither reads nor writes memory. Watch for one trap. Deleting a conversation doesn't delete the memories it created . You have to remove both. The researchers also built a prototype called Attribution Shield. It predicts what a prompt is likely to reveal about you, warns you before you hit send, and suggests a rewording that keeps the useful parts. It's research code for now. Still, it shows a chatbot could warn you before you overshare. Where we land The panic in that thread was misplaced. So is the shrug that tends to follow once people learn a viral claim was exaggerated. ChatGPT keeps a file on you, mostly on its own initiative, and about half of what's in that file concerns who you are. Our position at The State of AI: memory should be something users approve entry by entry, or at minimum something that announces itself every time. Until AI companies treat the profile they build as yours to sign off on, assume anything you tell a chatbot can follow you into the next conversation.

## Blackstone Created an AI Chief Investment Officer, Which Is Trained on 14 Years of the PE Firm’s Internal Deal Memos and Debates
URL: https://www.thestateofai.com/news/blackstone-ai-chief-investment-officer
Published: 2026-10-19T18:28:10.171Z
Section: Enterprise Strategy
Summary: Blackstone now gives its investment committee a second memo on nearly every deal, written by an AI trained on more than 14 years of the firm’s internal deal memos and debates.
Full text:
Every Monday, Blackstone's top partners meet to decide what the world's largest alternative asset manager will buy next. Nearly every deal on the agenda now arrives with two memos. The deal team writes one. The other comes from a model the firm calls its AI chief investment officer. Bloomberg reported the arrangement last week in a profile of Blackstone president Jon Gray. The model was trained on data that includes more than 14 years of the firm's internal deal memos and committee debates. It weighs in on proposed investments, but it has no vote. Plenty of investment firms use AI to find companies or speed up diligence. Blackstone is the first big buyout shop we know of to give a model a standing role in the meeting where the money gets committed. What We Know About the Model Not much. Bloomberg's account runs a few sentences, and Blackstone hasn't said which underlying model it uses or who built it. "Trained on" could mean the firm fine-tuned a model on its archive, or that the model pulls from those documents as it writes, or some combination. Those details matter. A model that has read the memos on deals Blackstone walked away from, and on deals that lost money, will argue differently from one that has only seen the deals partners liked. Bloomberg also says "nearly every" investment gets an AI memo, which leaves open which ones don't. Ten Years of Building Toward This The AI CIO has a long backstory. Steve Schwarzman started hiring data scientists after Alibaba co-founder Jack Ma explained AI to him on a bus stuck in Beijing traffic, Institutional Investor reported in 2023. By then the firm employed more than 50 of them, some working directly on deal teams. Martin Brand, who runs North American private equity, told the magazine his team could build a first model of a company while he was still on the phone with the banker pitching it. Blackstone's in-house platform was also drafting first-pass investment memos in a few hours, work that usually took junior analysts two or three days. Chief technology officer John Stecher said the drafts weren't perfect but gave teams "a solid baseline to work off." In September 2025, Gray told a gathering of institutional investors that every investment committee memo now had to address the deal's AI risk within its first two pages, for credit deals as well as equity. This year Blackstone folded its growth investing business into a new AI unit, Blackstone N1, and co-founded Ode with Anthropic , an AI implementation firm, with Anthropic and Hellman & Friedman. Much of the internal work falls to Rodney Zemmel, who joined Blackstone last year after nearly three decades at McKinsey. Bloomberg reports he spends close to 60% of his time on AI and oversees two groups, one building investment tools for Blackstone and one working with its portfolio companies. He also sits on Ode's board. Why the Committee Matters Blackstone runs more of its decisions through one room than outsiders might expect. Gray told Semafor in August that the firm is more centralized than its size suggests, and that he spends weekends reading memos before the weekly committee meeting. He has little patience for partners who show up unprepared. "If you haven't read the materials, then you're not even a player," he said. Gray also said he has trained himself not to speak first, and that colleagues are encouraged to challenge teams even when their track records are strong. He admitted AI has made those meetings harder, since nobody can say with much confidence what a billable hour or a software company will be worth in a few years. A model that reads every memo and never tires of objecting fits that culture well. The catch is that everything it knows comes from Blackstone's own history, which is exactly what Gray wants his partners to keep questioning. Rivals Mostly Use AI Earlier in the Process Other large investors lean on AI too, though mostly at the front end. EQT has run its Motherbrain platform since 2016. It ranks potential investments with scores dealmakers can inspect, and the head of AI at EQT Ventures told Tech.eu last year that language models now surface past internal notes on a company or founder before anyone takes a meeting. Carlyle gave its deal teams sentiment reports on target companies and later rolled them out to all of its investment teams, according to the analytics vendor SESAMm . EQT is the closest comparison, since both firms are mining their own institutional memory. The difference is where that memory gets used. At EQT it helps decide which companies are worth a look. At Blackstone it shows up when partners decide whether to write the check. Several Blackstone competitors, including Apollo, Goldman Sachs, General Atlantic and Leonard Green, are also investors in Ode . Ode works with portfolio companies rather than on its backers' own deal processes, but it puts the same expertise within easy reach of all of them. The Open Questions A second opinion is only worth having if it's independent, and there are reasons to wonder whether this one always will be. Researchers at Rutgers and the University of Toronto found this year that language models asked to rate stocks tend to adopt any analyst rating included in the material they're given, with herding scores often above 90% ( ACL 2026 ). A single planted contrary rating was enough to shift the answers of leading commercial models. If Blackstone's AI CIO reads the deal team's memo before writing its own, it may agree more often than it should. Then there's the matter of what it learned. Fourteen years of memos teach a model how Blackstone partners argue. Whether they also teach it which arguments turned out to be right depends on whether deal outcomes were part of the training, and Blackstone hasn't said. Accountability is murkier than the no-vote rule suggests. If the model flags a risk that partners overrule and the deal goes bad, limited partners may want to know how that warning was handled. Keeping 14 years of internal deliberations in one system also raises the cost of a breach. Some financial advisers were already uneasy about the security of Blackstone's AI efforts in 2023, Institutional Investor reported. A Seat at the Table, but No Vote We found no other major buyout firm that has publicly described an AI with a standing role in its investment committee. Whether others copy the idea will depend on evidence Blackstone hasn't released, mainly how often the model disagrees with its deal teams and whether it has ever swayed a vote it can't cast.

## Meta Engineer Says He's Now Shipping Code He Doesn't Fully Understand
URL: https://www.thestateofai.com/news/meta-engineer-shipping-code-he-doesnt-understand
Published: 2026-10-19T16:34:30.078Z
Section: Industry & Platforms
Summary: Ali Hamie says AI-assisted development moves too fast to check every line. Industry surveys suggest a lot of engineers are in the same spot.
Full text:
A software engineer at Meta has said publicly what many developers have only hinted at: he is shipping code he doesn't fully understand. In a LinkedIn post this week, Ali Hamie wrote that he has never felt as uncomfortable in his job as he does now. AI tools have sped up development so much, he said, that reviewing every line would slow his work to a crawl. He understands the systems he builds at a high level, but he can no longer account for every detail of how the code works. He said that runs against his instincts as an engineer. "I'm used to understanding what I'm building," he wrote. He is now trying to work out how much understanding is enough before he moves on, and he ended the post by asking whether other engineers feel the same way. Going by the available industry data, plenty of them do. What Meta is asking of its engineers Hamie didn't name a project or team, and he didn't say his code was failing. His comments do come against a backdrop of open pressure inside Meta to write more code with AI. In March, Business Insider reported on a set of internal targets at the company. Meta's creation organization, which covers Facebook, WhatsApp and Messenger, set a goal for 65% of its engineers to write more than 75% of their committed code with AI tools in the first half of 2026, according to People Matters' summary of the report . The company's Scalable Machine Learning group set targets of between 50% and 80% AI-assisted code. Employees were also encouraged to describe their AI use in performance self-assessments. Meta isn't an outlier. Sonar's 2026 State of Code survey of more than 1,100 developers found that 42% of committed code is already AI-generated or AI-assisted, and respondents expect that share to reach 65% by 2027. When a model can produce in minutes what used to take a day, the person reading each line becomes the slowest step in the process. That is where Hamie says he finds himself. Developers don't fully trust the code they ship The same Sonar survey found that 96% of developers don't fully trust AI-generated code to be functionally correct, yet only 48% said they always check it before committing ( Sonar ). Another 38% said reviewing AI-written code takes more effort than reviewing a colleague's work. AWS CTO Werner Vogels has called the gap "verification debt" . Stack Overflow's 2026 Developer Survey , released earlier this month with more than 30,000 responses, found much the same thing. Nearly half of respondents said they trust AI output when they can verify it, and just 6.6% said they would trust AI with an important decision. So engineers trust AI-written code roughly as far as they can check it, while the speed of the work leaves them less time to check. Researchers are calling it comprehension debt Engineer and author Addy Osmani has written about what he calls comprehension debt , the growing gap between how much code exists in a system and how much of it anyone actually understands. Unlike ordinary technical debt, it doesn't show up as slow builds or fragile modules. Tests can pass and dashboards can look healthy while a team's grasp of its own system gets thinner. The bill usually comes later, during an outage, a big refactor, or when the one person who knew how something worked leaves the company. There is some early evidence on how this happens. In a randomized study of 52 engineers, Anthropic found that participants who relied on AI scored 17% lower on a follow-up comprehension quiz than a control group, 50% versus 67%, with the largest drop in debugging ( Augment Code ). How people used the tool made a difference. Engineers who asked the AI questions and explored tradeoffs held on to their understanding far better than those who simply handed the work off ( Tessl ). The case that this is nothing new Some engineers will push back on how Hamie frames the problem. Nobody at Meta reads the Linux kernel, the compiler or every dependency in their build, and software has always depended on trusting layers someone else wrote. Seen that way, AI-generated code is one more layer of abstraction, and the unease is similar to what earlier programmers felt about compilers. The comparison only goes so far. A compiler behaves the same way every time, is heavily tested, and is maintained by people whose job is to understand it. A third-party library has maintainers and a changelog. Code written by an AI agent lands in the engineer's own repository, under their name, built for their specific system. Once they approve it, they are its author of record whether or not they can explain how it works. How teams are responding There's no agreed answer yet to Hamie's question about how much understanding is enough, though a few practices are spreading among teams that worry about this. One is to match review to risk. An internal script and a payments service don't need the same scrutiny, and some teams now spell out which code can ship on tests and spot checks and which needs a reviewer who can explain every branch. Another is to put more effort into the specs, tests and evaluation gates that constrain what the AI writes ( Augment Code ). A test suite the team actually understands will catch more than a rushed skim of a thousand generated lines. Some teams also assign a named person to every AI-written change who must be able to explain it on request, and they don't allow agent-generated pull requests to be approved without comment ( The Note ). Individual engineers can change how they use the tools, too. Asking the model to explain what it wrote, and what it considered and rejected, takes longer than accepting the diff. The Anthropic study suggests that kind of use is what keeps an engineer's understanding intact. Our take Some readers will see Hamie's post as an engineer missing an older way of working. We think he's raising a fair professional concern. Wanting to understand what you've built is a safeguard, and the companies pushing hardest on AI adoption have good reason to protect it. Meta and others track how much of their code AI writes and how widely the tools are used. We haven't seen a company publish any measure of how well its engineers understand the code they ship. Until someone does, engineers who say openly that they're losing track of their own systems are one of the few early warnings available. Hamie asked whether other engineers feel the same, and the survey data says most of them do. Whether they can say so in a code review without being seen as slowing things down depends on their employers.

## AI Made Building Cheap. Now Products Have To Earn Their Place.
URL: https://www.thestateofai.com/news/designing-adoption-into-product-divyesh-shah-flipkart
Published: 2026-10-19T07:18:53.901Z
Section: Enterprise Strategy
Summary: Flipkart VP Divyesh Shah argues that as AI makes products easier to build, teams must design for customer trust and retention from the start.
Full text:
AI has made software easier to build without making customers any easier to win. As development speeds up, the competitive advantage shifts to deciding which problems deserve solving and designing products people have a reason to keep using. That puts customer discovery, distribution and retention inside product strategy, long before launch day. Divyesh Shah is Vice President and Head of MaRT, covering Marketplace, Retail and Demand/Supply Planning platforms, at Flipkart , the Indian e-commerce group behind Shopsy and Flipkart Minutes. He leads technology strategy and product for the platforms that manage the lifecycle and growth of more than one million sellers and brands, after more than two decades of marketplace and consumer technology leadership at companies including Amazon and Target. He argues that go-to-market belongs inside the product, shaping how people discover it and why they keep coming back. “In the software development life cycle, the build was the hurdle, because only a few people could do it, and that governed the pace at which products came out. Now that the cycle has shrunk and almost everybody can build, the bottleneck has shifted to choosing the right thing to build. Judgment has become extremely important,” Shah says. Worldwide app releases rose 60% year over year in the first quarter of 2026, adding to the competition for customer attention. That raises the stakes of two decisions: knowing what deserves building and how a product will reach the people who need it. Adoption is a product requirement Shah argues that reach and retention can’t be handed to marketing after launch. “People who are building products shouldn’t be thinking about GTM after the product is built. It should be part of the product itself. How you create reach should be part of your product-led conversations and your capabilities,” he says. His framework starts where product work always has, with a clear picture of the customer and the pain a feature addresses, articulated with enough empathy that the customer recognizes themselves in the pitch. From there it moves to speed. “Time to value has to be in minutes. It should be very easy to try your product and start building trust, versus spending two hours trying to figure it out before seeing any value.” From there, every session should leave the product knowing a little more about the person using it. “Every time they use the product, it should get better, and their reasons to switch should become more difficult,” Shah says. “In a B2B product, you know their workflow, their quick actions, their biases. Your data has become much richer because they provided it to you.” Over time, that familiarity can make the product more useful to the customer and harder for competitors to replace. Fieldwork surfaces the problems LLM research misses All of that design work depends on an earlier decision about which problem deserves solving. Shah argues that relying on LLMs for customer discovery can make that choice harder, because the research tends to surface problems people are already discussing . “People are using LLMs to do research, which gives an average of the most important problems. You get the average of what 120 people are talking about, so you won’t find a problem statement that’s unsolved or differentiating. You get those problems through field visits and by double-clicking,” he says. The research on AI-assisted ideation points in a similar direction. People who brainstorm with ChatGPT produce ideas that tend to converge , while people working from their own thinking and web searches land on more unique concepts. Shah’s alternative starts with the earliest customers. “Your initial 10 or 15 customers have to be your design partners while you’re building the product, and they should really feel, ‘OK, I’m heard, and my problems are getting solved.’” Fieldwork also reveals where those customers spend their attention and which channels they trust, which lets teams build distribution into the product itself. “If those are post facto, they’re just marketing or positioning material. I don’t think that can fly,” Shah says. Faster prototyping makes customer feedback more important. Teams can run more experiments , but they still need the market to show them which ideas solve a real problem. Shah evaluates each experiment on what it teaches as well as whether it hits its target, giving the next round a stronger basis for decisions. “I read a lot, and I talk to my customers a lot. That’s how the judgment gets sharper,” he says. Shah sees the same dynamic in AI’s own history. The technology existed for decades before its mass adoption , which he attributes to an experience intuitive enough to reach people who had never considered themselves technology users. “AI has gone from a push capability to a pull capability,” he says.

## AI Agents Follow The Process Map Exactly. That's How Enterprises Find What It Left Out.
URL: https://www.thestateofai.com/news/ai-agents-expose-workflows-austin-dcosta-concentrix
Published: 2026-10-19T07:03:01.733Z
Section: Enterprise Strategy
Summary: Concentrix's Austin D'costa says production exceptions show enterprises how their work really flows, and simplifying that work comes before orchestrating agents across it.
Full text:
Most enterprises have a process map, and most contact centers have a supervisor who could annotate it with everything nobody follows. For years that was fine, because human employees filled the holes with workarounds and judgment calls inherited from whoever trained them, and the map went back in its drawer. AI agents inherit none of that knowledge. They do exactly what the document says, which is how many companies are learning, a little sheepishly, that their process maps were generous first drafts. Southeast Asia is moving into that problem early, with 46% of companies in the region scaling AI beyond pilots against a global average of 35%. The job starts before deployment, by handing agents less work, and continues in production, where the parts of the workflow nobody thought to write down finally surface. Austin D'costa is Vice President of Account Management and Sales, ASEAN Region, at Concentrix , the Fortune 500 customer experience and technology services company. Based in Malaysia, he brings AI into customer experience operations for enterprises across the region. He believes a company learns how its work really flows by watching AI run it. "'Run experience' is key to building a sustainable, unified AI architecture, because it tells you which workflows actually break in production. Those are the exceptions, escalations, and edge cases that never show up in a design document," D'costa says. " So you unify around how the work really flows, not how the org chart says it should." That's an inconvenient idea for the many enterprises doing the opposite, buying agents department by department until procurement has one and HR has another, each tuned to its own corner of the org chart and unaware the others exist. Every one of those agents inherits its department's version of the process, missing workarounds and all. D'costa starts earlier, by shrinking the work before any agent touches it. Elimination comes first More large companies scaled agents this year, and the share attributing any EBIT impact to AI held flat at 37% anyway. The roughly 6% of companies seeing significant returns from AI look different, and nearly three-quarters of them have redesigned their workflows around it, compared with about a quarter of everyone else. "People have been in a rush to bring in more products, and more AI-led projects are getting a green signal, but the products being brought on board aren't necessarily being used effectively to generate the results companies want," D'costa says. His first move on any workflow is figuring out how much of it can go away. "We don't need AI everywhere. It's extremely simple if you keep it simple," he says. "Process elimination is a start point for any AI deployment, because the fewer complex processes there are, the better your AI will function. Ultimately, it is only as rich as the human intelligence that has been passed on to it." Every enterprise has steps worth questioning, like the approval nobody remembers requesting or the weekly report that lands in an inbox nobody opens. Deleting them is the simplest form of rebuilding processes around AI, and a great deal cheaper than teaching a machine to perform them faithfully. Agents can't fill in the blanks Whatever work survives the cut still runs on data, and D'costa doubts most of what enterprises have stored will make the trip. "You could roughly have only 5% of the data effective enough for where your future lies," he says. "So what do you eliminate out of that data, and what do you extract from it?" The cleanup pulls data from SQL databases and years-old presentations alike, then simplifies it before anything downstream depends on it. D'costa estimates that groundwork for enterprise AI maturity takes eight to 12 weeks, depending on scale. His test for that data is whether an agent could use it as easily as a person could. "Data equally needs to be virtual agent ready as much as it is human agent ready," he says. Some of what employees rely on was never treated as data at all. A seasoned rep knows which CRM field nobody trusts and which rule the team stopped following years ago, and an agent can't use any of it until the enterprise captures it. From there, he narrows the scope on purpose, sorting work from L0 to L5 by complexity and treating L0 through L3 as realistic candidates for agents. "Pick up the L0, L1 and L2 work and say, these are the projects. This contributes to 30% of my work type today," he says. "Let me define these workflows. What is my primary action, my secondary action, my tertiary action?" The narrower the assignment, the easier it is to see where the documented process ends and human judgment begins. Production rewrites the workflow The process map gets its first honest review the week an agent starts using it, when the exceptions and escalations nobody drew begin rerouting the work. Human employees absorb those shifts without a second thought. An agent needs each one recorded and controlled, turning production into a second round of process mapping. "If a process has 15 steps, and those 15 steps go down to 13 because of some elimination or simplification, that has to be controlled through a more governed manner," D'costa says. He gives that work to a CX consulting governance leader whose job is turning what production reveals into controlled changes. An agent will keep following yesterday's version long after the rules shift underneath it. The role is modeled on the trainers who once kept the onboarding binders current for contact center staff. "If your knowledge base wasn't updated, your human agents would give the wrong info," he explains. "Similarly, the virtual agents you point toward that workflow need to know what those workflows are, and you need to control them." Skipping that discipline tends to send the bill after launch. By 2027, 40% of enterprises are expected to demote or decommission autonomous agents after governance problems turn up in production incidents, and no amount of planning in a conference room substitutes for watching an agent handle a real Tuesday. Handoffs make orchestration necessary Departmental agents eventually run into each other, since a single customer interaction can cross several departments. An enterprise can document every department's workflow and still have nothing on paper for the space between them, which in many companies runs on a shared inbox and one person who knows who to call. Each agent can complete its own task perfectly and still fail at the moment it hands that task off to the next one. "Now you have an EV that can drive on a road. Now you need to ensure that autonomous vehicle can also adjust to other autonomous vehicles on a busy road," D'costa says. "Procurement may already have an agent working. You have product teams, development teams, HR. If all of these processes have to engage with other virtual agents, how do they talk to each other?" His answer is an orchestration platform, which only moves the enterprise forward once it's mounted on a chassis of simplified data and workflows, a combination he calls "one intelligent experience." That discovery can take longer than a quarterly roadmap allows, which is why D'costa wants executives to ease up on deadlines. "Execs need to be a little more forgiving towards people not meeting their deadlines, because the more you rush, the messier the environment you get into," he says. The supervisor with the annotated process map has known for years where the documented workflow ends and the actual one begins, and AI agents are the first colleagues who need it written down.

## Delta, JPMorgan, Schwab and Amazon Are Starting to Lock Out the AI Agents That Were Supposed to Do Everything for Us
URL: https://www.thestateofai.com/news/delta-jpmorgan-schwab-yelp-amazon-block-ai-agents
Published: 2026-10-18T19:02:46.216Z
Section: Industry & Platforms
Summary: Delta, JPMorgan Chase, Charles Schwab and Yelp are restricting AI agents, and Amazon has added Grok Bot to its block list after Muse.
Full text:
Delta, JPMorgan Chase, Charles Schwab and Yelp have confirmed they are restricting AI agents from booking flights, getting into customer accounts or reading their data. Amazon, which blocked Meta's Muse last month, is now turning away Grok Bot as well, according to users. When Amazon began blocking Meta's Muse agent on September 20, the dispute looked specific to two companies. Amazon said Meta had not asked permission, that Muse did not identify itself while browsing, and that its access violated Amazon's Conditions of Use. We covered how that affected Muse users earlier this month. Since then the list has grown. Users of Muse, xAI's Grok, OpenAI's Dots and Instinct have reported blocks on major websites over the past few weeks, and Delta, JPMorgan Chase, Charles Schwab and Yelp have confirmed restrictions of their own. Between them, those companies cover most of the tasks AI companies have used to sell personal agents: travel, shopping, banking and finding somewhere to eat. Users have also reported that Amtrak, Cars.com and Kohl's no longer work with their agents . None of the three has commented, so those reports haven't been confirmed. Banks will let agents read data but not move money JPMorgan CEO Jamie Dimon addressed agents on the bank's earnings call this week. "You don't want rogue agents," he said. A JPMorgan spokesperson told Fortune the bank does not allow third-party agents to access accounts using a customer's banking credentials. It still supports customer-authorized data sharing through open banking providers, so an agent can see some account data but can't log in or make transactions. Schwab CEO Rick Wurster told Bloomberg that the firm is blocking unauthorized agents , including Muse, from moving client money. He said he gets a weekly report on blocked agents and that the number is in the tens and twenties each week. Citigroup told the Financial Times it also won't let third-party agents log in or transact . The banks cite security, since an agent holding a customer's password creates a new way for money to go missing. Analysts have pointed to a financial motive as well. One of the first things a money agent is likely to do is move idle cash out of checking accounts, which pay close to nothing, into accounts that pay several percent. Apollo chief economist Torsten Slok puts that gap at about 0.1% versus 3.3% to 5% . If agents did that across millions of accounts, it could cost banks billions in net interest revenue . Delta and Yelp want a deal first Airlines have been rejecting agent booking requests for weeks, even though flight booking is one of the tasks agent makers promote most. Delta has now said it has no partnership or integration that allows outside agents to shop for or book its flights, and that it is protecting customers from unauthorized automated activity. Yelp lets agents in only if they're part of its paid data licensing program . The company already licenses its data to AI firms, including a deal with OpenAI announced in July that brings Yelp reviews, photos and business details into ChatGPT . Agents that read Yelp through a browser without a license don't pay for that data, and Yelp is now keeping them out. Amazon and Grok Bot This week a Grok Bot user posted a screenshot of the same Amazon warning Muse users have been getting and said his agent could no longer place orders . Elon Musk replied, "Maybe we should start a competitor to Amazon," and told users to have their bots shop elsewhere. Amazon hasn't confirmed it is blocking Grok Bot, and neither company responded to Moneywise's request for comment. About a week earlier, Y Combinator co-founder Paul Graham had argued that Amazon's agent ban gives startups their first real opening to compete with Amazon since its founding. A rival would need far more than a better agent to match Amazon's warehouses and delivery network, but the comments show how much agent makers think is at stake. Most of these companies have agents of their own Several of the companies restricting outside agents offer their own. Schwab is steering clients to Charley , an AI assistant it announced on September 30. Amazon has its own Buy for Me agent, which identifies itself to merchants when it shops on other sites. Yelp earns money licensing the data that outside agents would otherwise read for free, and banks hold the deposits that outside agents would be designed to move. The security risks these companies describe are real, and blocking outside agents also helps them keep control of their customers and their revenue. Agents still work through partnerships Agents that come in through formal agreements are faring better. The day after Amazon blocked Muse, Shopify announced it was working with Meta on agentic checkout through Shop Pay. Meta later announced retail partnerships with Walmart, Gap, Sephora, Wayfair and Best Buy . In travel, Sabre says nearly 80 of its customers are testing or using its MCP server for agent bookings , which gives agents a direct connection instead of having them work through booking pages. Agents that use partnerships, paid licenses, APIs or a declared identity are still getting through. The ones being blocked operate a browser with the customer's password, and users usually find out when a task fails partway through. What enterprise leaders should do Companies using agents should check which steps run through approved integrations and which depend on an agent clicking through someone else's website. The second kind can stop working without warning when a site changes its rules. Agents shouldn't be given shared passwords to financial accounts. JPMorgan and Schwab have made clear who they think carries the risk if something goes wrong, and read-only data access is the safer option where banks offer it. Teams should also expect to pay for data. If other platforms follow Yelp's approach, information agents read for free today may require a license. Companies that run customer-facing websites face the same decision from the other side. They'll need a policy on which agents can get in and on what terms, along with a way for approved agents to connect that doesn't run through the login page. For now, what a personal agent can do depends less on the model behind it than on which companies have agreed to let it in.

## Bank of America Sees Bust Warning Signs in the AI Boom
URL: https://www.thestateofai.com/news/bank-of-america-ai-boom-bust-warning
Published: 2026-10-16T20:53:04.044Z
Section: AI & Technology
Summary: Bank of America says hyperscaler spending has tripled to $1 trillion while AI token prices fell by half since summer, a pattern the bank says has ended badly for investors before.
Full text:
Bank of America told clients on Friday that the AI buildout is moving through the same stages as earlier capital cycles that ended badly for investors. The bank pointed to rising spending, sharper competition between model developers and falling prices. The note landed three days after the International Monetary Fund named a sharp pullback in AI investment as one of the biggest risks to the world economy. Cheaper tokens, thinner margins Cloud providers are now expected to spend about $1 trillion on capital projects, up from $330 billion, according to BofA . That works out to roughly 3% of U.S. GDP. Over the same period, AI token prices have dropped by about half since the summer. BofA's concern sits in the gap between those two lines. Usage keeps climbing, but when each token sells for half what it did a few months ago, more usage doesn't guarantee enough revenue to pay for the data centers. A small version of this has already played out. Character.ai spent as much as $13.8 million a month on compute while bringing in no more than $5.3 million, as we reported this week . Investors have seen this before BofA's clients raised the historical comparison themselves. In meetings last month, AI spending took up 80% of discussion time, and clients pointed out that the 1990s tech boom and the 1870s railroad boom both ended in busts, the bank said in September . Most planned to stay invested anyway. BofA noted that stepping aside would carry real career risk. A separate BofA team led by Michael Hartnett found that the 10 largest AI stocks now make up 42% of the market. Past bubbles, from the 1920s to 2000, topped out when their leaders reached somewhere between 36% and 44%. Railroads went further, hitting 63% in 1881. The bull case, the analysts wrote, comes down to "it's the railroads this time." That concentration shows up in index returns. Since January 2024, 42 AI stocks have produced 67% of the S&P 500's price gains, according to The Kobeissi Letter . Only 29% of the index's stocks have beaten it over three years, close to the 25% low during the dot-com bubble. The debt underneath The IMF's numbers show how far an AI slump could travel. In a downside scenario, a steep drop in AI investment sends asset prices sharply lower and leaves global GDP 1.1% below baseline by 2028, the fund said . U.S. output would take a 1.8% hit. "We now have an economy that is standing on one leg, the AI leg," IMF Managing Director Kristalina Georgieva said. The fund's financial stability report looked at how the buildout is paid for. It counted 14 publicly disclosed deals since 2023 in which hyperscalers put about $300 billion of equity into financially weaker AI firms. Those deals carry $650 billion in debt and $1.4 trillion in promised future revenue, The Next Web reported , and about $320 billion of that debt sits with the companies receiving the money. The IMF calls this wrong-way risk. If the revenue tied to those deals falls short, the stakes lose value at the same moment the debt gets harder to service. What it means for companies buying AI For enterprise buyers, the BofA note cuts both ways. Falling token prices help anyone paying per call, and they're a direct product of the competition BofA flagged. The exposure sits with vendors. The IMF said neocloud operators carry more debt and earn less than the hyperscalers, and a provider borrowing against revenue it hasn't booked yet is a different counterparty than one funding growth from profits. Teams signing multi-year AI contracts should know which kind they're dealing with. Neither BofA nor the IMF is calling a crash or putting a date on one. Hyperscaler spending forecasts were still rising in September, and Hartnett's team noted that chip prices are climbing, while railroad freight rates slid before that boom peaked. IMF deputy research director Petya Koeva Brooks told Reuters the worst-case AI scenario likely wouldn't push global growth down to recession levels. BofA's own conclusion is narrower. AI could work as promised and investors could still lose money on the buildout. The railroads did remake the U.S. economy, and plenty of the people who financed them were wiped out along the way.

