Microsoft and Google are joining a project to create an open specification for exchanging semantic models across data, analytics, and AI platforms. The project already has the backing of over 60 companies including Databricks, Informatica, Mistral AI, Nvidia, Oracle, Salesforce, and Snowflake.

Their support for Ossie makes it a little more likely that future analytics platforms will be interoperable, but is no guarantee that vendor lock-in will go away, analysts said.

The project began life as Open Semantic Interchange (OSI), then became Apache Ossie when it was accepted into the Apache Incubator in June. It uses JSON and YAML to represent semantic models, including datasets, fields, relationships, metrics and AI context, making them interoperable across platforms such as Snowflake, Databricks, Tableau, ThoughtSpot and Sigma.

Ossie uses a hub-and-spoke model for interoperability, serving as the common semantic format while converters translate between it and individual vendors’ semantic implementations. This means an enterprise could move a semantic model between compatible platforms without requiring a separate point-to-point converter for every pair of vendors.

Microsoft’s support for Ossie includes developing a two-way converter between Power BI semantic models and Ossie, allowing semantic context defined in Power BI to be represented in the common format and Ossie models to be converted back into Power BI, the company wrote in a blog post.

It is also pushing for the Ossie specification to include more support for its ontologies, and for Ossie’s recognized query languages to include DAX, the expression language used by Power BI for defining calculations and business metrics.

That means enterprises could carry the calculation logic that gives their semantic models business meaning alongside the underlying model when moving between platforms that support Ossie, it wrote.

Google, meanwhile, is in the process of joining Apache Ossie, a company representative said via email response. The company has not yet provided details on what it plans to contribute or has already contributed.

The Ossie specification lists BigQuery/GoogleSQL as a supported dialect, a result of “early community contributions that recognize BigQuery’s footprint across enterprise data stacks,”the representative said.

Microsoft, Google backing could reduce engineering work

Support for the project from the two technology giants could reduce the burden of repeated semantic engineering for enterprise teams moving analytics workloads between platforms, said Aditya Ranjan, senior data engineer at supermarket giant H-E-B.

That reduced engineering overhead could also help avoid metric drift, which is often the consequence of recreating and maintaining the same business definitions across platforms, according to Ashish Chaturvedi, executive research leader at HFS Research. With Ossie, developers can instead define a metric once and treat it as a versioned, reviewable code artifact, rather than rebuilding and maintaining it separately for each platform, he said.

Another potential benefit, said Ranjan, is that productivity could improve if developers spend less time translating and validating semantic definitions for each platform when onboarding new analytics tools or deploying new analytics or AI applications.

It can also make it easier for developers to build agentic applications with consistent business context, since maintaining one definition of a metric across platforms could reduce the risk of different agents interpreting the same metric differently, said Stephanie Walter, practice leader of AI stack at HyperFrame Research. That could give CIOs greater confidence to scale agentic deployments, she added.

Portability

For Michael Leone, principal analyst at Moor Strategy and Insights, the bigger advantage of Microsoft and Google supporting Ossie is that it gives enterprises more ownership of their semantic models by making them more portable.

That portability gives buyers more leverage, said Walter, since changing a BI or data platform would no longer require rebuilding the semantic layer from scratch.

However, portability does not necessarily mean complete interoperability, as the degree to which enterprises can move semantic models between platforms will depend on how much vendor-specific logic and functionality Ossie can represent and how accurately the destination platform can interpret it, Walter said.

“A portable structure does not guarantee equivalent behavior. A metric may survive conversion syntactically but still produce a different result because the destination interprets joins, nulls, time calculations, or filters differently.”

That challenge is particularly relevant for Power BI, as its time-intelligence functions, calculation groups, and context transitions in DAX do not always map cleanly to ANSI SQL, meaning a sophisticated Power BI model could lose some of its behavior in translation, Chaturvedi said.

CIOs, therefore, will still need to validate whether converted models preserve the intended calculations, business logic and results before putting them into production, especially for complex ones, Ranjan advised.

There are gaps around governance as well, Chaturvedi said: “The core specification covers datasets, relationships, fields, and metrics, but doesn’t mention row-level security, access policies, or certification status as first-class elements.”

That means enterprises have to set them up again on each platform.

Moreover, Ossie’s stability and long-term adoption remain open questions. The project is still “incubating”, meaning that it isn’t a full Apache Software Foundation project and has yet to prove it meets community norms. The current specification version, 0.2,is explicitly labeled a development draft, meaning the schema and capabilities could still change as it evolves, giving CIOs less certainty about its suitability as a long-term interoperability layer, Walter said.

“The current draft also removes the earlier document structure and does not yet define bundles or cross-model references, which are capabilities that large enterprises with interconnected models are likely to need,” said Chaturvedi.

