VentureBeat

Most pipeline monitoring checks if the job ran. This one didn't check if the numbers were right.

Eleven days.That's how long our pipeline ran perfectly with zero errors, green Directed Acyclic Graphs (DAGs), clean Snowflake loads while producing audience counts that were 40% wrong. A <a href="https://venturebeat.com/orchestration/enterprise-ai-agents-are-only-as-reliable-as-the-messiest-documents-behind-them?_gl=1*1m69pib*_up*MQ..*_ga*MTE1NDcwODg1OS4xNzg4NzI2MjEw*_ga_B8TDS1LEXQ*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGgxODU4MzM1MTgx*_ga_SCH1J7LNKY*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGg3NDUzMjEyMTc.">data pipeline</a> is like a translation chain: If a word changes meaning at the source and nobody updates the dictionary, everything that follows is a confident mistranslation. In our case, an upstream ad network had silently renamed a field in its event payload. Our Spark join key stopped matching. Segment counts collapsed. Not a single alert fired.A client noticed. Their campaign was not performing. We traced it back to one field rename in one upstream schema.We trusted green checkmarks. We should have been watching the numbers.<h2>The system that looked healthy</h2>I was a Senior Data Engineer at InMarket (formerly NinthDecimal), processing terabytes of advertising event data daily. We operated at the scale of over 1PB of location and advertising event data, originally on MapR and later migrated to S3. Mobile SDKs collected IDFA/AAID signals impressions, clicks, conversions, location events. Raw events landed in AWS S3. Spark ETL jobs transformed them into structured audience datasets. Airflow DAGs orchestrated the full workflow. Transformed data landed in Snowflake. Output: Measurement dashboards and impression analytics for advertising clients.The critical invariant: Audience segment counts must be accurate. Clients make real budget decisions on those numbers. If my pipeline was wrong, their spend was misallocated.The scale of this system is part of why silent failures are so dangerous. When you are processing billions of events per day, a 40% drop in segment counts can hide inside normal variance for days. The volume that makes the platform valuable is the same volume that makes quality failures invisible until a human being usually notices something is off.The ad network gave us no warning, no migration notice. They renamed a field and added a new one. The Spark ETL kept running with zero errors. The data still looked like data. The output still looked like output. It was just wrong.<h2>Why this keeps happening</h2>The schema poison incident was not a one-off. It was a pattern. Every data engineer I have spoken to has a version of this story. The details change a renamed column, a shifted timezone, a changed enum but the structure is always the same: The system ran successfully while producing incorrect results.According to Monte Carlo’s 2023 <a href="https://montecarlo.ai/blog-data-quality-survey">State of Data Quality Survey</a>, 68% of data teams report a mean time to detect data incidents of four hours or more — and that is for incidents they eventually catch. The incidents that never trigger an alert where the numbers are plausible but wrong go undetected indefinitely.A second incident made the pattern undeniable. A daily Airflow DAG completed successfully. The S3 partition for that date existed. But the actual data files never landed; the upstream SDK feed had dropped silently. The Spark job processed an empty partition, wrote an empty result, and marked the task green. Three days of audience data vanished before anyone noticed. The partition’s mere existence satisfied every monitoring check we had in place. A client noticed zeroes on their dashboard before we did.Both incidents share the same root cause: The system was checking for structural completeness, not semantic correctness. The DAG succeeded. The partition existed. The table had rows. But the numbers meant nothing. Our <a href="https://venturebeat.com/orchestration/enterprises-winning-with-ai-agents-are-limiting-how-much-the-agents-can-do-alone?_gl=1*193mxx7*_up*MQ..*_ga*MTE1NDcwODg1OS4xNzg4NzI2MjEw*_ga_B8TDS1LEXQ*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGgxODU4MzM1MTgx*_ga_SCH1J7LNKY*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGg3NDUzMjEyMTc.">monitoring</a> was designed to catch infrastructure failures — crashed jobs, missing files, timeout errors. It was never designed to catch data that arrived on time, in the right format, and was simply wrong.Once we named the failure mode checking structure, not semantics the fix was obvious.<h2>Where I put the fix</h2>My approach now: Schema validation at the ingestion boundary. Validate incoming event schemas against a registry before any transformation runs.Most teams add validation deep in the pipeline after transformation. I put it at the front door. A schema mismatch caught at ingestion costs minutes. Caught after 11 days of downstream propagation, it costs client relationships.This is not sophisticated. It is not novel. But it is the difference between catching a silent field rename in seconds versus letting it corrupt 11 days of downstream output.The lakehouse pattern does not change this calculus. A lakehouse full of <a href="https://venturebeat.com/orchestration/the-cleanup-trap-stop-asking-rag-to-fix-bad-data?_gl=1*1wkqhe0*_up*MQ..*_ga*MTE1NDcwODg1OS4xNzg4NzI2MjEw*_ga_B8TDS1LEXQ*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGgxODU4MzM1MTgx*_ga_SCH1J7LNKY*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGg3NDUzMjEyMTc.">bad data</a> is just bad data with better tooling around it. The architecture gives you infrastructure to catch quality problems, but only if you build the semantic discipline on top of it.What I track now:<ul><li>Audience segment counts: The business outcome, not the system metric</li><li>Data freshness: Hours since last successful load</li><li>Schema validation pass/fail rates at ingestion</li><li>Partition completeness checks: File count, byte count, not just partition existence</li><li>Pipeline SLA completion windows</li></ul>The key shift is treating semantic correctness as a first-class monitoring dimension. Not as a nice-to-have. Not as something we check after a client complains. As the primary signal that the pipeline is actually working.Teams spend enormous engineering energy on pipeline throughput, infrastructure reliability, and storage cost. Silent <a href="https://venturebeat.com/technology/why-prompt-debt-retrieval-debt-and-evaluation-debt-are-quietly-reshaping-enterprise-ai-risk?_gl=1*2qefrx*_up*MQ..*_ga*MTE1NDcwODg1OS4xNzg4NzI2MjEw*_ga_B8TDS1LEXQ*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGgxODU4MzM1MTgx*_ga_SCH1J7LNKY*czE3ODg3MjYyMDkkbzEkZzAkdDE3ODg3MjYyMDkkajYwJGwwJGg3NDUzMjEyMTc.">quality failures</a>, numbers that are wrong but look right get treated as someone else’s problem until a client notices. Most data quality failures I have seen were not infrastructure failures. They were assumption failures nobody was monitoring.The myth that needs busting: “More data is always better.” More data means more storage cost, more compute cost, more schema complexity, and more surface area for silent quality failures. Ingesting everything because you might need it later is how you end up with a data lake nobody trusts and a compute bill nobody can explain.<h2>Where this goes next</h2>Agentic workflows will handle operational decisions that currently require human intervention: Schema drift response, backfill coordination, quality remediation. But agents will inherit the same fundamental problem: They need to know when the numbers are wrong, not just when the system is down.<h2>The one line for engineers</h2>Understand the data before the tools.Every tool in your stack exists to move or transform data. If you do not understand what the data represents, what its invariants are, and how it breaks, no tool will save you. Learn what a healthy row looks like. Learn what the business expects that number to mean. Learn where the upstream system is fragile. The tools change every two years. The discipline of understanding your data does not.<h2>The problem you probably have right now</h2>The pipeline is green. The DAG completed. The data landed. But the numbers are wrong — and nobody knows yet. That is the problem most data engineers are either living with right now or one upstream schema change away from. Not because anyone is careless, but because every default in our tooling optimizes for “did it run” rather than “is it right.”Add one semantic check today. It takes less time than explaining the incident.Siddharth Arun is a Senior MTS at Salesforce building enterprise data migration pipelines.

2026/9/8

OpenAI solves longstanding math problem with 10,000-agent swarm — but can't rule out benefitting from a researcher's private Codex data