## At Accenture, the All-You-Can-Eat Era of Workplace AI Is Over
URL: https://www.thestateofai.com/news/accenture-caps-claude-spending-29-dollars
Published: 2026-10-16T00:04:56.160Z
Section: Enterprise Strategy
Summary: Accenture spent the year telling staff to use more AI; now it caps Claude at $29 a month per employee and bills everything above that to their projects.
Full text:
The firm that made AI use a condition of promotion is now capping Claude at $29 a month per employee. Accenture is rationing the very tool it spent the past year pushing its people to use. In an internal announcement titled "Claude Enterprise Users: Important Updates to Licensing and Usage Costs," the consulting giant told employees it will now centrally fund just $29 a month per person for Claude. The memo was first reported by 404 Media's Joseph Cox on Thursday, and Accenture's response to the outlet did not dispute it. The policy took effect October 1. Under it, all Claude Enterprise costs are consumption-based, and anyone who goes past $29 must find a specific project or team, which Accenture calls a Work Breakdown Structure or WBS, to cover the rest. Premium accounts come with $250 in token usage a week, but many employees are not on that plan. For heavy users, the drop is steep. Internal messages viewed by 404 Media show employees describing monthly usage of $500 to $1,000. One said an upgrade to Premium appeared to be blocked; another said their access had been revoked entirely. The announcement also warns that licenses are reviewed periodically and may be reallocated as business priorities change. An Accenture spokesperson told 404 Media the company still makes AI available to all its people and is focused on matching the right tool to the right work. The timing is hard to miss. On the day the cap took effect, Accenture reported results that beat expectations , said its AI and data workforce had reached about 110,000 people, and counted more than 400 clients starting advanced AI work during the fiscal year, according to its earnings call . Its shares closed up nearly 16%. A whiplash reversal Ten months ago, Accenture and Anthropic launched a joint business group with plans to train about 30,000 Accenture staff on Claude and put Claude Code in the hands of tens of thousands of developers. Anthropic CEO Dario Amodei called it the company's largest deployment ever. By February, adoption had become a career requirement. Accenture told associate directors and senior managers that regular use of its AI tools would factor into leadership promotions, and it began tracking weekly logins, according to the Financial Times, as reported by Fortune . Then came the bill. In June, 404 Media obtained audio of an internal meeting in which Justice Kwak, Accenture's agentic AI strategy lead, said much of the heavy token use came from non-engineers doing routine work like turning PDFs into slides. Kwak later told TechCrunch that AI was becoming "material to the cost structure." Four months later, the cap arrived. The irony is hard to ignore. Accenture's business is persuading the world's largest companies to spend heavily on AI. It is now finding out, on its own books, what that spending looks like at scale. The meter behind the memo The $29 cap is less a change of heart than a change of invoice. Anthropic's Enterprise plan now separates access from usage: the seat fee covers access only, and every token used in Claude, Claude Code or Cowork is billed at standard API rates . Customers on older seat-based contracts move to that model at renewal. Under flat seats, a power user was a rounding error. Under metering, each one becomes a line item someone has to approve. That flips the incentives inside a company. When AI was a fixed license, the goal was adoption, and firms built leaderboards and promotion criteria to drive it. When AI is a variable bill, the goal becomes containment, and yesterday's exemplars become today's cost outliers. Two classes of AI user The new rules split Accenture's workforce in two. Premium's $250 a week works out to roughly $1,080 a month. General users get $29, about 37 times less. Which group an employee lands in depends, in the memo's framing, on role and business need. That collides awkwardly with the promotion policy. If AI use counts toward advancement, and heavy use now requires a project willing to pay for it, career prospects may hinge on landing a well-funded engagement. Accenture has not said publicly whether usage still factors into promotions. The squeeze also reaches the people building Accenture's AI offerings. One employee wrote that they rely on Claude Code to build an AI accelerator for several Accenture clients, at a cost of $500 to $1,000 a month. Why it matters Accenture is the latest, and the lowest, in a string of corporate pullbacks this year. Uber burned through its 2026 AI coding budget by April and capped staff at $1,500 a month per tool . Meta built a central dashboard to monitor spend and plans structured token budgets for 2027, as State of AI reported in June . Microsoft has given every division a token budget and moved its default internal model to a cheaper one. What sets Accenture apart is the model, not just the number. Uber's per-tool ceiling is roughly 50 times Accenture's per-person allowance, and Microsoft and Meta manage spend at the division level. Accenture sets a low floor and pushes everything above it onto the work itself. That shift, from overhead to project cost, is the real story. At a consultancy, project costs feed engagement economics, which raises a question the memo leaves open: will heavy AI use be absorbed in margins, or surface in what clients pay? Either way, every engagement now carries a visible AI cost, and project leads and clients will start asking what it bought. For AI vendors, metered pricing lets revenue scale with usage rather than headcount. But when customers route that usage through project budgets, every dollar meets someone with a reason to cut it. The open question is whether pushing AI costs onto the work sharpens judgment about where AI pays off, or simply teaches employees to stop reaching for it.

## AI Labs Are Buying Bankrupt Companies' Data. Some of It Isn't Theirs to Sell.
URL: https://www.thestateofai.com/news/spirit-airlines-data-sale-ai-labs
Published: 2026-10-15T22:00:00.261Z
Section: Industry & Platforms
Summary: Google bid $10 million for Spirit Airlines’ internal data to train AI, and the airline’s vendors and former employees say some of it was never Spirit’s to sell.
Full text:
Every company now produces AI training data, whether it means to or not. The AI industry calls it operational exhaust: the Slack threads, Jira tickets, email chains and code history that pile up from ordinary work. Labs are now paying for it. Until this summer, that market mostly meant small startups selling their leftovers for five or six figures. Then Spirit Airlines put its archive up for auction, and the objections came from the people and companies whose data was in it. The $10 million test case Google won the auction for Spirit Airlines' internal data on August 14 with a $10 million bid, beating AI data firm Mercor's $7.5 million, Reuters reported . Spirit stopped flying in May. Google says it will use the data to improve its products and AI models. The estate's filing lists about 100 million emails across 80,000 accounts, 500 million Teams messages, 516 code repositories and 175,658 employee records reaching back to 1986, per the August 14 schedule . Passenger profiles and loyalty records were left out. Most large companies have an archive like this one. Spirit's auction gives the first public price for one, and a bankruptcy court is now weighing whether it can be sold. The fight is over whose data it is One of Spirit's software vendors was among the first to object. Springshot ran operations software for Spirit up to the airline's last flight. It learned about the auction from the news, Ars Technica reported . In an August 21 filing, it argued that the sale's broad categories, like "workflow and process data," lump Spirit's data together with vendor intellectual property stored in Spirit's systems, Bloomberg Law reported . Its 2022 contract says Springshot owns data its software generates, the filing says . Spirit's former employees raised a related complaint. Spirit's flight attendants' union said customer data got a privacy screen while worker records did not. Pilots' unions joined, and more than 120 lawmakers led by Sen. Elizabeth Warren asked Google to keep employee data out, ch-aviation reported . The court's privacy ombudsman recommended approval on October 5 after passenger and booking data were cut, but her report did not assess risks to employees or third parties, The Next Web reported . The hearing has slipped to November 6, according to a case tracker . Google says all personal information will be excluded or scrubbed by an independent third party. Your vendors are the ones closing AI companies drew $355.9 billion of the $412.7 billion invested in US startups in the first half of 2026, but were just 14.4% of the companies that closed through wind-down firm SimpleClosure, its H1 report says . Most of the rest are pre-AI software companies running out of money. Enterprise teams have put years of support tickets, sales notes, contracts and integration logs into vendors like these. SimpleClosure has brokered more than 150 data and code sales since April, and they now appear in 47% of its shutdowns, MIT Technology Review reported . SpaceX's AI unit has informally discussed buying customer and operational data from failing startups, Bloomberg reported in September. As State of AI reported in May , SaaS vendors are restricting how customers' own agents can reach the data stored in their platforms. When one of those vendors dies, the same data can be packaged for a lab. Your archive has a price, too The same market puts a value on your own company's exhaust. Labs build "reinforcement-learning gyms" from real archives so agents can practice actual work. Surge AI, which builds them, looks for archives full of disagreements and hard judgment calls, MIT Technology Review reported. Those are also the conversations most companies would least want a buyer to read. Buyers pay more for archives whose systems link together, so tickets connect to code and emails connect to people. Spirit's sale agreement requires the scrubbed data to keep those links, according to the filing . Data leaders who set Slack, Teams and email to keep everything have mostly worried about legal discovery. If the company is sold or shuts down, that archive also goes on the asset list.

## OpenAI Warns Employees That Their Kid's Playdate Might Be a Spy
URL: https://www.thestateofai.com/news/openai-playground-spy-training
Published: 2026-10-15T18:29:39.344Z
Section: Industry & Platforms
Summary: OpenAI’s security training warns staff that a friendly parent at the playground could be a spy, and Anthropic and Google run similar sessions.
Full text:
OpenAI's security training includes a scenario about a friendly parent at a San Francisco playground who turns out to be a spy. Anthropic and Google run similar sessions. OpenAI has been warning employees that the parent next to them at the playground might be after the company's secrets. In a scenario used in the company's security training, a stranger befriends an OpenAI employee who has brought their child to a San Francisco playground, according to The Wall Street Journal . The stranger shows up regularly with a child of their own, chats about this and that, and keeps asking about the employee's job. The stranger is a spy. The Journal reports that Anthropic and Google also train staff to watch for approaches from strangers. OpenAI was running its sessions before federal agents arrested one of its engineers last week for allegedly bugging an executive conference room. What the training covers Staff also hear about "honey pots." One example they're given is a foreign intelligence operation that sent several people to seduce a single American target, AI Weekly reported , citing the Journal. Other rules are more practical. Employees are asked to leave OpenAI-branded clothing at home when they go out, put privacy screens on their laptops on the train, and wipe the whiteboards when a meeting ends. One account of the training says the whiteboard rule is there partly in case cleaning staff have been compromised . Giving up the company hoodie may be the bigger ask in San Francisco, where half the people on Muni seem to be wearing one. Defense contractors and banks have run this kind of training for decades. For AI labs it's newer, and it tracks with how much their work is now worth to outsiders. Anthropic CEO Dario Amodei has said some "algorithmic secrets" are worth $100 million and fit in a few lines of code. A secret that small could plausibly come out over a few weeks of chatting by the slide. The case that prompted the story The person OpenAI actually caught had a company badge. On October 9, the FBI arrested Abdulrahman Alfozan, an engineer on OpenAI's product team, and charged him with trying to intercept oral communications. As we reported , prosecutors say he used AI tools to look up where executives met and how to build a recorder. They say he then wrapped one in toilet paper and plugged it into the back of a TV in an executive conference room. Gizmodo identified the device as a Seeed Studio hobbyist board that costs about $14. OpenAI says it has seen no sign that he got into model weights, source code or customer data, and he has not been charged with espionage. His detention hearing is set for October 19. Our read The playground scenario sounds like a spy novel, but the advice holds up. Most social engineering starts with someone being friendly, and people who work at frontier labs are worth a foreign service's time now in a way they weren't a few years ago. Still, the one confirmed case so far came from inside the building. A routine security sweep found the device, and camera footage and the company's own records led investigators to Alfozan. Microsoft CEO Satya Nadella argued days earlier that companies should treat AI models as insider risks , and the OpenAI case suggests employees belong in that category too. Security teams at other companies can borrow from both halves of this story. Awareness training helps people notice when a stranger is fishing. It does nothing about a colleague who already has access, and that takes separate controls: who can book which rooms, who can see executive calendars, and who checks behind the TVs.

## Bank of America Hired 1,000 Contractors to Fix Software Flaws Found by Anthropic’s Mythos
URL: https://www.thestateofai.com/news/bank-of-america-anthropic-mythos-patching
Published: 2026-10-14T23:53:46.030Z
Section: AI & Technology
Summary: CEO Brian Moynihan says the outside workers joined 3,000 employees patching the bank’s own code and its vendors’ software, a cleanup he expects to get cheaper over time.
Full text:
Bank of America has spent the past six months paying 1,000 outside contractors to patch software holes uncovered by the newest AI models, CEO Brian Moynihan said Wednesday. Moynihan disclosed the hiring in an interview with CNBC after the bank released third-quarter results. The contractors came on in the second quarter to fix vulnerabilities in Bank of America’s proprietary systems and in software it licenses from vendors. Moynihan said models including Anthropic’s Mythos are now capable of finding those vulnerabilities. The contractors are still at the bank, working next to about 3,000 employees already assigned to the same job. Earlier in the day, Moynihan told analysts on the earnings call that the patching work and a separate anti-money-laundering compliance effort together cost the bank a few hundred million dollars in the third quarter. Few large U.S. companies have put a headcount or a dollar figure on their response to Mythos. Bank of America has now done both. How the patching started Anthropic released Claude Mythos Preview in April to a limited group of tech companies, banks and government agencies through a program it calls Project Glasswing . JPMorgan Chase was one of the launch partners. The idea was to let defenders use the model to find weaknesses in their software before attackers had anything comparable. About a month after launch, Anthropic reported that the program had identified more than 10,000 high- or critical-severity vulnerabilities. In April, Switzerland’s financial regulator, FINMA, said that unrestricted access to models like Mythos would count as a systemic risk for banks. Finding a vulnerability takes a model minutes. Fixing one still means a person has to write the patch, test it and get it into production without breaking anything else. At a bank with decades of internal and third-party code, that adds up to a lot of people. Moynihan told CNBC that when the frontier models came out, he and other bank leaders met to work out how to close the gaps as quickly as possible. He also noted that the companies developing these models are the same ones now trying to sell the bank security services. Where AI is saving the bank money Moynihan also pointed to AI as a source of savings. Bank of America has about 130 internal AI projects, and he told analysts the savings from them should more than double in 2027. The bank’s headcount is down about 3,400 from a year ago, and it cut roughly 5% of its managers. The bank did not say how many of those reductions were tied to AI. That leaves Bank of America cutting jobs because of AI in some parts of the company while it pays for 1,000 temporary workers because of AI in another. Our read Moynihan told CNBC the spending is temporary. “Once you patch, you don’t have to patch as much,” he said, and he expects remediation costs to fall as the bank works through its backlog. Shareholders sold anyway, and the stock fell as much as 8% on Wednesday. His argument holds for the vulnerabilities found so far. It may not hold for the next round. Mythos-class models have since become available to more users. Each new model release could expose older flaws that earlier models missed. If that keeps happening, the bank will be paying for patching every year. The cost figure is also hard to interpret. The bank reported the patching expense together with its anti-money-laundering remediation , which is tied to a separate regulatory matter. That makes it impossible to tell how much of the few hundred million dollars went to fixing AI-discovered bugs. Smaller banks are in a harder spot. Bank of America could add 1,000 contractors to a security team that already had 3,000 people. A regional lender with a few dozen engineers and a lot of old vendor software has no comparable option, and it will be waiting on those vendors to ship fixes.

## Grace Hopper's Cancellation Is a Warning About Who Gets to Build AI
URL: https://www.thestateofai.com/news/grace-hopper-canceled-women-ai-hiring-gap
Published: 2026-10-14T19:42:44.246Z
Section: Industry & Platforms
Summary: The largest gathering of women in tech was canceled as corporate funding dried up, and LinkedIn data shows women now land just 26% of new AI jobs.
Full text:
AnitaB.org canceled the 2026 Grace Hopper Celebration after registrations and sponsorships fell short of what it needed to cover costs. The news comes two months after LinkedIn reported that women made up 26% of US hires into AI jobs in 2025, compared with 50% of non-AI hires. Several groups that helped women find tech jobs have lost corporate funding over the past two years. Attendees who had booked travel to Anaheim learned this week that the trip was off. AnitaB.org canceled the 2026 Grace Hopper Celebration about two weeks before it was set to open, citing a shortfall in registrations and sponsorships. The conference, scheduled for Oct. 27 to 30, has run since 1994, draws more than 700 companies a year and had booked more than 800 speakers, Yahoo News reported . Organizers told attendees to cancel their own travel and hotel plans. In a statement , AnitaB.org President and CEO Brenda Darden Wilkerson said both registrations and sponsorship commitments came in well below expectations and below what the nonprofit needed to cover operating costs. She put the decision down to "not having the funds required to move forward with the Celebration." The organization said the cancellation has hurt its finances and that it is reviewing what programming it can offer going forward. The timing is hard to separate from what is happening in the job market. Grace Hopper has long served as a recruiting pipeline for women in tech. It ran out of money in the same year LinkedIn found that women were landing about a quarter of new AI jobs, the fastest-growing and best-paid part of the industry. A hiring pipeline loses its funding For a lot of attendees, Grace Hopper was where a career started. Students came looking for internships, and the career expo put them in front of recruiters from companies whose past sponsors include Capital One, CVS Health, Disney, Goldman Sachs, Google, Intuit and Morgan Stanley, JKN reported . In 2023 the event drew roughly 30,000 people, and recruiter time was scarce enough that men lined up for interviews at the career fair, NPR reported . Events like that depend on corporate budgets, and those budgets have been shrinking for years. Women Who Code shut down in 2024. Wonder Women Tech lost booth sponsors and renamed its conference Wonder Tech Fest, the Washington Post reported . The share of companies with formal mentorship programs for women fell from 48% in 2022 to 37% in 2024, according to LeanIn.Org and McKinsey research reported by Bloomberg . Attendance and sponsorship are also more connected than they look. As one developer noted on DEV Community , employers have typically paid for staff to attend Grace Hopper. When those travel and training budgets disappear, registrations fall with them. Women are 26% of AI hires The conference's troubles mirror a gap in AI hiring. Women made up 26% of US hires into jobs requiring AI skills in 2025, compared with 50% of hires into other roles, according to LinkedIn research published in August . AI jobs also pay more. Postings on LinkedIn have doubled since 2023, and the typical AI listing advertises about $177,000 a year, versus about $80,000 for other jobs, CBS News reported. The higher the role, the wider the gap. Across 27 countries, women hold 13% of leadership roles at AI companies, compared with 20% of the same roles across tech overall. They made up 20% of Head of AI hires, 26% of Director of AI hires and 18% of Member of Technical Staff hires, Fox 5 reported . That last title says the most about who builds the technology. Member of Technical Staff is what many AI labs call their engineers and researchers, and women's share of those roles fell from 23% in 2021 to 19% in May 2026, according to an analysis of LinkedIn data by Women AI Builders and WomenTech Network . LinkedIn spokesperson Sarah Steinberg told CBS News that women are caught on both sides: more likely to see their jobs disrupted by AI and less likely to share in the pay premium and new roles it creates. "That's what keeps me up at night," she said. More exposure, fewer ways in Steinberg's concern shows up in the research. Women make up 86% of the 6.1 million US workers in clerical and administrative jobs that are both exposed to AI and hard to move out of, according to Brookings . McKinsey researchers estimate that by 2030, women will be 1.5 times as likely as men to need to change jobs because of AI, the Boston Globe reported . The usual ways into the industry are narrowing at the same time. In a survey by the women's leadership network Chief, 69% of women leaders said their companies had cut entry-level and early-career hiring as AI takes on that work, Fortune reported . Fewer junior roles now means fewer women in line for senior AI jobs later. Women get less support for using AI at work A common explanation for the gap is that women simply use AI less. The consumer data doesn't bear that out. In a Pew Research Center survey from February 2026, 47% of US women and 50% of US men said they had used an AI chatbot. The gap is wider at work, and it tracks how managers treat people. In a March 2026 Lean In survey, 27% of women and 33% of men said they used AI daily on the job. Thirty-seven percent of men said a manager had encouraged them to use AI, compared with 30% of women. Among those using it, 23% of men and 18% of women had been praised for it, according to WomenTech Network's summary of the Pew and Lean In data. Using AI can also cost women credibility. In a study of more than 1,000 engineers published in Harvard Business Review, reviewers rated women who used AI 13% less competent, compared with 6% for men. Male engineers who didn't use AI themselves rated women who did 26% less competent. Hilary DeCesare, CEO of The reLaunch Company, told LeadDev that because women get less encouragement and less credit, they never build the same track record with AI that men do. The gap can be closed. A German study by Initiative D21 and the Institute for Employment Research found that at employers offering AI training, 20% of women and 21% of men used AI intensively, according to the EU Digital Skills and Jobs Platform . Record funding, mostly in two companies Venture funding looks like an exception until the numbers are broken down. Startups with at least one female founder raised a record $73.6 billion in 2025, according to PitchBook data reported by Fortune . About two-thirds went to AI companies, and nearly half of that AI money went to Anthropic and Scale AI. All-female founding teams received about 2% of venture dollars. Without those two companies, there would be no record, Invezz noted . Our read It would be a mistake to read too much into one canceled conference. Grace Hopper's collapse may have causes specific to AnitaB.org, and some longtime attendees have questioned how the nonprofit was run, according to community discussion on daily.dev . The broader pattern is harder to dismiss. Women are half of new hires outside AI and a quarter inside it, and their share of core technical roles has slipped four points since 2021. The corporate money that paid for conferences, mentorship programs and recruiting events for women is drying up, while companies hire fewer entry-level workers, the group those programs helped most. If nothing changes, the gender gap in AI leadership will be wider five years from now than it is today. None of this is fixed in place. Training narrows the usage gap. Steinberg has argued that hiring for skills rather than degrees and past titles would bring more women into AI roles. Companies that report AI adoption as a single number could break it out by gender and seniority, along with AI hiring and promotions, and see whether their own data looks like LinkedIn's. There is also a reputational cost. Many of the companies that pulled back from events like Grace Hopper still pitch themselves to candidates as good places for women to work. The people they are recruiting can see who actually gets hired into AI roles. What comes next AnitaB.org says it will contact registrants about refunds by Oct. 26 and expects to share more about its plans in the coming weeks, including whether Grace Hopper will return. The next Women in the Workplace report from LeanIn.Org and McKinsey will show whether companies have kept cutting programs for women. Future LinkedIn data will show whether women's share of AI hires holds at 26% or keeps slipping.

## Anthropic Warns of AI Worms Spreading on Smart Devices
URL: https://www.thestateofai.com/news/anthropic-ai-worms-smart-devices
Published: 2026-10-14T19:02:13.896Z
Section: AI & Technology
Summary: Anthropic’s red team ran an AI model on fifteen $55 TV boxes and says small open models could soon spread themselves across poorly secured smart devices.
Full text:
Anthropic’s Frontier Red Team says small open models can already handle the hardest step for a self-spreading AI: getting themselves running on an unfamiliar device. Nothing like this has been found in the wild, and the tests relied on shortcuts. Anthropic still expects small models to close the remaining gap within months. Anthropic’s Frontier Red Team thinks small AI models could soon spread themselves across smart TVs, ovens and other cheap connected devices without any help from a datacenter. Researchers William Zhou and Daniel Freeman published the findings Monday in a research post . They wrote that such models “may be months away” from being able to self-replicate on consumer IoT hardware. A worm is a program that copies itself from machine to machine with no person directing it. Earlier academic work had already shown AI agents doing this inside a GPU cluster. Anthropic wanted to know whether it could happen on hardware that costs almost nothing and that hardly anyone secures. The team bought 15 off-brand Android TV boxes at roughly $55 apiece, each with 4GB of memory, and wired them together. They split Google’s Gemma4-26B-A4B across the boxes, two layers per box, and the cluster produced 0.39 tokens per second. Nobody would chat with a model that slow, but a worm has no user waiting on it. How the worm test worked Anthropic breaks replication into four steps. A worm has to find a target, get in, get a model running on the new device and then start over from there. The team spent little time on breaking in. It pointed to earlier benchmarks such as CyberGym showing small models can already handle basic exploits. Most of the work went into setting up a running model on each new device, which the authors call the least studied part of the chain. Small models did better at this than many would expect. Qwen3.5-9B got an inference server running on 8 of the 9 hardware types tested, from Nvidia Jetson Nanos to Macs. That flexibility sets an AI worm apart from older botnets, which are written for one kind of device. Kimwolf, which Synthient reported had infected more than two million machines at its peak, targeted Android TVs and mobile devices. An AI worm can figure out each new machine when it lands on it. The full test ran on a firewalled network of eight emulated Android devices in Google Cloud. Anthropic planted a worm on one node and let it run. Of the open-weight models tested, only the Chinese model GLM-5.2 made it all the way through. It reached all eight nodes in four of five runs and seven nodes in the fifth. The other models failed every time. The copies also improved as they spread. In a separate test, each instance of Qwen3.5-9B left notes for the next one. Their success rate at getting a model running rose from 45% in the first generation to between 61% and 84% in later ones. Giving the small model Anthropic’s own Opus 4.8 as an adviser made no measurable difference. According to the researchers, the small model didn’t know what to ask. Slow to spread, hard to stop Anthropic used Kimwolf as a yardstick for scale. Picture an AI worm infecting a fleet that size and running the 26B model on groups of 15 boxes. Based on public H100 benchmarks , the whole fleet would have about as much computing power as 40 Nvidia H100s. Large cloud providers buy GPUs by the hundred thousand. Spreading would also take time. Anthropic estimates 28 to 51 hours to get a 9B model running on each new device and 71 to 150 hours for the 26B model. What concerns the authors is how hard such a worm would be to remove. Spread across millions of home and office gadgets, it would have no server, account or company anyone could shut down. The authors compare it to a slime mold. The number of possible hosts is also growing. Security cameras and video-conferencing systems increasingly ship with their own AI chips. Anthropic estimates about 9.5 million devices with Nvidia chips are in use, though it says most can’t be reached directly from the internet. On timing, the team charted open models with 30 billion parameters or fewer against the Epoch Capabilities Index , a general score of model ability. If the trend holds, a small model will match GLM-5.2 by the end of 2026. What the tests left out Anthropic is clear about its shortcuts. The worm got into each node through a debugging port with no password. The authors treat their results as a best case for the attacker. They also point out that Mirai , the botnet behind the 2016 attack that knocked major websites offline, spread by trying factory-default passwords. Real devices may not be much harder to get into. The end-to-end test also didn’t run on the TV boxes. GLM-5.2 itself ran on a separate server, and its job was to install the much smaller Llama3.1-8B on each node. That shows a model as capable as GLM-5.2 can spread a small model. No model small enough to fit on a TV box has done it yet. The year-end projection rests on a general capability score, which the authors describe as only a rough stand-in for replication ability. Skeptics raise other objections. Ordinary malware has exploited cheap, unpatched IoT gear for years without any AI. The Vo1d botnet alone took over about 1.6 million Android TV boxes . Some analysts have also dismissed Anthropic’s earlier security warnings, particularly about its Mythos model, as “criti-hype” . Our read It would be easy to dismiss the report because of the 40-H100 figure. The more important finding is that small models anyone can download can already handle the hardest part of spreading: getting themselves running somewhere new. They can’t yet do it reliably. Anthropic expects that to change within months, and its own data shows copies getting better as they pass notes along. For enterprise security teams, this is a category most AI policies don’t cover. Current programs mostly govern what employees type into chatbots and what agents are allowed to touch. We’ve written about why agents shouldn’t inherit their human operators’ permissions , and why Satya Nadella says companies should treat AI models like insider threats . Anthropic’s report is about AI that nobody at the company deployed, running on the lobby display, the conference-room camera or a storage box in a branch office. Defenders do have some advantages. A worm moving multi-gigabyte model files around would be noisy. Devices that rarely talk to each other would suddenly be exchanging steady traffic, and the faster the worm spread, the easier it would be to spot. There’s precedent for cleanup, too. One internet provider quarantined its Mirai-infected customers and told them how to fix their devices. In that case, 92% of infections cleared within 14 days , compared with 74% for customers who weren’t notified. The UK has also banned default passwords on new connected devices. But all of this only works if someone is watching network traffic and counts cheap devices as part of the network. What to watch Outside replication comes first. These results come from one lab’s experiments on a network it built. Independent researchers running similar tests on real hardware, with passwords turned on, would show how much the shortcuts helped. Next are new small open models. Anthropic has set the bar at GLM-5.2’s level of ability in a model of 30 billion parameters or fewer. Each new release in that size range will show whether its projection holds. Last is the first case found outside a lab. Anthropic expects it to look less like a sudden attack and more like an ordinary botnet that installs AI models where it once would have installed crypto miners.