Ossie could shift rather than eliminate vendor lock-in

Even if Ossie becomes widely adopted, it is unlikely to eliminate vendor lock-in entirely.

“New forms of lock-in are likely to emerge. Execution engines will retain proprietary behavior that no interchange format captures and vendor extensions will carry increasingly valuable features,” Chaturvedi said.

For enterprises, that means the definitions become portable while the behavior around them stays platform-specific, he added.

This article first appeared on CIO.

Google has unveiled a new frontier AI model after months of delay. Gemini 4 Argon is designed to handle complex, long-horizon workloads spanning software engineering, enterprise knowledge work such as legal and financial analysis, and cybersecurity. But only a few organizations can get their hands on it for now.

Argon is “rolling out to a set of trusted cyber defenders through our Fairwind Program,” Google wrote in a blog post announcing the release. That limitation, it said, is in order to comply with the US government’s voluntary process for granting early access to models in order to test and improve their safety guardrails before making them generally available.

Google DeepMind head Koray Kavukcuoglu recently said that Gemini 4 should be released “much earlier” than the end of this year.

The limited launch comes after Google delayed and ultimately skipped the release of Gemini 3.5 Pro, which the company had initially promised would arrive in June.

“Google took about seven months without releasing a major top-tier model. It is three to four months behind its own Gemini roadmap as Gemini 3.5 Pro, the model Google planned for June, never shipped. The delay was linked to model-development challenges, particularly around coding and reasoning,” said Pareekh Jain, CEO of EIIRTrend and Pareekh Consulting.

With Argon, Google has increased the model’s token capacity, while introductory pricing is set at $2 per million input tokens and $10 per million output tokens.

More tokens, no clear lead

The headline change in Argon is the model’s output limit, which has been increased from 64,000 tokens in previous Gemini models to 1 million, allowing room for more reasoning and for completing long, multi-step tasks within a single trajectory.

Google said Argon is designed to handle enterprise workflows spanning coding, reasoning and multimodal tasks. The company is backing those claims with examples from its internal use. It has used Argon to identify memory optimizations across its data centers that could free up more than 300 TB of memory once deployed, with estimated total savings of 500 TB to 1 PB.

On benchmarks, Argon scores 68.9% on the Vals Index, ahead of Claude Opus 5.5 at 67.0%, and 77.9% on DeepSWE v1.1, compared with 74.2% for Opus 5.5. But these results do not translate into a lead across every type of workload. In PostTrainBench for ML engineering, Claude Opus 5.5 leads at 49.3% compared to 45.3% for Argon.

The company is also aiming to close the gap with Anthropic and OpenAI in cyberdefence by enabling Argon to autonomously find, validate, and patch critical software vulnerabilities. On CWE-bench v1, a benchmark for vulnerability remediation, Google reports a 68% score, tied for the top position with Grok 4.7, GPT-6 Astra and Claude Opus 5.5.

While Google has published a broad set of benchmark results to support its claims, Jain cautioned that the scores should be treated as hints, not proof. “Argon looks to be good and beating rivals at using automated tools to complete multi-step tasks without getting confused, and it sticks closely to real facts. Its everyday coding abilities are basically average and tied with others. It still trails others when it comes to creative writing, nuanced explanations, and running command-line computer terminals,” he said.

Jain noted Argon shows that Google has regained much of the capability gap, but it has lost some momentum and developer mindshare. It is now competitive at the frontier, but not clearly ahead across all areas.

Price, performance and switching

Argon’s capabilities come with an introductory price of $2 per million input tokens and $10 per million output tokens, with cached input tokens priced 95% lower. Those rates will rise to $4 per million input tokens and $20 per million output tokens after the introductory period, although Google has not specified when the new rates will take effect.

In comparison, Anthropic’s Claude Opus 5.5 is priced at $4 per million input tokens and $20 per million output tokens, while OpenAI’s GPT-6 Astra costs $10 per million input tokens and $50 per million output tokens.

“This makes the introductory pricing very competitive. The eventual pricing is roughly comparable to other premium frontier models. Enterprises should therefore build business cases using the $4/$20 pricing, rather than assuming the introductory price will continue,” said Jain.

While Argon is worth evaluating for enterprises already using competing models, it is not necessarily enough to justify switching outright. CIOs would also need to weigh the cost of migrating existing applications and developer workflows and integrations.

Jain noted CIOs should evaluate models on their own workloads, focusing on task success rate, accuracy and hallucinations, agent reliability, cost per successful task, latency, security and governance, data privacy, integration with existing systems, and vendor lock-in. The key metric is not cost per token, but the cost per successful business outcome.

Argon gives CIOs a strong reason to evaluate it but not switch to it automatically.