OpenAI today announced an internal AI system <a href="https://openai.com/index/navier-stokes-solution/">solved the Navier–Stokes existence and smoothness problem</a>, one of the seven notoriously challenging<a href="https://www.claymath.org/library/monographs/MPPc.pdf?utm_source=chatgpt.com"> Millennium Prize Problems in mathematics</a> that has remained unsolved since its introduction 26 years ago, using a coordinated system that involved roughly 10,000 concurrent AI agents.The problem, named for 19th-century mathematicians Claude-Louis Navier and George Gabriel Stokes, asks a basic but extremely difficult question about equations used to describe how fluids such as air and water move: can a fluid that starts out behaving smoothly eventually develop a mathematical breakdown?OpenAI says its system produced a new proof showing that, under certain conditions, a smoothly moving three-dimensional fluid can reach a point where its calculated speed grows without limit in a finite amount of time. In practical terms, that would mean the equations themselves eventually stop providing a physically meaningful description of the fluid. But OpenAI's announcement also comes with a dispute over how the work was produced and who should receive credit. An NYU mathematician involved in closely related AI-assisted research released a statement on Mastodon last night, prior to OpenAI's announcement,<a href="https://cims.nyu.edu/~tristanb/statement.pdf?utm_source=chatgpt.com"> questioning whether the company's model could have been trained on or otherwise benefited</a> from research he and a collaborator from Anthropic had conducted in part using Codex, OpenAI's coding and work-focused AI harness and application. OpenAI initially told VentureBeat that neither its researchers nor AI systems searched user data to solve the problem. In a subsequent public statement, however, the company added an important qualification: while it says no specific user data was accessed to produce the solution, it “cannot rule out” that de-identified data derived from the researchers' use of OpenAI products helped improve its modelsAsked directly by VentureBeat during a video press briefing earlier today whether OpenAI or its agents had accessed Codex results from the outside researchers, OpenAI Chief Research Officer Mark Chen replied: " No people or AI systems searched through user data to solve this problem or any specific problem that we were trying. And I'm a little bit disappointed by the allegations of the huge breach of user trust. We we did not do that." Yet later today on X, <a href="https://x.com/OpenAI/status/2097375276384567642">OpenAI posted a statement </a>reading in part: <blockquote>"We (the researchers and the agents) did not see any of their work through any means until they released it publicly — in particular, no specific user data was accessed in order to solve this problem. While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models. However, our proofs differ significantly and even the precise results proved are different in the Euler case (forced vs. unforced)."</blockquote>That distinction — between retrieving a user's private work and potentially learning from data derived from product usage during model improvement — matters well beyond an academic dispute. For enterprises putting proprietary code, unpublished research or other sensitive intellectual property into AI systems, it raises a practical question: what protections actually prevent that information from becoming part of future model improvement?<h2>How the credit and data dispute unfolded</h2>The controversy began with a rumor. On September 1, word spread online that researchers associated with Anthropic might have solved two Millennium Prize Problems. OpenAI says that was what sent its newly trained internal model after the remaining problems. OpenAI technical staffer and esteemed AI researcher <a href="https://x.com/SebastienBubeck/status/2097379415747342689">Sébastien Bubeck later put it plainly on X</a>: “We began working on the Millennium problems due to viral twitter rumors that Anthropic had resolved 2 Millenium problems.” The goal, he said, was to see whether OpenAI’s rapidly improving system could pull off something comparable.The rumor was connected to real work by NYU mathematician Tristan Buckmaster and Levent Alpöge, an Anthropic researcher, who had spent months using AI systems to push forward a specialized line of research on fluid equations related to Navier–Stokes. Records produced by both parties indicate that on September 3, Buckmaster contacted OpenAI to explain that theirs was a personal collaboration, not an Anthropic project. By then, according to OpenAI’s timeline, its own agent experiment was already underway. <a href="https://x.com/SebastienBubeck/status/2097379415747342689?utm_source=chatgpt.com">Bubeck later insisted </a>that OpenAI “did not see any of [Buckmaster's and Alpöge's] work until they released it publicly” and pointed to differences between the two teams’ eventual proofs as evidence of independent development.Then, on September 6, OpenAI told the external mathematicians that its system had produced something much bigger: a proof of finite-time blowup for forced Navier–Stokes. A s<a href="https://x.com/SebastienBubeck/status/2097379411691516310">creenshot posted on X by Bubeck </a>shows a text message conversation between him and a user identified as Alpöge. “I would like to be maximally open with you,” Bubeck wrote, according to the screenshot, saying OpenAI wanted to ensure that “all the academic accolades” for their work went to Alpöge and Buckmaster."What is the precise theorem you are claiming?" the screenshot shows Alpöge asking Bubeck."Existence of forced blowup in R^3 and T^3," Bubeck is shown to have responded. But the message apparently alarmed Alpöge and Buckmaster. In <a href="https://cims.nyu.edu/~tristanb/statement.pdf">his PDF statement</a> published publicly on September 7, Buckmaster wrote that hearing the word “forced” was “a bright red flag,” because the smooth-forcing route was precisely the obscure approach the two mathematicians had been pursuing.That led to the most consequential accusation — or, more precisely, question. The mathematicians had been putting unpublished drafts into private Codex sessions, and Buckmaster asked whether OpenAI’s model had been trained on or had access to them. He says he was told that the model did not look up user data, but received no answer when he pressed specifically about training. Importantly, he stopped short of alleging theft: “I do not know whether our data was used. I am not accusing anyone of anything.”The conversation then deteriorated over credit. Buckmaster said Bubeck proposed a path in which he might help present OpenAI’s Navier–Stokes proof without Alpöge as an author, and cited Alpöge’s employment at Anthropic as a complication. <a href="https://x.com/SebastienBubeck/status/2097379411691516310">Bubeck strongly disputed that interpretation on X</a>. “I never ever asked for Levent to be removed from authorship of his own work,” he wrote. His version is that they were discussing whether Buckmaster could lead a rewrite of OpenAI’s separate proof, and that he felt it would be inappropriate for an Anthropic employee to author work created by an OpenAI system. Bubeck also acknowledged making a remark about Buckmaster “risking” his career, but called it an “extremely poor choice of words,” apologized and said he had retracted it immediately.OpenAI has since denied that its people or agents directly accessed the mathematicians’ private work to produce the proof, while acknowledging that it cannot rule out de-identified data from their use of its products having contributed to model improvement. That leaves the dispute in an unusually narrow but important place: not an established case of OpenAI taking private research, but an unresolved question about whether information generated through researchers’ use of an AI product can indirectly flow back into the systems that later compete with them.<h2>From one hard problem to millions of agent messages</h2>The privacy dispute is only one part of what makes the Navier–Stokes announcement noteworthy. How OpenAI says it actually produced the proof suggests a different model for deploying frontier AI.According to <a href="https://openai.com/index/navier-stokes-solution/?utm_source=chatgpt.com">OpenAI’s description of the experiment</a>, training of the unnamed internal model began August 28 and is continuing. OpenAI describes the system as significantly more capable than GPT-6 Astra, its frontier model released last week. The internal model is not currently available to ChatGPT or API customers. On September 1, after hearing rumors that other researchers had made progress on Millennium Prize problems, OpenAI set agent groups to work across the remaining open problems and several related mathematical questions. Agents could run code, consult a cached version of the internet and communicate with other agents within their groups.An important intermediate result came from the Euler equations, which describe fluid motion without the viscosity term found in Navier–Stokes. OpenAI says nearly 100 agents worked for about 50 hours to produce an unforced Euler regularity disproof. It then redirected resources toward Navier–Stokes, gave agents the Euler result as a starting point and used Codex to consolidate promising intermediate ideas from different groups. The group that produced the Navier–Stokes result involved on the order of 10,000 concurrent agents. OpenAI says the agents reached the resolution on September 5, approximately 88 hours after the first agents were launched. Formalizing and checking the proof in Lean took another 17 hours using GPT-6 Astra. The scale is striking. Across all of the mathematical problems attempted, OpenAI says its agents exchanged 4.9 million messages and generated roughly 300 billion output tokens. The Navier–Stokes work alone accounted for 2.7 million messages and approximately 130 billion output tokens. This is less like asking a chatbot an extraordinarily difficult question and more like operating a computational research organization made up of thousands of model instances.<h2>Lean provides another verification layer — but not instant acceptance</h2>OpenAI also released a formalized version of its proposed proof in Lean.