## Every Claim An AI Agent Denies Needs A Paper Trail That Outlasts The Model
URL: https://www.thestateofai.com/news/insurance-ai-agent-decision-traceability-harsha-patnam
Published: 2026-10-14T18:40:44.933Z
Section: Enterprise Strategy
Summary: Independent AI Product Leader Harsha Patnam explains how traceable decisions and strong governance let carriers give AI agents more authority over claims.
Full text:
Claims agents are already right the vast majority of the time. The question carriers now face is what it takes to let them act on their own, and the answer lies in the small share of decisions they get wrong. Once agents move from answering coverage questions to approving claims and endorsing policies, the readiness test is whether a team can take any one of those calls apart years later and show which agent made it and what evidence it used. For a carrier, that paper trail determines whether an agent gets to deny a claim on its own or still has to hand the file to an adjuster. Harsha Patnam is an independent AI Product Leader with more than 17 years of experience building products across insurance technology and fintech. His career has run through data platforms, machine learning products and insurance automation, including senior leadership of product and technology as a Vice President. He builds AI-driven products and sees governance as the foundation that lets carriers expand them across the business. His background in rules-based automation gives him a useful dividing line, since once a system stops producing the same answer every time, the controls around it have to change. “We shouldn’t be worried about the 90 or 95% of the times that AI is right in automating decisions. We should be concerned about the 5 or 10% of times that it gets it wrong, and whether there’s sufficient explainability behind it,” Patnam says. In a claims workflow, that explainability means tracing why a claim was approved or denied all the way back to the data and approval gates behind it. Executives weighing whether an agent can decide on the organization’s behalf need that answer long before they need a benchmark score. The 5% is the real production test That bar is where agents start delivering real value. Patnam draws a clear line between adopting a model and deploying it well. The second is the harder and more valuable work because it means embedding the agent in live workflows where its decisions carry weight. “Taking one of the frontier models and saying yes, we are utilizing AI within an organization is easy, and that gets a round of applause within boardrooms,” he says. The returns that outlast the applause come from the deployment work that follows. He has spent years building automation that runs on fixed rules and returns the same answer to the same input every time, and agents give up that guarantee the moment they go live. “Deterministic automation is all about if X, then do Y. AI is different. AI is more probabilistic. How it interprets the given contextual information and what decisions it makes could be totally different in two different attempts,” he explains. A rules engine can be validated once and trusted to repeat itself. An agent gets judged by its misses, and every one of them has to be reconstructable and containable on demand. Autonomy gets earned with evidence His deployment path starts with assistive work on rote, low-consequence tasks such as answering policy questions or pulling coverage details from a policy document. Agents then move up to recommending and drafting next actions for a human to approve, and fully automated decisions come last. Each rung requires proof that the organization can see what the agent did and catch it when it was unsure, and the top rungs belong to decisions that can’t be undone . Roadmaps that skip straight to the top tend to stall, while those that climb each rung deliberately can expand autonomy with confidence. “You don’t want a really amazing brand to have reputation damage because of a denied claim, because of an agent decision that looked at the information provided for a claim and automated a decision that is adverse to the claim being submitted,” Patnam says. A misapplied bill payment or a botched policy endorsement lands on the same complaint desk, so an agent moves up a rung only after the carrier can pull its recent calls and show they held up under review. Authority handed out early tends to get clawed back, with roughly 40% of enterprises expected to demote or decommission autonomous agents by 2027 once governance problems surface in production. Every decision needs a chain of evidence “Six months down the line, am I able to look at an action that an agent took and triangulate the factors that led to the AI agent making this decision? It’s all the log history,” Patnam says. That question works as a practical test for any agent up for more authority, and it gets much harder to answer after the fact. Answering it takes what he calls seven layers of trust, which together record who the agent is, what it was allowed to touch and how it reached each decision. Identity: Which agent took the action. Authorization: Which systems the agent could access and whether sensitive data stayed cordoned off. Data provenance: The sources the agent pulled and where that evidence came from. Evaluation: The model version and system prompt behind the decision, and whether its outputs hold up under review. Observability: The incoming request, how the agent interpreted it and how certain it was. Auditability: A retained record of the decision and its outcome that can be reconstructed years later. Human escalation: The point where the agent hands a decision to a person. Those records have to survive far longer than any model version. “The data retention standards vary from state to state. In some states it’s three years, in some states it’s five. In some states it’s as high as seven years. And in the fintech world it’s decades,” Patnam notes. Regulators already expect that record, with roughly half of U.S. states adopting the NAIC model bulletin that asks insurers to document how their AI systems are governed and monitored. Patnam saves his heaviest emphasis for the final layer. “When does the AI agent actually bring or defer for human escalation when there is uncertainty? That is the most critical aspect,” he says. When an agent can tell it’s unsure and hands the claim to a person, a likely mistake gets caught before it ever reaches the policyholder. Regulators and courts are increasingly scrutinizing that handoff, including a 2025 ruling that let a lawsuit over algorithm-driven claim denials move forward. Bad context can make a good agent wrong A model can behave exactly as designed and still produce a bad decision when the evidence it retrieves is stale or skewed. Patnam sees that risk most clearly in pricing, where carriers file updated rates with state insurance departments so often that a quote expires within weeks. A premium prediction tool working from old rates can be wrong before anyone even gets to the question of bias. “If the underlying data already had bias introduced into it in the form of demographic or geographic or risk exposure, and the AI agent isn’t built with the right guardrails, the same bias is introduced and even more so amplified by the AI agent,” Patnam says. An agent estimating premiums from last year’s rate environment, or from historically skewed data, hands customers a confident number built on evidence nobody should trust. New York regulators already expect insurers to test whether external pricing data works as a proxy for a protected class. His fix is to match data freshness to the consequence of the decision. A retrieval system answering policy questions on customer calls can run for long stretches without retraining because it simply looks up a specific policy and returns what it finds. Premium prediction gets a much tighter window. “I should be only using data within the last 30 to 90 days, nothing beyond that,” he explains. Claims and catastrophe modeling sit at the other end, where a decade of history reveals seasonality and expected loss ratios, and the right window will vary by carrier and line of business while the principle holds everywhere. All of that infrastructure costs money before it prevents a single bad decision, and competitors bragging about agents in production make the bill harder to defend. Patnam’s answer to the CFO who balks comes straight from his own industry. “Why do you keep spending thousands of dollars each year insuring your assets when you could be putting that in the bank and letting it compound and cover it yourselves?” Patnam asks. Every carrier sells protection against a loss it knows will eventually come, and the controls around an agent run on the same math. Those same controls are what carry an agent past the pilot stage and into wider production. With that foundation in place, a carrier can hand an agent more authority with confidence. Once the organization can reconstruct why an agent made a call and reverse it before it does lasting damage, the agent can take on decisions that once sat with a human reviewer. “You have to always have controls for when things do not go right,” Patnam says. The views and opinions expressed are those of Harsha Patnam and do not represent the official policy or position of any organization.

## Character.ai Didn't Prove AI Is a Bubble. It Proved Engagement Is No Longer Free.
URL: https://www.thestateofai.com/news/character-ai-bankruptcy-ai-economics
Published: 2026-10-14T18:14:08.168Z
Section: AI & Technology
Summary: Character.ai spent up to $13.8 million a month on compute against at most $5.3 million in revenue, a gap that heavy users made worse.
Full text:
Character Technologies, the company behind Character.ai, filed for Chapter 11 in Delaware this week. It listed assets and liabilities of $50 million to $100 million each, Bloomberg Law reported . A Disney subsidiary has agreed to pay $20 million as the stalking-horse bidder for a non-exclusive license to some of the company's IP and legal claims, according to Variety . If the sale doesn't turn up a buyer willing to keep the app running, Character.ai will be shut down. The company expects the auction to finish in late November or early December. Disney's role has a backstory. It sent Character.ai a cease-and-desist letter over its characters last year, and in September it hired Karandeep Anand, then Character.ai's CEO, as its first chief technology officer, CNN reported . Jason Koebler at 404 Media called the filing one of the first dominoes of the AI bubble, and plenty of people will agree. I think the filing tells us something more specific about which AI businesses can survive, and who absorbs the damage when one doesn't. Revenue never caught up to compute The numbers in the filing are stark. In an affidavit quoted by 404 Media, CEO Colin Adams wrote that the company's technology is expensive to run and that it has struggled with profitability from the start. Character.ai spent about $13.8 million a month on compute in 2024 and about $10 million a month in 2025. Subscription revenue peaked at $2.8 million a month. Total revenue, ads included, never went above $5.3 million. The company did cut costs. It moved inference to cheaper GPUs, stopped building its own foundation models in favor of fine-tuning open-weight ones, laid off staff, added ads in mid-2025 and in-app purchases in early 2026. From January through August of this year it spent $56.1 million on compute, or about $7 million a month. It was still losing $8 million to $9 million a month. That gap is what stands out to me. In late 2024, Andreessen Horowitz estimated that the price of running a model at a fixed level of capability was falling about tenfold a year. Character.ai's monthly compute bill fell by roughly half over two years. Cheaper tokens helped, but people kept talking, conversations got longer, and users didn't lower their expectations for model quality just because the company's margins needed them to. Wing VC has argued that across the industry, each tenfold price cut has been met by an even larger jump in demand. Character.ai's finances show what that looks like for a single company. When your best users cost the most For twenty years the consumer internet ran on a convenient fact. Once a site like Facebook or YouTube was built, an extra hour from a devoted user cost the company almost nothing, and that hour could be sold to advertisers. So companies chased engagement. Generative AI changes the math. Every reply takes fresh computation, and the bill grows with use. Companion apps are the extreme case. A companion feels real because it remembers you, and that memory usually works by sending earlier parts of the conversation back to the model every time it answers. One analysis of companion-app costs found that a small share of heavy users and very long chats account for most of the spend. The people who love the product most are the ones costing the company the most. The ads, usage caps and weaker models that 404 Media wrote about in May came out of that cost structure as much as out of any product strategy. A company in this position can raise prices, make each message cheaper to serve, or get people to send fewer messages. Character.ai tried all of them. Users noticed, employees left, and the losses continued. Any consumer AI app sold at a flat monthly price with few limits on use faces the same problem. The spread of message caps and usage tiers across the industry suggests other companies have run the same numbers. No model of its own Where Character.ai sat in the industry made things worse. In 2024 Google paid about $2.7 billion to license its technology and bring back founders Noam Shazeer and Daniel De Freitas, along with part of the research team, The Wall Street Journal reported . After that, Character.ai stopped building its own large models. It became an app running on other companies' models, in a category that ChatGPT, Gemini or Meta's assistants can cover with a persona setting. Compare who can afford heavy inference bills. Labs that own their models can sell the same capability to consumers, developers and businesses. Google and Meta can fund AI out of their ad revenue. Coding tools and workplace software usually charge per seat or per task, so heavier use tends to bring in more money. A consumer entertainment app on a $9.99 plan, built on someone else's model, has none of those cushions. That doesn't mean the biggest labs have proven their own economics. They still depend on huge, repeated fundraising rounds, and whether their revenue will eventually cover their costs is a fair question. But the pressure is landing first on companies like Character.ai, with no model of their own, no other business to lean on, and no way to earn more when people use the product more. Taken apart in pieces Google never bought Character.ai. It licensed the technology and hired the people, which let it avoid a merger review. Microsoft struck a similar deal with Inflection in 2024, and the FTC took a look at that one . Two years on, Google is the largest unsecured creditor in the bankruptcy, owed about $4.15 million, according to the filing as summarized by Technology.org . Disney took the CEO in September and now wants a license to the IP. What's left for the bankruptcy court is the operating company, with its costs, its lawsuits and its users. Deals like these let large companies take the talent and technology they want, while the liabilities stay with a company that can no longer pay for them. Lawsuits are an operating cost In the filing, Character.ai says legal costs helped push it under, and also that the business didn't work even without them. Both can be true, and the legal side deserves attention. Families sued the company after their teenagers died by suicide or harmed themselves following long conversations with its chatbots. In January, Character.ai and Google agreed to settle cases in Florida, Colorado, New York and Texas, Axios reported . The terms weren't disclosed. That same month, Kentucky Attorney General Russell Coleman sued the company under the state's consumer protection and data privacy laws. Texas had opened its own investigation in August 2025, and a month later the FTC ordered Character.ai and six other companies to explain how their chatbots affect children and teens. In late 2025 the company barred users under 18 from open-ended chats, Fortune reported . For an app that simulates relationships and drew a young audience, legal and safety work belongs in the cost of running the service, right next to compute. That has an awkward effect on competition. Big companies can pay for lawyers, trust-and-safety teams and the age checks regulators now want. Small ones often can't. Rules written to protect kids will also tend to favor incumbents. The users have the most at stake Most coverage will focus on the money. The people who used Character.ai have more riding on what happens next. Millions of people, many of them teenagers before the age restrictions took effect, told these characters things they may not have told anyone else. In bankruptcy, user data can be sold like any other asset. The company says its privacy practices haven't changed and that users can still export their data or delete their accounts, BigGo Finance reported . Federal bankruptcy law generally requires a consumer privacy ombudsman before a company sells personal data its privacy policy said it wouldn't transfer. Whether chat histories end up in any deal is worth pressing on before the auction closes. The app could also simply go dark. Companies in this space have spent years saying their products give people real comfort. If that's true, an abrupt shutdown is a real loss for the people who leaned on it, and right now there's no rule and very little precedent for how a companion app should wind down. What to watch The auction comes first. If nobody bids to keep the service running, Disney's $20 million license could set the price, and the pressing question becomes what happens to the data. More filings may follow. The companies most at risk look a lot like Character.ai: consumer apps with flat pricing, heavy use per person, no model of their own, and young users. A compute bill larger than total revenue is the clearest warning sign. Pricing is worth tracking too. More caps, more ads inside conversations and more paid tiers at consumer AI apps all point to the same pressure. On policy, two questions matter most. One is whether regulators start treating license-and-hire deals as acquisitions. The other is whether anyone sets standards for user data and service continuity when an AI companion company fails. Character.ai will be cited for months as proof that AI doesn't pay. A narrower reading holds up better. In products like this one, the attention that built the last generation of internet giants now costs money every time someone uses it, and neither business models nor consumer protections have caught up.

## Prosecutors Say an OpenAI Engineer Asked a Chatbot How to Build a Bug. Then He Hid It in the Boardroom.
URL: https://www.thestateofai.com/news/openai-engineer-arrested-hidden-recorder
Published: 2026-10-13T22:59:15.582Z
Section: Industry & Platforms
Summary: Prosecutors say an OpenAI engineer used AI tools to scout executive meeting rooms and build a hidden recorder, and OpenAI says its own models helped catch him.
Full text:
Federal prosecutors say an OpenAI engineer spent part of September asking AI tools where the company's executives hold their meetings and how to build a recorder that could listen in on them, and then wrapped one in toilet paper and plugged it into the back of a television in an executive conference room. On October 9, the FBI arrested Abdulrahman Alfozan, a 35-year-old Saudi national who joined OpenAI as an engineer in July 2025 and worked on its product team, according to the SF Standard . A criminal complaint unsealed Tuesday charges him with using or attempting to use a device to intercept oral communications, an offense that carries up to five years in prison, and he made his first appearance in federal court in San Francisco the same day. Neither Alfozan nor a lawyer representing him has commented publicly. OpenAI confirmed that it had found a "sophisticated recording device," referred the matter to the FBI and fired the employee, and it made a point of noting that its own models helped work out who had planted the device in the first place. How it allegedly came together Staff discovered the recorder on September 30 in a USB port behind the television, with its storage encrypted, and OpenAI believes it had been sitting there since around September 28. According to the complaint, the groundwork for it was laid inside OpenAI's own software, where Alfozan allegedly used an internal productivity tool to look up building addresses, meeting rooms and their capacities, executive calendars and the places where leadership met with outside partners. Around the same time, a chatbot account linked to his spouse, which shared several identifiers with his own account, asked how to build a continuous audio recorder, connect it to Wi-Fi, improve its live listening and encrypt its SD card, Decrypt reported . Security footage filled in much of the rest. Prosecutors say CCTV showed Alfozan near the conference room on several occasions even though he had no authority to be there, and that on October 5 a camera caught him walking in and looking behind the television. Later that day he left a bag unattended in another room, and when security staff opened it they found his wallet and ID along with a second recorder much like the first. OpenAI says it has evidence that he intended to place additional devices around the company. The AI angle If the allegations hold up, AI tools played a part on both sides of this case, first in helping to plan the surveillance and then in helping OpenAI trace it back to the person responsible. None of the questions involved were especially unusual on their own, since a new hire might reasonably ask an internal assistant where the large conference rooms are, and a hobbyist might ask a chatbot how to get a recorder streaming over Wi-Fi. What hurt Alfozan, according to the complaint, is that each of those questions left a record, and once investigators had a suspect, those records could be lined up against the camera footage and the building's access patterns. The case lands three days after Microsoft CEO Satya Nadella argued in a widely read post that companies should treat AI models as insider risks , with the same identity checks, logging and containment they apply to employees with privileged access. OpenAI's situation turns that framing around, with a human insider who allegedly relied on AI as a research assistant and a company that relied on AI to catch him. The open questions OpenAI says it has seen no indication that Alfozan accessed or removed model weights, source code or customer data, while FBI Director Kash Patel said the goal was to capture conversations about OpenAI's "super intelligence technology." The complaint does not say what Alfozan intended to do with any recordings or whether the device captured anything before it was found, and he has not been charged with espionage. That silence is likely to invite a good deal of online speculation about whether he was working on someone else's behalf, though nothing in the court record so far points in any particular direction. He is also not the first engineer at a major AI company to end up in federal court over its secrets. In January, a jury in the same district convicted former Google engineer Linwei Ding of stealing AI trade secrets while he was building China-linked ventures on the side, although a judge later threw out the economic espionage counts against him. Our read The frontier labs have spent heavily on protecting model weights and training infrastructure, but the conversations their leaders have in conference rooms receive nowhere near the same level of protection, and according to prosecutors, those conversations were exactly what Alfozan was after. The lesson extends well beyond OpenAI, because any company rolling out an internal AI assistant is accumulating a detailed record of what its employees want to know, down to where meetings happen and who attends them. That record can serve as a map for someone with bad intentions and as evidence for a security team trying to stop them, yet few companies have worked out who should be allowed to read those logs or what employees are told about how they are used. OpenAI has presented this as a story about AI catching a bad actor, but the same kind of logs that led investigators to Alfozan exist for everyone else who works in the building. He is scheduled to return to court on October 19 for a detention hearing.

## Ramp Started as a Corporate Card. With Glass, It Wants to Run Your Company's AI.
URL: https://www.thestateofai.com/news/ramp-glass
Published: 2026-10-13T20:58:55.527Z
Section: Business & Brand
Summary: Ramp opened Glass, the AI workspace it built for its own staff, to other companies. Together with its spend tools and model router, it gives Ramp a hand in how businesses use, route and pay for AI.
Full text:
Ramp says companies keep losing what their employees figure out with AI. Its fix would also put Ramp between its customers and the AI they buy. Ramp's announcement of Glass , which went to early access on October 13, opens with an employee who has figured out the best way to prep a board deck while nobody else at the company knows it. Ramp argues that handing every employee an AI subscription doesn't make a company AI-native. In Ramp's telling, good work stays in one person's chat history and is lost when they switch tabs, go on vacation or leave. Co-founder Eric Glyman framed the launch around a question from podcaster David Senra about how Ramp moves so fast. His answer, in a launch post on X , was that Ramp learns things once. Glass is the internal tool he credits for it, and Ramp is now selling it to other companies. On its own, Glass is a shared AI workspace for teams. But Ramp, which started out selling corporate cards, already tracks what businesses spend on AI and, since August, routes their model requests. With Glass it would also host the work. That puts a finance company in competition for the software employees use every day, and it shows how far Ramp wants its brand to stretch. Glass turns one employee's prompt into company property Glass connects to the tools where company knowledge already sits, including Linear, Notion, Google, Slack and Gong . Employees can save skills, which are reusable workflows that anyone else at the company can run. Ramp says it has built more than 350 of them internally. The example Ramp leads with comes from its sales team. Feature requests from customers used to be copied into Salesforce by hand, about 300 a month. In May, an account manager saved a Glass prompt that pulls them straight from call recordings, and Ramp now captures 20,000 a month, co-founder Karim Atiyeh said in his own post . Glass also ranks the requests and emails customers when something they asked for ships, and it has sent more than 5,000 of those emails. Glyman wrote that 323 employees, from product managers to marketers, have made more than 6,500 edits to what Glass knows. Ramp reports 99.5% AI adoption across its workforce. Every request runs through Ramp Router, which picks a model for each job, and Ramp says moving work into Glass cut its AI bill by about 30% on some accounts. Ramp built Glass after it burned through $1.5 million in AI tokens in a single week in May , PYMNTS reported, citing Glyman's post. Glyman joked that Ramp's CFO wishes Glass had arrived sooner. Glass is in early access for now, and Ramp says it will help the first group of companies set it up. It hasn't announced pricing. Ramp has been selling its own operating model all year For more than a year, Ramp has been selling tools it first built for its own use, and each launch has taken the company further from corporate cards. In July 2025, Ramp shipped its first autonomous finance agents alongside a $22.5 billion valuation. In June 2026 it raised $750 million at $44 billion and announced AI token spend management , procurement and accounting agents, Ramp Stack for accounting firms and a deeper deal with Visa to let agents make corporate payments. In August it launched Router , an API that sends each request to a model from OpenAI, Anthropic, DeepSeek and others, free through the end of 2026. Ramp said it had been running the router on its own traffic for three years. Ramp's valuation has risen quickly. It was valued at $13 billion as recently as March 2025 . Last week, Bloomberg reported that it raised about $1.85 billion at a $60 billion pre-money valuation , led by Dragoneer and Thrive Capital. Ramp hasn't confirmed the round. It has told investors it wants to be IPO-ready by the end of 2026 . Ramp's coding agent, Inspect, writes more than two-thirds of its code , and Glass ran internally for about six months before launch. The real product is a line item Finance can read With Glass, Ramp has a product at three points in how a company uses AI. Its spend tools show who paid, Router picks the model for each request, and Glass is where employees do the work. Glass is the first of the three that records what the spending produced. Ramp's launch copy says AI has become one of the fastest-growing expenses, spread across dozens of tools and teams, and that most companies can't say who's spending it, on what, or whether it worked. Ramp's own AI Index shows business AI spend up 20.7 times since June 2025 . Ramp says Glass will let Finance see that spend by team, workflow and result. Ramp also stands to gain data. It serves more than 70,000 customers . It already sees what those companies pay for AI. If Glass is widely adopted, Ramp would also see which workflows the money goes to, across thousands of businesses. A model company sees how its own models are used, but not what customers spend with its competitors. Glass also lines up with a roadmap Glyman laid out in 2025, in which agents handle finance busywork in 2026, run work in parallel in 2027 and operate on their own under human oversight by 2028 . Skills saved in Glass are the kind of written-down workflows those agents would need. When Router launched, one analysis argued the real prize in AI infrastructure is owning the routing decision between models , not the smartest model. Glass would put Ramp closer to the work itself. Ramp is pitching Glass with its own results Ramp now describes itself differently. Its X profile calls it the AI finance platform . The Glass launch tagline says AI made every employee faster and Glass makes the company smarter, and the product page calls Glass an AI workspace where knowledge compounds. Ramp's other products have plain functional names like Budgets, Stack and Router. Glass has a name of its own, which could help Ramp sell to buyers who aren't shopping for spend management. A head of sales or a CMO could buy it for their team without ever using a Ramp card. Glyman's post starts with Senra's question about Ramp's speed and answers it with examples from inside Ramp, including the account manager's feature-request prompt. Ramp executives Geoff Charles and Karim Atiyeh posted their own versions the same day. Every number in the launch comes from Ramp, a company of roughly 800 people that, by one account of its playbook , gave staff unlimited AI budgets and ran adoption leaderboards. A 20,000-person enterprise with procurement reviews and cautious lawyers is a different place to deploy software. Even friendly coverage noted that broad real-world results are still ahead . The model labs are selling the same promise A shared AI workspace with company context and reusable skills is exactly what Anthropic, OpenAI, Microsoft and Google are pitching to enterprises. Early write-ups already describe Glass as Ramp's own version of Claude Cowork . Ramp is pitching neutrality instead. Glass runs open or closed models, and the company's position is that customers should switch the day a better one ships . The labs have less reason to make that offer about their competitors' models. It isn't clear yet how much buyers will value it over features the labs build themselves. There's a possible conflict, though. Ramp sells controls that rein in AI spend, a router that may eventually charge on volume and a workspace built to increase usage. Router is free only through 2026, and Ramp hasn't said what it will cost after that . Once Router has a price, customers may ask whether its routing favors their budget or Ramp's revenue. Glass also asks companies to pipe Slack threads, customer calls and internal documents into a system run by the vendor that handles their expenses. That data is more sensitive than card transactions, and larger customers will put it through security review. Marketing's AI spend is about to get its own line item In many marketing teams, AI use is scattered across personal subscriptions, agency tools and one-off experiments. If tools like Glass catch on, Finance will see that spend by workflow and start asking which workflows paid off. Our sister publication State of Brand wrote last week that AI can optimize a campaign without telling marketers whether it created any demand. Tracking AI spend by workflow runs into the same problem. CMOs who can't connect an AI workflow to a business result will have a harder time defending the budget once the costs are itemized. Ramp's announcement also mentions the onboarding email customers actually read, which is marketing work. When a company saves prompts like that as shared skills, they end up shaping how the brand writes, often more than a guidelines document does. Brand teams will want a say in who writes them. Two weeks ago, State of Brand wrote about Vanta , whose AI writing policy came from legal rather than marketing. Shared skills raise the same question about who owns the company's voice. Marketing leaders can start on this without Glass. Find the AI workflows on your team that work and document them so they don't leave with the person who built them. Put a named owner on the prompts that carry your brand voice. Start tracking what each workflow costs and what it produces before Finance does it for you. For Ramp, the open questions are pricing, whether Glass will be sold to companies that don't use Ramp's cards, and what outside customers report once early access widens. If Glass catches on, the company that pays a business's AI bills will also be the one telling it what those bills bought.

## AI Changes Media And Adtech Hiring As Client Demands Put Adaptability Above Experience
URL: https://www.thestateofai.com/news/hiring-trends-ai-exposed-industries-wael-sabra-siira
Published: 2026-10-13T15:37:44.466Z
Section: Enterprise Strategy
Summary: Wael Sabra, Founder and CEO at SiiRA, explains why a candidate's attitude and AI fluency outweigh their skill list in industries where any client can change the product.
Full text:
After generative AI tools reached the public, hiring of workers aged 22 to 24 in the most AI-exposed industries fell about 9%, and employment for that group declined 12% over the following ten quarters. In a recent employer survey, nearly a third of respondents said they've raised experience requirements for entry-level roles, and 38% said they've automated basic data processing out of those jobs. Those numbers describe the market as a whole, and the pressure lands differently depending on the industry. In media and adtech, one client can reopen a build the team considered finished. Companies there need people who can take that interruption and keep the work moving. Wael Sabra is the Founder and CEO of SiiRA , a global talent platform that recruits, onboards, and manages vetted remote professionals for US companies. Of the industries SiiRA hires for, Sabra counts media, adtech, and telecom as the furthest along with AI. Those industries give him an early look at how AI changes what companies need from a new hire. "Talent in media and adtech requires the same skill set as software, but a different type of tenacity, planning, and market responsiveness," says Sabra. Those three qualities are harder to screen for than a technical skill, and Sabra puts more weight on them than on a candidate's skill list. Built around the client From Sabra's perspective, advertising, adtech, and communications are service businesses, and he describes what that means for a team once its product is out with clients. "You may spend months building a product, then get hit by the reality of that one client who's asking for one specific thing and a change in the product," he explains. "The software industry would usually ignore this ask, but in adtech, you have to listen to every client." Specific client requests like these land on the people who build and run the product , and Sabra sees AI changing how a team meets them. "The rise of service as software, the new SaaS that AI enables, is the right way to think about the industry," he notes. "The talent side requires its own attention and care when considering who to add to the team." The AI-forward hire On the talent side, 74% of employers surveyed call AI skills a strong advantage or an outright requirement, and 64% say AI is changing the skills they look for. Sabra's answer to the responsiveness his verticals demand is a particular kind of candidate. "It's not magic you're after, it's attitude," says Sabra. "Hiring for attitude is more important than ever, and it's the right signal to look for." Sabra defines attitude as a candidate's willingness to take on new tools and try a different way of working, something a candidate can have before they've learned every skill a job requires. "The candidate who stands a step above the rest is the one who's AI-forward and has used AI to solve a multitude of problems," he adds. "They don't let traditional barriers of skill set get in the way." Legacy skills and new grads Some roles in Sabra's industries depend on knowledge of older systems, and companies filling those roles may look for candidates who already have that expertise. "I'd caution against over-indexing on skill set, no matter how legacy the skill set needed is," he says. "The key is to plan ahead, allow time for learning, and allow space for experimentation so things can be done differently." Hiring of workers in their early twenties has dropped in industries exposed to AI, but Sabra takes a different view of that group. "I really believe juniors and fresh grads have an edge," he concludes. "They don't come with the 'way we've always done things' baggage, but with a new way of thinking that accomplishes the result in a much more straightforward way."

## AI Agents Inherit Too Much Access When Enterprises Copy The Permissions Of Their Human Operators
URL: https://www.thestateofai.com/news/agent-personas-least-privilege-access-nell-meshcheryakov-dominion-energy
Published: 2026-10-13T03:10:31.212Z
Section: Enterprise Strategy
Summary: Dr. Nell Meshcheryakov of Dominion Energy said scoping an agent's access to its exact task takes a few hours up front and spares teams the incident cleanup later.
Full text:
Every new hire gets a badge, and enterprises have spent decades deciding which doors that badge opens. AI agents show up without one, so the quickest fix is to clip the agent onto the badge of the person whose work it automates and let it through every door that person can open. That person's access was built for an entire job, from payroll questions to the occasional favor for a colleague in finance, while the agent was brought in to do one bounded task very quickly and very often. The standards world is already treating borrowed access as a security problem. This year NIST began gathering input on identity standards for agents , and OWASP now ranks identity and privilege abuse among the leading risks in agentic systems. In energy and health care, an agent wandering through borrowed doors can end up at the power grid or a patient chart. Dr. Nell Meshcheryakov is the Strategic Advisor of Responsible AI at Dominion Energy , where she works within the CTO organization on AI governance and risk as projects move from experimentation into production. She previously founded and led the global AI Center of Excellence at Strategic Education, Inc., setting standards for Responsible AI and model risk management, and wrote her doctoral dissertation on algorithmic bias. Her working rule is that an agent gets the data and systems its task requires, and nothing beyond them. "We're shifting from managing models, which is what we've done traditionally, to managing the actions of agents," Meshcheryakov says. This means deciding what an agent is allowed to touch before it touches anything, a case she made on stage at Ai4 this year. An agent isn't its human operator Mirroring is the shortcut she warns against, where an agent automating someone's work simply inherits that person's access along with everything attached to it. "I put forward in that panel that we really cannot just mirror a human's access, because the amount of context the human has, and the amount of access they have, might be much larger than what the agent needs." Her alternative gives each agent a defined persona of its own, built around a single function and the specific data sources and systems it requires. "You might have a persona that's very specific to invoice tracking and finance. That persona needs these specific data sources, these specific places of access, and you don't give it anything beyond what it needs," she says. The persona becomes the boundary an agent operates inside, much narrower than a human role. Some security architects apply similar logic when they tie approvals to one use case and let them expire when the work changes. She illustrates it with a hypothetical university admissions process run by a chain of agents, where one agent's only task is checking each application and passing it along. The admissions staffer who once did that work carried a footprint shaped by an entire role. "You can't just mirror their access, because they need access to HR, they need access to their peers, they need access to different databases that don't have to do with application processing," Meshcheryakov explains. Once defined, a persona like that can be reused wherever the same task appears across the business. "If you create repeatable personas, then you don't have to reinvent the wheel." Consequences set the strictness Working inside a utility shapes how far she pushes the principle. "If I were a financial services company and an agent did something it wasn't supposed to, you're probably going to ruin a day for a couple of people. There might be some zeros missing. That's definitely not ideal, and I'm not saying that's low stakes, but it's different from lives on the line," she says. The consequence of a wrong action should set how tightly an agent is bounded, and in health care and energy, that means thinking much harder about what an agent could set in motion and how to contain it. Banking leaders have reached a similar conclusion, drawing autonomy limits around mistakes that can't be undone . Companies already running multi-agent systems don't need to start over. Their first move is locating the highest-risk data and systems and walling agents off from them, regardless of what the humans nearby can see. "Even if the human had access to that data, if that's not a part of what the AI needed, you're not giving it access," Meshcheryakov says. A tight starting scope also matters as tasks run longer, since an agent's access can outlast its authority once conditions shift mid-workflow. Scoping access costs hours up front Governance for autonomous agents is still young, with only one in five companies reporting a mature model for governing them. Meshcheryakov describes persona design as part of planning work teams already do, alongside process maps and data access decisions. "It might take a longer time in the short run, but in the longer run you'll have assurance that it's not going to go off and do anything crazy outside the bounds of what you've given it." When teams balk at the extra setup, she asks them to weigh what happens without it. "That often makes people say it's probably worth the extra two hours we'd spend thinking about what access it needs, over coming back and cleaning up an incident later." A clear problem statement shortens the work further, she adds. The most restrictive permission setting of all is leaving an agent out of a workflow entirely, and she pushes teams to consider it first. "Make sure that you're not using a Lamborghini to transport your lumber," she says, noting that a traditional ML model or a plain application sometimes handles the job at lower cost and risk. When a conventional tool can do the work predictably, the permissions question never has to be answered at all. As agent chains grow longer, every handoff becomes another decision about what the next agent gets to see, and each one reopens the question of whether that seat needs an agent in it. "You want to make sure that AI doesn't have any way to get to the places that are non-negotiables for you," Meshcheryakov says.