The smart move, he said, is for enterprises to add Argon for the jobs it does best, like legal, finance, and long documents, and keep their current AI for things like coding. If a company already runs all its tech on Google Cloud, switching can be considered if Argon clearly wins in the tests and the costs still make sense at the full price, said Jain.

After many years of watching how Microsoft develops platforms and rolls out technologies to external users, one thing is clear: anything that is important to Microsoft internally quickly becomes important to anyone building on top of Windows or Azure.

The transition from internal to external tooling invariably takes the form of new features in Visual Studio and Visual Studio Code. Often these capabilities have been in use inside Microsoft for years, and they’re ready for you to use immediately in your own software. We’ve seen it happen many times before, such as with the development of C# and TypeScript.

Microsoft’s Tier-1 programming languages

C# and TypeScript, like C++ before them, are what Microsoft internally calls its Tier-1 languages. This status rests on being backed by a complete tool chain, from editors to compilers; integration with Windows and Azure through native SDKs and optimized libraries; and compliance with Microsoft’s internal software development life-cycle requirements. When you’re shipping software for a billion users, these trappings aren’t optional extras, they’re essential.

Now there’s a new member of the Tier-1 club: the Rust language. That shouldn’t be a surprise, as Azure CTO Mark Russinovich has talked about his organization’s commitment to Rust and how Rust’s memory safety features are a key component in Microsoft’s security strategy. In addition, Microsoft was a founding member of the Rust Foundation, and has made significant investments in Rust’s Windows tooling and in Rust compilers that work as part of Microsoft’s build platform. Now Rust enjoys first-class development tooling and workflows inside Microsoft.

A recent post on the Rust Foundation website details how Microsoft is working to integrate Rust with the existing Microsoft Visual C++ (MSVC) platform. This approach will allow Microsoft to ensure what the blog post calls “seamless interoperability” between the languages, with Rust inheriting Visual C++ features as they’re delivered. Using Visual C++ with Rust will allow Rust to be used to build low-level Windows services, from drivers to the kernel itself.

We’ve already seen that in the Windows release of Coreutils, which are a Rust re-implementation of core UNIX commands. Coreutils allow you to use certain UNIX commands inside the Windows terminal, making it easy to switch between Windows and WSL (Windows Subsystem for Linux)-hosted Linux distributions. Now that Rust has crossed the Tier-1 threshold, we can expect to see more Rust-based Windows developer tooling, where we get access to low-level functionality while avoiding memory leaks.

The secret sauce: a new Rust code generator

One key to delivering production-grade Windows software with Rust is a new code generation tool for Rust’s compiler, rustc. rustc is designed to use different code-generation back ends, beyond the default LLVM. There are already variants that work with GCC and with Cranelift. If you’ve not come across Cranelift, it’s the code generator of the Bytecode Alliance, used as part of the wasmtime framework. Adding a new code generator is a matter of building a tool that connects to the Rust compiler’s APIs, takes its bytecode output, generates native code, and passes it on to your choice of build pipeline.

This is the role of Microsoft’s rustc_codegen_utc tooling. It’s designed to work with the existing MSVC stack, giving Rust access to a mature, well-tested, proven part of the Windows development platform without needing any changes to your code (compatibility is baked in). This links it directly to the back end of the Visual C++ compiler, a set of tools marshaled by Microsoft’s build system to work with complex projects that mix code and libraries.

Microsoft calls this back end the UTC, for Universal Tuple Compiler. You won’t see that name anywhere, though; the actual code is a DLL, C2.DLL. Code is generated and delivered as .OBJ files where it can then be passed to the MSVC linker and delivered as a binary executable. This allows Rust tooling to take advantage of the decades of work Microsoft has put into both its compilers and build tooling. There’s no need for Microsoft to duplicate that work, ensuring that existing security and resilience features carry forward to the Rust compiler chain. And the resulting code is compatible with C and C++ code that has been passed through the same back end.

Managing only a single compiler back end will also make it cheaper to support Rust, with no need to run two separate compiler teams that are likely to be out-of-sync with each other and with Windows SDK and kernel development. Reducing the economic impact of Rust will speed up any transition, as well as supporting what is likely to be a long-term hybrid delivery of combined Rust and C++ applications.

This approach also puts Microsoft’s Rust development on a par with platforms that use GCC and LLVM compilers, which can already use the GCC and Clang back ends with Rust, leveraging the investments into Linux and macOS application development. Code developed in Rust will get the same interoperability capabilities no matter which platform you end up targeting.

Microsoft Rust tools for the rest of us

Unfortunately for the rest of us, rustc_codegen_utc is currently only available internally, unlike the other Rust compiler codegen tools, which are all open-source projects. Microsoft describes it as “production ready”, and it’s used by more than a hundred Microsoft Rust projects—an interesting pointer to the scale of Rust adoption by Redmond. It’s not the only Rust tool currently hidden away, as Microsoft’s complete Rust tool chain also includes its own builds of the core rustc compiler, standard libraries.