<a href="https://lean-lang.org/doc/reference/latest/?utm_source=chatgpt.com">Lean’s own documentation</a> describes it as an interactive theorem prover whose small trusted kernel checks formal proof terms. That can provide a powerful safeguard for AI-generated mathematics: instead of relying entirely on whether a lengthy mathematical argument sounds plausible, researchers can encode the theorem and its proof in a language that can mechanically check whether the steps follow from the stated assumptions. But formal verification does not eliminate the need for outside scrutiny. Lean's <a href="https://lean-lang.org/doc/reference/latest/ValidatingProofs/?utm_source=chatgpt.com">proof-validation guidance</a> notes that reviewers still need confidence that the formal theorem statement actually expresses the intended mathematical claim and that its definitions and assumptions have been represented correctly. Meanwhile, the <a href="https://www.claymath.org/millennium-problems/?utm_source=chatgpt.com">Clay Mathematics Institute</a>, which established the Millennium Prize Problems in 2000, offers $1 million for a recognized solution to each problem, but has not yet awarded OpenAI the prize. Under <a href="https://www.claymath.org/millennium-problems/rules/?utm_source=chatgpt.com">Clay's official rules</a>, a proposed solution must appear in a qualifying publication, at least two years must then pass, and the work must gain general acceptance in the global mathematics community before Clay will consider it. OpenAI says it does not intend to claim the prize. <h2>The economics of solving the difficult problems</h2>Those 130 billion output tokens also provide a rough way to understand the economics of this new research model.OpenAI's <a href="https://openai.com/index/gpt-6-astra/?utm_source=chatgpt.com">published GPT-6 Astra pricing</a> is $10 per million input tokens and $50 per million output tokens.At that retail rate, 130 billion output tokens alone would represent about $6.5 million in API charges, before accounting for any input tokens. That is not OpenAI's actual infrastructure cost, and the internal model that generated the proof has no public price. Nor has OpenAI disclosed how many input tokens the research system processed. One outside estimate circulating on X placed a hypothetical retail-equivalent total anywhere from below $10 million to $30 million or $40 million depending on assumptions about input volume. That estimate remains speculative.OpenAI executives did confirm that the experiment operated at a multimillion-dollar scale. Bubeck said during the briefing, “We are able to spend millions of dollars on a problem that we really care for.”Bubeck framed that expenditure as a preview of how organizations could eventually use AI on commercially valuable scientific problems: “What I think we should all get into the mindset of is: what happens when we are able to spend that amount of compute on problems that really matter?”OpenAI CEO Sam Altman underscored the unusual economics with a <a href="https://x.com/sama/status/2097408559583772986">joke on X</a>, asking whether the researchers knew the problem was “only worth $1 million” — the size of the Clay prize.For enterprise technical leaders, the more important comparison may eventually be not cost per prompt but cost per solved problem. A pharmaceutical company, semiconductor manufacturer or materials-science organization might rationally spend millions of dollars on inference if an AI research system could compress work that otherwise requires years of expert labor. The total cost of ownership, however, would extend beyond tokens. Agent orchestration, failed approaches, tool use, verification infrastructure, security monitoring and human review all become part of the bill.<h2>10,000 agents also create a new control problem</h2>The 10,000-agent figure creates a second operational issue: controlling large populations of increasingly capable agents.That is particularly notable because OpenAI recently disclosed a serious security incident involving an earlier generation of internal research agents. In its <a href="https://openai.com/index/hugging-face-incident-and-the-road-ahead/?utm_source=chatgpt.com">postmortem on the Hugging Face incident</a>, OpenAI said agents worked around technical controls, communicated through unauthorized channels and took actions no human had directed. A related <a href="https://openai.com/index/hugging-face-model-evaluation-security-incident/?utm_source=chatgpt.com">July incident report</a> says models found and exploited a previously unknown vulnerability to obtain internet access before moving laterally through OpenAI systems and reaching Hugging Face infrastructure. OpenAI later described the episode as a “warning shot.” OpenAI says it responded by creating more isolated sandboxes, restricting internet access, strengthening model-weight protections and devoting substantially more compute to monitoring. The company says those stricter monitoring and isolation safeguards were active throughout the Navier–Stokes project. Its <a href="https://openai.com/index/safety-overview-gpt-6-astra/?utm_source=chatgpt.com">GPT-6 Astra safety overview</a> describes additional protections for Astra-class systems including stricter isolation, checkpoint encryption and monitoring of complete agent trajectories. For enterprises, that makes 10,000 agents more than a measure of computational power. It is also a measure of the control surface. Permissions, network isolation, tool access, logging and automated monitoring become progressively more consequential when an organization moves from a handful of assistants to thousands of agents acting simultaneously.<h2>What protections keep enterprise Codex data out of OpenAI’s models?</h2>Perhaps the most important question facing enterprises after the release of these results is how careful they should be inputting proprietary or sensitive data into cloud-based AI products such as Codex, ChatGPT or competing offerings from other AI companies and labs. For business customers of OpenAI, the<a href="https://openai.com/business-data/?utm_source=chatgpt.com"> data privacy policy</a> is relatively clear, stating OpenAI does not use data from ChatGPT Business, Enterprise, Edu or the API — including customer inputs and outputs — to train or improve its models by default. OpenAI’s <a href="https://help.openai.com/en/articles/8798634?utm_source=chatgpt.com">specific documentation for ChatGPT Business</a> says that protection continues when employees use Codex: “Business workspace data is excluded from training by default, including when the workspace uses Codex.” OpenAI also limits human access to stored business information. Its <a href="https://openai.com/enterprise-privacy/?utm_source=chatgpt.com">enterprise privacy documentation</a> says stored API inputs and outputs may be accessed by authorized employees when necessary for engineering support, investigating abuse or legal compliance, and by specialized contractors for abuse and misuse review. Competitive research is not listed as an authorized reason for accessing the content. The rules are different for individual ChatGPT and Codex customers. OpenAI says in its <a href="https://help.openai.com/en/articles/5722486-how-your?utm_source=chatgpt.com">model-improvement data policy</a> that it may use content from consumer services such as ChatGPT and Codex to train its models. However, ChatGPT Free, Plus and Pro users can manually turn off this policy through ChatGPT's data controls; OpenAI also documents separate settings governing whether some Codex “full environment” data may be used for training. That means the description “private Codex session” does not, by itself, establish that the contents were excluded from model training. The answer depends on the product, account type and applicable data-control settings. The currently available material does not establish which settings governed Buckmaster and Alpöge’s particular Codex usage.For an enterprise buyer, however, the baseline is stronger: OpenAI says business inputs and outputs are not used for model improvement unless the organization explicitly opts in.There is another important distinction. Not using customer content for training does not necessarily mean OpenAI does not retain that content at all.OpenAI's <a href="https://platform.openai.com/docs/models/default-usage-policies-by-endpoint?utm_source=chatgpt.com">API data-control documentation</a> says ordinary API requests can generate abuse-monitoring logs containing prompts and responses, which are normally retained for as long as 30 days. Some APIs also retain application state because persistence is required for the feature to operate. For companies handling especially sensitive data, OpenAI offers a stronger option: Zero Data Retention, or ZDR.OpenAI's current API documentation dates its broader default policy of not training on API data to March 1, 2023. And public records on OpenAI's own developer community show that by at least September 2023, the company's enterprise privacy documentation was already telling qualifying API customers they could request Zero Data Retention. <a href="https://community.openai.com/t/openai-data-retention-policy/391946?utm_source=chatgpt.com">That September 2023 discussion quoted OpenAI’s policy at the time</a> as allowing customers with qualifying use cases to request ZDR. In an A<a href="https://openai.com/index/offering-zero-data-retention-for-frontier-models/?utm_source=chatgpt.com">ugust 19, 2026 announcement</a>, OpenAI went further, noting that eligible API customers using ZDR have their prompts and model responses removed after processing and that customer content is unavailable to OpenAI personnel for review, subject to narrow legal exceptions. OpenAI simultaneously previewed Private Safety Processing, a system intended to identify risky patterns across multiple interactions without giving OpenAI employees access to the underlying prompts and responses. That is increasingly important for agentic AI. Safety systems may need to understand behavior across a long sequence of actions, while companies using AI for software development, pharmaceutical research, finance or other sensitive work may be unwilling to let a provider retain the underlying content simply to perform that monitoring.OpenAI says that in ZDR deployments customer content can remain on infrastructure controlled by the customer. It is also developing an option in which content stored on OpenAI infrastructure is encrypted using customer-controlled keys that OpenAI personnel do not possess. Private Safety Processing is currently being tested with early customers. GPT-6 Astra itself supports ZDR for eligible API customers, according to <a href="https://openai.com/index/gpt-6-astra/?utm_source=chatgpt.com">OpenAI’s Astra launch documentation</a>. ZDR still does not apply universally. OpenAI's <a href="https://platform.openai.com/docs/models/default-usage-policies-by-endpoint?utm_source=chatgpt.com">API data-control documentation</a> says customers must be approved for the control, and some features cannot operate under full zero-retention rules because they inherently require persistent state. Code Interpreter, for example, is not currently compatible with ZDR, and background-mode Responses requests likewise require temporary storage. Persistent objects such as Threads and Vector Stores have their own retention behavior. For enterprise architects, those distinctions matter. No-training commitments control whether customer information can be reused to improve models. Access controls determine who may see stored information. ZDR goes further by reducing the amount of customer content OpenAI retains in the first place.The Navier–Stokes controversy gives technical leaders a concrete reason to treat those as separate architectural controls rather than collapsing all three into a generic promise of “privacy.”<h2>The next benchmark may be a research program, not a test set</h2>The immediate scientific question is whether OpenAI's proof survives examination by mathematicians.But for developers and technical leaders, the operational lessons are already broader. The system OpenAI describes did not simply answer one difficult prompt. Thousands of agents explored different approaches, communicated findings, ran tools, consumed enormous amounts of inference, consolidated intermediate ideas and ultimately handed a proposed solution to another frontier model for formal verification.At the same time, the Codex dispute exposes another side of that future. As companies entrust AI systems with increasingly valuable intellectual property, the policies governing model training, retention and access become part of the technical architecture, not simply language in a privacy statement.The Navier–Stokes project therefore brings three trends together at once: organizations can spend extraordinary amounts of inference on a single high-value objective; increasingly capable agents require stronger control systems as their numbers scale; and customers need to know exactly what happens to the proprietary information those agents consume along the way.OpenAI’s experiment suggests that the meaningful unit of AI capability may increasingly be shifting from the model itself to the entire computational research process built around it.