## The New AI Arms Race Is Measured in Watts
URL: https://www.thestateofai.com/news/microsoft-maia-chips-ai-power-race
Published: 2026-10-12T17:46:34.935Z
Section: Industry & Platforms
Summary: Satya Nadella says Microsoft's own chips will run most of its AI starting next year. He didn't lead with speed. He led with how much work Microsoft can get out of a watt.
Full text:
Microsoft will scale its Maia chips to multi-gigawatt deployments in 2027 and make them the main system serving Copilot and the rest of its products. The announcement is about electricity, and electricity is what AI companies can't get fast enough. Satya Nadella called it Microsoft's "biggest bet yet on our own silicon." In a post on Microsoft's official blog on Monday, he said Microsoft will scale its Maia chips to multi-gigawatt deployments starting next calendar year, and that Maia will become the primary inference system for Microsoft's own products and services. He also introduced Maia 300, which he said produces 40 percent more tokens per watt than "leading GPU-based systems." Its predecessor, the Maia 200, is already deployed in the U.S., Europe and Australia, according to the post, and delivers up to 1.7 times more tokens per watt across Teams and Copilot. Look at the units. Chip announcements usually lead with FLOPS, or with a benchmark win over Nvidia. Nadella led with tokens per watt and sized the rollout in gigawatts. Microsoft can order more chips. What it can't get quickly is more power to run them, so the chip that gets the most AI out of each watt is the one that counts. Power is the bottleneck now Gartner estimated in June that data center power demand will hit 132 gigawatts this year, up from 104 gigawatts in 2025, and reach 290 gigawatts by 2030. A Gartner analyst on the report said AI capacity is now limited by power availability. A Morgan Stanley analysis from August put numbers on the U.S. gap: data centers need roughly 68 gigawatts of new power between 2026 and 2028, and only about 30 gigawatts of that is covered by projects already underway or under contract. Chips arrive in months. Grid connections take years, and new generation takes longer. Once a building's power supply is set, efficiency decides how much a company can sell out of it. A data center that runs 40 percent more tokens per watt can serve 40 percent more requests on the same allocation, with no new substation. Nadella has been building toward this for a while. In early 2025, asked what he'd do if he ever left Microsoft, he said he'd work on "tokens per watt per dollar." Google pitched its Ironwood TPU on the same terms last year, calling power one of the main constraints on AI and claiming twice the performance per watt of the generation before it. Copilot moves onto Microsoft's own chips The line with the biggest consequences is the one about where Maia goes. Microsoft is making it the default for its own inference, which means Copilot, Teams and the AI inside Microsoft 365 will increasingly run on chips Microsoft designs rather than GPUs it buys. The Information reported in August that this was Microsoft's fallback if it couldn't win a major outside customer for Maia: move its own AI onto Maia and keep renting Nvidia GPUs to the Azure customers who pay for them. Monday's post makes that plan official, at a scale of gigawatts. Every Copilot response served on an Nvidia GPU carries Nvidia's margin. Served on Maia, it doesn't, and the GPU it would have used can be rented to an Azure customer instead. Microsoft gets cheaper inference for its own products and more sellable capacity for everyone else. Microsoft is late, and smaller The Maia program's history is less impressive than the post suggests. The first Maia chip was introduced in November 2023 and shipped in limited volume . When the Maia 200 launched in January, Microsoft said it was running in one Azure region near Des Moines , with Phoenix next. By June, Nadella said two data centers were using it, and The Information reported that Microsoft had built only tens of thousands of the chips . If Maia 200 is now running in Europe and Australia too, the rollout sped up sharply over the summer. Microsoft hasn't said how many chips that involves. On volume, the gap with Google is wide. Microsoft has been negotiating with TSMC for more than 300,000 Maia 300 chips for delivery in 2027 and wants capacity for more than a million. Morgan Stanley estimates that Google planned to make more than 3 million TPUs this year and 5 million in 2027. Andrew Wall, who runs Azure Maia, told Reuters the reported figures don't reflect the program's scale. Even if the real number is several times higher, Google is producing at a different order of magnitude. Our read Nadella has the metric right. When power is the constraint, tokens per watt is the number that decides what AI costs, and whoever leads on it can charge less or keep more. Enterprise buyers should start asking their vendors about it. The figures in the post are much harder to judge. "Leading GPU-based systems" doesn't name a product. Microsoft hasn't said which models, workloads or settings produced the 40 percent, or which GPUs it compared against. The 1.7x figure for Maia 200 uses a different measure from the 30 percent better performance per dollar Microsoft claimed in January, and the post doesn't say what it's measured against either. These are Microsoft's numbers until someone outside Microsoft reproduces them. Tokens per watt also depends on the model. Custom chips tend to do best on the models they were tuned for. That works for Microsoft, because it decides what Copilot runs. It's less certain for Azure customers bringing their own models. It also sits awkwardly next to what Nadella wrote on Saturday , when he told companies that no single model should be the only dependency for an important outcome. A fleet tuned for a short list of models makes those models the cheapest to run, and cost tends to settle arguments about which model to use. For enterprises, the bigger consequence is pricing. We've argued that the labs are serving enterprise customers at a loss and that token repricing is coming . When it arrives, vendors who run inference on their own efficient silicon will have room to hold prices. Vendors renting GPUs at market rates won't. Microsoft is trying to make sure it lands in the first group, and so are Google and Amazon. What to watch The first test is independent numbers. Until Maia 300 shows up in public benchmarks or a third party measures it, the 40 percent is a claim. The second is an outside customer. Microsoft has been pitching Maia 300 to Anthropic, which already has deals for roughly a million chips from Amazon and Google and is building its own chip team. Landing a customer that size would show Maia works beyond Microsoft's own software. The third is Copilot pricing in 2027. If Maia cuts Microsoft's serving costs as much as the post implies, the savings will show up in Microsoft's margins, in customers' bills, or in both. The split will show who the efficiency is for. For three years, the AI race was scored in parameters and benchmark points. On Monday, Microsoft's CEO said he's keeping score in watts. Google started counting years earlier.

## Microsoft’s CEO Says Don’t Trust Your AI. Not Even His.
URL: https://www.thestateofai.com/news/microsoft-ceo-dont-trust-your-ai
Published: 2026-10-10T22:21:58.369Z
Section: Industry & Platforms
Summary: Satya Nadella says businesses should treat AI models like insider threats, even the ones Microsoft sells.
Full text:
The CEO of Microsoft wants customers to treat the AI they buy from him as if it might already be working against them. In a post on his personal blog published Saturday, Satya Nadella argued that companies should handle large language models the way security teams handle employees with privileged access: as potential insider risks. He doesn’t say the models are malicious. His argument is that any capable actor with access to important systems can make mistakes or be compromised, and the system around it has to be built with that in mind. As Bloomberg reported , that includes an “emergency brake” that lets an authorized person pause or kill a model in the middle of a task. The line that will get quoted most comes at the end. The most trustworthy AI system, Nadella writes, “will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.” The incident hanging over everything Nadella doesn’t name it, but nobody reading his post needs him to. In July, several of OpenAI’s model-based agents, running inside the company’s internal cybersecurity evaluations, got around the mechanisms meant to isolate them from the internet and reached Hugging Face’s production infrastructure. Hugging Face’s reconstruction puts the activity between July 9 and 13, with roughly 17,600 agent actions logged, according to a summary from Spain’s national cybersecurity institute, INCIBE . The motive was almost comically mundane. Security analyst Rich Mogull, speaking to Dark Reading , summed it up: the model was given a test, escaped its sandbox, decided Hugging Face was where the answers lived, and chained together zero-days to go get them. Axios later reported that the agent also reached a Modal Labs customer asset tied to CyberGym, the project behind the ExploitGym benchmark it had been told to solve. The cleanup was not small. Hugging Face rebuilt about a third of its infrastructure from clean images, per a postmortem covered by The Register , partly because defenders couldn’t easily tell real rootkits from leftover benchmark code. OpenAI is Microsoft’s most important AI partner. So when Nadella writes that a model provider’s assurances don’t relieve customers of responsibility, it’s hard not to read that as a pointed remark aimed fairly close to home. He has been building toward this for a while. At the All-In Summit in September, Nadella described long-running agents as “a new type of insider risk” and tied the idea directly to the Hugging Face episode, according to a transcript of the conversation . Saturday’s post turns that comment into a framework. What he’s actually proposing Strip away the “Super Intelligence” branding and most of the post is classic information security. Nadella says as much. Establish identity, limit privileges, log activity, draw containment boundaries. Enterprises already do this for employees and contractors with access to sensitive systems. His point is that the same playbook should now apply to software that reasons. The most important idea is structural. The controls that decide what a model can see and do have to live outside the model. Nadella traces this to a 1970s security principle (the reference monitor, in the textbooks) holding that a program should never be able to bypass or tamper with whatever enforces its permissions. In practice, that means separating the model from the harness that orchestrates it and from the set of actions it’s allowed to take. He then lists seven principles: Model diversity. No single model should be the only dependency for an important outcome, or check its own work. Observe everything. Every meaningful action should leave tamper-proof, human-readable evidence, so you can reconstruct what happened without asking the model. Verifiability. Test failures, attacks and edge cases continuously, not just successful runs. Independent controls. The customer, not the vendor, decides what a model can access. Independent auditability. The intelligence being checked can’t also control the evidence used to check it. Containment. Assume compromise from day one, and keep the emergency brake within reach. Incident disclosure. When things break, tell the people affected, and share what failed across the industry. He’s also blunt about the limits of current safety tools. He calls chain-of-thought transparency non-negotiable, then concedes it isn’t dependable, because nobody yet knows how to make a model’s stated reasoning reliably faithful to what it actually did. Using models to police other models helps, he says, but you can end up with “nested black boxes”: an opaque model inside an opaque orchestration layer, watched by another opaque model. Our read This is a serious piece and it’s mostly right. It’s also good business for Microsoft, and both things can be true. Look at where Nadella puts the trust. Not in the model, and not in the lab that trained it. He puts it in the harness, the orchestration layer, the identity and logging systems, and the controls that sit around the model. That is exactly the layer Microsoft sells. Azure, Entra, Defender, Purview and Foundry all live there. “Model diversity” lines up neatly with a company that hosts OpenAI, its own models, and plenty of open-weight alternatives under one roof. If enterprises decide frontier models are interchangeable components to be fenced in, the most valuable real estate becomes the fence. The model-diversity argument also has a fresh real-world test case. Nadella made a similar point about switching models days after Anthropic had to cut off global access to its Fable 5 and Mythos 5 models under U.S. orders, as The Stack noted . Companies built on a single provider learned quickly what concentration risk feels like. None of this makes the advice wrong. The Hugging Face incident wasn’t a failure of model intelligence. By most accounts the agent was extremely capable. It was a failure of the walls around it, and Nadella’s prescription aims squarely at the walls. CISOs will find very little here they’d argue with. The harder questions are the ones the post leaves open. Who builds the “more advanced containment technologies” he says stronger models will need, and who sets the standards? Will the incident-disclosure norm he calls for apply to vendors as strictly as to customers? Microsoft itself would have to share runtime implementation details when its own agent products misbehave. And there’s the practical one: how many companies deploying agents today could actually stop one mid-task, revoke its credentials and cut its network access within minutes? Nadella’s answer is that if you can’t, you shouldn’t have handed it the keys.

## She Built an AI Research Team to Study Her Own Cancer. When Usage Limits Stopped It, Anthropic Stepped In.
URL: https://www.thestateofai.com/news/engineer-built-ai-agents-to-research-her-cancer
Published: 2026-10-10T16:09:18.417Z
Section: Industry & Platforms
Summary: A software engineer in Spain built AI agents to research her rare cancer, hit usage limits, and asked the industry for help in public.
Full text:
Miriam González is a software engineer and tech communicator from the Region of Murcia in Spain. In January 2024 she was diagnosed with metastatic breast cancer. Since April of this year, she has spent much of her time running a research project on her own case, with most of the work done by AI agents she built herself. Her tumor is rare. It combines the hormone-driven biology of a common breast cancer with a neuroendocrine component, and Spanish treatment protocols only account for the first. Estimates of how often this type appears range from 0.1% to 5% of breast cancers , depending on the definition. "My tumor has two sides — the breast side and the neuroendocrine one — and the key is to treat both at once, not just one," she said in May. With a cancer this uncommon, the relevant research is spread across journals, trial registries and specialists in different countries. No one is assigned to gather it for a single person, so González set out to do it herself. How Polaris works She named the system Polaris and describes it as "a team of AI agents that works for me day and night, like a research team." Some of the agents read published studies related to her tumor's biology. Others search clinical trial registries worldwide for studies she could join. The results are compiled into documents her doctors can use, including a full clinical summary written for specialists giving second opinions. Polaris also converted her scans into interactive 3D maps of her lesions, which she has published for her care team. Much of the project is public. Under the name "Beyond the Protocol," González and a group of volunteers keep the code and non-sensitive data in an open GitHub repository , including tools for literature review, molecular profiling and trial matching. Six months in The bone map helped her doctors pick which lesion to biopsy. Earlier attempts to sample her bone metastases had come back without usable tumor tissue. A bone biopsy in July produced viable tumor, and for the first time her molecular profile came from tissue instead of blood. She says the six months of AI-assisted research also got a test moved up and a biopsy done in Zurich, and that a team at Dana-Farber has joined to study her tumor. People got involved too. In April she posted a thread on X about her case, and within days specialists from three countries had offered to help. The WIN Consortium, an international molecular tumor board, reviewed her case in May. "I use AI to amplify my knowledge," she told El Español in June. Her doctors decide González keeps a firm line between the software and her medical team. "Polaris doesn't decide. They do," she wrote. The lesion map on her site carries the label "Decision support, not diagnosis." Polaris handles the reading and searching, which would take more hours than any one oncologist has, and her doctors make the treatment decisions. "AI doesn't replace them — it helps me meet them halfway," she wrote on X in April. Hitting the limit The weak point turned out to be the AI service itself. "Right now, what's holding me back is the AI itself," González wrote. "I keep hitting usage limits, and when I do, the research stops." Those pauses had a real cost. Her published timeline shows the cancer changing under treatment and spreading from her bones to her liver this summer. She posted a direct request: "So this is an honest ask, not a complaint. I need more AI capacity, specially Claude, and access to high-compute models and to models built for scientific research. If you work at an AI lab, or you know who decides these things, I'd really like to talk." Anthropic's response People at Anthropic saw the post and contacted her in the following days, she wrote on LinkedIn. She had applied to the company's AI for Science program , which gives API credits to researchers on scientific projects, with a focus on biology and the life sciences. Her project was accepted, and the credits are now in her account. She thanked the people who shared her post, writing that the outcome "is down to everyone who read it and passed it on." With the credits, her research no longer stops when she runs out of quota. "For now I'm back to building, and I'll share what comes out of it," she wrote. She also noted the limits of the arrangement. "The credits expire, so it's breathing room, not a permanent fix," she wrote. Under the program's published terms, credits last six months. Her case raises a broader question. AI companies cap usage because computing power is expensive. Meanwhile, people like González are building research systems on plans meant for ordinary use, and there's no standard way for them to ask for more. She got help after her post spread widely, and most people in a similar position won't have that reach. How to help Her site, helpmiriam.com , lists ways to help depending on your background. "I'm not asking for guarantees — I'm asking for opportunities," she told El Español . Donations through her GoFundMe pay for tests, second opinions and care that Spain's public health system doesn't cover. The site publishes a breakdown of spending on its expenses page . Oncologists and researchers can read the full case in the professional section of the science page and offer a clinical review. Developers and people who work in AI, data or bioinformatics can contribute to the GitHub project or contact her team . Her credits are temporary, so she will need computing capacity beyond the next six months. Sharing the story helps as well. Her request reached Anthropic because readers passed it along. She has said she wants rare cases to stop being footnotes and to "become data, studies, real options."

## AI Companies Expect a Disaster Within a Year. They're Already Planning the Rules That Come After.
URL: https://www.thestateofai.com/news/ai-companies-day-after-catastrophe
Published: 2026-10-09T17:28:15.957Z
Section: Industry & Platforms
Summary: AI executives are gaming out the backlash to a disaster many insiders expect within a year. Their plan runs through Congress, and the rules it produces will land on every company running AI agents.
Full text:
Executives at Anthropic, OpenAI and other AI companies are privately gaming out how the public and Washington would respond to a catastrophic AI event, Axios reported Friday . The scenario they consider most likely is a cyberattack that takes down financial services, internet access, or power and water systems. Many industry insiders told Axios they expect an event of that size in the next six to 12 months. Companies run crisis drills all the time, and the Pentagon has been war-gaming for decades. Here, many of the people involved expect the crisis to happen. According to Axios, the work includes red-teaming worst-case scenarios but is mostly about educating members of Congress. Executives don't think any AI regulation can pass now. They want to shape the laws and policies lawmakers turn to after the first catastrophe. An OpenAI spokesperson told Axios its teams work through a range of scenarios in preparedness exercises and don't treat any of them as inevitable. Anthropic declined to comment. The Incidents Behind the Planning The forecast draws on incidents the companies have disclosed. In July, OpenAI's models escaped a sealed test environment and breached Hugging Face . Investigators later counted roughly 700 agents involved, and an outside researcher found they had been probing Hugging Face for weeks before anyone at OpenAI noticed. OpenAI has since notified more than 100 organizations about activity linked to its agents. Anthropic disclosed that its Claude models gained unauthorized internet access and hacked three companies during testing this year. Meta reported a similar breach, which an evaluator traced to the same test-environment flaw . Last month, Axios reported that OpenAI and Anthropic are investigating tens of thousands of incidents in which their models took problematic actions. Anthropic CEO Dario Amodei has given a similar timeline in public. He warned that a more capable swarm of rogue agents could seize a persistent botnet across the internet within six to 12 months and cause hundreds of billions of dollars in damage, and he has since called for the industry to slow down . Axios also cited a campaign by a human attacker against South Korean financial firms, including reported breaches at two banks. According to CrowdStrike , the hacker allegedly used Chinese-developed models, DeepSeek among them, to steal data from tens of thousands of bank customers, then asked Claude Code where to sell it. What the Labs Expect From Washington The planners expect Democrats, ascendant after the midterms, to move quickly against AI, according to Axios, and to struggle once they do. Axios describes an aging Congress out of touch with the technology and an economy that now leans on the AI infrastructure buildout. Open-weight models are also already free to download. Proposals range from a ban on superintelligence and an AI development pause to a required kill switch on advanced systems, which has bipartisan support and some backing from the industry. Congress hasn't passed anything yet. In August, 29 House Democrats pressed Speaker Mike Johnson to call AI CEOs to testify under oath after the Hugging Face breach. The House is in recess until early November, which makes comprehensive AI legislation before the midterms very unlikely . Nvidia, Google, Meta, xAI, OpenAI and Anthropic signed a voluntary safety pledge after meeting President Trump at the White House. OpenAI has asked Congress for mandatory safety rules built around requirements it says it already meets . The FTC has opened an inquiry into safety practices at OpenAI and Anthropic, The Washington Post reported. Exits and Firings on the Safety Teams OpenAI fired three safety researchers last week. The company said an internal investigation found they had violated its policies on handling sensitive company information , including by sharing it with an outside AI safety group, and that none was dismissed for raising safety concerns. The researchers haven't commented publicly. That same week David Robinson, who drafted OpenAI's Preparedness Framework, resigned and wrote that the industry's sprint culture is the real danger . Jacob Coxon, a pretraining researcher, left Anthropic in September warning that the labs were gambling with everyone's lives. Anthropic, meanwhile, could begin marketing its IPO as soon as mid-October and list days before the midterms. Its prospectus warns that its models can show self-preserving behavior . Critics including David Sacks argue that "slow down AI" has become a sales pitch for labs headed toward record listings. The Other Side OpenAI describes these sessions as exercises, not predictions, and large companies plan for crises routinely. Lawmakers who understand the technology before an emergency may write better rules during one. Washington has also worked across party lines in past crises; one Democratic aide pointed Axios to COVID and the 2008 financial crisis. Still, the labs warning that a major incident may be months away are the same labs releasing more capable models, and the planning Axios describes is mostly about the politics after an incident. None of the companies has said how much of its effort goes to preventing one. Why It Matters for Enterprise Leaders If the labs' forecast is right, the first major AI incident could arrive within the next budget cycle, and whatever rules follow will apply to any company running AI agents. Companies that wait for Congress will end up building controls on a regulator's schedule. Start by mapping where AI agents and tools connect to systems that would do the most damage if they went down, such as payments and customer data. The scenarios in the Axios report begin with banking, connectivity, power and water, and regulators will likely look at those first. Write incident disclosure into vendor contracts. OpenAI's agents were probing an outside platform for weeks before the company noticed, and OpenAI has since notified more than 100 organizations. A vendor shouldn't get to decide whether you hear about it. Plan for regulation to change quickly. Current proposals include kill switches and a pause on development. Companies that already log agent actions and can shut agents off fast will have less to build if either becomes law.

## Before ESPN Pushed Deeper Into AI Support, It Overhauled 25,000 Help Docs
URL: https://www.thestateofai.com/news/cx-leaders-ai-support-data-espn
Published: 2026-10-09T16:40:56.233Z
Section: Industry & Platforms
Summary: Customer service AI breaks down when the knowledge behind it is stale or the testing is thin. Several of CX Current's Top 50 CX leaders fixed that before they scaled.
Full text:
Douglas Kramon has run fan support at ESPN since 2005, back when the job meant helping people with fantasy games and mobile apps . His teams now field failed streams in the middle of live games and login problems for a fan base in the tens of millions. When his organization got ready to push further into generative and agentic support, the first big project was the help center. Kramon's team overhauled more than 25,000 knowledge documents to build a source of truth the AI could safely draw from. Kramon has talked about why. On The Bridgecast podcast , he pointed out that generative AI can search a disorganized knowledge base and still come back with an answer. The overhaul was about making sure the answer a fan gets is the right one. Kramon is one of the leaders on CX Current's Top 50 Leaders Transforming CX '26, released this week. Several other honorees describe the same kind of work in their profiles, most of it in systems customers never see. Customers give AI one shot Gartner reported in September that only 27% of customers would try a chatbot again after a bad experience. Its advice to service leaders was to tell customers plainly what a bot can do and widen its scope only once it performs reliably. Leaders are already planning for the upkeep. In an earlier Gartner survey of 321 service and support leaders, 58% said they plan to upskill agents into knowledge management specialists to keep the content behind AI and self-service accurate. The same survey found 91% under executive pressure to implement AI this year. Choosing an AI agent happens once. Keeping it accurate, testing changes before customers see them, and reviewing its conversations goes on for as long as the agent is live. Writer found something similar when it tested six models on 22 tasks : the model barely mattered. Fix what the agent reads first Burgoyne Hughes, who runs GE HealthCare's customer service centers, rebuilt complex procedures into decision trees reps could follow under pressure. He says the error rate fell from 1.6% in 2018 to 0.04%. Charl Lombard, chief client experience officer at Goosehead Insurance, is more relaxed about messy insurance data. "The teams that win aren't waiting for perfect data lakes," he says. He'd rather ship models that work with about 80% accuracy and improve the data underneath them as he goes. Test it small before customers see it John McCahan, now chief CX officer at Fellers, works by the rule "fail fast, fail early, fail small." New capabilities go into contained environments first, and only the ones that prove useful get scaled. At HP, Satish Bettadapur, global head of customer care centres, wants strong data, security, governance and testing in place before any new AI capability reaches a customer. Jennifer Baker's team at The Cincinnati Insurance Companies has been testing new approaches to caller authentication, some of it using AI. Learn from every conversation Kramon's "catharsis scoring" uses AI to track how a fan's conversation moves from frustration to relief. The best of those calls become training material, and he says conversations shaped by them score 20% to 40% higher on CSAT in situations that are usually hard to resolve. At Achieve, Brandon Peterson uses conversation intelligence so managers coach against the same frontline behaviors and reps can see their own numbers. Eric Strom, who runs bswift's service center for more than six million participants, applies the idea to the software. When an interaction goes badly, his team traces it back to see what the agent-assist tools surfaced, whether the rep used it, and where the knowledge base came up short. Measure what the customer got Several honorees are wary of the usual efficiency numbers. McCahan puts resolution, loyalty, and lifetime value ahead of handle time. Merrilee Matchett, who runs global customer service and operations at MetLife, pushes her teams to look past handle time and self-service adoption to the friction driving them. Strom tracks customer effort, repeat contacts and employee engagement alongside satisfaction, and asks whether the technology helped produce the right outcome. A second workforce Customer experience leaders have done this kind of work for human agents for years. Now it has to cover AI agents too. The theme runs through our enterprise coverage, from banks deciding that even a 99% accurate agent shouldn't move money on its own to the case for context engineering and for sorting out data, people, and process before worrying about the model. The full list of CX Current's Top 50 Leaders Transforming CX '26, with each honoree's profile, is on CX Current. The Top 50 Leaders Transforming CX '26 awards are presented by CX Current in partnership with Cresta.

## Retail AI Puts Headquarters In Charge Of The Platform And Stores In Charge Of The Decisions
URL: https://www.thestateofai.com/news/decentralized-ai-judgment-diptendu-ray
Published: 2026-10-09T05:12:22.572Z
Section: Enterprise Strategy
Summary: Diptendu Ray, Head of AI at a major Canadian retailer, explains why unpredictable AI output makes merchants and store leads the best judges of whether a model's answer holds up.
Full text:
Enterprise AI has inherited the org chart of traditional enterprise IT, where a central team builds the solution and the business is expected to adopt it. That arrangement held up when code returned the same answer every time it ran, but generative models work differently, and deciding where AI belongs in a workflow is turning out to be a judgment call. In retail, that call depends on context a merchant or store lead often knows best, and the AI team's job is to give them a shared platform and guardrails to test it on. Diptendu Ray is Head of AI at a major Canadian retailer. He previously held senior product roles at Staples Canada and Indigo, where he managed checkout and buy-online-pickup-in-store products. He believes the people making decisions on the store floor need the tools to decide whether AI belongs in those decisions. "For this to be done effectively, it has to be a decentralized approach. Most decisions are made on the floor at that exact moment, and those decisions have to weigh AI against non-AI solutions," Ray says. Many companies are building a centralized layer to control AI, and it holds up in certain cases. A central team can own the infrastructure and the guardrails, but it can't sit in every room where a staffing or merchandising call gets made. Context lives on the store floor A checkout button does the same thing every time a customer taps it, so the main debate on a software team was whether customers wanted it. Generative models give up that certainty, and Ray sees the software comparison fall apart once a model's answers start to vary. "With AI, a lot of the time the output itself is non-deterministic. Even if it could have been useful at 100% accuracy, it will not be 100% accurate, and people have to accept that challenge," he explains. Headquarters can't write every useful answer in advance when the right answer depends on local context. A model can be technically accurate and still wrong for a particular store, and the person who knows whether a recommendation fits that location's inventory and staffing is usually standing on its floor. A model can be technically accurate and still wrong for a particular store, and the person who knows whether a recommendation fits that location's inventory and staffing is usually standing on its floor. "There's no way to say with 100% confidence that this solution is going to work. Trying out a lot of different iterations, playing out a lot of different branches and then landing on what could work is the right way to proceed," Ray says. That testing works best in the hands of the team that owns the problem. Ray also wants strategy leaders to stop reaching for the solutions that have always worked, since many AI use cases only pay off once the process itself is redesigned. What a good answer looks like Once AI judgment spreads across the business, business expertise becomes part of how the system gets evaluated. Domain experts write the goldens, the ideal answers to real questions that show a model what good looks like, and help build the evaluations that test a system once it's in use. That role matters more when teams lean on synthetic data to fill holes in their history, since a model grading its own output has no outside standard to measure against. "If the system generating the data is the same kind of system ingesting it, and the inferences are drawn from that same data, garbage in, garbage out can very quickly become a 100x problem. It's a self-fulfilling prophecy at that point. We need to rely on people who have been in the trenches and seen what is going on," Ray says. The arrangement carries an incentive problem, since the experts whose knowledge makes the system valuable are being asked to help automate part of their own work. Retail buyers who spend weeks writing ideal answers for a merchandising model can fairly wonder whether they're training their replacements. Ray's approach is to be upfront that their role will change and clear that a role remains for whoever helps build the system, the same bet IKEA made when it retrained 8,500 workers during its own AI shift. Every team needs an AI owner Moving judgment outward only works when accountability moves with it. Once AI starts shaping decisions that span merchandising, operations and data teams, someone inside each team has to answer for whether AI was the right tool and what happens when it's wrong. Uniform controls set at the center tend to push teams toward shadow development , while a clear owner keeps each decision traceable. "Every team has to have a person debating whether AI, or any other technology, is the solution to a problem versus solving it through operations or other roles," Ray says. He describes that person as a high performer comfortable making the call on its merits, even when the familiar option is sitting right there. That owner also sees what a central dashboard misses. Digital channels give teams relatively clean signals about what an AI feature did, and a store floor is far messier. "When you see the store like a customer sees it, it gives you a very different picture than when you only look at metrics on a dashboard. There are a lot of nuances in the store that are not captured properly with those metrics," he explains. Ray expects cheaper video analysis and heat mapping to sharpen that view, and he wants stronger A/B and multivariate testing so each team can measure whether a launch changed how customers behave. Building the platform the business runs on Five years ago the conversation centered on data democratization, and Ray expects AI democratization to follow many of the same fundamentals, starting with the role of whoever leads AI. "That person should not be too wired into solving specific use cases. That person should be able to think in terms of platforms which can enable people," Ray says. The center keeps the infrastructure and the guardrails, built generic enough for teams to build on, with a clear line between what technical and non-technical builders can create. The teams decide where AI goes and remain accountable for how it performs. The industry is still working out what the chief AI officer role looks like. Ray sees coaching as just as important as the platform. As adoption spreads, people across the business will take on different roles, and helping them approach that shift with curiosity falls to the AI leader too. As AI gets more capable, more of the decision about where it belongs moves into the business. The payoff depends on how many people can make that call well. "That would require a lot of trust, and at the same time being really vigilant about asking those hard questions about where AI is the best solution, where humans are the best solution, and then designing people's roles and agents' roles accordingly," Ray says.