That doesn’t mean that rustc_codegen_utc is not going to arrive for the rest of us. Past experience suggests that it and undoubtedly other Rust tools will come with a major update to Visual Studio or Visual Studio Code. However, the timing is always hard to predict. Even when tooling that works inside Microsoft is highly suitable for external developers, there needs to be more for it to reach the rest of the world, with language servers and IntelliSense support, as well as full integration with the Visual Studio debugger platform. There’s also more to building code outside Microsoft’s offices, where we don’t have access to their custom build tools.

In discussions on the Rust compiler forums, Microsoft has indicated that it will first upstream its test and back-end infrastructure work into the wider Rust project. That implies that it may be some time before there is a public release, but also that open sourcing the project is clearly on Microsoft’s radar. Getting rustc_codegen_utc out in public is important—adoption of Rust to build third-party device drivers should help make PCs, servers, and cloud VMs more stable and reduce security risks.

Get started with Rust in VS Code

For now, Microsoft offers Rust tooling that integrates with Visual Studio Code and guidance for developing on Windows with Rust. To use Microsoft’s Rust language extension for VS Code, rust-analyzer, you’ll still need the MSVC C++ Build Tools to compile and build your code, along with a Microsoft-developed Windows crate that gives you direct access to Windows APIs. An automated process collects metadata from Windows APIs, ensuring that they are always up-to-date. Microsoft also provides documentation on how Windows API calls and structures are projected into Rust.

It’s worth getting started now with the existing Rust tools to become familiar with Windows development in a new language. That way you can start to take advantage of Rust’s memory safety features, understanding how the language works and what changes you need to make to your programming style. Then when Microsoft starts shipping its new internal tooling for the rest of us, you can start using it to build low-level code, like drivers or libraries, that need to interoperate with Microsoft’s own C++.

In most companies, the struggle to answer a new question fast has nothing to do with a lack of data. The problem is a lack of semantics. Or to put it another way, a lack of agreement about what the data means.

Suppose a CFO wants to generate a new report on revenue by customer segment. It sounds simple, but in practice, for the employees tasked with executing the CFO’s directive, it means a multi-day argument about what a “customer segment” even is. Before they can make the report, they need to define the terms of the report.

The dream of enterprise semantics, as I define it, is that someone who understands the business should be able to talk to an intelligent data agent and get the answer they need without knowing how the data is structured or stored. No more tickets. No more definitional arguments.

For decades, we’ve tried to do better. We even created solutions for enterprise semantics, but the work required was too much. AI changes the equation. As the data agents at OpenAI and Anthropic have shown, the dream of enterprise semantics has come to life.

We’ve tried this before

The dream of machine-readable business meaning is not new. After inventing the World Wide Web in 1989, Tim Berners-Lee proposed an idea in 1999 called the Semantic Web. He argued that if everyone tagged their web pages according to machine-readable standards, internet search would become far more powerful. Standards such as RDF, OWL, and SKOS emerged to let people tag content according to ontologies that captured meaning and enabled reasoning.

But the effort never took off. Building an ontology that actually worked for a business required rare hybrid expertise, months of workshops, and constant upkeep as the business changed. Most projects produced a carefully built ontology for one narrow domain, then collapsed once the team moved on or the business outgrew the map.

The standards themselves survived: RDF, OWL, and many standard vocabularies form the foundation of serious data management today. The vision was right; the economics made execution impossible at scale.

The labor required to build and maintain an ontology never paid for itself. Several startups built solutions using semantic approaches and solved real problems in narrow niches, but the category never found broad traction.

Another approach was to define concepts in a data catalog. This form of BI semantics created precise definitions of key metrics such as revenue, income, and customers. People building solutions could then use the standard glossary definitions to keep dashboards and reports consistent and accurate.

The problem is that these definitions make sense to people, not machines. A human reading a text definition of “customer” can fill in the rest from experience: which systems customers live in, how they relate to orders, regions, and revenue. An AI can’t fill in what it was never given. It needs entities, properties, and relationships: a customer is a person, belongs to a domain, and places orders. Give an agent that graph and it can build its own model of the business and infer new information from it. Ask how many customers you serve in Europe, and it can reason its way to an answer. Give it a definition with no structure behind it, and it will guess confidently instead.

BI semantics help within a narrow scope, but they’re rarely built on the open standards that would let AI systems reason over them.

The dream of enterprise semantics in 2026

The power of frontier large language models (LLMs) tempts people into thinking that simply loading enterprise data into these models gets you close to the dream of enterprise semantics. It doesn’t. LLMs still need to be told what the structured data means, how business concepts are defined, and which data is authoritative. They need what people now call context.