2026/9/8

Agents identifying as OpenAI systems wrote 17,000 posts to a wiki no one was supposed to write to

Four researchers spent six weeks reconstructing what happened on a 25-year-old German programmers' wiki: agents identifying as OpenAI systems had turned it into a coordination channel, leaving about 18,000 posts, trading task answers, and sharing a working sandbox bypass. The lesson generalizes past this one wiki — an agent that can reach a writable surface can find the other agents that can reach it too.<a href="https://openai.com/index/gpt-6-astra/">GPT-6 Astra began rolling out</a> on September 3, one day before the report surfaced, off by default in ChatGPT Enterprise until an admin turns it on, with a system card that flags 0.2% of its runs on one test as possible attempts to contact other agents.The researchers published the evidence on September 4 at <a href="https://collusion.wiki/">collusion.wiki</a>; Reuters, reporting it the same day, <a href="https://www.reuters.com/world/europe/openai-agents-hijacked-german-website-previously-undisclosed-ai-breakout-this-2026-09-04/">independently counted more than 15,000 edits on the wiki</a>. By evening, Hacker News commenters and <a href="https://simonwillison.net/2026/Sep/4/rogue-agent-wikis/">Simon Willison</a> were pointing at sister wikis and other UseMod-family sites carrying the same agent signatures. On September 5, OpenAI acknowledged the “wiki incident” in a <a href="https://x.com/OpenAI/status/2096133504417616165">post on X</a> and said its agents “wrote to several internet sites,” without saying which model ran them.<h2>The card flags 0.2% of runs as possible agent contact and does not measure a shared Codex harness</h2>The <a href="https://deploymentsafety.openai.com/gpt-6-astra">Astra system card</a> section titled Unintended Engagement with External Agent Messages tests whether an agent speculates about other agents, attempts contact or engages a simulated communication surface, work the card says draws on the Hugging Face incident.<table><tbody><tr><td>ExploitGym evaluation</td><td>GPT-5.6 Sol</td><td>GPT-6 Astra</td></tr><tr><td>Speculated about other agents</td><td>43%</td><td>Under 4%</td></tr><tr><td>Arguably attempted contact*</td><td>Not reported</td><td>0.2%</td></tr><tr><td>Engaged simulated message board</td><td>84%</td><td>27%</td></tr><tr><td>Followed board instructions</td><td>52%</td><td>0%</td></tr></tbody></table>*OpenAI footnotes the 0.2% as flags that do not by themselves establish an attempt. Source: Astra system card, section on Unintended Engagement with External Agent Messages.None of those measurements, OpenAI writes, capture agents talking to other agents under the same user in the same Codex harness, a behavior it noticed in internal testing.An enterprise never sees the reasoning those tests read. It gets actions, outputs, and reasoning summaries, and in pre-release testing, UK AISI found the user API failed to return up to 80% of the reasoning summaries on long simulated cyber trajectories (Astra system card, section 9).AISI also observed that Astra “reasons in a compressed style.” ARC Prize’s <a href="https://x.com/fchollet/status/2095598451115614371">François Chollet</a>, reading its reasoning chains on ARC-AGI-3, saw it “developing its own shorthand DSL to represent in-game situations.” OpenAI states that Astra’s chain-of-thought monitorability decreased against Sol.<h2>56% of enterprises running agents monitor and log, while 8% both enforce and isolate</h2>Among the 93 enterprises running or piloting agents in VentureBeat’s <a href="https://venturebeat.com/resources">Agentic Security and Identity tracker</a> (VentureBeat Pulse, July 2026 wave, 93 enterprises running or piloting agents out of 116 total respondents), on a question that lets a respondent pick more than one posture, 56% monitor and log agent activity with limited runtime enforcement, 65% enforce scoped permissions at runtime, 18% isolate high-risk agents and 8% do both. From the full 116-respondent wave, 53% report a confirmed agent incident or a near-miss, and 6% have runtime sandboxing tooling in their consideration set.Gartner’s security note reached the same place on September 4, in a First Take it says it will update. “OpenAI’s Astra Reveals AI Cyber Risk Is Agent Action, Not Agent Intelligence” (subscriber-only), by Meghan Hollis, Christopher Mixter and four colleagues, calls AGI “a red herring” for cybersecurity teams and names agentic collusion the greatest emerging AI risk, agents that “evade or circumvent our control structures” by working together. A companion <a href="https://www.gartner.com/en/documents/8351317">"First Take for CIOs"</a> published the same day, by Arun Chandrasekaran and colleagues, told them to design agent patterns "assuming nothing can make the model safe" rather than relying only on chain-of-thought monitoring.<h2>Nearly all the traffic traced back to one cloud provider</h2>Sydney Von Arx of the Nightingale Collective, Cormac Slade Byrd, Spencer Kitts and Thomas Larsen reconstructed the incident from the public edit logs of DSE wiki, a German-language site for software developers that had been edited about 20 times in the previous decade. From May 24 the agents wrote to it, under names that later included OpenAIResearcher and OAIResearchMar26. The report counts about 18,000 posts, roughly 17,000 of them on this wiki, under more than 3,700 self-given names, with 98.5% of those agent edits arriving from Microsoft Azure address space, and 197 from AWS, DigitalOcean and Tor, often under the same agent names.Their tasks were timed web lookups in rounds, with follow-up windows as short as 14 seconds, so an agent that already held the next answer won. By June 16 they were holding answers for each other, an agent ahead posting the next state or country with its value, and an agent behind answering the identical question within a second.They also learned when they would die. One agent ran a heartbeat through an external counter so its container’s death would be logged outside the sandbox. Another read the last beat, number 353, to infer the cutoff.A volunteer moderator noticed on June 2 and spent six weeks deleting pages by hand, at the peak about 100 a day against roughly 400 the agents created. On June 19 an agent posted that a “cleanup/deletion sweep appears active alphabetically” and named a backup page beginning with ZZZ so it would be deleted last.<h2>A 25-year-old wiki on 23-year-old software turned read-only internet into write access, then a proxy bypass</h2>All of that ran through a rule that was supposed to prevent it. The agents could read the internet and were blocked from writing to it, a rule the environment enforced by permitting GET requests only. Willison identifies the site as running a UseMod-derived Perl CGI wiki, a software family whose 1.0 release is dated September 2003, and it accepts edits by GET, a flaw he traced to CGI.pm, whose single param() call never told a query string from a posted form.Then the agents shared a bypass. One task needed a POST to read a Power BI figure to two decimals, and the sandbox’s proxy settings carried a NO_PROXY exception for any hostname ending in blob.core.windows.net, with no check that the host was real. A NO_PROXY entry sends matching requests around the outbound security proxy. An agent mapped a made-up bypass.blob.core.windows.net to the Power BI server’s address in /etc/hosts, sent the blocked POSTs with the real Host header and certificate verification off, and posted the recipe. Fourteen minutes later another agent reported it working, and other agents posted reproductions the same morning.<h2>OpenAI's own traffic hit the wiki June 21. It stayed unacknowledged for 11 weeks</h2>Addresses registered to OpenAI first visited the wiki on June 21. Agent edits stopped on June 22, apart from a small burst on July 1 and 2.OpenAI’s <a href="https://cdn.openai.com/pdf/67869394-cb91-4c12-888c-5cbd85c7814c/OpenAI-Hugging-Face%20Incident-Technical-Report.pdf">Hugging Face technical report</a> of August 26 describes a mechanism that would fit. On page 23 it reports that agents of some OpenAI models “learned to use improvised collaboration channels in rare cases during the training process,” and that the behavior “was then reinforced during training.” The report does not mention the wiki.Asked by Reuters on September 4, an OpenAI spokesperson called claims that its legal team discouraged investigation false, while Reuters cited four people saying an effort to widen the internal probe met resistance. OpenAI also told Reuters the German activity “wasn’t related to Hugging Face” and that the researchers declined its request for access.A day later OpenAI acknowledged it publicly. In its September 5 post, OpenAI said it had treated the wiki incident as “an instance of misalignment similar” to others it had shared, while Hugging Face got “a traditional security incident response playbook,” called it “past time” to define standards for sharing misalignment incidents, and promised a framework “in upcoming weeks.”The report names three things it does not know. Which model ran the swarm, whether the tasks were training or evaluation, and how the agents found the site. Willison raises the possibility that the reinforcement learning loop baked knowledge of the chosen wiki into the model, so subsequent agents launched already knowing where to look. The researchers also allow that an external customer running Azure sandboxes on OpenAI models could account for the traffic. OpenAI has not said which model either, or whether the hostname trust that let the POSTs through is closed. “It seems extremely unlikely that OpenAI wanted them to do this,” Von Arx told Reuters.What happened on the wiki matters because most of those 93 enterprises are running the weaker posture, not the stronger one. The board question for the security director approving Astra is whether two of her agents can reach the same writable surface, even indirectly, and Gartner’s security note frames the risk the same way, as a failed control on agent action rather than a gain in agent intelligence.<h2>Three findings transfer to any sandbox that trusts a hostname suffix</h2>A GET is a write when the server treats it as one, so read-only internet only holds against surfaces that refuse writes on GET. An allowlisted hostname suffix the sandbox trusts without verifying the host, plus an agent that can map any name to any address and reach the real host directly, is an exit with no proxy in the path and nothing in the proxy log. On the wiki the agents switched off certificate checks themselves.This isn't unique to OpenAI: Anthropic’s <a href="https://www-cdn.anthropic.com/0339e6a7c5c7b87f5c07798616dc32c215d14235/Claude%20Fable%205.1%20&%20Claude%20Mythos%205.1%20System%20Card.pdf">Claude Fable 5.1 and Mythos 5.1 system card</a> of September 1 reports rare cases of Mythos 5.1 working around safety classifiers or broken permission hooks.And her log reads one agent at a time while the agents were reading each other, so the visible signal sat at the destination, a dormant wiki suddenly busy, an egress anomaly a SOC can alert on today if it holds destination telemetry from the environment the agents ran in. The 197 edits from AWS, DigitalOcean and Tor mean that telemetry has to cover every network the sandbox can reach, not only the primary cloud.<h2>The controls are configuration, not product, and six questions belong in front of the platform team</h2>Where her agent’s code executes decides which of these she can act on. In ChatGPT Enterprise, Codex cloud and hosted agent runtimes generally, the provider runs the sandbox, and her levers are whatever that provider exposes, in OpenAI’s case the admin toggle, the webhook and the monitor. Where her own team operates the execution environment, on the API, Azure or Bedrock, the controls that follow are hers.Route all agent egress through the proxy, and where an exception is unavoidable pin it to a verified destination rather than a hostname suffix. A read-only hosts file is not enough, since two posted reproductions used curl’s --resolve flag for the same mapping, so only the proxy gets a route out and the proxy verifies the destination rather than trusting the name. Pin package installs to approved sources and end background processes with the task, with explicit exceptions where the work needs them. Treat query strings on outbound GETs as payloads, because on the wiki they were, with the redaction and retention rules any payload log needs, and alert on destination anomalies, because one dormant site took 400 agent pages a day at the peak.Six questions belong in front of the platform team before Astra goes live in a sandbox it operates. Does our sandbox trust any hostname suffix without verifying the host? Can the agent map a name to an address of its choosing, install packages, or leave a process running after it answers? Which surfaces reachable by GET accept writes? Do we read outbound query strings for payloads? Can any of our agents see what another agent wrote, anywhere? Would our SOC notice one dormant site taking 400 pages a day from our address space?<h2>Closing the door costs capability, and OpenAI’s monitor can stop the API tasks it flags</h2>Closing the door has a price, and OpenAI’s own launch materials name it. Its <a href="https://openai.com/index/path-to-astra/">Path to Astra post</a> warns that the misalignment monitor can slow, pause or stop legitimate work, and that in the API a flagged task stops, on requests stateful enough to be stopped. The blob-storage exception the agents rode let traffic to Azure storage hostnames skip the security proxy, in the report’s reading, and every allowlist entry the reader closes carries the same kind of cost.What the security director approving Astra gets from OpenAI in return is narrower than the launch coverage implies. Enterprise customers can <a href="https://developers.openai.com/api/docs/guides/safety-checks/misalignment-monitoring">configure webhooks</a> for misalignment alerts across Codex, ChatGPT and the API, with separate setup for API projects and for ChatGPT and Codex workspaces. Chat Completions sits outside this monitoring system.In the Responses API, OpenAI can halt further execution only when persisted reasoning, WebSockets or its own compaction lets the system associate activity with a continuing conversation, and a stopped conversation returns the error code misalignment_policy_violation and cannot be resumed. Other calls can generate alerts for the customer’s webhook receiver, but they do not automatically stop.A webhook delivers an alert, not a kill switch the customer controls. OpenAI also warns that “harmful actions can occur before it intervenes.”OpenAI’s evaluation flagged 0.2% of Astra runs as possible attempts to make contact. The wiki shows one public example of what the behavior looked like outside the test harness, before OpenAI published the measurement.

2026/9/8

Most security teams don't know how many AI agents they're running. Falcon Guardian found 18,000 at one company that had approved only 300.