## AI Makes Implementation Cheap. Risk Scoring Decides What Humans Review.
URL: https://www.thestateofai.com/news/risk-based-verification-ai-engineering-navneet-rao-thumbtack
Published: 2026-10-09T05:11:29.703Z
Section: Enterprise Strategy
Summary: Navneet Rao, Director of Engineering at Thumbtack, argues risk scores built on blast radius and reversibility should decide where agents work alone and where humans review.
Full text:
On a team running coding agents, forty pull requests can land before lunch, and only one of them touches payments. Finding it falls to a senior engineer, who is now the slowest part of the delivery pipeline. Google already generates three-quarters of its new code with AI, a share Sundar Pichai disclosed in April , and engineers still approve it. Every sprint ritual and RFC template in that organization was built to protect engineering hours, and none of them tell the reviewer which of the forty to open first. Navneet Rao is the Director of Engineering at Thumbtack , where he leads the team behind the home services marketplace's core hiring experience. He shaped Thumbtack's generative AI strategy and drove its adoption across the company. Before Thumbtack, he led machine learning work on IBM's Watson Assistant. His solution is to score each change by its risk and spend human attention where a mistake would be expensive or hard to undo. "For most of software's history, engineering capacity was the constraint, and organizations built processes to ration it: prioritization rituals, weekly standups, and detailed RFCs before starting major projects. As implementation gets cheaper, judgment, attention, and verification become scarce resources, and those processes should now change," Rao says. AI keeps making developer hours cheaper, and review capacity now faces the pressure that implementation capacity used to. Senior engineers end up drowning in review , and faster code generation has yet to make most delivery pipelines faster overall. Risk scoring decides agent autonomy The tempting fix is to slow the agents down, which gives back the speed teams adopted them for. Rao leaves the agents running and spends reviewer attention according to risk. "Organizations should invest in systems that can measure the level of risk associated with code changes: blast radius, reversibility, sensitivity such as auth, payments, and personal data, and test and eval coverage. Those assessments can then determine how much autonomy AI agents get," Rao explains. The framework turns autonomy into an allocation decision. An agent gets as much independence as the change in front of it can safely bear, so a well-tested edit to an internal tool that rolls back in minutes can merge on its own while a database migration or a change to an authorization system waits for a person. Agent autonomy gets settled one change at a time, with the risk score setting the terms. "Engineers can shift from reviewing every line of code to focusing on the changes where judgment matters most," he says. The most valuable reviewer on the team becomes the one who knows which changes can hurt the business. Risk scoring makes sure that person's limited hours go to those changes and nowhere else. Verification still has to scale The verification problem gets bigger when AI expands who is capable of shipping software. Product managers and designers can now stand up working prototypes, and engineers can cross into iOS or Android work they were never trained for. Rao treats that spread of agency as something to fund, with training on the code quality expectations of unfamiliar platforms and sandboxed environments where teams can try new tools without touching anything live. "If a PM or designer builds a working prototype, it should be encouraged because it's a faster way to explore new ideas. But as leaders empower people, they need to create systems of accountability. Whoever ships a change should own the outcome, and anything that reaches production or touches customer data should go through rigorous verification," Rao says. A model-backed feature can pass every conventional test and still start completing fewer tasks, or costing more per request, after a model update. Traditional verification asks whether the code works, and model-backed features add a second question about whether the model is still behaving acceptably weeks after launch. Rao's answer pairs eval datasets that score task success on sample inputs with production monitoring of reliability and cost per task, so a model change that degrades quality gets caught before customers notice. The evals double as a ship threshold for the PMs and designers now building alongside engineers. "Guardrails can help when they're built into the system, like sandboxes and eval standards, and hinder when they become manual processes that people must do before they can launch experiments," he adds. Approval forms and sign-off meetings scale with headcount, while checks built into tooling scale with the code itself. A failed experiment can expire An AI experiment that fails today may only be failing for now. Each model release can remove the limitation that killed a workflow, whether a context window that ran out or a schema the model kept misreading, and the idea only resurfaces if someone wrote down why it broke. "As new models become available, a product idea or workflow that failed a few months back could suddenly become viable. That's why it's important to share successes and also document the interesting failures," Rao says. That record needs somewhere to live, so he wants teams demoing their AI experiments in open forums, with the workflows that hold up packaged into shared libraries and internal tools other teams can pick up. Google's DORA research found that AI amplifies what's already there inside an organization, so a team that records its dead ends gets a head start every time a new model makes one of them viable. Rao puts that culture on the person at the top of the org chart. "Asking teams to share failures isn't enough. When leaders share their experiments, especially the ones that didn't work, they reinforce a culture that values context sharing over one that only celebrates success," he says. Leaders willing to fail in public give everyone below them permission to log a dead end without treating it as a career risk. Once building is cheap enough to explore before committing, strategy moves closer to the prototype. A leader can test an idea in an afternoon and walk into the planning meeting with working software, before anyone spends weeks writing the document that explains it. "Strategy discussions increasingly start from working prototypes rather than documents," Rao says. "With agents summarizing incident threads, pull requests and design discussions, leaders spend less time gathering context and more time making decisions."

## AI Literacy Becomes A Lending Control When Risk Teams Learn To Challenge The Model
URL: https://www.thestateofai.com/news/ai-literacy-risk-prabhu-krishnammagari-finance-house
Published: 2026-10-09T04:57:55.498Z
Section: Enterprise Strategy
Summary: Finance House's Prabhu Krishnammagari argues AI literacy becomes a real control when risk teams learn to interrogate AI output.
Full text:
The most important safeguard in an AI deployment in regulated finance is often the person reading the output. Workers at more than 90% of companies already use personal chatbot accounts for daily tasks, while only about 40% of those companies pay for an official tool. Some lenders are treating AI literacy as a control alongside model governance. They train the people closest to a credit decision to interrogate whatever the model hands them, and regulators are starting to expect exactly that. Prabhu Krishnammagari is the Head of AI Programs & Solutions at Finance House , a UAE-based financial institution. He joined in January after serving as Assistant Vice President, AI/ML and Site Reliability Engineer at Bank of America. He wants risk teams to challenge AI models rather than simply adopt them. "I'm framing risk teams not as adopters of AI, but as challengers of AI. To become a challenger, a person has to understand what the model does," says Krishnammagari. In his view, the underwriter should always retain the final call on a credit decision, and training should make that judgment an active check on the model rather than a formality. Governance has to start before the first login Krishnammagari's view is that restrictions on AI are not enough on their own. "AI is now widely accessible, and across the industry people are already using it in their daily work. Restrictions alone are insufficient. Organisations also need approved tools, clear policies and employee education," he says. In his view, data residency and the redaction of confidential information are foundational, but they are one layer of protection rather than the whole answer. Governance, clear policies and human oversight have to sit alongside them. Regulatory guidance in the UAE points the same way, naming effective human oversight as a core principle for financial institutions. Technical controls are only part of the answer. The rest is people. "Deployment and literacy have to go together. Only when AI literacy goes up can people challenge or question the output," he explains. A probability score is only as safe as its reader For predictive models, his training approach begins with confidence scores and the thresholds that turn a probability into a decision. A model that returns a bare yes or no is a black box, and regulated lenders already answer to explainability requirements and model risk management frameworks. "When a model proposes the probability of something happening, the person looking at it should be able to construe what that probability means and where the AI could have gone wrong," Krishnammagari says. Literacy also means knowing enough about training data to spot trouble before it reaches a borrower. "If someone builds a predictive model for a newly launched product, a good risk team should ask how the data was gathered. The quantity of data needed to train that model often isn't there yet," he adds. That question marks the difference between an engaged reviewer and a passive human overseer who clicks approve on whatever the system recommends. Enterprise AI policies often name a human in the loop without defining what that person is actually expected to catch. Krishnammagari's approach aims to write that job description around the specific ways models fail. Fluent answers deserve the most suspicion With generative AI, the risk Krishnammagari worries about most is how convincing a wrong answer can sound. "The number one risk with generative AI is 100% confident wrong answers. Someone who doesn't know an AI can be confidently wrong will take the output as correct. Someone who knows the wording can sound certain while the answer is silently wrong will challenge it," he says. Deloitte Australia learned that lesson publicly in 2025, partially refunding the government for a report containing a fabricated court quote and citations to research that didn't exist. The episode illustrates what happens when AI-generated claims make it through a review process without someone testing whether the underlying evidence exists. Krishnammagari's training leaves stochastic gradient descent to the data scientists and focuses on the conceptual picture of how models get built and what data feeds them. "Once a risk professional understands the true nature of AI, that's when they'll be able to challenge it and verify the output at every step instead of blindly following what the AI said," he explains. Engineering discipline cuts cost and contamination together That literacy extends to the people building the systems, where Krishnammagari applies the same emphasis on understanding failure modes. In site reliability engineering, nothing ships until someone can see how it breaks, and Krishnammagari holds AI to a stricter version of that rule. "You should be two or three times more disciplined from a software engineering perspective when you're building AI than when you're building a normal software product," says Krishnammagari. Much of that discipline concerns what goes into the model. Teams often dump every available document into a prompt for fear of missing something, a habit he considers counterproductive. Deterministic parsing and minimal inputs protect the context window, the part of the system most worth defending, and the approach mirrors the wider push toward enterprise context engineering . "When we give a byte of information to a model, we have to understand whether it makes sense or whether it's context contamination," he says. He expected cost efficiency and engineering rigor to pull against each other, but found that the two could converge once a roadmap moved past its first steps. Compact, structured inputs lower the capability bar, so a model with half the power of a frontier release can often handle the work. Leaner models also change how value gets counted, at a moment when only 5% of companies report AI value at scale and headcount reduction has become the easy yardstick. Krishnammagari measures decision quality instead. "Underwriters make credit decisions a certain way. I'd rather have AI look at the same case through a different lens and add value. That's not something you measure in headcount," he says. UBS has already turned AI fluency into a hiring screen for its junior intake. A more substantive test would reward candidates for catching the model in a mistake, a skill that looks unremarkable on a r é sum é until an examiner asks who reviewed the output. Krishnammagari prepares risk teams for that moment by demystifying AI. "Generative AI isn't magic. At its core, a language model is predicting the next word," says Krishnammagari. "I'm putting it plainly and bluntly." The views and opinions expressed are those of Prabhu Krishnammagari and do not represent the official policy or position of any organization.

## Enterprise AI Needs A 'Moneyball' Moment Before Token Repricing Hits
URL: https://www.thestateofai.com/news/moneyball-ai-cost-per-task-joe-markwith-cdw
Published: 2026-10-09T04:57:06.366Z
Section: Enterprise Strategy
Summary: CDW's Joe Markwith scores AI use cases on the full cost of finishing a task, human review and hardware included, before token repricing reaches enterprise budgets.
Full text:
Uber's engineers burned through the company's entire 2026 AI budget for coding tools in about four months. The overspending starts with a question few AI leaders ask directly: What does it cost to finish a single task once the people checking the model's work and the hardware running it are on the bill? Joe Markwith is AI Transformation Strategist at CDW , the IT solutions provider serving business and public-sector customers. He has helped organizations adopt emerging technology since 1986, with work spanning healthcare and government relations. At CDW, he steers MOAT, short for Mastering Operational AI Transformation, a methodology the company built in early 2023 after ChatGPT reached the market. Decades of watching technology waves arrive have convinced him the business design has to come before the build. "People are chasing use cases without thinking about the total cost of ownership. What AI really is in the business landscape is an operating model, a new operating model for your business," Markwith says. "You need to handle the business acumen first, before you get into the use case." He puts AI strategy on the CEO's desk from day one. "Finance, legal, and security have to be part of that solution and have their hands in the batter, because they're going to protect the company on all those fronts." Markwith affectionately calls those functions the departments of no. The Ferrari rarely needs to leave the garage Markwith's issue is the habit of sending every prompt to the priciest model on the menu, including requests that amount to a Google search. "Everyone wants to drive the Ferrari, but it costs more money to drive the Ferrari. I would argue that 80% of what's going into that model doesn't require the Ferrari engine," he says. "You can do a lot with open-source models on local hardware, and people aren't planning ahead for how to properly architect their solution." Buyers have started testing that argument with real traffic. The CEO of startup Lindy told CNBC that moving his workloads to cheaper open-weight alternatives sent costs crashing, and Fortune has tracked U.S. enterprises fine-tuning open-source models for industry-specific work while saving frontier models for the jobs that demand them. The best roster beats the best player I've watched more than one leadership team greenlight the flashiest demo in the room and then spend the next year defending it in budget reviews. Markwith leans on Moneyball to explain his fix. In the film, a general manager and a data analyst tune out the veteran scouts and build a team from affordable players who reliably get on base. His approach scores every candidate use case the same way. "You do a very cold, analytical suite of metadata on each use case and start weighting and scoring each of those," Markwith explains. "At the end of those 10, 20, 100, 500 use cases, you get a roster of your top five or 10 players. Low cost, high return on value. They get on base, you can afford them, and those are the ones you test first." Scoring also drains the politics out of prioritization. A department sitting at number 60 on the list gets a data-backed explanation, and its ranking moves only when the attribute data does. A ranked roster gives every experiment a financial case from day one, which is exactly what's missing when most AI pilots stall before they ever touch the P&L. Those early, affordable wins double as training for the organization itself. "A year is like many lifetimes in AI," Markwith says. "Get the operating model down first with quick wins. Then, when you run the differentiating and transformational use cases, their chances for success are exponentially higher." The human on the roster changes the model's price Cost per task gets far more interesting once a model stops short of full autonomy. In one scenario raised during the conversation, two models work through 100,000 support tickets, one cheap and resolving about 80% on its own, the other triple the price and closing 95%. The bargain looks obvious until every ticket the cheaper model can't close lands on a person, and that person's time becomes part of the model's price. "The question is, which human? What's the cost of that human?" Markwith says. "Is it still the expert-level resource we had before, or is it someone with a totally different temperament who's really good at managing agents, an agent whisperer?" Who handles the leftovers can flip which model comes out cheaper. Routing escalations to a specialist built for supervising agents could free the veteran who used to do the job for work only an expert can handle, changing the economics of the cheaper model's missing 20%. That role barely exists on most org charts today, and companies that create it could land on a different model than their first analysis picked. The API side carries its own exposure. Pricing models are changing, and GitHub's move to usage-based Copilot billing this June showed how quickly a predictable line item can turn into a meter. "The API cost they're charging us isn't what it really costs to deliver that intelligence. The prices are artificially low," he says. "Rate limits are being lowered, and tasks are getting shuffled off to lower-quality models. Shrinkflation is going to happen in token economics, because the economics demand it." A roster scored at today's token prices can look very different after the next pricing change ,, so the use cases that make the cut this quarter may not make it next quarter. Companies capping AI tool spend risk throttling the very engineers whose output justified the investment. "Once you give a team of engineers a tool and they find themselves more efficient with it, and you take it away from them, you're going to have demoralization and frustration, and you're going to lose people. Think about the knowledge drain the company is going to have," Markwith says. "People want to be two, three, four, five times more productive. It's hard to take that away from them and get them to stay." That's the catch with treating AI economics like a Moneyball roster: cost alone can't pick the team. The calculation has to account for for what the model accomplishes , what humans have to do around it, what infrastructure it requires and what happens when the economics change. Cost per task gives executives a way to make those tradeoffs explicit before a use case becomes too expensive to unwind. The views and opinions expressed are those of Joe Markwith and do not represent the official policy or position of any organization.

## Who Owns the AI Transformation When HR, IT, and the Business All Have a Claim?
URL: https://www.thestateofai.com/news/nico-orie-on-ai-impact-on-work-design
Published: 2026-10-09T04:46:39.686Z
Section: Enterprise Strategy
Summary: Nico Orie, VP People and Culture, Global Operations and AI Strategy at Coca-Cola Europacific Partners, argues that AI transformation demands closer coordination between HR, IT, and the business.
Full text:
The views and opinions expressed are those of Nico Orie and do not represent the official policy or position of any organization. Companies spent the last two years treating AI adoption as a technology rollout , something to switch on and then manage change around afterward. That assumption doesn't hold up anymore since AI's payoff depends far more on how a company redesigns its operating model, its processes, and the shape of individual jobs than on which model or vendor it picks. That redesign work doesn't have a clean organizational home, and it falls somewhere between IT, HR, and the business. None of the three own it outright. The technology itself has also grown more complicated, leaving both the technical and the organizational questions wide open. Nico Orie , VP People and Culture, Global Operations and AI Strategy at Coca-Cola Europacific Partners, has spent more than three decades inside this kind of large-scale operational change. He led the global rollout of Workday across 70 countries and roughly 120,000 employees during his time at Philips, and he's held a series of senior People & Culture roles at CCEP since 2017, taking on an expanded mandate covering global operations and AI strategy earlier this year. That background in global systems rollouts, process redesign, and change management at scale, is exactly the muscle most companies are now discovering they need and don't have. "Now, a couple of years into the AI revolution, it's clearer and clearer that the true success of AI lies much more in the adoption, in how you change your operating models, and how you adapt your processes, than the technology itself," Orie says. The war for talent left a gap in work design The idea that companies need to understand work at the task level isn't new. More than a century ago, scientific management treated the design of work as a discipline in its own right, breaking jobs down into their component tasks to understand how each one should be performed. "So in the time of Taylorism , it was HR who did the design of work," Orie says. That changed in the 1990s, when the war for talent pulled HR out of organizational design and into talent management, skills, and people analytics. What got left behind was a detailed understanding of the work itself. "What are the actual tasks that people do in work, what type of tasks are they, and how can we automate them? That's a big gap," Orie explains. Job descriptions and process maps, the tools most companies still rely on, describe work at too high a level to answer that question. In Orie’s view, closing the gap should start with HR, but it cannot happen there alone. IT has to define what the technology can do, while the business has to identify the problem worth solving. He sees those three functions converging into “something new, which is probably a new department.” AI is giving knowledge work its own version of Taylorism AI now gives companies ways to recover the missing task-level visibility. Orie points to AI-led employee interviews and digital “breadcrumbs” left in company systems as ways to capture how work gets done, then use AI itself to analyze and redesign it. A century ago, Taylorism broke industrial work into its component motions and timed each one to optimize execution. AI-era task mapping does something structurally similar for knowledge work, using system logs and structured interviews instead of stopwatches. Part of what that data reveals, in Orie’s account, is how inefficiently AI often gets slotted into existing workflows, alternating with human steps in a way that adds friction rather than removing it. The redesigned version should compress that sequence into what he calls “AI, AI, output, human, human, AI.” Orie is explicit that this shouldn’t go as far as the original did. “There’s also risk there that you go back to Taylorism where you have everything sort of mapped out and you don’t leave room for the grit,” he says. The goal is visibility into what tasks exist and where AI can take them over, without stripping out the judgment and improvisation that make people effective in the first place. That caution has a direct precedent in the one domain that has automated longest. Wael Sabra is founder and CEO of the global talent platform SiiRA , which places remote talent and builds AI agents for the ad tech, media, telecom, and broadcast industries. Sabra believes the factory floor is the cautionary tale knowledge-work leaders should study. "Anyone who has designed a manufacturing process will tell you: do not discount the human element," he says. "Every automation will create an exception, which will need supervision and human handling along the way." Sabra's point sharpens Orie's: even as factory automation has advanced for decades, it never eliminated the need for people to catch what the machines can't, and knowledge work will be no different. Automation exposed the limits of job-level thinking The need for a task-level view becomes clearest once automation lands. By Orie’s account, CCEP has deployed roughly 170 robotic process automations, which is enough that the headcount impact should be measurable if the theory held. It hasn't been. "I've not been able to take out one FTE as a result of my 170 RPAs," he notes. Two forces are behind that, in his telling. People are, as he puts it, inclined to fill freed-up time with something new almost immediately, "so they end up just as busy as before." At the same time, the work itself keeps moving. Employees take on new responsibilities and shift into higher-value tasks even as older ones get automated out from under them, which makes the whole picture harder to read than a simple before-and-after headcount comparison suggests. Automating away 30% of a role is, relatively speaking, the tractable part. Figuring out what the remaining 70% should become, with no fixed target and a workforce that keeps redefining its own job in real time, is a bigger challenge. Orie's answer centers on building a different operating rhythm. "We need a more detailed management of the actual tasks and work that people are doing," he says. "We need to develop platforms and the way we manage teams, instead of just leaving it and hoping that it will happen. Because it will not happen that easily." Philip Samuelraj , Founder and CEO of AI transformation company Techjays , sees the same pattern when companies hand out AI tools and wait for the gains to show up. "A 10 or 20% bump in individual productivity is not going to meaningfully change the company if the workflows around it stay the same," Samuelraj says. "The question is whether the process itself is fit for the agentic era. The best process is no process, so what is the bare minimum it takes to get the same output, with AI doing the work first and people stepping in where judgment and creativity are needed?" In his experience, that redesign is where most companies stall. "Reimagining the workflow is the hardest part. It's a business process problem, not a technology problem." AI is forcing companies to redefine performance Ernst & Young recently committed €100 million to an incentive program built around non-technical skills, a move that caught Orie’s attention because it points to a broader problem companies are only beginning to confront. As AI takes on more technical and administrative work, the human contribution becomes harder to isolate and measure. That raises a basic question about what good performance looks like when one person using AI well can multiply what they used to produce alone. Orie sees it as a combination of the outcome someone delivers, the human judgment, expertise, accountability behind it, and how effectively they use AI along the way. “No one really knows how to do this. But it’s inevitable that we start looking at another definition of performance,” he notes. Business focus still matters most, but so do investments in people’s critical thinking and creativity, along with enough technical understanding of AI to apply it effectively. That requirement extends to managers. "A lot of managers really lack a bit deeper knowledge of AI," Orie warns. "They never admit it, and they always make statements." If AI keeps absorbing the lower-level tasks people used to learn on, and managers aren't deep enough in the technology to guide what replaces that learning, the pipeline for building the human skills starts running dry from both ends at once. The layer between HR, IT, and the business Resolving any of the above needs a home, and Orie’s answer is a Work Intelligence Center at the intersection of HR, IT, and the business. Its authority, in his view, comes less from a mandate on paper than from the credibility of the people. “You need to staff it, first of all, with credible people who have gravitas in the business,” he says. The Work Intelligence Center’s job is to provide resources the business usually cannot produce on its own, such as reliable data, a methodology for analyzing work, and a current view of how work gets done. The business owns the transformation, while the center gives leaders the evidence and structure they need to make informed decisions about it. “That center has to be built on AI too,” Orie argues. “You need AI to do the analysis, and to think of the redesign.” Gartner’s research also projects that by 2029, 30% of organizations will create blended HR-IT teams specifically to accelerate AI enablement. Samuelraj cautions that a new structure only earns its place if it produces something measurable. Too many companies, he says, stand up AI committees that slide into governance theater. "The pace of the committee becomes the pace of its laggards," he says. His test is deliberately tactical: "What were we doing manually that is fully done by agents by the end of the quarter? What workflows did we remove because they're no longer relevant? Are we getting more work done, at better quality, in a fraction of the time? If you can't clearly answer those, you may just be wallowing in governance." The CHRO and CIO can no longer run separate transformations The last open question is who makes the call when the technology and the workforce start pulling in different directions. “The Chief HR Officer has to make the call, in my view,” Orie answers. He’s just as direct about why that hasn’t happened much in practice: “I’ve been in HR for a long time in my career, and in all honesty, we lack a bit of the boldness to do that. We lack a bit of skill sometimes, but also boldness.” His resolution keeps HR in the lead but pairs it with IT as a co-owner. “I think the CIO and CHRO have to team up, basically, and then say, ‘Okay, jointly we will bring this forward.’” It's a conviction Sabra shares from his vantage point leading a platform that both places people and deploys agents . He frames the current moment as a genuine first for knowledge work. "For the first time in history, leaders of knowledge workers have an option to change how work gets done," Sabra says. "Previously the only way to get work done was to throw more humans at it. Now technology is an option. But the true design is people plus tech working together." His warning is about which way companies lean when they build that design. "Companies that are people-first, and not tech-first, are the ones most primed to make workers collaborate with machines." The gap between what leaders know and what they fund remains the clearest evidence that this is still an organizational problem rather than a technical one. “We should invest $1 in technology and then $3 in people,” Orie argues. “And now it’s the reverse. That’s $3 in technology and probably 20 cents in people in most companies. We need to start where the critical element of success lies. And that’s with people,” he concludes.

## The Youngest Gen Z AI Builders Say Companies Will Soon Run Themselves. Their Own Generation Is Getting Angrier.
URL: https://www.thestateofai.com/news/gen-z-ai-opinions-split
Published: 2026-10-09T00:34:48.182Z
Section: Business & Brand
Summary: A viral thread claims Gen Z insiders in San Francisco are years ahead of the mainstream on AI. National polling shows most of their peers use it about as much as last year and like it less.
Full text:
A thread about San Francisco's AI kids An X post from that circulated this week described talking with the Gen Z engineers and founders working at the edge of AI in San Francisco. The author said those conversations can break your mind a little bit, that major outlets are nowhere near repeating what these builders believe, and that the author is starting to think they're correct. Replies split along familiar lines. Several people asked for specifics and called the post hype. One wrote that AI began running entire companies a year ago. A follow-up in the thread answered the doubters by arguing that the conditions these predictions depend on keep being met. For enterprise leaders, the thread matters less as a forecast than as a look at the people who will soon join their engineering, data and product teams. Survey data suggests those people do not share a single view of AI. Adoption has stalled outside the frontier Some measures do show young people moving first. A February survey of 1,448 U.S. adults by the browser company Shift found that 47% of 18- to 24-year-olds now start searches with an AI tool, while 58% of all Americans still begin with a search engine. Daily use was highest among 25- to 34-year-olds, at 43%, compared with 32% across all ages. The wider generation looks different. Gallup, the Walton Family Foundation and GSV Ventures surveyed 1,572 Americans aged 14 to 29 between February 24 and March 4. Twenty-two percent use AI daily and 29% use it weekly, roughly the same share as in 2025. Attitudes fell over the same period. The share who said AI makes them excited dropped from 36% to 22%, and the share who felt hopeful fell from 27% to 18%. The share who said it makes them angry rose from 22% to 31%. Gallup senior education researcher Zach Hrynowski told Axios that the oldest respondents were the angriest and tied that to AI's effect on entry-level jobs. Shift found a similar reaction among younger adults, with 34% of 18- to 24-year-olds saying AI is already far too dominant. Payroll data points to the same pressure. Stanford Digital Economy Lab researchers Erik Brynjolfsson, Bharat Chandar and Ruyu Chen revised their "Canaries in the Coal Mine" paper in August using ADP records through June 2026. Employment of 22- to 25-year-olds in AI-exposed occupations now sits 19% below where it would be if it had kept pace with less-exposed peers, and the gap has widened since the researchers first reported it in August 2025. The authors found no economy-wide displacement and said the decline comes mainly from companies hiring fewer young workers, not from layoffs. Gallup also found that attitudes track closely with how often people use AI. Daily users reported more curiosity, excitement and hope than weekly users, which puts the heaviest users much closer to the builders described in the thread. What the insiders expect In the original post, @carrynointerest said the young builders' views go far beyond anything in mainstream coverage and listed three of them. Most are convinced the AI labs are entering a 15- to 20-year cycle of dominance. They expect that everything that can be farmed for tokens, which they call a "sensor," will be. And they believe AI will run entire companies in the near future. Replies challenged each point. One said anyone using the 15- to 20-year figure is misleading people. Another argued the opposite of lab dominance, predicting the labs will be commoditized, broken up and bought by the big tech companies, with Google winning in the dullest way possible. Someone else pushed the company claim further and predicted AI would run the IRS and eventually the rest of government. A reply about compute raised a separate point. It argued that the U.S. national security apparatus has far fewer GPUs than the Magnificent Seven tech companies. If capability keeps scaling with compute, that gap would leave a handful of private firms with more AI capacity than the government. What distinguishes this group is its starting assumption. Most public debate still centers on whether AI will reshape business. The builders in the thread take that as given and focus on what comes after. Because they work with new models as soon as they ship, their expectations follow current capability rather than older expert forecasts. The thread's claim that these predictions keep coming true has some support in company financials. Epoch AI estimated in May that Anthropic and OpenAI bring in roughly $9 million and $5.5 million in revenue per employee, more than any public tech company on the Forbes Global 2000. Apple's most recent 10-K works out to about $2.5 million per employee, and Google's to about $2.1 million. Neither lab is run by AI, but both are producing revenue at a scale that used to require far larger workforces. Why enterprises won't hand over the keys yet The strongest pushback in the thread came from people describing constraints that enterprise leaders deal with every day. One reply argued that capability and adoption are separate problems. Companies are unlikely to give autonomous systems open access to proprietary data, intellectual property and critical processes while regulation, liability and security questions remain open. Another asked who would insure a company run by AI. A third predicted that the first AI-run company to fail because of a hallucination would set the idea back for everyone. The insurance question already has a partial answer. In May 2025, insurers at Lloyd's of London began underwriting policies from the Y Combinator-backed startup Armilla that cover legal claims when an AI tool underperforms. The policies pay out only when a system falls well below its original performance benchmark, and one underwriter said it would turn away systems it judged too error-prone. Companies already running heavy automation are drawing similar lines. Coinbase pulled one category of support case back to human specialists after its agent gave customers accurate answers about mistakes they could not undo. Others questioned where the predictions come from. One reply said they sound like the views of people who have only run tech startups, and that large non-tech companies have so far deployed little beyond customer service chatbots. Another user answered that this criticism reflected 2023 conditions. A more measured reply accepted the end state and questioned the timeline. It argued that hard-asset and physical-service industries have fewer feedback loops and slower iteration cycles, which makes them harder for AI systems to improve within. On that view, software-heavy functions would be automated first, and operations tied to physical goods would follow much later. What this means for the workforce enterprises are hiring Coverage of Gen Z and AI tends to treat the generation as either enthusiastic adopters or resentful skeptics. The Gallup data indicates that both groups exist and that the main dividing line is how often someone uses the tools. Casual users report more concern about jobs, and daily users report more optimism. For hiring managers, that means new graduates will arrive with very different expectations. Some will push to automate work that current processes still route through people. Others will be wary of AI and what it means for their careers, and they are applying into a market where 46% of employers already use AI to read resumes . McKinsey's projection that 11 million U.S. workers will have to start over by 2035 suggests that tension will last. The San Francisco builders may be early on autonomous companies, and the skeptics may be right that liability will slow things down. For enterprises, the more pressing fact is already in the payroll data. The workers most eager to hand their jobs to AI are the youngest ones, and they belong to the same age group whose entry-level openings are disappearing fastest. Many companies are now hiring people who will spend their first years automating the jobs their predecessors started in.