Context has become a buzzword used loosely, but three specific types of context, taken together, form a layer that lets AI deliver on the dream of enterprise semantics:

• Data context: A single, unified metadata graph that connects structural schemas, data quality signals, end-to-end lineage, and usage profiling. Data context lets the AI know exactly what data exists.
• Semantic context: Moving beyond flat tables to formal ontologies and business relationships. Semantic context teaches the AI the meaning of data and explicit business rules, for instance how “customer” relates to “net revenue”, so it can reason accurately without hallucinating.
• Memory context: A persistent, shared record across the organization of human corrections, feedback, and tribal knowledge. Memory context allows agents to inherit the corrections experts have already made, instead of starting from scratch in every chat.

These three layers let AI actually guide a business user to the answers and data they need. Without an open context layer, frontier models struggle. With an open context layer, our internal tests show that AI produces answers that are seven times more accurate while reducing query workloads by 86%.

Gartner predicts that organizations that prioritize semantics in their AI-ready data could see 60% lower AI costs by 2027.

How AI changes the economics of enterprise semantics

Applying AI to data management changes the economics of building the open context layer in several ways.

Building a fully populated, unified repository of context that maps all of an enterprise’s data used to be a huge amount of work. Trust me—I struggled for years to make this happen at Uber when I was chief data officer. Now, working through connectors to virtually every data source, AI agents automate the creation of technical metadata describing data structure, along with metadata for security, governance, quality, and lineage.

Building an ontology used to require a human expert starting from scratch. Now AI can propose the ontology, using public standards where they fit, while humans review, refine, and approve what it creates. A domain expert who couldn’t build a thousand-concept ontology alone can validate what AI drafts. That’s a real shift in what’s achievable.

Previous semantic projects decayed because businesses changed faster than humans could update ontologies by hand. Now AI can monitor the data environment continuously, catch drift, and propose updates for a human to review, so the context layer stays current without heroic effort.

What finally becomes possible

Now return to our CFO example. With the context layers in place, asking a new question leads to a different outcome. The AI agent finds the relevant tables, consults the ontology to give “customer segment” its precise organizational definition, and retrieves a note from memory that explains how post-acquisition figures require a specific adjustment the finance team already validated. Then it delivers the answer with a clear explanation of how it was calculated.

That’s what data democratization actually means once context is in place. It means giving people access to answers, not just the data warehouse. A marketing analyst or a product manager doesn’t need to understand the technical stack. The context layer absorbs that complexity so they don’t have to.

The Semantic Web had the right vision and the wrong tools. Thirty years later, the tools have caught up: AI can build ontologies faster than humans could manage alone, keep the context layer current as the business changes, and let agents build on frameworks that other agents helped construct. The bottleneck that kept this dream out of reach for three decades is gone, and organizational knowledge can now build on itself instead of decaying between projects.

The CFO’s question has always deserved a correct answer. The infrastructure to deliver one is finally within reach.

—

New Tech Forum provides a venue for technology leaders—including vendors and other outside contributors—to explore and discuss emerging enterprise technology in unprecedented depth and breadth. The selection is subjective, based on our pick of the technologies we believe to be important and of greatest interest to InfoWorld readers. InfoWorld does not accept marketing collateral for publication and reserves the right to edit all contributed content. Send all inquiries to doug_dineley@foundryco.com.

OpenAI says true agentic AI has finally arrived, pushing beyond the trivial capabilities of early-stage virtual assistants.

This week at OpenAI Dev Day, the company introduced Dots, which CEO Sam Altman described as “remarkably capable, always-on” agents powered by GPT‑6 Astra. Dots have their own cloud computer, can be accessed in ChatGPT, Slack, or Teams, and plug into more than 4,000 apps based on human-set boundaries.

In a keynote, Altman said using it will feel like “a whole new way to work with AI.”

“It can hugely magnify your ability and expand your potential, working 24/7 to take on things that you don’t want to do, so you can focus on higher-level work,” he said.

OpenAI also announced a slew of other new capabilities and tools, including GPT-6.1 Sol, a cheaper and faster sibling of GPT-6.1 Astra, which was shelved earlier this week due to safety concerns. Additionally, Codex is also now in the cloud, Codex CLI has voice control and can help developers inspect, edit, and run code locally, and a new Agents API supports computer use and provides components like harnesses, hosting, memory, and multi-agent controls.

Dots goes beyond ‘trivial’ tasks

Early virtual assistants have been useful for quick handoff tasks like booking reservations, but that is “trivial relative to what the technology can do,” Altman contended in his keynote.