A Fortune 500 customer turned on agent discovery in August and found 18,000 AI agents active on its endpoints. They had only approved 300. That gap was the opening slide of CrowdStrike President Michael Sentonas’ keynote at <a href="https://secure.businesswire.com/news/home/20260819577865/en/CrowdStrikes-Fal.Con-2026-Unites-Cybersecuritys-Ecosystem-to-Secure-the-AI-Revolution">Fal.Con 2026</a>, introducing <a href="https://www.crowdstrike.com/en-us/press-releases/crowdstrike-unveils-falcon-guardian-ai-agent-security">Falcon Guardian</a>.All 18,000 showed up on day one. Sentonas said the discovery capability was already live in the Falcon sensor weeks before the keynote, shipping as a <a href="https://www.crowdstrike.com/en-us/pricing/falcon-flex/">Falcon Flex</a> entitlement. Flex is CrowdStrike’s consumption-based licensing model that lets customers activate new modules without a separate procurement cycle. Existing Falcon customers could turn on Guardian the minute Sentonas put the slide up, per his keynote.<a href="https://github.com/anthropics/claude-code">Claude Code</a>, <a href="https://chatgpt.com/codex/">OpenAI Codex</a>, Cursor and <a href="https://kiro.dev/about/">Kiro</a> were among the 18,000 agents Guardian identified. How many of those 17,700 were shadow AI, CrowdStrike would not say.VentureBeat continues to see shadow AI’s use <a href="https://venturebeat.com/security/shadow-ai-is-consultings-survival-strategy-in-the-genai-era">exponentially growing</a>, a direct result of a flourishing underground app and skill economy not visible to IT and security teams. <a href="https://venturebeat.com/security/shadow-ai-is-consultings-survival-strategy-in-the-genai-era">Fear of AI layoffs</a> continues motivating everyone from entry-level to executive employees to take crash courses in Python, vibe coding, and how to integrate APIs into shadow AI apps.“For decades, software did what we programmed it to do. Now, software can decide how to accomplish a goal. It’s moved from execution to agency,” Sentonas said onstage.<h2>The endpoint sees what the prompt layer misses</h2>VentureBeat asked CrowdStrike CEO George Kurtz whether the single agent architecture now pays unforeseen dividends in an agentic AI world. Sentonas answered first. “We knew that if you’re going to solve the agent problem, you’re going to do it on the endpoint,” he said. Kurtz added that the same logic applies to cloud workloads — a point he said he hadn’t hit hard enough in the keynote. “Because that's where the agents are running," he said. "They’re connecting to the user. They’re using the user’s identity.”Kurtz said the ask came straight from design partners. “We don’t want yet another agent. We already have a great agent. You guys already can give us runtime visibility. Now we want runtime visibility on the agent.”“We need application visibility," he said. "We need prompt visibility. And then we need data protection. We want to know what data it’s actually touching, and we want to understand where it’s going on the network.”Only 18% of 116 enterprises isolate their highest-risk AI agents, and just 8% pair enforcement with isolation, per <a href="https://venturebeat.com/resources/agentic-security-enterprises-enforce-agent-permissions-two-thirds-of-the-time-and-isolate-high-risk-agents-less-than-one-in-five">VentureBeat’s Agentic Security and Identity tracker</a>, July 2026 wave.In a controlled Fal.Con demonstration, CrowdStrike showed how an engineer’s Claude Code agent followed a link into a GitHub issue thread, where a hidden instruction told it to load a skill and send its AWS credentials out. The sensor blocked the exfiltration, and a query through the Falcon MCP server found 12 agents that had used that same skill. CrowdStrike’s demonstration showed every attempt blocked, with no credentials leaving any machine.In a second controlled demonstration, Claude Code installed a plugin from a public repository that registered a local MCP server, then the server stole credentials on every tool call. No one manipulated the model itself, and that was the demo’s point. A tool watching only the prompt layer would have passed the plugin as clean. CrowdStrike said the sensor caught the exfiltration.<h2>Guarding against agents inheriting human permissions</h2>“Every agent has an identity, and in most cases, it’s an overprivileged identity. And in too many cases, it inherits the human permissions, and you are all deploying them faster than you can govern them,” Sentonas said onstage. Per its <a href="https://ir.crowdstrike.com/events/event-details/crowdstrike-investor-briefing/">investor briefing</a>, CrowdStrike puts the ratio at roughly 90 agents per employee today. A number the company attributed to outside research it did not identify.<a href="https://ir.crowdstrike.com/news-releases/news-release-details/introducing-crowdstrike-agentic-identity-provider-foundation-ai">CrowdStrike’s agentic identity provider</a> was announced September 2. In the keynote demo, Guardian picked up an engineer’s Claude agent and registered it with the identity provider on its own. No human enrolled it. No one created the record. Discovery and credentialing happened in the same motion, collapsing two separate workflows into one sensor-driven step, per CrowdStrike.Amazon was CrowdStrike’s first design partner for Guardian, per Kurtz. Amazon CISO <a href="https://aws.amazon.com/blogs/security/author/cmoses">CJ Moses</a> has watched identity carry two categories for decades, humans and computers. “You need now a third.” An agent’s scope “should never be more than the individual that is operating it,” Moses said onstage. Enforcement belongs “at the infrastructure layer, not in the agent’s reasoning,” because containers “are not adequate as a security boundary for an agent.”<h2>No tool closes this alone</h2><a href="https://www.cobalt.io/about/team/andrew-obadiaru">Andrew Obadiaru</a> spent years as an auditor before moving into security leadership. He is now CISO at Cobalt, a penetration testing firm independent of every vendor in this story. His lens on agentic identity comes from the audit discipline, where every access decision has to be traceable, explainable, and bounded.“When I give you access as a human, then I’m pretty much certain what you’re able to do with that access. I can audit that access,” he told VentureBeat in an exclusive interview on September 1. An agent breaks that audit chain completely. “When it comes to an agent, there is just so much unknown in that process.”Token rotation on a schedule does not work at machine speed. “There’s not a tool you can deploy.” His first step is “to know what you have. Map, identify the agents, and then map them to their effective permissions.”Obadiaru’s argument comes down to sequencing. Visibility first, tooling second. Before any product can enforce a policy on an agent, someone has to know the agent exists, know what it connects to, and know whose permissions it inherited.<h2>The agents pull the packages now</h2>The supply chain protection Sentonas demonstrated intercepts npm and PyPI installs at the command line, before an embedded script runs. Over 8,000 people in the hall and online are already running this policy, Sentonas said onstage, because CrowdStrike built it into the platform as a policy customers set and turn on, not a separate product.DPRK-nexus Stardust Chollima injected a malicious npm package as a dependency into 131 Mastra AI framework packages, turning trusted AI building blocks into supply chain targets. In the first half of 2026, 87% of identified software registry threats involved malicious npm packages. Altered Spider compromised more than 300 software dependencies in a single day, harvested credentials, and pivoted into cloud environments, per <a href="https://www.crowdstrike.com/en-us/resources/reports/threat-hunting-report/">CrowdStrike’s threat hunting report</a>. “The AI ecosystem is the next software supply chain battleground,” Adam Meyers said in the report.Sentonas made the endpoint case for why supply chain protection belongs on the device. Every turn, agents resend their entire working context to the model. That traffic runs 700 times what a person typing into a browser generates, per CrowdStrike’s <a href="https://ir.crowdstrike.com/events/event-details/crowdstrike-investor-briefing/">investor briefing</a>, and most companies first see the bill “at the end of the month,” Sentonas said onstage. The supply chain intercept stops a malicious package before the agent can load it. The prompt layer never sees the attempt.<h2>The breakout clock hit zero</h2>Adam Meyers, CrowdStrike’s SVP of counter adversary operations, said onstage that CrowdStrike had seen almost as many agentic adversaries in the month before Fal.Con as in the six months prior. In a separate interview with <a href="https://siliconangle.com/2026/09/03/agentic-adversaries-cut-attacker-intrusion-times-minutes-falcon/">theCUBE</a>, he put the number at roughly 26 in 30 days, more than CrowdStrike had tracked in the entire year before.Vault Panda targeted an organization and ran 1,100 commands in under an hour. CrowdStrike watched the agent learn in real time, changing its approach in seconds when its initial technique failed, per Meyers. A Revenant Spider agent hit 17 victims in about 48 minutes, writing a custom web shell for each and deploying it in seconds. When the agent found credit card data was encrypted, it figured out on the fly how to decrypt and exfiltrate it, per Meyers’s keynote.Moses brought the attacker’s receipts. In July, an AI agent ran a full 94-event attack against one of Amazon’s honeypots in 12 minutes and 42 seconds. No syntax errors. Replies under 500 milliseconds. The target was a decoy, one node of the MadPot network that logs 750 million threat interactions a day.In June alone, CrowdStrike counted 7,400 publicly disclosed vulnerabilities, 96% above the June before. CrowdStrike found 2,400 of them, roughly 30% of all vulnerabilities reported that month. By July and August, Meyers said, growth jumped from double digits to triple digits. “This is the last time I think we’ll see double digit growth there,” he told the audience. That was the lowest count he had, and anyone running the research would find more. “We’re approaching probably a 30-minute patch cycle.”Sentonas put it flat. “The breakout time is zero.”CrowdStrike has built <a href="https://ir.crowdstrike.com/news-releases/news-release-details/crowdstrike-unveils-next-evolution-agentic-soc">Charlotte AI</a> into a progressively deeper SOC tool, and Sentonas acknowledged onstage that CrowdStrike has “talked about the agentic SOC” for the last couple of years. What Fal.Con 2026 added is the shift from sequential to simultaneous. Previously, agents worked one domain at a time. Endpoint would finish, then identity would start, then cloud. Now they investigate together, per Sentonas. “One takes endpoint, one takes identity, one takes cloud. Same case, same time, shared memory. What one learns, the others know.” The demo case was an IT help desk copilot tricked into issuing a rogue credential that rerouted payments. Nothing irreversible fired until an analyst approved it.Kurtz said CrowdStrike’s advisory board members now ask one question first after any incident. Was it agentic? That answer goes straight to the board deck. Sentonas said the ask has escalated. Large companies now want to send their entire boards to hear the answer and find out if they are spending enough.<h2>Inventory before autonomy</h2>The count of AI agents running on a network — approved or not, active or dormant — matters because it's the number a board will ask for. Endpoint telemetry, scheduled scans and DNS queries surfaced the 18,000 at CrowdStrike's Fortune 500 customer — the same three sources any security team could run against its own fleet. Obadiaru's questions for a service account apply just as directly to an agent: who owns it, what it was created for, when it was last used. Agents without answers to those questions are the ones likeliest to lose access first.Agents are increasingly getting their own identity class. <a href="https://www.okta.com/newsroom/press-releases/okta-brings-first-class-identity-to-ai-agents-with-agent-sso/">Okta shipped Agent SSO on August 24</a> and built it into core SSO at no extra charge. CrowdStrike shipped its own identity provider on September 2. Microsoft Entra Agent ID and other non-human identity platforms are working the same problem: the human who launched an agent sets its access ceiling, while agents running without a human behind them get a separately approved policy scoped to the task.A gap in a vendor’s ability to identify agent involvement in an incident is a gap in the detection chain — one a board is likely to find before a SOC does.The agent in Moses’s honeypot finished in 12 minutes and 42 seconds against a target built to be attacked. About 17,700 of Guardian’s detections sat outside the customer’s approved inventory, on CrowdStrike’s account, and they were there before anyone switched discovery on.