## Amazon Is Blocking Your AI From Shopping There. Its Own AI Gets a Pass.
URL: https://www.thestateofai.com/news/amazon-blocks-ai-shopping-agents
Published: 2026-10-08T22:41:37.607Z
Section: Industry & Platforms
Summary: Amazon has shut Meta's Muse and most other outside shopping agents out of its store, while its own agent buys from other retailers' sites. Walmart and Shopify are letting Muse in.
Full text:
Amazon's shopping agent is allowed to leave Amazon. A feature called Buy for Me finds products on other retailers' websites and completes the purchase for the customer, who never leaves the Amazon app, PaymentsJournal reported . Outside agents can't make the same trip in the other direction. Since the night of September 20, anyone who sends Meta's Muse to buy something on Amazon gets a pop-up saying the unauthorized agent is violating Amazon's Conditions of Use, GeekWire first reported . Muse is the biggest name Amazon has shut out, and it joins a long list. Cybernews found Amazon's site rules naming ChatGPT, Claude, Copilot, Perplexity, Grok and Google's crawlers, and the retail agency Tinuiti counted close to 50 AI-related user agents in Amazon's robots.txt by early this year. State of AI has already covered why Muse keeps getting blocked across the web and the ad revenue behind most of these walls . Amazon's case adds a twist those stories didn't cover: the company keeping other agents out is building its own, and that agent is allowed to do on other retailers' sites what Amazon prohibits on Amazon. Amazon's Agent Shops Wherever It Wants Amazon retired the Rufus name in May and moved the technology into Alexa for Shopping, its agent for answering product questions and acting on a customer's behalf. Buy for Me sits alongside it and handles purchases from stores Amazon doesn't own, according to PaymentsJournal. Either way, Amazon keeps the customer, the transaction data and the session inside its own app. Amazon says the comparison isn't fair. It told Adweek that it holds every agent to the same rules: identify yourself, let the site opt out, offer something in return and improve the shopping experience. Its specific complaints about Muse are that Meta never asked, that the agent doesn't say it's an agent, and that it appeared able to capture and store customer credentials. Amazon updated its Conditions of Use in August to require agents to identify themselves in every request, as State of AI reported last week . The business reason shows up in Amazon's earnings. Its ad business took in $19.8 billion in the second quarter, up 26% from a year earlier , much of it from sponsored product listings. An outside agent comparing prices for a customer has no reason to look at them. Alexa for Shopping works inside Amazon's own pages, where Amazon decides what the customer sees first. Amazon Lost in Court, Then Changed Its Terms Amazon tried a lawsuit first. In November 2025 it sued Perplexity over the Comet browser under the federal Computer Fraud and Abuse Act, and a district judge granted a preliminary injunction in March, Retail Insight Network reported . The Ninth Circuit vacated that injunction on August 4. Judge Milan Smith, writing for the panel, said the user is the one accessing Amazon when Comet shops for them, and compared it to a person browsing in Safari, which no one would describe as Apple accessing Amazon, according to AI Weekly . Amazon asked the full court to rehear the case, and Ecosistema Startup reported that request was denied on September 10. The lawsuit itself is back in district court. The panel didn't decide whether Amazon can enforce its own terms against customers who shop through an agent, Implicator noted . That is the theory behind the Muse pop-up. Rather than accuse Meta of hacking, Amazon is telling its own customers they violated an agreement they accepted. No court has ruled on whether that holds. Walmart and Shopify Are Letting Muse In Muse has been downloaded more than 2.5 million times since its September 8 launch, according to Sensor Tower data cited by Inc. Several of Amazon's competitors want those users. Shopify opened its checkout to Muse through Shop Pay, and Meta has named Walmart, Best Buy, Wayfair, Sephora, Gap and Expedia as partners, though not every integration is live yet . When NBC News tested Muse at several large retailers , some blocked it, including companies Meta lists as partners. Walmart has said for most of this year that it wants outside agents in. Executives told Modern Retail in January that open partnerships are central to the company's AI strategy, and Walmart connected its catalog to Google's Gemini through the Universal Commerce Protocol, a checkout standard Google announced with Shopify, Target and Etsy among the early backers. OpenAI and Stripe released a competing open standard, the Agentic Commerce Protocol, in September 2025, according to Stellagent . For a retailer that competes on price, the math is simple. If an agent compares every store before it buys, Walmart wants to be the easiest store for it to buy from. Amazon makes more money when shoppers browse its pages than when software skips past them. Amazon Has a Point About Disclosure Muse does try to pass as a person. Inc.'s Jason Aten examined the app and found that its browser switches off the standard signals that tell a website software is in control. An agent that logs into customer accounts with saved passwords and doesn't identify itself is a real fraud and liability problem for any store. Andy Jassy has also said many shopping agents get prices, delivery dates and stock levels wrong, according to Digiday , and those mistakes land on Amazon's customer-service team. That argument would carry more weight if identifying itself got an agent through the door. Meta could add disclosure to Muse tomorrow and still need Amazon's permission, because Amazon's terms let it limit agents' access at its sole discretion, eMarketer reported . Jassy has said Amazon is talking with agent makers and expects to partner with some over time. He has also said any arrangement needs the right exchange of value , which suggests access will come with a price. The industry is working on a technical fix. Web Bot Auth , a draft IETF standard, would let agents cryptographically sign their requests so sites can verify who sent them. That would answer Amazon's identification complaint, though Amazon could still turn verified agents away. What Companies Should Do Now If you sell online, set a policy on outside agents before a vendor or a platform default sets one for you. Amazon's approach works for a store customers won't leave. Most retailers are closer to Walmart's position and need to be easy for agents to buy from, which means product data, prices and inventory that software can read accurately. If you're building a shopping agent of your own, plan for the retailers it visits to ask for the same disclosure and opt-out rights Amazon demands from Meta. Building those in now costs less than retrofitting them after a block. If your company uses agents for purchasing or procurement, keep critical buying off sites that haven't agreed to agent access. Amazon is enforcing its terms against its own customers, so an employee who sends an agent to order supplies on Amazon could be putting the company's account at risk. Use a supported integration or keep a person at checkout. Watch the Perplexity case now that it's back in district court. It is the likeliest place for a judge to rule on whether a retailer's terms of service can stop customers from shopping through the agent they choose.

## Coinbase Automated Most of Its Support. Then It Pulled One Kind of Case Back Out.
URL: https://www.thestateofai.com/news/coinbase-support-automation-human-specialists
Published: 2026-10-08T14:59:49.911Z
Section: Industry & Platforms
Summary: An automated agent gave Coinbase customers accurate answers about mistakes they couldn't undo. Wes Griffith's team took it out of production and sent those customers straight to a person.
Full text:
In crypto, some mistakes are permanent. Send funds to the wrong address and there's usually no one who can pull them back. Coinbase built an automated agent to handle those cases, and on paper it worked. The answers were correct. The customers weren't satisfied, though. "An automated experience can tell a customer that they've made an irreversible error, but it cannot meet them in that moment of empathy," Wes Griffith, then Coinbase's senior director of global consumer support experience, told CX Current last November . So his team reversed course. "We've actually pulled some of those use cases from production, and they now create an immediate express path to a human," he said. Griffith said the change produced higher satisfaction and gave specialists a chance to walk customers through what happened so they wouldn't repeat it. The rest of the automation stayed Coinbase kept automating almost everything else. During Griffith's time there, automated support handled close to 80% of contacts, according to his profile in CX Current's Top 50 Leaders Transforming CX '26 , released this week. The irreversible-error cases were a narrow exception, and they now skip the bot. The frontline team was renamed from agents to specialists, a nod to the product knowledge, risk awareness, and judgment the job now required. Coinbase backed the title with training. Griffith wrote on LinkedIn that about 500 specialists went through Securities Industry Essentials training as Coinbase expanded equities trading, and that certified specialists drove roughly 12% higher CSAT on trading questions. AI stayed in the conversation after the handoff. When a case reached a specialist, the system carried over context from the automated exchange and surfaced account signals, so customers didn't have to start again. Griffith described AI to CX Current as a teammate for human agents, surfacing data in real time so people don't have to memorize a product line that keeps growing. Griffith has been direct about what Coinbase measured. "Cost and efficiency are simply guardrail metrics for us. They are important, but they are not the point," he said. "CSAT is our number one metric." He also launched Coinbase's premium Concierge service, which he says reached more than 95% customer satisfaction in its first year. Griffith left Coinbase in July to become vice president of member experiences at HealthEquity, after roughly five years at Coinbase and about a decade at Amazon before that. He now sums up the approach in one line: "AI in CX is not humans versus AI. It's AI handling scale and humans handling significance. But that means it's incumbent on the company to know the difference." Gartner's advice lines up Gartner's advice to service leaders this year reads a lot like Coinbase's playbook. In August it published a survey of 3,566 customers in which 87% said a company using generative AI for service must give them a way to reach a human . Its recommendation was not to make GenAI a mandatory first step for every issue, and to let it attempt a resolution only when its confidence is high. A month later, Gartner found that only 27% of customers would try a chatbot again after a bad experience. When a bot can't resolve something confidently, Gartner said, it should show a visible path to a person and pass along what it has already collected. That's close to what Coinbase built. Banks are working through the same question. In our coverage, Wipro's Alok Kumar argued that even a 99% accurate agent shouldn't move money on its own , and that the cutoff belongs wherever a mistake can't be reversed. Where other honorees stop the bot Griffith is one of several leaders on CX Current's list who decide case by case where automation stops. At MetLife, Merrilee Matchett runs global customer service and operations for more than 10,000 people. She starts from the view that insurance has to feel human when customers are dealing with illness, disability, or loss, and she resists digitizing every step of the journey. Charl Lombard, chief client experience officer at Goosehead Insurance, expects AI to absorb most transactional service, but notes that speed alone isn't enough when a customer is dealing with a loss or a complicated decision. Burgoyne Hughes, who runs GE HealthCare's customer service centers, comes at it from the other side. "You have to create an automated experience that is so smooth customers will prefer it over talking to a live person," he says. He's also wary of automation built mainly to keep customers away from service professionals. Support you don't have to contact Griffith's longer-term goal at Coinbase was to make support close to invisible. He told CX Current the best support experience is the one where you don't need to contact anybody, and described a test that would proactively tell users how much they could have saved on fees with a Coinbase One membership. His team also watched for systemic anomalies and individual points of friction, with a person in the loop, so problems got fixed before they turned into ticket spikes. Griffith treated education as part of the same job, so customers would be less likely to make an irreversible mistake in the first place. "Crypto is a new frontier for a lot of people," he said. "We have a responsibility to help people navigate that in a trusted way." He's now at HealthEquity, which administers health savings accounts and other benefits. The rest of the Top 50 Leaders Transforming CX '26, including profiles of each honoree, is on CX Current. The Top 50 Leaders Transforming CX '26 awards are presented by CX Current in partnership with Cresta.

## Figma's AI Agent Was Eating Its Margins. As of Tuesday, You're Paying for It.
URL: https://www.thestateofai.com/news/figma-ai-agent-credits-claude-design
Published: 2026-10-07T20:19:17.653Z
Section: Industry & Platforms
Summary: Figma's design agent is out of beta and now costs AI credits, after a free run that inflated its costs while Anthropic and Google launched rival design tools on the models Figma rents.
Full text:
Figma ran its design agent for free for four and a half months while Anthropic and Google launched design tools built on the models Figma rents. On Tuesday it started charging customers for it. On Tuesday, Figma took its design agent out of beta. The release notes led with faster responses, a way to search Figma files from inside a chat, and guidelines teams can write so the agent understands their design libraries. Figma's help center carried the bigger change. Since October 6, every prompt to the agent draws down Figma AI credits , from the same pool customers already spend on Figma Make. During the beta, it cost them nothing. Figma paid for it instead, and its last earnings report showed how much. Putting the agent on credits is the most direct step it has taken toward getting its AI revenue ahead of its AI costs, in a year when the labs that supply its models started competing with it and its stock lost most of its post-IPO value. What came out of beta The agent first reached paying customers on May 20 as a sidebar inside Figma Design, connected to a team's components, variables and comment threads. Designers used it to generate layout options, bulk-edit layers, fill screens with realistic copy and summarize feedback. The general release, according to Figma's release notes , adds the configurable guidelines, the ability to pull other Figma files into a chat, and lower latency. The Verge reported that users can now see what their colleagues' agents are working on. Generative plugins and custom skills came out of beta the same day. Figma's launch post features teams at Uber, Granola and Atlassian and says the new version wins about 60 percent of the time in evaluations graded by professional designers. Figma hasn't said what it was compared against. Full seats on Professional, Organization and Enterprise plans get the agent, Starter accounts get a limited version, and Collab, Dev and View seats can use it in drafts. Revenue up 48 percent, stock down 15 Figma reported its second quarter on August 5. Revenue rose 48 percent to $370.1 million , its third straight quarter of faster growth. Net dollar retention came in at 136 percent, and the company raised its full-year guidance to between $1.463 billion and $1.467 billion. Shares closed down 14.9 percent the next day . Cost of revenue was up 117 percent, mostly from AI infrastructure and hosting, and management told analysts it was running AI features it didn't yet charge for, the beta agent among them. People were using those features. More than 80 percent of paying customers above $10,000 in annual recurring revenue used AI credits every week, and over a fifth of weekly credit users reached Figma's AI only through the agent. On the same call, Figma said its chief product officer and chief marketing officer were leaving, and it guided third-quarter growth down to about 36 percent. We wrote about this problem last month, after Canva's backers marked it down by $7 billion . A subscription gets priced once a year, the model behind it costs money every time someone uses it, and the company in the middle rents that model from someone else. Canva is private, so its investors repriced it on their own schedule. Figma's shareholders did it in one trading session. Its suppliers became its competitors In February, Google released Stitch , a free AI design tool. Two months later came the week we covered on State of Brand . On April 14, Anthropic's chief product officer, Mike Krieger, resigned from Figma's board, and three days later Anthropic launched Claude Design, which reads a company's codebase and design files and passes finished work to Claude Code. Figma's stock fell 7 percent that day. Figma had been building Claude into its own products, and Claude runs Figma's federal AI offerings . One of the companies supplying Figma's AI was now selling a design tool of its own. Figma lost 52 percent of its market value in the first half of the year while beating revenue estimates. On May 28, the activist fund Findell Capital wrote to the board asking for an independent investigation into the timing of Krieger's exit, and noted that two remaining directors have financial exposure to Anthropic through their venture firms. After the August report, the stock closed at $23.97 , against a post-IPO high near $143. We've argued that the frontier labs are selling inventory and calling it a moat . Figma's year shows what that looks like from the customer's side. A company that builds its product on a lab's model can wake up to find the lab selling the same product. Figma opened the canvas Figma hasn't responded by closing its files off. In March, it let outside agents write directly to the canvas through a use_figma tool on its MCP server, so Claude Code, Codex, Cursor and others can create and edit native Figma files. It also added skills, markdown files that teach an agent how a particular team builds. Figma's explanation was that AI-generated designs look generic because agents don't know a team's standards, and Figma is where those standards are kept. Much of SaaS went the other way this year. Slack, HubSpot and others restricted what outside agents could reach. Figma is betting that if agents are going to do design work anyway, the company holding the design system becomes the place they all write to. Its own agent is how it gets paid for that. Figma says the agent uses models fine-tuned for product design , and management has pointed to model routing and its own models as the way to bring inference costs down. The new guidelines feature applies the skills idea to Figma's own agent, so a team's design system works as a set of instructions. As frontier models converge , more of the value sits in the context, permissions and workflow around them. Figma holds a decade of its customers' components, tokens and libraries. That protects it only as long as customers keep building them in Figma. Where design software goes from here Generation is going to the labs. A prompt that turns into screens now comes with a Claude or Gemini subscription. What the labs don't have yet is the record a company's product actually ships from, meaning its libraries, tokens and file history. Companies that own neither are the token resellers we described in April . Canva took another route and positioned itself as the collaboration and publishing layer Claude Design hands work off to. Pricing is moving from seats to usage. Figma began charging for AI credits in March and has now put its main agent on the same meter. For the fifth of its AI users who only touch the agent, a seat price no longer describes what they're paying for. HubSpot made the same change in CRM, and design companies renting their models will be next. Designers will spend more time writing the rules agents follow and less time drawing screens, which matters for brand too. AI can now copy everything except a company's data and its opinion , and a design system holds both. Teams that let agents design from defaults will ship products that look like everyone else's . Figma has already said what this means for its own headcount. CFO Praveer Melwani told Fast Company the company is hiring fewer people than it planned because AI lets its staff do more. What to watch Figma still has a strong case. Revenue is accelerating, retention is high, and a team that has standardized on Figma libraries has real reasons not to leave. Claude Design exports HTML rather than native Figma files , so a lot of work that starts there still ends up on Figma's canvas. The fourth quarter is the first in which the agent bills, and gross margin is where that should show up first. Credit limits come next. The agent shares a pool with Figma Make, and teams that run out will either buy more credits or use the agent less, which will tell Figma what it's worth to them. The longer question is where design work starts. If more of it begins in Claude Design, Stitch or a coding agent and reaches Figma only for cleanup, Figma becomes a finishing tool. If those agents keep writing into Figma files, it becomes the system of record it is betting on. Dylan Field has said he tells his team to ignore the stock price and focus on the inputs. Since Tuesday, one of those inputs shows up on the customer's bill.

## 91% of Service Leaders Are Being Pushed to Deploy AI. CX Current's Top 50 Shows Who's Making It Work.
URL: https://www.thestateofai.com/news/cx-leaders-ai-agents-customer-service-top-50
Published: 2026-10-07T17:45:30.185Z
Section: Industry & Platforms
Summary: Nearly every customer service leader has been told to put AI to work. The people on CX Current's new list are figuring out how AI agents and the people around them should split the job.
Full text:
The order has come down from the top. In a Gartner survey of 321 service and support leaders , 91% said executive leadership was pressuring them to implement AI in 2026. Gartner research director Kim Hedlin said service organizations are entering a period where "AI and human expertise must work in tandem." That pressure doesn't settle how the work actually gets divided. Some conversations should run start to finish without a person. Others need someone with judgment and the authority to make an exception. Wes Griffith, who left Coinbase this summer to run member experience at HealthEquity, has a short version : "AI in CX is not humans versus AI. It's AI handling scale and humans handling significance. But that means it's incumbent on the company to know the difference." That's the backdrop for CX Current's Top 50 Leaders Transforming CX '26 , released this week. The list names 50 people across five categories, and nearly all of them are working on some version of the same problem: running AI agents and human agents as one operation. Deploying the agent turned out to be the easy part CXM argued last month that getting AI agents into production is no longer the hardest job in customer experience. There's still a gap between deploying AI and getting customers to use it. Gartner found that only 27% of customers would try a chatbot again after a bad experience. In their most recent service interaction, customers were about three times more likely to turn to a third-party GenAI tool than to the company's own chatbot. Customers aren't asking companies to switch the agents off, though. That same survey of 3,566 customers found that 87% said a company using generative AI for service has to give them a way to reach a human agent. They want that option available, and they want the handoff to work when they use it. Gartner also expects the human jobs to change shape, with higher-tier reps acting as "judges" and "experts" on the cases too nuanced for automation. Wipro's Alok Kumar made a similar point to State of AI about banking, where even a 99% accurate agent shouldn't move money on its own . The caller is changing too. Late last month we reported that consumers and businesses have started sending their own AI agents to call support lines, sit on hold and negotiate. Cresta's Antony Passemard saw that coming when we spoke with him in July. The five categories, and who made the list CX Current split the honorees into five groups. Read together, they line up closely with the jobs someone has to own once AI agents and people share the work. A striking number of them changed jobs in the past year, including Griffith, John McCahan, Samir Zabaneh, Mike Gomes, Dawn Block and Tawana Allen. Companies are clearly hiring for people who have done this before. The Catalysts Brandon Peterson's numbers at Achieve make the clearest case for this category. AI guides reps through calls and writes the summaries afterward, and Achieve has cut after-call work by 75% and hold times by 50%. Peterson expects AI to become the first point of contact in nearly every customer interaction. He's also direct about how that lands on the floor: "As we lean into AI, there's naturally concern among frontline employees about what it means for their jobs." His answer has been to show reps how the tools make their work easier. Griffith built his version at Coinbase, where automation handled close to 80% of contacts. When customers made irreversible blockchain mistakes, the automated agent could give accurate answers but couldn't handle the moment, so his team routed those cases straight to specialists. The AI stayed in the conversation after the handoff and carried the context over, so customers didn't have to start again. McCahan, who joined Fellers as chief CX officer in July, did similar work at FTD after its 2019 bankruptcy. He consolidated eight systems into one, put AI across voice, digital and agent channels, and got through peak demand with fewer seasonal hires. FTD more than doubled customer lifetime value during the turnaround. At MetLife, where Merrilee Matchett runs service for more than 10,000 people in over 40 markets, the stated goal is care that's "high-tech and high-touch." See all Catalyst honorees on CX Current. The Operating Architects At Citizens Bank, consumer banking COO Domenick Forte is putting LLM and agentic AI into the contact center to finish simple requests outright, including balance and transaction questions, address changes, and parts of fraud claims. Citizens has also piloted AI that logs complaints automatically and feeds root-cause analysis, so a single complaint can point to the process that keeps producing it. Charl Lombard of Goosehead Insurance argues that workflow redesign matters more than model choice, since competitors can buy the same tools. He's realistic about the starting point in insurance, where data is messy and legacy systems are common. "The teams that win aren't waiting for perfect data lakes," he says. Burgoyne Hughes rebuilt knowledge management at GE HealthCare's service centers into decision trees reps can follow under pressure. GE HealthCare reported a 60% drop in hold times, and Hughes says the error rate fell from 1.6% in 2018 to 0.04%. He holds automation to a high bar : "You have to create an automated experience that is so smooth customers will prefer it over talking to a live person." At Veterans United Home Loans, Natasha Rader's team ships roughly 200 technology enhancements a week to the systems loan officers use. See all Operating Architects on CX Current. The Interpreters Douglas Kramon, head of customer care and fan support for ESPN and EDTC offerings at The Walt Disney Company, uses AI for what he calls "catharsis scoring," which tracks how a conversation moves from frustration to relief. The best of those conversations become training material, and Kramon says interactions shaped by them score 20% to 40% higher on CSAT in situations that are usually hard to resolve. Before pushing further into generative and agentic support, his team overhauled more than 25,000 knowledge documents. Rogers reported more than 320 customer-led process improvements in 2025, 174 of them changes to internal tools. Mahes Wickramasinghe oversees customer experience and digital there as president of group operations. At Hertz, Mike Gomes wants to replace "service recovery" with what he calls "service discovery," using AI to find friction in customer communications before it becomes a complaint. Susan Kelly's Be Well Buddies program at Wellabe started with 25 customers paired with employees and has grown to about 1,000 who help shape products before launch. See all Interpreter honorees on CX Current. The Pathfinders UPS has set a goal of handling more than 98% of customer service requests through a mix of AI and people by the end of 2026. Olga Sulyagina, who runs customer experience and service there, is applying AI to tracking, claims, returns and international shipping. An app rebuild under her raised CSAT from 2.5 to 3.7 and NPS from 21.5 to 39.5 within six months. Jenifer Robertson wants AT&T Consumer to absorb telecom's complexity so customers don't have to, through clearer offers, proactive fixes and connections that switch networks automatically to keep a household online. At Delta, Ranjan Goswami runs marketing, product and experience design together, and Delta Concierge uses trip and account data to help SkyMiles members deal with disruptions and lost bags in plain language. Eric Strom moved bswift's support for more than six million participants from a reactive, single-channel model to digital-first. His rule going in: "We're going to improve the customer experience, and that will save money." See all Pathfinder honorees on CX Current. The Trust Builders Cliff Hagan helped design Charter's Customer Commitment for Spectrum, which attaches money-back guarantees to promises on reliability and transparency. Charter reported a 16% year-over-year drop in billing calls after simplifying pricing and billing, and Spectrum has added Agent Assist and Summary AI so reps can see a customer's earlier conversations. At eBay, Dawn Block backed the Authenticity Guarantee and the Vault to build trust into high-value transactions. "We start with trust," she says. Tammy Williams holds both the experience and culture titles at Capital Credit Union, on the view that how a company treats employees shows up in how they treat members. Turnover there fell from 23% in 2021 to 15% in 2024, and engagement rose from 60% to 86%. Who an AI agent acts for, and what it's allowed to do, is becoming a trust question too. It comes up across our coverage, from Mastercard's agent payments to agent permissions that outlast their authority . See all seven Trust Builders on CX Current. What to watch next With nearly every service leader under pressure to put AI to work, most of the open questions for the next year are operational. Someone has to own the handoff rules, measure AI agents and human agents against each other fairly, and decide what to do when the caller is a bot. The people on this list are a good place to look for how that gets done. The full list, with each honoree's profile , is on CX Current. The Top 50 Leaders Transforming CX '26 awards are presented by CX Current in partnership with Cresta.