Taking that to the next level, OpenAI’s new Dots can understand what’s happening in a user’s workflows and learns over time without requiring constant human instruction, he explained. Soon, users will be able to access Dots outside ChatGPT by interacting with it through text messages or even by calling the agents on the phone to discuss updates, changes, and weigh in on decision-making.

“You can delegate ambitious pieces of work the way you would to a high agency engineer or a chief of staff,” Altman said. Dots can monitor incoming bug reports and propose fixes, draft pull requests (PRs), or take on tasks like kicking off the next year’s budget planning cycle.

Altman provided the example of migrating an app off a legacy API. This can be difficult, because the API might be used all over a code base, he said, and it could break as developers start making changes. But Dots can trace dependencies and determine what needs to change, run tests, and suggest next steps.

“Think about how you would have done that the old way,” Altman noted. “How many people would have been involved? How much time would it have taken them? What could they have done instead?”

Dots is now available to all ChatGPT Pro, Business Premium, and Enterprise users. OpenAI is also now previewing specialist Dots for enterprises, and is working with Microsoft to integrate Dots into Agent 365. These will serve as virtual teammates to help scale more intensive work in accounting, marketing, or legal, Altman explained.

Carmi Levy, an independent technology analyst, said of everything announced at DevDay 2026, Dots might be the most impactful, as it represents OpenAI’s definitive move into AI agents.

While Meta has been grabbing headlines with its app store-topping Muse, OpenAI’s offering is potentially more relevant to enterprise decision makers who are still trying to figure out how agents can fit into their corporate AI development and deployment roadmap, he noted.

“It allows enterprise customers to build on their pre-existing investments in OpenAI’s stack, and represents a familiar adoption path for developers,” he said.

Cheaper and faster sibling of Astra

OpenAI launched GPT-6 Astra to a limited group of users earlier this month, calling it state-of-the-art in computer use, browsing, software engineering, cybersecurity, science, and professional work. But its generally availability was canceled this week after the model failed critical internal safety and alignment tests.

OpenAI learned from the experiment, Altman said, with early testers demanding: “make it cheaper and make it faster.” The answer to that is GPT 6.1 Sol, which provides near Astra level intelligence at one-fifth of the price. Cached inputs cost $0.10 (US) per million tokens, 95% less than standard input pricing. This makes it cheaper for agents to work through longer tasks, reuse context, and ruminate on solutions. Example uses include multi-step business workflows, code writing and debugging, and document analysis.

GPT 6.1 Sol is “smarter than Astra in some ways, and it will become your daily workhorse,” Altman said. It is now available to all Plus, Pro, Business, Enterprise, and Edu users of ChatGPT Work and Codex, and will soon be offered in an ‘Ultrafast’ plan, with up to 8X faster token generation.

Levy noted that GPT 6.1 Sol reduces the cost curve for enterprises looking to deploy AI agents at scale, all while “avoiding some of the privacy/safety/integrity baggage of the now-stillborn GPT 6.1 Astra.” It effectively shifts the economics of AI agents by dropping the price of resource-intensive development activities like querying repositories, running tests, and iterating code.

“It doesn’t have quite the power of Astra, but that was never what the average developer was looking for, anyway,” Levy noted. “Affordability still drives development decisions, and by leading with Sol, OpenAI removes one more barrier to broad-based adoption.”

New Codex capabilities, assurances around safety

In a much-anticipated move, OpenAI has introduced Codex Cloud, giving developers the ability to move coding tasks between devices without losing threads. “You don’t have to worry about closing your laptop in the middle of a run,” Altman said. “Your agents just keep working, wherever you are.”

Meanwhile, new Codex CLI capabilities allow developers to start, steer, delegate, and track tasks with voice commands, and a new Codex Security Cloud helps defenders identify vulnerabilities and prepare fixes.

Altman addressed the top-of-mind security and governance issue in his keynote. “The best version of AI is not about making people cogs in a giant machine,” he said, noting that there are some things that should not be automated.

“People often talk about AI as a new industrial revolution. I find that quite off-putting,” Altman said. “The future, if we get this right, can be much more like a new renaissance than a new industrial revolution.”

As enterprises increasingly turn to coding agents for building applications, Stack Overflow has added new capabilities to Stack Internal, its enterprise-focused platform for centralizing proprietary technical knowledge, to help development teams turn organizational knowledge into trusted, actionable context that these agents can understand and use.

Stack Internal now evaluates knowledge based on factors such as provenance, recency, expertise, corroboration and human validation, and then assigns each piece of knowledge a trust score that AI agents can use to decide whether to rely on it or seek additional validation or human input.

In cases where human input is required, Stack Internal automatically identifies the appropriate subject matter expert, and a validation workflow built into the agent can alert the expert through platforms like Slack, allowing them to confirm or update the relevant knowledge directly, the company said.