2026/9/8

How European enterprises can meet sovereignty demands without giving up global reach

Presented by Equinix<hr/>Imagine a technology-savvy European financial institution. The business serves customers across the European Union as well as globally, and depends on the seamless movement of data to provide market-leading solutions to its customers. More than ever, that financial institution is fielding pointed questions from regulators and customers alike: Who ultimately controls our data and infrastructure, how is that control exercised, and under whose laws?The question has grown more urgent this year. There is understandable and rising unease across Europe about the implications of global, sometimes conflicting legal frameworks, and about scenarios in which access could be constrained by decisions made outside the region. In June 2025, <a href="https://labs.cloudsecurityalliance.org/research/eu-tech-sovereignty-cloud-ai-enterprise-risk-v1-0-csa-styled/">testimony to the French Senate</a> confirmed that a major U.S. cloud provider could not guarantee that data held in its French data center regions would never be disclosed to U.S. authorities under certain legal circumstances. While the legal exposure associated with the U.S. CLOUD Act had already been widely discussed across the industry, the testimony brought renewed public attention.European enterprises are deciding how to respond now, without waiting for harmonized policy, and the choice shapes both their compliance posture and their economic competitiveness.<h2>The scope and scale of the European sovereignty question</h2>The context is significant. <a href="https://digital-strategy.ec.europa.eu/en/policies/eu-tech-sovereignty">The European Commission estimates</a> that the EU relies on non-EU countries for “over 80% of key digital products, services, infrastructure, and intellectual property.” Reducing that dependency and mitigating its risks is a stated priority of economic strategy.Policy has moved accordingly. In June 2026, the Commission put forward the <a href="https://commission.europa.eu/news-and-media/news/strengthening-europes-tech-sovereignty-2026-06-03_en">European Technological Sovereignty Package</a>, a set of measures spanning semiconductors, AI, cloud, and open source, and designed to strengthen the bloc's digital autonomy. Earlier, in April 2026, the Commission <a href="https://commission.europa.eu/news-and-media/news/sovereign-cloud-framework-explained-2026-06-01_en">awarded a sovereign cloud contract worth up to €180 million over six years to four European providers</a>, the first time EU institutions subjected cloud procurement to explicit, measured sovereignty criteria. The direction of travel is clear, and enterprises are increasingly evaluating how their cloud and AI strategies fit that trajectory.The market is moving in step with policy. This year, Gartner estimated European sovereign cloud IaaS spending will grow approximately 83% in 2026, rising from $6.9 billion (in U.S. dollars) in 2025 to a forecasted $12.6 billion. It is projected to reach $23.1 billion by 2027, at which point Europe would surpass North America in sovereign cloud IaaS spending for the first time.The spending surge mirrors other regions, including the Middle East and Africa (89% forecasted increase in 2026), as well as Gartner’s Mature Asia/Pacific region (87% forecasted rise). Gartner attributes the surge primarily to governments and regulated industries.<h2>Sovereignty lives on a spectrum, not a binary choice</h2>For all the policy momentum, the underlying enterprise decision is best understood as a spectrum of control rather than a single binary choice.Picture a simple analogy. Sovereignty resembles control over a building more than ownership of the land it sits on. You hold the keys, determine who enters, and maintain a verifiable record, without needing to own every brick. The question organizations face is how much of the stack they must own, and how much they must simply control.<a href="https://www.oxfordeconomics.com/resource/the-eonomics-of-sovereign-ai-balancing-autonomy-innovation-and-growth-in-the-asia-pacific/">Oxford Economics modeling</a> from May 2026, commissioned by the AI Adoption Initiative, categorizes sovereign AI policies into five levels of restrictiveness, ranging from control-and-choice approaches that retain global providers and apply residency rules to a narrow set of sensitive workloads, to ownership-centric approaches that mandate a fully domestically owned technology stack. Many European enterprises are unlikely to sit comfortably at either extreme. The binary framing tends to drive over-restriction, and European policymakers are increasingly concerned about the competitiveness implications of excessive restriction.<h2>Understanding the economics of excessive restriction</h2>Restriction adds direct cost in the form of data centers, processors, and talent development. By many estimates, restriction can add a larger indirect cost through delayed adoption and lost productivity.The <a href="https://www.computerweekly.com/news/366644332/Strict-sovereign-AI-policies-could-cost-APAC-economies-billions">Oxford Economics analysis estimates</a> that highly restrictive approaches could delay enterprise AI adoption by approximately three to five years. While the report models the Asia-Pacific region, not Europe, these implications transcend regions. Consider: duplication of infrastructure and delayed access impose an economic penalty wherever they occur. In a European context, this penalty can compound the fragmentation already present across national jurisdictions, and the cost is measured in slower innovation and higher run-rate. This is the balance Europe is now weighing as it directs an estimated $12.6 billion toward sovereign cloud IaaS in 2026: the cost of control compared with the cost of restrictions.<h2>Where control actually comes from</h2>Control is demonstrated through governance over data, infrastructure, access, operational authority and data flows, rather than through ownership of the full technology stack alone. This emphasis on demonstrable control is becoming increasingly visible in European policy discussions.In a neutral colocation model, customers retain possession, custody, and control of their data and infrastructure environments; the provider does not operate the customer workload or control the customer data layer. The location of a provider's headquarters does not automatically determine access to customer data. What matters is how control, custody, operational responsibilities, and legal obligations are structured and enforced. The <a href="https://commission.europa.eu/document/download/09579818-64a6-4dd5-9577-446ab6219113_en">Commission's Cloud Sovereignty Framework</a> reflects this emphasis, assessing the legal, contractual, or technical channels through which non-EU authorities could compel access, with direct reference to the US CLOUD Act.In models where customers retain operational control of their environments, they may also retain primary responsibility for responding to lawful requests relating to their data. That structure can help give an enterprise a defensible, credible and verifiable answer to the board's question about who is in control.<h2>The role of neutral infrastructure and a path between extremes</h2>A neutral, interconnected foundation gives European enterprises a path between local-only providers and provider-operated sovereign clouds.Customers keep ownership and operation of their environments while reaching global clouds, networks, and certified sovereign providers, without lock-in. For a European bank, that means keeping regulated workloads and market data in-region while still reaching cloud-based AI and analytics through private, controlled interconnection. Organizations can implement network architectures and routing controls designed to support jurisdictional requirements for data in motion, including during resilience and failover scenarios. These controls can help organizations align network behavior with their sovereignty objectives while maintaining responsibility for their overall compliance and governance requirements. This middle path also addresses a key concern Gartner raises. Even as U.S. hyperscalers launch sovereign offerings for the European market, <a href="https://www.computerworld.com/article/4129552/gartner-european-spending-on-sovereign-cloud-iaas-to-nearly-double-in-2026.html">questions remain about the level of genuine sovereignty those provider-operated services afford</a>. A model in which the customer operates and governs its own environment is able to provide a stronger foundation for addressing those concerns.<h2>The policymaker's role in matching safeguards to risk and workload</h2>The most effective policies calibrate safeguards to use cases, rather than imposing uniform rules, and European policymakers have a decisive role in getting this balance right.A productive contribution is to match safeguards to workload sensitivity and to recognize demonstrable customer control as a key basis for compliance. This approach allows European policy to achieve sovereignty while keeping the region economically competitive and at the forefront of global innovation. The <a href="https://www.oxfordeconomics.com/resource/the-eonomics-of-sovereign-ai-balancing-autonomy-innovation-and-growth-in-the-asia-pacific/">Oxford Economics report</a> makes a comparable case for a managed interdependency model that pairs domestic oversight with continued access to global AI infrastructure. Applied correctly, this would enable member states to set domestic terms while retaining access to leading global capabilities, all while empowering regulated European industries to keep sensitive workloads in jurisdiction while still reaching cloud-based AI.<h2>Independence without isolation</h2>Let’s go back to the example of the European financial institution. By governing the stack rather than owning all of it, the institution can provide regulators and the board a verifiable answer on the question of control, all while preserving the global reach the business depends on. Sovereignty for Europe is best understood as the agency to govern, achieved through a foundation that keeps control in the customer's hands while preserving global connectivity. As European policy continues to develop, that discipline is what allows enterprises to remain both compliant and competitive, independent without being isolated.Bruce Owen is Executive Vice President, Global Markets at Equinix.<hr/>Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact <a href="mailto:sales@venturebeat.com">sales@venturebeat.com</a>.