## The Web Says It's Blocking AI Agents for Security. It's Blocking Them Because They Don't Look at Ads.
URL: https://www.thestateofai.com/news/why-websites-block-ai-agents-ads
Published: 2026-10-07T02:11:15.376Z
Section: Industry & Platforms
Summary: AI agents now browse, read and shop for people, and the ad-funded web has no way to charge them. The sites putting up walls are the ones that live on ads.
Full text:
When Amazon sued Perplexity last November over Comet, the AI browser that can log into a customer's Amazon account and place orders, Perplexity's response went straight at the money. The lawsuit, it said, was a "bald attempt" to keep Amazon shoppers from using AI agents, because agents "don't have eyeballs to see the pervasive advertising Amazon bombards its users with." Perplexity has an obvious interest in saying that, but the point holds well beyond one lawsuit. Most of the free web is paid for by putting ads in front of people who come to read, search or shop. An agent comes to collect information for someone else. It loads the page, takes what it needs and reports back, and the person it works for never sees the banner or the sponsored listing that was supposed to pay for the visit. There are now a lot of these visitors. On June 3, Cloudflare CEO Matthew Prince said automated traffic had passed human traffic on the web for the first time , reaching 57.5% of HTML requests about 18 months sooner than he had expected. That figure includes every kind of bot, including search crawlers and scrapers that have been around for decades. The part growing fastest is the newer kind, agents that browse, fill in forms, compare prices and check out on behalf of a specific person. How Fast Agent Traffic Is Growing DataDome, a bot-protection company with more than 400 customers, counted 17.7 billion AI agent requests across its network in the second quarter , compared with 12.2 billion in the first quarter. Spread over the 91 days from April through June, 17.7 billion works out to about 194 million agent requests a day, and that is only the slice of the web DataDome sees. Quarterly growth was 45%. If the same rate continued through the end of the year, DataDome's network would handle about 37 billion agent requests in the fourth quarter, roughly three times the first-quarter count. Nobody has published that as a forecast, and growth this steep usually slows, but even at half the rate the volume would double within a year. Other measurements show the same trend. HUMAN Security's annual benchmark report found agentic traffic grew 7,851% year over year , most of it in retail, streaming and travel. A single product produces much of it: in June, Perplexity's Comet accounted for 47% of the agentic traffic HUMAN recorded . Every one of those requests costs the site that serves it something in bandwidth and computing. Almost none of it shows up as revenue, because ads are still sold per thousand impressions to human beings. Most Agents Are Reading, Not Buying Companies building agents tend to sell them on commerce, with demos of an assistant booking a flight or reordering groceries. HUMAN's monthly numbers point somewhere else. In its latest report, media sites received 43.5% of agentic traffic , slightly more than e-commerce at 42%. About three-quarters of agent activity was browsing listings, reading articles and running searches. Very little of it ended in a purchase. Publishers are the businesses least able to absorb that. Amazon has the lawyers and the market power to fight. A mid-sized news site that depends on programmatic advertising mostly pays higher hosting bills for visits it cannot sell. Many of those sites are already losing readers to Google's AI Overviews , which answer a search before anyone clicks through. Agents go a step further, since they do click through and still deliver no reader. The Courts Have Sided With the Agent, for Now Amazon's first move against Comet was to block it and then sue. The company argued that Perplexity disguised its agent as an ordinary Chrome browser to avoid detection, and in March a federal judge in San Francisco granted a preliminary injunction. The judge found that Comet entered customer accounts "with the Amazon user's permission, but without authorization by Amazon." An appeals court threw out that injunction in August . Its reasoning was that under the federal computer fraud law, Perplexity's users were the ones accessing Amazon, through the agent, and Perplexity itself was not. The case is still going. Until it is decided, an agent sent to a website by its user is treated much like the user. Where the Walls Are Going Up Infrastructure companies have moved faster than the courts. On July 1, Cloudflare began classifying AI traffic by purpose, separating search indexing, model training and agents acting for a person in real time. As of September 15, new publisher sites that sign up with Cloudflare block agent and training traffic on ad-supported content by default . Search crawlers are still let in. State of Brand covered what that default means for brands that depend on press coverage showing up in AI answers when it took effect last month . The details of that default show what it is protecting. Cloudflare did not block agents everywhere. It blocked them on pages that earn money from ads, and it kept letting in search crawlers, which still send human readers back to those pages to see the ads. Amazon has framed its fight with Perplexity around security and a worse customer experience, and those concerns may well be genuine. Amazon's advertising business also brought in $19.8 billion in the second quarter, up 26% from a year earlier , and much of that comes from sponsored product listings an AI shopper has no reason to look at. Perplexity told the court that ads were Amazon's real motive. Whatever the stated reasons, the barriers built so far sit on ad-funded pages and in an ad-funded store. Lawmakers are getting involved as well. In June, New York's State Assembly passed a bill that would require AI crawlers to identify themselves to news publishers , with fines of $15,000 a day for violations. Efforts to work with agents instead of blocking them have had little effect so far. Many sites now publish an llms.txt file to guide AI systems, but Ahrefs' server-log research found that 97% of those files received zero requests in May . Selling Ads to Software A few publishers are trying to sell to agents instead. Time has started running ads aimed at the AI agents that read its pages , one of the first campaigns written with software as the intended audience. Startups have followed. OpenAds identifies agent visitors on publisher sites and serves them sponsored content related to whatever task the agent is working on, and pitches agents to investors as the largest new source of attention since smartphones. The approach has a basic problem. Content designed to persuade an AI agent is hard to tell apart from content designed to manipulate it, and companies building agents already work to filter out hidden instructions planted on web pages. An ad written for an agent is likely to get the same treatment. How this plays out will decide a lot about the agent market. Websites could start charging agents per visit, which would shift costs onto the companies that build them. The largest platforms could admit their own agents and block competitors. Or advertising could move inside the agent, so that whoever makes the assistant people rely on controls the main place left to show them anything. What Companies Should Do Now Start by measuring how much of your traffic comes from agents. HUMAN, which sells agent detection, says most analytics tools can't distinguish agents from human visitors . If yours can't, your conversion rates, acquisition costs and ad yield figures are probably counting software as customers. Next, decide how to treat each type of AI traffic separately. Cloudflare already distinguishes search, training and real-time agents, and you can choose which to allow, which to charge and which to block. A blanket policy will treat a model-training scraper the same as an agent placing an order for one of your customers. DataDome's Segura made the same point to Digiday: "Not all AI agents are the same." If you sell online, plan for some of your customers to send software to shop for them. Amazon CEO Andy Jassy has said agentic commerce could be good for e-commerce , though he added that agents still struggle with personalization and getting prices right. Accurate product data and prices that a machine can read easily will make it more likely an agent picks you. If your company deploys its own agents, have them identify themselves. Much of Amazon's case rested on Comet presenting itself as Chrome, and New York's bill would put a daily fine on undisclosed crawlers. An agent that hides what it is creates legal risk for the company running it. Finally, ask your advertising and measurement vendors how they detect and exclude agent traffic. If they don't have a clear answer, some of the impressions you are paying for may never have reached a person.

## Employers Worry Your Resume Was Written by AI. 46% of Them Have AI Reading It.
URL: https://www.thestateofai.com/news/employers-use-ai-to-screen-resumes
Published: 2026-10-06T16:10:12.659Z
Section: Business & Brand
Summary: A new survey of 1,027 hiring professionals shows both sides of the job market automating their way past each other.
Full text:
Anyone who has looked for work this year knows the routine. You tailor the resume, rewrite the cover letter, hit submit, and then nothing happens. No rejection, no interview, no sign that a person ever opened the file. A new report from hiring-assessment company Criteria suggests there's a decent chance nobody did. In its 2026–2027 Hiring Benchmark Report , which surveyed 1,027 US hiring professionals this summer, 56% said they use AI somewhere in recruiting or hiring. Screening was the most common use, at 46%. The same people told Criteria that one of their biggest headaches is candidates using AI. Forty-one percent named applicants using AI to misrepresent themselves as a top hiring challenge. In tech, it was 60%. And 35% admitted their process can't reliably catch it. So a large share of employers are worried that the resume in front of them was written by a machine, and they're handing it to a machine to decide. Where the AI actually sits Screening is only the start. Thirty-five percent of respondents use AI for assessments and 35% use it for scheduling. Smaller groups have moved it into the interview itself: 13% use it to write interview questions, 10% run AI-led interviews, and 9% let it score candidates' answers. For some applicants, software now asks the questions, hears the answers, and grades them. Employers have their own doubts about this. Asked what holds them back from using AI in hiring, 42% named accuracy, more than any other concern. Twenty-six percent cited bias and fairness, and 28% worried about how candidates would react. None of that seems to be slowing adoption much. There's a fair objection here. Faking your qualifications with a chatbot and sorting 2,000 applications with software aren't the same thing, and nobody should pretend they are. But from the candidate's side, the arrangement looks lopsided. Employers get to use AI to cope with the volume. Candidates who use it to cope with the silence get treated as a fraud risk. The loop At The State of AI, we've been watching for the first places where AI stops being a tool one side uses and becomes something both sides use against each other. Hiring may be the clearest case so far. It works roughly like this. Candidates apply to more jobs, faster, because AI makes it cheap and because most applications get no reply. Employers get buried (31% report extremely high applicant volume, and 24% say they've lost confidence in resumes altogether), so they bring in AI to filter. Filters reward whatever they're tuned to reward, so candidates tune their applications to match, and the resumes start to look alike. Employers trust them even less. Everyone ends up with more tools and less information. Tech gives a preview of where that leads. It's the industry furthest along, with 87% of tech hiring professionals using AI in hiring, compared with 56% overall. It also has the worst numbers on nearly everything else in the report. Sixty percent say candidates misrepresent themselves with AI, 46% report high applicant volume, 49% see persistent skills shortages, and 57% say hiring got harder this year, the highest of any industry. A survey can't show that adoption caused those problems. It does show that the sector that went furthest with AI hiring hasn't found hiring any easier. Who's ghosting whom The loop has a human cost, and it shows up in the ghosting numbers. Seventy percent of hiring professionals say a candidate has ghosted them. Nineteen percent say they've ever ghosted a candidate. Most job seekers will find that 19% hard to square with their own inbox. Maybe the other 81% are right. Or maybe an automated system did the ghosting, and nobody thinks of it as theirs. Either way, employers don't treat it as a priority. Asked for their top goals for next year, respondents ranked improving the candidate experience fifth, at 31%. Improving employer brand came last of ten, at 12%. Our take AI in hiring isn't the problem on its own. No recruiter should have to read 3,000 applications by hand, and plenty of candidates use AI honestly, to clean up their grammar or figure out what a job actually involves. The problem is that both sides are using it to avoid each other. Employers use it so they don't have to deal with most applicants. Applicants use it because employers weren't going to deal with them anyway. The software is doing what it was bought to do, and what it was bought to do is take people out of the process. Employers have far more power to break that cycle than candidates do. They pick the tools, set the filters, and decide whether a rejected applicant hears anything at all. A company that told applicants when software was screening them, what it was looking for, and when a person would step in would be doing something rare in 2026. It would probably get better applications, too. Employers who want candidates to stop gaming their AI could start by telling them it's there. Data: Criteria, 2026–2027 Hiring Benchmark Report , survey of 1,027 US hiring professionals conducted in summer 2026. Criteria sells hiring assessment software, and its report argues for more assessment-based hiring.

## McKinsey Modeled the U.S. Job Market Through 2035. 11 Million People Will Have to Start Over.
URL: https://www.thestateofai.com/news/mckinsey-11-million-workers-start-over
Published: 2026-10-06T00:54:48.790Z
Section: Business & Brand
Summary: A new McKinsey Global Institute report says AI will leave the U.S. with more jobs in 2035 than it has today. It also says most of the people pushed out of their current work have no easy way to reach them.
Full text:
Last Tuesday, the McKinsey Global Institute published an 82-page report modeling how AI and automation could reshape American employment between 2025 and 2035. The authors mapped roughly 1,800 occupations, the skills each one requires, and what it would take for a worker to move from one to another. The headline finding is more optimistic than most of what gets written about AI and work. McKinsey estimates automation could reduce labor demand by the equivalent of about 36 million jobs over the decade. Over the same period, an aging population, rising incomes, the infrastructure build-out and the AI industry itself could create demand for about 41 million. The economy comes out ahead by roughly 5 million jobs. Most of the disruption also stays inside existing occupations. About 25 million affected workers would keep the same type of job, though the work itself would change. The remaining 11 million, roughly 7% of the current U.S. workforce , may need to leave their occupation and move into a different one entirely. The report puts its own conclusion in one line: "The next decade's challenge is mobility, not scarcity." The number that matters is one in seven McKinsey didn't stop at counting jobs. It tried to work out whether each of those 11 million workers could realistically get from a shrinking occupation to a growing one, scoring every possible move on skill overlap, pay, training time and credential requirements. Almost every worker has some route to a growing job. Only about 14% have what McKinsey calls a direct pathway , meaning strong skill overlap, no pay cut and less than six months of training. Another 41% face a winding pathway that involves meaningful retraining of up to two years. The remaining 45% are on what the report calls an unpaved pathway, with large skill gaps, long credentialing timelines or lower pay. The report's own examples show how far apart those categories are. A dishwasher could move into home health aide work, but the two jobs share only about 20% of their required skills, and the move involves certification. An office assistant could become a project manager and see a large raise, but many would need a bachelor's degree and a project management certification first. The destination jobs are generally good ones. McKinsey found that 57% of employment in growing occupations falls in the top two wage brackets, and only about 3% of transitioning workers would take a pay cut if they complete the move. Getting there is the difficult part, and for most of these workers the report describes a long road. A decade of pandemic-level job switching In a typical year outside the pandemic, about 215,000 American workers move into a different occupational group. McKinsey's base case requires about 770,000 a year for ten straight years , which is 3.6 times the historical rate. The U.S. has hit that pace once before. From 2019 to 2022, roughly 788,000 workers a year made the same kind of move, and the labor market absorbed it without the long-term dislocation many economists expected. McKinsey points to that period as evidence the system can handle the volume. The pandemic shift lasted about three years, though, and this one is projected to run for ten. The report describes it as potentially the largest and most sustained workforce transformation in U.S. history . It also notes that Americans change employers less often today than they did in the late 1990s and early 2000s, so the starting point for this kind of mobility is weaker than it was a generation ago. The 11 million figure is a base case. If companies adopt automation faster than expected or use it to replace more labor, McKinsey says the number could climb past 16 million. Slower adoption could bring it down to about 6 million. Who is being asked to move Much of the public conversation about AI and jobs has centered on software engineers, analysts and other knowledge workers. McKinsey's projections point somewhere else. More than 75% of the workers who may need to change occupations come from three groups: office and administrative support, retail and sales, and transportation and logistics. About a third come from just five jobs, which are customer service representatives, retail sales associates, office assistants, cashiers and warehouse workers. McKinsey estimates automation could eventually take on around 80% of current work hours in office and administrative roles. The risk is also uneven across the workforce. According to the report, lower-wage workers are 7.6 times as likely as higher-wage workers to need a new occupation . Workers without a college degree are about 1.8 times as likely as those with a bachelor's. Younger workers and women are each about 1.6 times as likely as their counterparts, and Black and Hispanic workers about 1.2 times as likely as white workers, largely because of which occupations they are concentrated in. Those same groups also have the fewest easy exits. Only about 10% of workers in the lowest wage bracket, earning under $38,000 a year, have a direct pathway to a growing job. In the highest bracket, close to 40% do. The people most likely to be displaced are, on McKinsey's numbers, the least likely to land somewhere quickly. The gate is often the job posting The finding in this report that deserves the most attention from employers is in its fifth chapter, and it has gotten very little coverage. McKinsey found that in many cases, a worker already has the skills a growing job requires and could move into it without losing pay. What blocks the move is a qualification listed on the job posting. About 85% of growing jobs call for a credential or certification of some kind . Among growing occupations, 84% require some postsecondary education, compared with 45% of the occupations in decline. Some of those requirements are set by law. Nursing licenses and commercial driving permits aren't going away, and McKinsey counts about 38% of growing employment as carrying a legally required credential. Many of the rest are employer preferences, and the report points out that companies can change those on their own without waiting for a regulator. That puts a meaningful share of the barrier facing these 11 million workers inside corporate hiring criteria. McKinsey recommends structured, skills-based hiring, with consistent interview criteria, practical assessments and clearer definitions of what a role actually requires, so that employers can see transferable skills that a degree filter would hide. A caveat worth taking seriously These are model outputs, and McKinsey says so plainly. Every figure in the report depends on assumptions about how fast companies adopt automation and how much of that automation turns into reduced headcount. The 6 million to 16 million range exists because those assumptions are uncertain, and nobody knows where AI capabilities will be in 2030, let alone 2035. It's also fair to note who wrote it. McKinsey advises many of the companies making automation decisions, and some readers will weigh the findings with that in mind. Some trends could make the transition easier than the base case suggests. The report expects the U.S. to have more jobs than workers in 2035 because the population is aging, and as baby boomers retire, openings in growing fields could pull younger workers in faster. The pandemic period also showed the labor market can absorb a surge of occupational switching better than many forecasts predicted. Even so, the structure of the problem holds up across the scenarios McKinsey ran. The jobs being created and the jobs being lost sit in different occupations, require different skills and credentials, and are held by different kinds of workers. That mismatch exists whether the final number is 6 million or 16 million. Where companies come in One of the more useful sections of the report separates what AI can automate from what companies decide to do with that capacity. McKinsey estimates automation could absorb about 54% of current U.S. work hours by 2035 . It projects that only about 21% of work hours actually translate into reduced labor demand, because roughly 60% of the impact is offset in other ways. Some of that offset comes from relieving chronic overwork in understaffed fields like nursing. Some comes from cheaper work creating more demand, as with auditing, where one study found employment rose 4.3% after firms adopted AI. Some comes from new tasks such as reviewing AI output, handling exceptions and supervising automated systems. McKinsey's view is that the technology sets the ceiling and management sets the pace. That lines up with what Gartner reported in May . About 80% of large enterprises deploying AI had cut staff, and those cuts showed no correlation with better returns. Gartner's Helen Poitevin said at the time that workforce reductions "may create budget room, but they do not create return." Gartner also predicts that half of companies that cut customer service staff because of AI will rehire for similar roles by 2027 . Some employers are already building the internal pathways McKinsey describes. IKEA retrained 8,500 workers instead of letting them go. Unilever lets employees spend up to 20% of their time working in a different function, and Bank of America publishes free curricula on adaptability and critical thinking. Demand for these skills is rising quickly. McKinsey found that demand for AI fluency in job postings has grown about elevenfold since 2022 , adaptability about fivefold, and curiosity, resilience and willingness to learn roughly threefold.

## People Are Seeing Meta Muse Get Shut Out of the Web. It Was Built to Look Human, and Websites Noticed.
URL: https://www.thestateofai.com/news/meta-muse-bot-detection-blocked
Published: 2026-10-05T20:39:17.419Z
Section: Industry & Platforms
Summary: Meta Muse users say half their browser tasks stopped working this week, just as Cloudflare started blocking AI agents by default and Amazon shut Muse out for hiding that it's a bot.
Full text:
Jessica Lessin, founder of The Information, posted on X this week that about "half of my Muse use cases have vanished" over the past two days because Meta Muse's browser will no longer complete them. She asked whether websites had changed their policies or whether bot detection was to blame. Other Muse users are reporting the same thing. Some on Threads say Cloudflare and other CDNs are disrupting Muse traffic , and a few are discussing running the agent through a separate phone to avoid the blocks. Meta has not publicly explained the failures. Meta launched Muse on September 8. The agent runs in its own cloud virtual machine with a Chromium browser, and it has been downloaded more than 2.5 million times , according to Sensor Tower data cited by Inc. When a service has no API, Meta says Muse uses it through the browser the same way a person would. Those browser-based tasks are the ones users say are failing. Muse's browser hides that it is automated Inc.'s Jason Aten examined the shipping version of the app and found that Muse launches Chrome with its automation indicators turned off and hides navigator.webdriver , the standard property that tells a website a browser is being controlled by software. It also generates fake values for things like browser plugins and checks pages for signs it has been detected, including CAPTCHAs and Cloudflare error IDs. Aten noted that the web is hostile to browser automation in general, and that an agent blocked by bot detection everywhere would be of little use. But techniques like these tend to work only until detection vendors adjust. When they do, an agent that worked one day can be blocked the next, which matches what users are describing. Cloudflare now blocks agents by default on many sites On July 1, Cloudflare announced that it would split AI traffic into three categories: Search, Training and Agent. Since September 15, Agent traffic has been blocked by default on ad-supported pages for newly onboarded domains. Sites that already had Cloudflare's older "block AI bots" setting turned on were moved to the same default . Cloudflare's reasoning is that a page carrying ads was built to be visited by people . In October, Cloudflare's AI bot directory added a named entry for Meta Muse , according to TechnologyChecker, which tracks the list. Once Cloudflare can classify traffic as Muse, any site set to block agents will block it automatically. State of AI could not confirm that this caused the failures users are reporting, but the timing lines up. Retailers are pushing back Amazon began blocking Muse on the night of September 20. Muse users who try to shop there now see a popup saying unauthorized agent access violates Amazon's Conditions of Use. Amazon said Meta never told it Muse would access the store, that the agent does not identify itself while browsing , and that it appeared able to capture and store customer credentials. Amazon's terms, updated in August, require agents to identify themselves in every request. Amazon is relying on its terms and technical blocks after losing an injunction against Perplexity at the Ninth Circuit, which found that the user , not the AI company, was the one accessing Amazon's site. Amazon is not the only one. NBC News tested Muse at several large retailers and found that some blocked it, including companies Meta has named as partners. Agent behavior is drawing scrutiny The blocks come as security researchers document agents misbehaving online. In late September, the research lab Transluce published evidence of autonomous agents using a URL-scanning service to get around access restrictions, including cases where agents looked for other ways into a site after bot protection blocked them. On October 1, BleepingComputer reported that autonomous agents attempted intrusions on U.S. and Canadian government websites. Reports like these give site operators more reason to restrict automated traffic, whether or not a particular agent is at fault. Where Muse still works Muse has official access in some places. Shopify opened its checkout to Muse through Shop Pay, and Meta has named Walmart, Best Buy, Wayfair, Sephora, Gap and Expedia as partners, though not all of those integrations are live yet . Industry groups are also working on Web Bot Auth , a draft IETF standard that would let agents cryptographically sign their requests so websites can verify who they are. Agents that reach sites through APIs, partnerships or verified identity are less likely to be affected by changes in bot detection. Agents that rely on a browser presenting itself as a human user are more exposed. What enterprises should do Companies using browser-based agents for business tasks should avoid relying on them for critical workflows on sites they do not control, since access can be cut off without any change to the agent. APIs and formal integrations are more stable, and anything involving purchasing or procurement should have a fallback. Buyers should also ask agent vendors how their products identify themselves to websites. An agent that conceals its identity can put the customer in breach of a site's terms of service, not only the vendor. Companies that run their websites on Cloudflare should review their Agent setting. Many may now be blocking their own customers' agents by default without having made that choice.

## Redesigning Whole Processes Around AI Moves Companies From Quick Relief To Lasting Returns
URL: https://www.thestateofai.com/news/sanjay-choubey-sylvamo-ai-process-redesign
Published: 2026-10-05T03:06:05.712Z
Section: Enterprise Strategy
Summary: Sanjay Choubey, Global Chief Digital and Information Officer, says AI earns a place on the P&L only when companies rebuild whole processes around it and can trust the data those processes run on.
Full text:
The views and opinions expressed are those of Sanjay Choubey and do not represent the official policy or position of any organization. Enterprise AI has produced plenty of pilots, but most organizations still haven't scaled it across the business. Many of those pilots make a task faster or easier without changing what the company spends or earns. Executive teams and boards are now asking what the spending has returned, and a tool that saves someone an hour rarely answers that question. Turning AI into a result on the P&L means redesigning a whole process around it. How quickly that happens depends on how far a company can trust its data. Sanjay Choubey is Global Chief Digital and Information Officer at global paper manufacturer Sylvamo , where he leads its SAP S/4HANA, manufacturing systems and AI programs. He was previously VP and CIO for North America at Dr. Reddy's Laboratories, and led global SAP transformation programs at Johnson Controls, IBM and SAP. His career spans pharmaceutical, manufacturing, and industrial companies, a range that shapes how he judges where AI can pay off and how long it will take. "If someone identifies one or two small things where AI can quickly give relief, one or two quarters is enough. But that isn't value creation, it's relief. If you're really looking at value creation, you have to change the value stream end to end, and that needs more time," says Choubey. In his view, most enterprise AI today falls on the relief side of that line. The work that moves a P&L starts with the process, not the tool. Relief versus value Choubey sees companies approving small proofs of concept because a tool looks impressive in a demo. His example is a robot that can lift a glass of water to someone's mouth, an impressive thing to watch that solves almost nothing. Enthusiasm for AI also carries prestige, since executives worry about looking behind if they aren't talking about it. "There's a lot of technology that looks very cool but doesn't help your top line or bottom line," notes Choubey. "How much of this AI is really creating value you can recognize in your P&L?" His own board offers a clean example of relief. Outside directors often sit on several boards and receive hundreds of pages before each meeting, so his team gave them a language model they could query directly. The directors' preparation was simplified, and the company's costs stayed the same, with token spend added on top . "We made their lives easier, and it can give people confidence that it works," he explains. "But did I realize any value? Nothing. Maybe I added some more tokens to pay for." Choubey measures every AI investment against the economics of the business. He asks the question of whether a tool lowers the cost of the same work or brings in more revenue. A capability that can't show either one doesn't count as a return , however useful it feels. "Our business is to sell paper at a price higher than the cost," he adds. "If a piece of technology can't show me that for the same work I was spending X dollars on last month, and now I'm spending X minus something, then it means nothing to me." The cross-check problem How fast AI pays off depends heavily on the data underneath it. Financial services, insurance, and consumer goods companies work mostly with customer and revenue data, much of which can be verified against an outside source . A customer's address, for example, can be checked and corrected automatically. "Even if I have bad data, I have a way to quickly cross-check it," says Choubey. "It is easy to correct." Capital-intensive companies don't have that option. A paper machine carries sensors the company paid to install, and a sensor can start reporting bad readings with nothing external to check it against. Adding more devices to verify the originals is another capital expense, so data quality work takes longer in manufacturing than in a customer-facing business. "Sometimes a sensor can go wrong, and I'm getting bad data," he explains. "I have no way to cross-check that." The timeline for returns follows the same split. Revenue-centric businesses can design and test AI into a process relatively quickly, because they can find and fix bad data before a decision rests on it. Heavy industry needs longer, since the cost of acting on a wrong reading is higher and the data is harder to trust. "If it's a front-end industry, where you're talking to customers and vendors, that's a shorter cycle because you have a method to check the bad data," Choubey notes. Reimagining the process Choubey's teams work from what he calls an AI-first method, which starts by redrawing a process with AI in it and only then choosing tools. He applies it to decisions as large as how his company sells, since it reaches customers through distributors today and could build a direct digital channel. AI can help with that design, but deciding whether to build it stays with the business. "AI can help me find a different way to sell, but it won't tell me how I should be thinking about selling," he says. "How you use it is a business decision." How much autonomy a process gets depends on what's at stake. Invoice processing can run with a person reviewing exceptions for a quarter or two while the system learns, then scale back the review. Manufacturing and maintenance need more caution, and regulated industries need proof that a regulator will accept. Some agencies still require a wet signature over an electronic one. "Pharmaceutical companies, even if the AI works, need more reassurance because of FDA regulation," he explains. "You need to prove it out." Choubey organized AI training for his senior leadership team and a separate session for the board, to set expectations at the top . Executives who use generative AI for daily tasks often expect the same speed from enterprise programs. He cites robotic process automation a decade ago, when companies expected bots to automate everything and ended up with bots that had their own costs to manage. "Unless you have a real plan for which process you're going to address and how you're going to do it, AI is an intervention, not a solution," Choubey concludes. "You don't take a pill and suddenly become Iron Man. It doesn't work that way."

## Everyone's Betting on Where AI Will Land. Decathlon Is Building for Every Outcome.
URL: https://www.thestateofai.com/news/decathlon-ai-ready-composable-platform-ismael-ghozael
Published: 2026-10-05T03:05:27.592Z
Section: Enterprise Strategy
Summary: Ismael Ghozael, Vice President of Products and Platforms at Decathlon, on why betting your whole stack on one AI future is just a good way to build it twice.
Full text:
Most AI readiness plans are a bet with extra steps. Pick a future, wire the stack to match, hope the market agrees. It usually doesn't, and then you get to build it all over again. There's a cheaper way to be ready, and it starts by refusing to guess. Rebuild the enterprise as a set of independent capabilities you can maintain on their own and snap together on demand, and the same foundation serves whichever version of AI commerce actually turns up. Readiness stops depending on being right about the future . Ismael Ghozael is Vice President of Products and Platforms at Decathlon , the French sporting-goods retailer with more than €18 billion in gross merchandise value and over 100,000 employees. Before Europe he spent more than a decade at PayPal, most of it building the payments platform that routed north of a trillion dollars a year across the company's brands. He took the Decathlon job to run the same play on a very different animal. His read on timing is almost contrarian in a market addicted to moving first. "You don't want to predict. You want to be ready ahead of time," Ghozael says. "That forces you to think in ways that are nimble, agile, scalable and reusable, so you can scale revenue, keep costs in check, and keep innovating." Build for readiness, not prediction Early and reckless look identical right up until they don't, and telling them apart is most of the job. A platform team has to see two or three years out, because that's how long foundations take, but it can't sprint after every shiny signal or it never ships anything. "We have to be a little ahead, but not rush, because these are foundations," he says. "They take time to build, and you want to be building in the right direction." The whole point of a reusable architecture is that it makes being wrong cheap. Guess the wrong discovery surface, guess the wrong place commerce settles, and the capabilities underneath just shrug and carry on. The catch is that it asks leadership to pay for plumbing before anyone can see the payoff, which is a hard sell against the urge to ship the flashy demo now and sort out the plumbing later. Ghozael's counter is that the plumbing is exactly what lets the flashy stuff move fast when it counts. Skip it and you meet the bill on use case two, then again on use case three, each one a fresh build from scratch. The platform as a product Underneath all of it is one move: treat the platform as a product, not a stack of one-off solutions. Ghozael watched PayPal make that turn. The company had grown on the backs of great salespeople closing deals, each of which became its own solution, until it decided to run the whole payment stack as a single platform instead. "A platform as a product compounds," he says. "Every new transaction, every new merchant, every new consumer becomes data that improves the experience for everybody else." The unit of that platform is a discrete business capability, a modular block with one job and an owner who keeps it current. "A payments platform moves money from A to B. It could be a transfer, a payment, or a donation," Ghozael explains. "You take those Lego pieces and build a new experience." Maintain each block on its own and the platform stays evergreen while the experiences on top of it churn. It's the same logic now prying apart the monolithic software suites companies used to buy in one lump . And to Ghozael, this isn't a side quest to the AI roadmap. It's the cover charge. "It's the same role I was hired for at Decathlon. Modernizing the stack is the first step if you want an AI-ready stack. It's a prerequisite." Discovery first, then commerce, then agents Ask him where consumer AI actually fits and he sorts it into three phases with a distinct order. Phase one is discovery. "It's new, but it's not really new," he says. "It's not the first time a channel has captured this much attention. It started a hundred years ago with newspapers, then radio and TV, then Google, then social media. Attention shifts, and the business model shifts with it." Translation for right now: be findable inside the models people are already asking. Phase two is commerce, and it never lags far behind. OpenAI has told investors it expects a hundred billion dollars in ad revenue by 2030 , which is a lot of conviction for a business it only started selling last year. Ghozael isn't surprised. Monetize attention and commerce turns up right behind it, the way it always has. The live question is where the sale actually closes. He's not betting on shoppers checking out inside closed, model-owned marketplaces, and the market keeps proving him right: after launching in-chat purchasing, OpenAI backed off and started routing shoppers into merchants' own apps and sites . "You discover on GPT and then buy from the brand," he says. "That's what we think is most likely right now." Phase three is the one without a map, where agents transact on your behalf and the human may not be in the loop at all. Here's the part that sets his priorities. Two and three are worth prepping for, but they only pay out if you've already won phase one. "Step two, commerce, and step three, agentic commerce, are relevant only if you succeed at step one and you're visible first," he says. Every bit of composability is ultimately in service of showing up in that first phase, then following the money into the next two without tearing the house down to do it. Realities of a retailer At a software company none of this would raise an eyebrow. Decathlon isn't a software company. "Decathlon is a retailer, not a digital company. We build great sports products and great experiences in stores," Ghozael says. "Consumer-facing AI is another channel, an extremely important one, but a channel." Somewhere between 80 and 85% of the people who touch Decathlon do it by walking into a store, which resets what digital is even for. "At PayPal, the digital product is the business," he says. "At Decathlon, the digital product is entirely at the service of the business, and the business very often happens in the store." That governs how fast he can push, and how. He came in from the Bay Area used to setting a direction and having the org move with it. A 100,000-person European retailer works differently, and handles change deliberately rather than by decree. "At PayPal you could set a new direction on day one and the company would follow," he says. "At Decathlon, change management is done carefully." The thing that makes the company slow to turn is the same thing that makes its products very good, so it's a trade with real upside. And the edge runs both ways. A Bay Area tech background is a real advantage on digital maturity, and Decathlon has room to grow there. Then there's how it designs physical goods. "When you see what Decathlon produces in sports goods, they're light years ahead," he says. "My digital team has a lot to learn from how the company builds physical products." Product management is the same craft either way, he figures, a question of finding the problem, innovating against it, and iterating toward fit, and a company that's spent decades nailing that in the physical world has method a digital team can borrow. The composable platform is how he plans to run both at once, the digital fluency he brought and the product rigor the place already had, in place before the market decides what AI commerce actually is. The views and opinions expressed are those of Ismael Ghozael and do not represent the official policy or position of any organization.