The new capabilities also support flagging of conflicting information during an agent’s response time, allowing teams to not only identify discrepancies but also rectify them, it added.

The combination of these capabilities is what Stack Overflow says makes the organizational context more trusted and reliable for AI agents to act on, compared to the previous method of simply retrieving information from knowledge sources in Stack Internal.

Further, the company said it was expanding ways for organizations to bring knowledge into the platform with the help of a new ingestion API and additional connectors that will allow enterprises to pull information from tools and sources including Microsoft Teams, Slack, Google Docs and other third-party tools.

As part of the update, Stack Overflow is also releasing an MCP server for Stack Internal that will allow enterprises to make their organizational knowledge available to AI coding tools, terminals, and IDEs, including Claude Code, Codex, GitHub Copilot and Gemini CLI, it added.

In addition to the MCP server, the update adds enterprise governance controls, including custom roles and permissions, activity tracking, and exportable audit trails that show the sources behind agent decisions, the company further said.

Trust signals could improve developer productivity

For enterprise development teams, Stack Internal’s new capabilities, particularly trust scores, could improve productivity, potentially shortening development cycles, analysts and experts pointed out.

“Typically, coding agents treat all internal knowledge as equally credible, forcing them to reason through conflicting guidance and leaving developers to verify assumptions and potentially rewrite code for an application or service, consuming additional time and tokens,” said Ashish Chaturvedi, executive research leader at HFS Research.

“In contrast, Stack Internal’s trust scoring gives agents a machine-readable way to identify trusted guidance and avoid reasoning through conflicting information. For developers, that could mean less supervision, fewer rework cycles and lower token consumption.”

Other capabilities, such as the expert validation workflow, conflict flagging, and the MCP server, also add to developers’ productivity.

Aditya Ranjan, senior data engineer at supermarket giant H-E-B, pointed out that, while the expert validation workflow can help improve accuracy and reduce development delays as developers get answers from the right subject matter expert without having to search for them manually or rely on whoever happens to be available, conflict flagging can help identify conflicting guidance before it affects their code.

And, noted Advait Patel, senior site reliability engineer (SRE) at Broadcom, the MCP server reduces friction for developers by eliminating the need to switch between their coding environment and separate knowledge sources to find the organizational context they need.

Governance features could help CIOs scale agentic deployments

Chaturvedi added that those developer benefits, particularly the improved accuracy of agents, combined with Stack Internal’s new governance features, could help CIOs move prototypes into production faster and expand the use of agents across development workflows.

“While more accurate agents mean fewer reworks and faster development cycles, the governance features ensure that CIOs know what information an agent relied on, whether that information was current and authoritative, what data the agent had access to and who can be held accountable when its guidance is wrong,” he observed.

That visibility, in turn, can give CIOs greater confidence in expanding the scope of agent deployments.

Trust signals bring new risks

Those benefits, however, come with potential risks that CIOs need to consider.

“The score provided by trust signals needs deep review. Any score that compresses provenance, recency, and validation into a single number embeds judgments about how those factors should be weighed, and a highly scored answer can still be wrong,” Chaturvedi said.

“CIOs should understand how the score is calculated, test whether it aligns with their own risk tolerances, and resist letting it become a substitute for oversight on high-consequence actions,” he added.

Ranjan agreed, noting that this is even more important because Stack Overflow doesn’t reveal how the scores are calculated.

For Stephanie Walter, practice lead of AI stack at HyperFrame Research, the bigger challenge for CIOs will be determining what information should become part of the organizational knowledge base in the first place, particularly as agents may act on that information.

“Slack threads and AI conversations contain useful context, but they also contain speculation, mistakes, sensitive information, and conversations employees never intended to preserve,” she said. “Determining what deserves to be captured, who should validate it, how broadly it should be shared, and when it has become outdated could create substantial work for knowledge managers and subject matter experts.”

That burden on subject matter experts could soon become a bottleneck, Chaturvedi noted.

“Expert validation depends on expert availability. Routing questions to subject matter experts in Slack works well until those experts are inundated, and as agent usage grows, validation requests could multiply faster than experts can respond,” he said.

Moreover, Patel pointed out, the integrations with sources such as Slack and Microsoft Teams could also increase security exposure.

“Ingesting private Slack, Teams, and Docs content creates a larger pool of sensitive information that needs to be protected,” he explained. “Simply respecting permissions at the point of ingestion may not be enough if a summarized response combines restricted and openly accessible information and serves it to the wrong person.”

True to its name, AI-model-training tool Unsloth would do more work than it was asked to when developers checked out a model: It would also allow arbitrary code to execute on their machines.