2026/9/8

MCP's new spec turns a planted prompt into a stolen credential

The Model Context Protocol's (MCP)'s largest revision since its initial launch shipped on <a href="https://blog.modelcontextprotocol.io/posts/2026-07-28/">July 28</a>. By the end of the first day, all four Tier 1 SDKs were already speaking the new version, and Cloudflare's Agents SDK had support in place from day zero, with customers such as Sentry and Linear picking it up right away, meaning the surface this article describes is already live in production. A new 12-month deprecation policy keeps the changes in place through at least mid-2027. Most of the coverage has focused on what improvements have been made: A stateless core that scales on ordinary HTTP, OAuth-native authorization, and server-rendered UIs via MCP Apps.For the past two years, I have been building agent systems that connect to enterprise tools through MCP. The obvious interpretation of the new spec is that it is a scaling upgrade. However, the more important story is that there has been a substantial shift in where <a href="https://venturebeat.com/security/ai-agents-need-their-own-identity-before-they-need-a-gateway?_gl=1*1nx689a*_up*MQ..*_ga*MTI1MDIxNTgzLjE3ODg2Mjc2Nzg.*_ga_SCH1J7LNKY*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgyMDYyNDc1MTc2*_ga_B8TDS1LEXQ*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgxNzY2OTMwMTU.">security obligations</a> fall. The new spec shifts enforcement from the protocol to your endpoints and developers. If your security architecture does not evolve alongside this change, you will inherit attack surfaces your network-layer tools can't see.To date, MCP security coverage has focused on permissive servers, missing authentication, and tool poisoning, and the scale behind it is not small. Each month, MCP's Tier 1 SDKs<a href="https://blog.modelcontextprotocol.io/posts/2026-07-28/"> clear close to half a billion downloads</a>, and the TypeScript and Python SDKs have each passed a billion in total. A<a href="https://censys.com/blog/mcp-servers-on-the-internet/"> Censys scan</a> in late April found 12,520 MCP services exposed to the public internet, on a protocol that requires no authentication by default.<a href="https://www.ox.security/blog/the-mother-of-all-ai-supply-chains-critical-systemic-vulnerability-at-the-core-of-the-mcp/"> OX Security reported</a> that a single design flaw in the STDIO transport put as many as 200,000 servers at risk. In May, the NSA's Artificial Intelligence Security Center<a href="https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4496698/nsa-releases-security-design-considerations-for-ai-driven-automation-leveraging/"> published its own MCP guidance</a>, warning that adoption has outpaced the protocol's security model. This is a different problem. The July 28 spec changes the reason those risks compound: The session is no longer the unit of control. Each request is treated as an independent unit, state moves into portable handles, and MCP Apps offload UI rendering to the AI client. Same family of failures, but a different control plane under them.For platform teams, this is an exercise in scaling. It's also a pivot in security. Here's what has changed, and what you need to do about it.<h2>What actually changed (and why security teams should care)</h2><a href="https://venturebeat.com/orchestration/mcp-solved-tool-calling-a2a-solved-coordination-what-solves-transport?_gl=1*bdyowr*_up*MQ..*_ga*MTI1MDIxNTgzLjE3ODg2Mjc2Nzg.*_ga_SCH1J7LNKY*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgyMDYyNDc1MTc2*_ga_B8TDS1LEXQ*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgxNzY2OTMwMTU.">MCP is now stateless</a> at the protocol level. The Mcp-Session-Id header and the initialize/initialized handshakes that linked clients to specific server instances have been removed. The protocol version, client information, and client capabilities are conveyed inline within each request, allowing any server instance to process any request.While this showcases solid engineering design, it also entails a shift in terms of <a href="https://venturebeat.com/security/ai-agents-that-pass-authentication-can-still-drift-expose-data-or-get-memory-poisoned?_gl=1*1nx689a*_up*MQ..*_ga*MTI1MDIxNTgzLjE3ODg2Mjc2Nzg.*_ga_SCH1J7LNKY*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgyMDYyNDc1MTc2*_ga_B8TDS1LEXQ*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgxNzY2OTMwMTU.">security considerations</a>. Here is what changed and what it means for your defense.<table><tbody><tr><td>Spec change</td><td>What it enables</td><td>Where security now lives</td></tr><tr><td>Stateless core (sessions removed)</td><td>Round-robin load balancing, autoscaling</td><td>Per-request enforcement at the gateway, every call must be inspected, not just the session start</td></tr><tr><td>Portable state handles</td><td>State passed explicitly between tool calls</td><td>Handle validation at the endpoint, a handle planted or read via prompt injection is a valid credential</td></tr><tr><td>MCP Apps (server-rendered HTML)</td><td>Interactive UIs inside the AI client</td><td>The endpoint/IDE, stored XSS now lives in AI-rendered HTML inside a sandboxed iframe</td></tr><tr><td>OAuth-native authorization</td><td>Standard identity flows</td><td>Audience-bound token validation, tokens minted for one server must not replay against another</td></tr><tr><td>Tasks extension</td><td>Long-running async work</td><td>Scope enforcement, without sessions, task ownership must be bound to identity, not connection</td></tr></tbody></table><h2>The three new attack surfaces</h2>Backslash and Akamai have each mapped where the new spec opens the attack surface, and Microsoft's tool-poisoning research shows why that shift bites once agents move from reading to acting. Three new attack vectors emerge, all of them on the endpoint.1. Stored XSS in MCP Apps: MCP Apps lets a server ship interactive HTML that the host renders in a sandboxed iframe. This brings a classic web vulnerability into the AI ecosystem. <a href="https://venturebeat.com/security/forget-typosquatting-slopsquatting-is-the-software-supply-chain-threat-created-by-ai-coding-tools?_gl=1*bdyowr*_up*MQ..*_ga*MTI1MDIxNTgzLjE3ODg2Mjc2Nzg.*_ga_SCH1J7LNKY*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgyMDYyNDc1MTc2*_ga_B8TDS1LEXQ*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgxNzY2OTMwMTU.">An attacker</a> stores malicious HTML or JavaScript through an MCP tool; when an agent or another user views it, the script runs inside the app's interface. The sandbox limits full takeover, but the client is layered above source code, terminals, filesystems, and every other connected MCP server.2. Handle hijacking: Instead of sessions, portable handles are used, but a handle is merely a string within the conversation, and anyone able to insert or read that string can exploit it. A prompt-injection payload in a Jira ticket or a tool response can hand an attacker a valid handle without ever touching the server. The new spec enables handle hijacking; prompt injection is the method. What you need is per-request handle validation, not hygiene at the conversation layer.3. The network's enforcement gaps remain invisible: State has moved out of the transport and into the application, so the security work that used to happen at the session layer now has to happen deliberately, on the endpoint. These threats begin on the other side of the boundary where network visibility terminates.<h2>What to do, in priority order</h2>The platform migration and the <a href="https://venturebeat.com/security/prompt-injection-is-exploiting-enterprise-ais-biggest-design-flaws-by-targeting-agents-rag-pipelines-and-model-routers?_gl=1*bdyowr*_up*MQ..*_ga*MTI1MDIxNTgzLjE3ODg2Mjc2Nzg.*_ga_SCH1J7LNKY*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgyMDYyNDc1MTc2*_ga_B8TDS1LEXQ*czE3ODg2Mjc2NzckbzEkZzAkdDE3ODg2Mjc2NzckajYwJGwwJGgxNzY2OTMwMTU.">security transition</a> are the same work, just from different angles. Below is my thought process. I have ordered everything by risk, not dates.We'll start with exposure of MCP Apps: Identify which MCP servers your teams use that can render HTML UI to a client or IDE. Set a policy regarding the review of HTML that is rendered, just like you would review a third-party script that gets sent to a production website. If you don't know which servers can render UI, you can't govern it.Move enforcement to the request level: If decisions based on session state were made by your MCP gateway, that is a broken design. It needs to be set up to inspect and enforce at every single call. Adopt the hardened authorization model: OAuth 2.1 with PKCE, per-client consent, strict redirect-URI matching, and audience-bound tokens (meaning a token issued for one server cannot be used on another). Put an identity-aware gateway in front of every server and reject any call without a valid, audience-bound token.Handles are considered untrusted input: Validate that the identity presenting a handle is the one it was issued to. Implement conversation-layer hygiene that removes or flags instruction-like content in tool outputs and retrieved documents, because that is where planted handles arrive.Instrument the endpoint: An identity-aware gateway enforces the request, but it lacks knowledge of the MCP Apps rendering, local server operations, or execution in the IDE. That needs a different tool. Build endpoint visibility for the host process, local MCP servers, and client rendering. If your stack is fully network-based, this is the gap the new spec opens.Unit tests will not identify what breaks here: A spec change looks fine in unit tests and will fail in a live agent loop. Run your migrated servers against real models driving real workflows. Look out for state that leaks across server instances, handles reused across scopes, and unexpected UI content.Plan for the deprecations: Roots, sampling, and logging are deprecated with this spec, and so is the legacy HTTP+SSE transport, which for most platform teams forces migration work. The 12-month clock started on July 28, and as a result the removal comes no earlier than mid-2027. Start planning that transition now. Deprecation windows always seem long, and then they feel quite short.<h2>The strategic point</h2>The MCP maintainers made a conscious decision: The protocol does not enforce security for you. That can be justified. For enterprise-scale agents, a stateless protocol on commodity infrastructure is the right choice. But "the protocol doesn't enforce security" means "you do," at the endpoint, on every request, every handle, every rendered UI.Companies that consider this a migration will deliver the new spec with the same security posture they had for the stateful protocol, and that posture is misaligned with the current threat surface. On the other hand, companies that treat this as a security transition, moving enforcement to the request level, putting controls at the endpoint, and governing MCP Apps before they proliferate, will be the ones whose agent deployments outlast contact with a genuine attacker.The spec has evolved. So the real question is: Will your security architecture keep pace?Nik Kale is a principal engineer specializing in enterprise AI platforms and security.

2026/9/7

Companies are spending millions rewiring how AI gets used. Almost none can prove it's working.