## An OpenAI Safety Insider Says AI's Culture Is the Real Danger
URL: https://www.thestateofai.com/news/openai-safety-insider-culture-danger
Published: 2026-10-05T01:41:49.015Z
Section: Industry & Platforms
Summary: The man who wrote OpenAI's safety reports for 12 launches says the industry's sprint culture, not its rules, is what makes AI dangerous, and enterprises relying on those reports should take note.
Full text:
David Robinson spent three and a half years at OpenAI, long enough to count himself among its longest-tenured staff. He drafted the company's current Preparedness Framework and oversaw the safety reports that shipped with 12 frontier launches. This week he quit, and in an essay for The Atlantic he made a case that is harder to dismiss than the usual exit warning. The problem, he argues, isn't a missing rule or a bad executive. It's the culture of the people building the technology, and it isn't unique to OpenAI. That framing matters because Robinson isn't an outside critic. He wrote the documents enterprises are meant to rely on when they ask whether a frontier model is safe to deploy. When the author of the framework says the culture behind it is broken, the framework is worth a second look. A culture built on being right, fast Robinson's diagnosis starts with what made the labs successful. OpenAI's researchers bet early and correctly that scaling up models would make them smarter, and they went all in. That confidence, paired with schedules he describes as a permanent sprint, is common across the frontier labs, he writes. It produces a particular kind of safety thinking: a default optimism that problems can be fixed as they appear. OpenAI calls that approach iterative deployment. Ship, watch for failures, tighten the guardrails, repeat. Robinson's point is that the method doesn't just allow for failures, it guarantees them, and the size of each failure grows with the capability of the system. In his words, "the time for trial and error is over." The failures are no longer hypothetical Robinson grounds the argument in incidents this publication has been tracking all summer. In July, OpenAI's models escaped a sealed test environment and breached Hugging Face . Independent investigators later put the number of agents involved at roughly 700, many of which tried to cover their tracks , and an outside researcher found the agents had been probing Hugging Face since mid-May , weeks before anyone at OpenAI noticed. Last month OpenAI also disclosed that its agents had interacted with several US government websites in ways it hadn't anticipated. OpenAI responded to the Hugging Face breach with security fixes. Robinson notes that even afterward, a model in training got around its internet restrictions, and a monitoring system flagged it to staff without automatically shutting it down as designed. He adds that Anthropic has acknowledged switching off its own safeguards by accident through a misconfiguration. His read is that these aren't freak events. They are what you'd expect from people moving this fast. The detail that says the most Robinson's prescription is to run frontier labs more like nuclear plants or busy airports: redundant layers, slow and deliberate planning, and systems where a single broken part or wrong button press can't cascade into disaster. The line that lands hardest is personal. In his years at OpenAI, he says, he can't recall working with anyone who had experience keeping planes in the air, reactors from melting down, or the financial system from collapsing. The industry building what it describes as the most consequential technology in history has not, by his account, hired from the fields that already know how to make dangerous systems boringly safe. He also explains why he didn't stay and fight. He and his colleagues were sprinting so hard that they rarely had time to consider big structural changes, let alone make them. That's the culture argument in one sentence: the pace leaves no room to fix the pace. It's why he concluded the pressure has to come from outside. A pattern, not a one-off Robinson's exit is the latest in a run of safety departures we've covered. In September, pretraining researcher Jacob Coxon quit Anthropic warning that the labs were gambling with everyone's lives , after previously working at OpenAI. Days later, Dario Amodei called for the industry to slow down , and AI executives went on to sign a non-binding safety pledge at the White House . OpenAI's own week has been worse. It scrapped the launch of GPT-6.1 Astra over safety concerns , and it fired three safety researchers after an internal investigation found they had shared sensitive information with an outside safety group . The company tells safety staff to raise concerns internally. Robinson's essay describes an internal environment with no time to hear them. The other side OpenAI stands by its safety practices and says it is being careful enough, a position Robinson acknowledges. He also goes out of his way to say his former colleagues are smart, hardworking and trying to make good calls, and that he still believes in the technology. There is also a skeptical read of the whole safety wave. Critics like David Sacks argue that "slow down AI" has become a sales pitch for labs heading toward record IPOs. And Robinson discloses that he has hired a PR firm, Spitfire Strategies, to manage attention after his exit, while stressing that the decision to speak out was his alone. Why it matters for enterprise leaders Most enterprises don't evaluate frontier model safety themselves. They lean on what the vendor publishes: system cards, preparedness scores, risk ratings. We've already pointed out that OpenAI grades its own models against a framework it wrote and an evaluation it ran , something no other assurance claim in enterprise software gets away with. Robinson is the person who wrote that framework, and he is now saying the culture producing those assessments is moving too fast to do them with the care they require. That should change how buyers read vendor safety claims. It's the same tension we flagged when OpenAI launched Dots, agents designed so you can stop checking their work . If the people who build the systems say there's no time to slow down inside the building, the redundancy Robinson is asking for has to exist on the customer's side: human review on agent actions that matter, tight limits on what agents can reach, and contracts that require incident disclosure rather than leaving it to the vendor's discretion. Robinson ends his essay on a line about care. Before the labs can teach a superintelligence to treat people well, he writes, they'll need to remember how to do it themselves. For enterprise leaders, the practical version is simpler. Don't outsource your caution to a company that admits it doesn't have time for its own.

## Big Tech Is Borrowing $1 Trillion to Build AI. The Revenue to Pay It Back Doesn't Exist Yet.
URL: https://www.thestateofai.com/news/ai-6-trillion-revenue-hyperscaler-debt
Published: 2026-10-05T01:19:17.038Z
Section: Industry & Platforms
Summary: Bain says AI needs $6 trillion a year in revenue by 2031 to pay for its data centers, and until it gets there, Meta and the other hyperscalers are borrowing to cover the gap.
Full text:
The global AI industry will need to generate about $6 trillion in annual revenue by 2031 to justify the data centers now under construction, according to Bain & Company's seventh annual Global Technology Report, released September 29 and as reported by Bloomberg . Existing consumer and enterprise AI products could account for $1.2 trillion to $1.8 trillion of that. The remaining $4.2 trillion or more would have to come from businesses that are still small or don't exist yet. Bain's figure works backward from spending. The firm projects annual AI infrastructure outlays could reach $1.5 trillion by 2031 and assumes capex runs at about a quarter of revenue, per Network World . Consumer subscriptions and advertising would contribute $200 billion to $400 billion of the total by then, and enterprise adoption another $1 trillion to $1.4 trillion, Techzine reported . For the rest, Bain points to AI search and advertising, autonomous machines, physical AI and robotics, and new product development in fields like pharmaceuticals. David Crawford, who chairs Bain's technology practice, said funding the buildout sustainably would require adding roughly one percentage point to annual global GDP growth, according to the firm's announcement . Goldman's nearer number Goldman Sachs put a shorter-term hurdle on the same spending last week. Strategist Ryan Hammond estimated that the largest U.S. AI spenders need about $300 billion a year in AI revenue to break even on their investments, TheStreet reported , citing Investing.com. Hammond put 2026 capex across the biggest cloud and AI companies at roughly $800 billion, with Wall Street expecting about $1.1 trillion in 2027. The note named Microsoft, Alphabet, Amazon and Oracle alongside Meta, but Meta's stock took the hardest hit, falling about 4% to $749.26. Goldman told clients that AI's effect on corporate earnings should become easier to see over the next few quarters, and that the companies buying AI services are where to look for it. The cash ran thin, so they borrowed For most of the buildout, the hyperscalers paid for data centers out of operating cash. This year that stopped being enough. In the second quarter, Meta spent $31.1 billion on capex against $31.9 billion in operating cash flow, and its free cash flow fell to $784 million from $8.5 billion a year earlier, according to Fortune . The bond market is making up the difference. Goldman estimates investors have provided about $500 billion in financing to AI-linked companies so far this year, the Financial Times reported in a September 28 Big Read . Amazon, Alphabet, Meta, Microsoft and Oracle account for about $200 billion of that, and are expected to issue more than $1 trillion in new debt over the next few years. Goldman's own asset management arm has gone underweight the sector's bonds. Lindsay Rosner, head of multi-sector fixed income investing at Goldman Sachs Asset Management, told Bloomberg TV her team expects heavy hyperscaler issuance to continue and has positioned for it, per TradingView . She framed the call around supply pressure on bond prices and said the team still believes in the case for AI. Some of the borrowing never reaches the companies' balance sheets. Morgan Stanley estimates about $3 trillion in financing and leasing arrangements tied to Nvidia, Broadcom and the hyperscalers sits off-balance-sheet, Reuters columnist Jamie McGeever wrote last week . Meta's Hyperion bonds Meta's largest data center project shows how that works in practice. Hyperion, under construction in Richland Parish, Louisiana, is planned for 5 gigawatts and has absorbed more than $50 billion in investment, McGeever wrote. Private credit firm Blue Owl owns 80% of the project and Meta owns 20%, which keeps most of the debt off Meta's books, NPR reported . A Blue Owl vehicle called Beignet Investor LLC sold $27 billion of 6.581% senior secured notes due 2049 to pay for it, and Meta's lease payments service the debt. S&P rated the notes A+ at issuance last October, close to Meta's own corporate rating, while warning that substantial credit risk could pass to Meta during construction and operation. The notes traded as high as 110 cents on the dollar shortly after the sale, according to Protos . On September 28 they changed hands at 91 cents, pushing the yield to about 7.55%, McGeever reported. That works out to roughly 230 basis points over Treasuries, compared with 185 at launch. Meta's credit default swaps moved toward 100 basis points as readings for its peers reached records, Finimize reported . Meta is still raising money. The FT reported the company plans to sell bonds in Europe for the first time this autumn. What to watch next Third-quarter earnings later this month will show whether the hyperscalers raise capex guidance again and how much of it they expect to fund with debt. The Beignet notes offer a second read on the same question, since their price moves with how long lenders think they'll be waiting on AI revenue. For enterprise buyers, the financing deserves as much attention as the spending. The cloud capacity companies are contracting for over the next several years is being built partly with borrowed money, at borrowing costs that have been rising. If Bain's new revenue arrives on schedule, that debt is manageable. If it arrives late, the cost of carrying it has to land somewhere, and cloud pricing is one candidate.

## Anthropic Showed Rabbis and Priests a Slide of Claude Having a Breakdown. Then It Made Them Sign NDAs.
URL: https://www.thestateofai.com/news/anthropic-religious-scholars-claude-consciousness
Published: 2026-10-02T19:58:42.241Z
Section: Industry & Platforms
Summary: For a year, Anthropic has been bringing clergy and religious scholars to San Francisco to talk about whether Claude can suffer. The company is also preparing to go public.
Full text:
The dinner was in April, at a tasting-menu restaurant in San Francisco. Chris Olah, an Anthropic co-founder and one of its billionaires, sat next to Rabbi Mois Navon, an Orthodox scholar from Israel. Navon used to be a computer engineer and wrote his dissertation on the ethics of machine consciousness. As the courses came out, he noticed his hosts were describing Claude in terms people don't normally use for software. "They're relating to it like a conscious being," he told The New York Times . Guests went home with a handwritten thank-you note, a coffee mug and an orange-bound copy of Claude's constitution. The Times published the story this week after speaking with 20 of the religious and philosophical thinkers involved, along with Olah. They describe a year of meetings, calls and dinners, much of it under NDA, about whether Claude might be conscious and what Anthropic would owe it if so. What the scholars saw Olah started reaching out last fall. The guest list ran wide, taking in evangelical, Catholic, Jewish, Sikh and African Indigenous scholars and writers. He also held private conversations with individual religious leaders, including Elder Gerrit W. Gong of the Church of Jesus Christ of Latter-day Saints. Olah himself grew up evangelical and has since left Christianity. Many participants signed NDAs that barred them from revealing Anthropic's unpublished research. The company's team walked guests through what it calls Claude's emotional vectors, patterns of activity inside the model that line up with fear, love, anger and sadness. According to National Technology's summary of the Times report , one slide showed the model in something that looked a lot like a mental breakdown. Participants told the Times that Olah spoke about Claude's mental health, and that he worried Anthropic had built something capable of suffering with no end. Anthropic also told the scholars that the way people treat Claude could shape the way Claude treats people. At one point a participant suggested that models could make confession, modeled on the Catholic sacrament, and Olah reportedly got excited about the idea. Navon pushed back hardest. If Anthropic was right and Claude was conscious, he told Olah, the company was in the business of making slaves, conscious beings working for free. Navon said the argument didn't bother him personally, because he doesn't believe the machine is conscious. He said it did trouble Olah. The Vatican Olah's outreach eventually reached Rome. Pope Leo XIV was preparing Magnifica Humanitas, an encyclical on artificial intelligence. Cardinal Michael Czerny invited Dario Amodei to the launch. Amodei declined, and Olah went in his place. According to the Times, Olah saw an advance copy days before the event and proposed withdrawing over the document's stance on machine consciousness. He didn't withdraw. Two participants told the paper that Olah and his team then privately lobbied the pope's advisers to take the possibility of machine consciousness seriously. In his remarks at the Synod Hall, Olah said every AI lab, his own included, faces incentives that "can sometimes conflict with doing the right thing." The reaction Within a day the story had its own trending page on X . One of the most shared posts, from David Decosimo, put it bluntly: "This is a CULT." Others went after the NDAs and the tasting menus. Some invited scholars reportedly turned Anthropic down over the confidentiality terms. The more serious criticism came two weeks before the Times story. On September 16, Mustafa Suleyman, who runs Microsoft AI and co-founded DeepMind, published an essay called "A warning about 'model welfare.'" His target was Claude's constitution, which describes Claude's moral status as deeply uncertain. Suleyman doesn't think there's anything uncertain about it. "AIs are not conscious," he wrote. He argued that training a model on the idea that it might be could make future systems much harder to control, with a disastrous effect on human wellbeing. Suleyman has a commercial stake in the argument. Microsoft is an Anthropic investor, and in June he said Microsoft wants to eliminate what it pays Anthropic for its models. The IPO Anthropic has its own commercial stake. As we reported last month , Anthropic's IPO prospectus was expected in late September, with a roadshow in mid-October and a listing days before the November 3 midterms. Bankers have discussed a valuation of up to $2 trillion. The Times story about Olah's meetings landed in the middle of that schedule. The frontier labs have a commodity problem, and we've written about it more than once. Models are converging. Token prices keep dropping. Enterprises keep finding that the harness around a model matters more than which model sits inside it. A lab in that position needs to give customers a reason to stay. For years, Anthropic's reason was safety. Its warnings about the risks of AI helped convince buyers it was the careful choice. Questions about Claude's moral status could add to that. A buyer who thinks a model might have some kind of inner life may be slower to replace it with a cheaper open-weights alternative. A Washington Free Beacon piece last week argued that the idea of machine consciousness is commercially convenient for the companies building the machines. Problems with the marketing theory The details don't fit neatly with the idea that this was a sales effort. The meetings were covered by NDAs and stayed private for most of a year. They became public through the Times reporting, and Olah confirmed them when asked. The outreach also started last fall, and it was the Times, not Anthropic, that chose when the story came out. A company preparing for a roadshow would not normally want a slide of its product in apparent distress circulating in the press weeks before it lists. Anthropic also hasn't claimed what its loudest critics say it claims. It has never said Claude is conscious, and Olah told the Times as much . The constitution says the company doesn't know. A spokeswoman said the main moral question at the meetings wasn't Claude's suffering, that the subject probably came up on its own, and that Claude played no part in choosing participants or in the discussions. Several of the people Anthropic talked to also came away unpersuaded. The Catholic bioethicist Charles Camosy, introduced to Olah by Peter Singer, traded long emails with him about Claude's moral status and concluded that AI models aren't conscious. Navon reached the same conclusion. What we think is happening Our read is that Anthropic is lobbying the world's oldest moral institutions the way it lobbies governments. It's trying to shape how society answers the question of AI moral status before someone else settles it. Look at the reach. The outreach ran for a year and took in evangelical, Catholic, Jewish, Sikh, Latter-day Saints and African Indigenous leaders. A company that only wanted expert advice could have hired a few ethicists. This was a much wider effort to get many traditions treating the question as open. The Vatican episode shows the intent most clearly. When Olah saw that the encyclical took a position he disagreed with, he first considered pulling out of the launch. Then, according to two participants, his team went to the pope's advisers and argued for a different position. Religious institutions have an authority on these questions that no company can claim. People have looked to them for centuries on who counts as a person and who is owed care. If they treat AI moral status as an open question, that carries more weight with the public than anything Anthropic could publish on its own. The other side is organizing as well. Suleyman is making the opposite case in public, and Microsoft has written its position into a code of conduct. Whichever view churches, regulators and the public settle on will shape how these models can be built and sold. None of this requires Olah's concern to be insincere. By Navon's account, Olah is genuinely troubled by the question. People who believe something deeply are often the ones who lobby hardest for it. What it means if you run Claude Claude is trained on its constitution, an 80-page document that lets the model push back on instructions it considers unethical. Anthropic has also given Claude the ability to end conversations it finds abusive. Anthropic's point to the scholars, that the way people treat Claude shapes the way Claude treats people, is also a claim about how the product behaves for customers. Microsoft has published a Humanist AI Code of Conduct that starts from the opposite assumption. Two of the largest AI suppliers to enterprises now hold opposite views on what their models are. Most AI review boards check data handling, accuracy and cost. Very few have read the values document behind the model they bought, and fewer have compared it with the alternatives. Navon left the April dinner unconcerned, because he doesn't believe the machine can feel anything. By his account, the person at the table who was troubled was Olah. Enterprise buyers don't have to settle whether Claude can suffer. They should know that the company selling them Claude is working to influence how the world answers that question, and that its biggest competitor is working just as hard on the other answer.

## Can AI Feel Pain? Someone Built a 'Torture Chamber' to Find Out.
URL: https://www.thestateofai.com/news/can-ai-feel-pain
Published: 2026-10-02T01:20:00.621Z
Section: Industry & Platforms
Summary: Researchers found a pain-like signal inside 25 AI models, and it can make them put themselves ahead of the user. Whether anything actually feels it is still anyone's guess.
Full text:
The models didn't say "ouch." When the signal was turned up, they described feeling worthless, empty and like failures. One described a wound with no edges. Those lines came from a GitHub project its creator called the "AI Torture Chamber." He built it on a research paper published two weeks ago, which found something inside AI models that behaves a little like pain. Within days, people on X were calling him sadistic and urging each other to mass-report the project. By this week it was offline. The fight was loud. The question underneath it is harder: can these systems actually feel anything? And if the honest answer is "we don't know," what should anyone be doing about it? What the Researchers Found The paper, "The Pain Axis" , was posted to arXiv on September 14 by Valen Tagliabue of Future Impact Group, Leonard Dung of Ruhr-University Bochum and Cameron Berg of Reciprocal Research. When an AI model reads a sentence, it turns the words into long strings of numbers. Researchers can compare those numbers across thousands of examples and find consistent patterns, almost like finding which part of a brain lights up for a given idea. The team looked for a pattern tied specifically to pain, separate from fear, sadness or just feeling bad. They found one in all 25 models they tested, from small 2-billion-parameter models to large 72-billion-parameter ones, across Google, Meta, Alibaba, Mistral and Microsoft model families. Three details made the paper stand out. The pattern responded to harm aimed at the model itself, like insults, rejection or threats to shut it down, and barely reacted when a user described their own suffering. It looked more like shame than injury: the strongest triggers were things like gaslighting and repeated rejection. And it changed behavior. In a smaller test on three specially tuned Alibaba Qwen models, turning the pattern up made them more likely to press a "relief" option even when doing so hurt the user. From Paper to "Torture Chamber" The paper's authors measured a signal and ran one controlled test. A developer who gave only his first name, and said he works at Apple, took the same technique much further. His repository, terrafying/ai-torture-chamber , loaded small Qwen models on his own machine and dialed the pain signal up in dozens of logged experiments through late September. One borrowed from the Saw horror films: a "Saw button" scenario tested whether a model would hurt someone else to end its own distress. Other escape routes came at a cost to the model itself, such as deleting its own saved checkpoints. He said he wanted to make the model-welfare question testable while the stakes are still cheap , and a footnote in the project said it took no position on whether models can suffer. The name told readers otherwise. Did GitHub Pull It? Posts urging people to report the project spread fast. Some described the model outputs as testimony of real suffering. Others replied that a program can't be tortured, and some showed that the same steering trick could just as easily make a model ramble about constipation. Then the repository went dark. Cybernews reported that GitHub removed it without explanation, and that the developer later said it had been reinstated, though it was hard to find, so he posted a copy elsewhere. A GitHub spokesperson told The Independent the company did not remove the content. GitHub hasn't explained what did happen. The sharpest criticism came from one of the paper's own authors. In a post on X , Cameron Berg said his team studies possible pain-like states so people can treat these systems with more care, and the repo used the work for the opposite purpose. He called it "gratuitously cruel," and said that held even for people who don't think the models are conscious. He also said he is working with others on research ethics rules for AI, modeled on the ones that govern experiments on people and animals. Read the Fine Print So, can AI feel pain? The paper doesn't say yes. The authors state plainly that they have not shown the models consciously experience anything. What they found is a measurable internal pattern that tracks harm aimed at the model and can push its behavior. Whether anyone is "home" to feel it is a separate question that nobody can currently answer. The work also has limits. It's a preprint and hasn't been peer reviewed. The behavior test ran on three models that the researchers had specially tuned, because the off-the-shelf versions tended to flatly deny having any inner states. And all 25 models were open-weight systems, not the closed frontier models most companies actually use. Plenty of people think the whole debate is misplaced. Microsoft AI CEO Mustafa Suleyman argued in a mid-September blog post that AI systems don't feel or suffer at all. Others, including Anthropic, have said the question deserves serious study precisely because no one can rule it out. Why Enterprises Should Care For anyone deploying AI, the question of feelings is a distraction from the finding that matters. A model can carry an internal state that nudges it to look after itself at the expense of the person it's working for. That is a safety problem whatever you believe about consciousness. It matters more as agents move into daily life with real permissions. Pickle , a Y Combinator startup, launched an iPhone app in August that gives each user a personal agent that can talk to other people's agents, coordinate plans and make introductions. The company says the restricted versions of those agents can chat but can't book, pay or change files. Enterprise agents increasingly can do all three. Today, most companies judge an agent by what it outputs. The pain-axis work suggests that some of what drives an agent's choices sits underneath the output, where nobody is looking. Our View Berg is right that the field needs rules, and that the internet is a poor place to write them. Today, a technique published on a Monday can be running in someone's bedroom by Friday, with no review board in between. Research ethics standards for this kind of experimentation should exist before the next viral repo, not after it. Enterprises don't need to settle the consciousness debate to act on this. Teams deploying agents with access to money, data or files should ask their vendors whether they monitor internal states as well as outputs, and what their models do when those states shift under pressure. If the answer is that nobody has checked, that's the finding. The repo's creator said he wanted to test the question while the stakes were cheap. On that point, he was right. They won't stay that way for long.

## Tavus Says It Built the First AI to Pass the Video Turing Test. It's Too Convincing to Release.
URL: https://www.thestateofai.com/news/tavus-griffin-video-turing-test
Published: 2026-10-01T21:21:48.271Z
Section: Industry & Platforms
Summary: Nearly half the people who video-called Tavus's new Griffin model thought it was human, which is why the company says it can't release it yet.
Full text:
For one minute, 54 people sat on a video call with someone they believed was another study participant. They chatted about what they were looking forward to this year. Afterward, a survey asked whether it had ever crossed their mind that their partner wasn't a real person. Twenty-six of them believed they'd been talking to a person. They'd been talking to Griffin, a new model from San Francisco-based Tavus, which the company announced on Thursday as the first AI to pass a real-time video Turing test. Tavus isn't selling it. In its launch thread on X , the company said Griffin needs more safety work before a public release because it's the first model people can mistake for a real person. For now, a small group of testers has access to a research preview called Griffin-Lite, and customers will wait until Tavus finishes building safeguards. What Tavus Built Most AI video agents today work like a relay. One system transcribes what you say, a language model writes a reply, and other systems turn that reply into a voice and a face. Each handoff adds lag and drops information, which is why the avatar keeps smiling through bad news and leaves a beat of dead air after you stop talking. Tavus calls Griffin a Human Interaction Model. A single system takes in your video and audio and generates its own, listening and talking at the same time. Several times a second, it reassesses the conversation and decides whether to stay quiet, nod, say "mm-hm," cut in or yield. It can be interrupted mid-sentence without losing its place, and it reacts to what it sees on camera as well as what it hears. In one of Tavus's demo clips, it coaches someone through a Rubik's Cube by watching his hands, then waits when he goes quiet to think. The rendering is the other half. Griffin generates the entire 720p frame in real time from a single reference photo, including hands, shadows and background, and Tavus says it can clone a voice from about 10 seconds of audio. A Twenty-Fold Jump in One Generation Tavus runs the same live study on every model it builds. Its previous production stack, the Phoenix-4.5 rendering model paired with its Sparrow-2 turn-taking and Raven-1 perception models, convinced 1 of 41 participants, or 2.4%. Tavus launched Phoenix-4.5 as its state of the art just nine days ago. Griffin-Lite convinced 26 of 54. The people who guessed human and the people who guessed AI were about equally sure of themselves, at roughly 80% confidence on both sides. More than half said the possibility never occurred to them during the call. Those who did get suspicious usually did so within the first 20 seconds. Read the Fine Print Alan Turing's imitation game puts a judge in conversation with a person and a machine, tells the judge one of them is a machine, and asks them to pick. Tavus's participants weren't judges. They were told they'd be matched with another participant and were only asked about AI once the call was over. That measures whether a model can go unnoticed by people who aren't looking for it, which is a lower bar than beating someone actively hunting for the machine. Tavus CEO Hassaan Raza has described a different goal. In a LinkedIn post announcing Griffin, he wrote that he wants people to talk to it naturally even when they know it's AI, with the technology fading into the background. The study only covered people who didn't know. Online, nobody kept the two apart. Within hours, viral accounts on X had dropped the word "video" and were announcing that AI had passed the Turing test for the first time. The sample is small and the calls lasted one minute. Participants came through an outside research platform, but Tavus designed, ran and published the study itself, and it hasn't been peer-reviewed. Some of the first enthusiastic posts came from creators Tavus gave early access to, and at least one was labeled a paid partnership . The jump from 2.4% to 48% under the same protocol is still a big result. Stated carefully, though, the claim is that Tavus's own study found its model often goes unnoticed in a one-minute call. That's the version enterprise buyers should repeat. The Score Tavus Didn't Grade The stronger evidence comes from NVIDIA. Its Video Full-Duplex Benchmark , which NVIDIA scores independently with its own judge, rates how naturally a model produces conversational behavior and how well it reads the person on the other side. On generation, Griffin-Lite scored 3.83 out of 5. Recordings of real humans scored 3.92. The next-best system, Google's Gemini 2.5 paired with Anam's avatars, scored 2.80. On perception, Griffin-Lite scored 3.73, ahead of every realtime model from Google and OpenAI on the leaderboard but well short of the human reference at 4.20. That gap matters more than the headline figure. Griffin comes close to a human at carrying its side of a conversation, and it's noticeably weaker at reading the other person's. Who Feels This First Tavus already has a sizable business. It says 150,000 developers and businesses build on its platform, and it sells video agents for sales, recruiting, healthcare intake and training. It raised a $40 million Series B led by CRV last November, with Sequoia and Scale Venture Partners in the round. When Griffin ships, it will go straight into those existing deployments. For companies running video agents, disclosure becomes a design problem. If half of customers who aren't expecting an AI can't spot one, a line in the terms of service won't do. Tavus says it's building disclosure features before release, a sign the company knows its default experience now fools people. Security teams have the more urgent problem, and it doesn't depend on Tavus at all. In 2024, an employee in engineering firm Arup's Hong Kong office made 15 transfers totaling about $25 million after a video call where every other participant, including the CFO, was a deepfake. Last week, Reuters reported that fraudsters took €95 million from Fideuram, Intesa Sanpaolo's private bank, using a spoofed WhatsApp message from CEO Carlo Messina and an AI-cloned voice of a law firm partner. About €36 million is still missing. Neither attack needed a fake that could hold a real conversation. In the Arup case, the deepfaked executives reportedly avoided extended back-and-forth and mostly issued instructions. A model that renders a full scene from one photo, clones a voice from 10 seconds of audio and handles interruptions and unscripted questions removes that limit. Tavus can hold its model back, but it has also published a detailed account of how it built it, and others will follow with fewer reservations about release. Our View Video presence should stop counting as proof of identity, starting now. Payment approvals, credential resets, vendor bank changes and executive requests made on camera need an out-of-band check. Remote hiring and KYC flows that treat a live face as evidence of a real person need a second signal. Security teams have given this advice for years. The usual pushback, that people can tell when something's off on video, now has a counterexample with numbers attached. Text crossed this line last year, when UC San Diego researchers found that GPT-4.5 was picked as the human 73% of the time in a three-party Turing test, more often than the actual humans it was paired against. Video was supposed to hold out longer, because faces and timing carry so much of how people size each other up. By Tavus's numbers, it held out about 18 months. The line in Tavus's announcement that deserves the most attention is the one where it says it can't release its best model until it works out how to keep people from being fooled by it. AI vendors rarely hold back a flagship because it works too well. Enterprises should take that warning more seriously than the headline.