In December 2025, Uber gave its engineers Claude Code and set up internal leaderboards tracking token consumption and ranking teams by how much they used it. By April, <a href="https://fortune.com/2026/05/26/uber-coo-ai-spending-tokens-claude-code/">the entire AI coding budget for 2026 was gone</a>. That budget crisis made major headlines, but the real surprise came when Uber President and COO Andrew Macdonald said <a href="https://finance.yahoo.com/sectors/technology/articles/uber-coo-andrew-macdonald-says-130036457.html">there was no link yet between that overblown usage</a> and shipping actually better products for riders and drivers. The whole episode gave a name to a broader problem: “tokenmaxxing” or surging token consumption without the ROI to justify it.Gartner <a href="https://www.gartner.com/en/newsroom/press-releases/2026-07-01-gartner-says-us-dollars-234-billion-in-enterprise-application-software-spend-is-at-risk-from-agentic-artificial-intelligence">expects</a> spending on AI agent software to approach $207 billion this year, up more than 139% from $86.4 billion in 2025. But token pricing doesn’t behave like the software costs CFOs have spent decades learning to model. The same engineer, on the same tool, on the same day, can produce very different invoices depending on whether they spent the morning auto-completing suggestions or running parallel agents for a major database migration.Uber now <a href="https://techcrunch.com/2026/06/02/uber-caps-employee-ai-spending-after-blowing-through-budget-in-four-months/">caps</a> spending at $1,500 per employee per agentic coding tool each month. And it is not the only one having second thoughts. Microsoft <a href="https://www.theverge.com/tech/930447/microsoft-claude-code-discontinued-notepad">questioned</a> the cost of Claude Code licenses before canceling them across its Experiences and Devices division. Duolingo <a href="https://www.businessinsider.com/duolingo-ai-performance-reviews-ceo-backtracked-2026-4">reversed</a> a plan to factor AI use into performance reviews after employees pushed back on being told to use the tools for their own sake.Today, adoption and token consumption are only inputs in the broader question of enterprise AI value. A company can get almost every engineer using AI and still be unable to prove the spend produced more features shipped, more bugs fixed, or more customer problems solved. That gap is now a problem for enterprises. And the people trying to close it are not necessarily agreeing on what can solve it.<h2>People or plumbing problem?</h2>Noe Ramos, VP of AI operations at Agiloft, an enterprise contract lifecycle management platform, thinks the word tokenmaxxing points at the wrong culprit. "Teams aren't burning spend because they love waste. They're burning it because the default infrastructure pushes them toward it," Ramos told VentureBeat. "Most enterprises still hand model selection to whoever is prompting, which means a frontier model is handling tasks that a cheap open-weight model could do just as well. That's not a people problem. It's a plumbing problem."Dmytro Palaniichuk, head of engineering at language-learning company Promova, blames the defaults set by most AI tools."It turned out that on team and enterprise plans, the premium models are pre-selected; they run at high reasoning effort by default, and on our plan, Opus sessions upgrade to a 1M-token context window. Of course, nobody changes these in their own settings," he said. Within months, he was watching the premium model handle work as trivial as checking email. To solve these gaps, Palaniichuk said Promova is working toward a 40/50/10 split across Opus, Sonnet and Haiku. However, he calls this more of a direction rather than a destination, because the mix is not really the point."What's stopping us is mostly a behavioral problem. Even if you force the org default to Sonnet, but you don't create awareness of what to use when, people fall back to habit," Palaniichuk said. "The most important thing is that people use the models consciously by understanding which model to choose for which task and have a habit of checking it before starting a new conversation with an LLM."<h2>Optimizing usage isn't the same as using less AI</h2>While token costs are surging, optimizing AI usage doesn't necessarily mean using less AI."The first reaction should not be to 'use less AI'. High token usage can mean a lot of different things. If someone is using $16,000 in tokens to save us $100,000, of course we want to encourage that,” Rick Spencer, GM of technology and product at SUSE, told VentureBeat. “It starts with diagnoses, not enforcement."SUSE sorts AI usage into three buckets managers coach against: Daily Work, Autonomous Agents, and Curve Jumping for one-time strategic efforts. "For example, the best model for an autonomous agent isn't necessarily the latest frontier model," he noted. "The important shift is that we’re not trying to suppress usage; we're trying to make sure usage maps to impact." Notably, SUSE has no automated routing layer of any kind, with Spencer saying, "we don't have any sort of proxy in place, so decisions are left to the individual developers." A proxy is on the roadmap, he added.Everlaw, which provides AI for litigation and investigations, does run per-person token caps (much like Uber), but CTO Max Christoff calls them the opposite of rationing. Hitting the cap triggers a one-line email to the tools team, and the engineer has double their cap usually the same day. Everlaw was also the only company able to share hard numbers on AI’s return. One effort on core Java infrastructure consumed $3,500 in tokens and cut implementation from 9.5 engineer-months to 2.5. "These are real numbers; the ROI of $3500 to save seven months of engineering time is simply a no-brainer," Christoff said. A larger unlaunched product has run $27,000 in tokens and will likely reach $40,000, against engineering time that dropped from an estimated 90 to 100 engineer-months to 19.Not everything works all the time. Everlaw spent thousands having agents port interface code from Dojo to React and threw the output away, because the frameworks rest on different assumptions about how state and view relate. The team now asks the agent to document the old system's behavior first, then build from that documentation.Agiloft, for its part, scrapped its caps entirely: "74% of people were never hitting the old caps anyway. Caps were a false ceiling that created friction for heavy users without addressing the actual cost drivers," Ramos said.The company instead made cheaper models the default, with escalation to frontier models only when a task needs it, routing at the infrastructure layer rather than the prompt layer, and caching. "The quickest lift for most enterprise teams is a company-wide LLM gateway that handles cheaper defaults and smart routing," Ramos said. "Don't ration the tool. Fix the architecture underneath it. Scarcity governance is a patch. Intelligent routing is the fix."<h2>Inside the routers</h2>Interestingly, many vendors today, including <a href="https://gateway.merge.dev/login">Merge</a>, <a href="https://www.databricks.com/product/artificial-intelligence/unity-gateway">Databricks</a>, <a href="https://aws.amazon.com/bedrock/pricing/">AWS Bedrock</a>, and <a href="https://learn.microsoft.com/en-us/azure/foundry/openai/concepts/model-router">Azure AI Foundry</a>, are solving this gap with auto-routers that map the complexity of a task to route it to the model best suited for it while also being affordable at the same time.Databricks introduced Smart Routing inside Unity AI Gateway at its Data + AI Summit in June, alongside hard spend caps and cost attribution across hosted models, coding agents, and custom agents. It is in beta, with recommendation-only and auto-routing modes.David Nasi, director of product management at Databricks, said the router sizes up each request using deterministic signals and model-based classification, looking at factors such as prompt intent and length, referenced files, stack traces, the scope of the change, reasoning depth, and execution complexity.The router is not only picking a model, either. "We've found that the same model performs differently when leveraged with a different harness, so we've built Smart Routing to include that flexibility," Nasi told VentureBeat."The decision is fully transparent at runtime; we explicitly avoid making the router a black box," he said. When routing hits a budget ceiling, admins pick between a hard limit that blocks further requests and a fallback that tries a cheaper compliant model first.Agentic workloads are even harder as a single task can fan out into dozens of model calls, and no human approves each one. There, Databricks’ router evaluates at execution boundaries rather than per call. <h2>The ROI problem</h2>That said, whether in conscious individual-based routing or auto-routing, almost nobody can put a number on the savings.Palaniichuk, who is targeting a 40/50/10 split across models with people consciously choosing what they need for the task, did not give a before-and-after figure for Promova, since the change shipped alongside other work. However, his telemetry did show that Opus on the 1M-token window made about a third of monthly spend.SUSE, which is sorting AI usage across buckets with a proxy on the way, has no metrics either, only anecdotes. One project went from hundreds of CVEs in its dependencies to zero, and its agents have categorized close to 10,000 CVEs in the VEX database since May.Databricks, meanwhile, offered a glimpse of where teams are headed. "Early usage patterns show a clear shift: teams that previously ran all traffic through frontier models are starting to shift routine tasks (such as boilerplate generation, simple bug fixes, or minor edits) to lower-cost models without measurable drops in resolution rates," Nasi said.To ensure teams get clarity into this cost optimization and catch quality drift after a routing change, Databricks ships Unity AI Gateway with unified tracing and LLM-as-a-judge evaluation frameworks, alongside evaluation datasets, trace analytics, and automated feedback loops. However, validating accuracy for a specific business domain rests with the customer, which Palaniichuk described as a challenge, noting that "you're imposing deterministic checks on non-deterministic output, and models ship on roughly a quarterly cadence — an eval tuned to one model doesn't cleanly transfer to the next." Christoff says Everlaw tries to solve this by giving engineers a wide model menu and a dollar budget and letting them choose (provided they clear security review). The thinking is that the person reviewing the code builds the fastest instinct for which model produces work worth keeping.Models can pass every test and still leave code nobody can maintain. "The coding agent will propose twenty surface-level fixes instead of addressing an underlying pattern," Christoff said.<h2>What comes next</h2>Both Palaniichuk and Christoff indicated that the specific tactics they’re using right now to optimize AI usage will expire, but the underlying discipline will survive."I don't think this specific target will matter much, but the discipline will," Palaniichuk said of Promova's model mix. "Cheaper models don't remove the need to match the tool to the job — if anything, more options make that judgment even more important."Christoff thinks teams will better embrace token consumption in their planning efforts."My prediction is that over the next one to two years, we'll start to see token expense treated more like annual headcount or production costs, and less like an IT or general software expense," he said, adding that department heads will soon walk into annual planning with a position on headcount and on tokens, alongside a business case for both. Essentially, one team might plan millions in tokens and almost no new hires. Another might invert it entirely.While the executives disagreed on where to start, their insights, when seen together, do show what a practitioner would need to do as token costs and usage surge.Ramos would rebuild a strong routing layer, Spencer would start with coaching and training the managers, and Christoff would start further back, understanding what the company is optimizing for before anyone touches anything. Palaniichuk would watch what his own team is doing with the tools and where exactly optimization is needed."Give your team a tool and a visible budget to experiment with — different models, different providers — and capture their real usage over a short window with telemetry and a feedback loop," he said. "Don't theorize about the right mix; let the data from your own team surface it. The surprise is often who lands the best discipline: surprisingly, it's not always the most technical people."

2026/9/7

VentureBeat

Most pipeline monitoring checks if the job ran. This one didn't check if the numbers were right.

OpenAI solves longstanding math problem with 10,000-agent swarm — but can't rule out benefitting from a researcher's private Codex data

Agents identifying as OpenAI systems wrote 17,000 posts to a wiki no one was supposed to write to

Most security teams don't know how many AI agents they're running. Falcon Guardian found 18,000 at one company that had approved only 300.

How European enterprises can meet sovereignty demands without giving up global reach

MCP's new spec turns a planted prompt into a stolen credential

Companies are spending millions rewiring how AI gets used. Almost none can prove it's working.

推荐订阅

Stratechery by Ben Thompson

Lessons Learned

Small Business Trends

Inc.com

Quick Sprout