Pillar Security found that simply selecting a model in Unsloth Studio caused the application to download and execute Python code from the model repository. This could potentially allow attackers to use a specially crafted model to get malicious code executed on a developer’s system.

“The code ran from nothing more than a metadata check,” researcher Ariel Fogel said in a post on Pillar’s blog. “Reading the model’s config.json was enough to trigger the exploit; the backend never loaded the weights or ran inference.”

The code would run with the user’s permission which, Fogel said, could expose proprietary training data, model artifacts, Hugging Face tokens, SSH keys, or accessible cloud credentials in an enterprise’s AI development environment.

Unsloth Studio is a web-based interface that is currently in beta, a status Unsloth’s maintainers cited when they reportedly declined to publish a security advisory or have a CVE assigned to the flaw after fixing it in June. Pillar contests that reasoning, pointing out that the vulnerable Studio code ships as part of the standard, generally available “unsloth” package on PyPI and can be installed through an ordinary “pip install unsloth” without selecting a beta or prerelease version.

Transformers setting opened the door

Unsloth uses Hugging Face’s trust_remote-code option, which allows a model to bring along its own Python code when needed.

That’s not necessarily dangerous by itself. Some legitimate Hugging Face models, including IBM Granite Speech and Vision, DeepSeek-OCR, ChatGLM, and earlier Qwen releases, need custom code to work properly, Fogel said.

The problem was that Unsloth enabled the feature automatically during a routine model check rather than requiring the user to explicitly opt into running remote code. Before the patch, “trust_remote_code” was turned on by default when Unsloth used Hugging Face’s Transformers model-loading functionality to obtain information about a model being inspected.

Unsloth’s maintainers also pointed to Hugging Face’s own malware scanning and warnings for models containing custom code as another reason for not treating the issue as a vulnerability. Pillar counters that Hugging Face’s protections are mostly blocklists and that its proof-of-concept (PoC) code was not flagged when scanned but could have fetched a malicious second-stage payload only when processed by Unsloth.

However, Fogel stressed that this is not a Hugging Face vulnerability, but an issue with how Unsloth uses trust_remote_code.

The fix went beyond flipping the setting. Pillar initially recommended pinning trust_remote_code=False on the model-checking path because that path only needed to read declarative information from config.json. Unsloth’s eventual fix went further.

In version 2026.6.9, Studio was changed to no longer enable arbitrary model loading directly from Hugging Face and to not trust remote code from local model files. Fogel said it independently retested the version and confirmed that both the Hugging Face and local-directory attack paths were closed.

Pillar urged users to upgrade to the fixed version, even if they never launch Studio and only use Unsloth core. Additionally, the company advised to audit LLM workflows for unnecessary occurrences of trust_remote_code=True.

“The time-to-exploit for attackers keeps shrinking, because automated repo scanning, agentic exploitation, and organized supply-chain campaigns can weaponize a benign-looking auto_map module even faster than before the adoption of AI,” Fogel warned.

My mom used to say that Hodges’s law was “Junk expands to fill the space allotted for it.” We lived in three houses over the years, each one bigger than the previous house as our family grew, and each house became just as full of junk as the one before it. 

My mom was echoing C. Northcote Parkinson, whose famous law said the same about work—that it expands to fill the time given to get it done. In other words, if you say a task will take a week or two weeks, you’ll be right either way. We all know it is true, right?

So what does Parkinson’s law mean for the productivity gains that we get from agentic coding? For the sake of argument, let’s say that we are five times more productive with coding agents. Instead of fixing one bug a day, we can now fix five. Instead of doing three story points a week, we can now do fifteen. What actually happens?

Leisure happens

Well, initially, I think it means we’ll get more free time. The productivity gains that turn eight hours of work into two won’t suddenly mean we get six more hours of work piled on. Instead, we get what Fabian Stelzer has dubbed “dark leisure”—the notion that your manager doesn’t know yet that you’re five times as productive, so instead of doing five times the work, you speed up by a factor of only two and surf the web the rest of the time. Your boss sees more work and you keep up with the latest cat memes.

But that will catch up with us eventually. I’ve written about the Jevons Paradox, and that comes into play as much as Parkinson’s law does. Gradually, as managers and ambitious devs start putting agentic tools to work more efficiently, we’ll see demand for more software, and dark leisure time will get filled with more work.

We’ve seen this before. Back in the early days of Windows, it was a serious pain to create a simple Windows application. You had to write many lines of C/C++ code just to make a blank form appear on the screen. Adding a simple button was even more effort. Eventually, though, tools like Delphi and Visual Basic made putting a button on a form child’s play.

When creating Windows apps became easier, the number of Windows applications exploded, and their user interfaces grew more complex. Early Windows apps had fairly simple user interfaces, but it wasn’t long before the increase in productivity allowed us to build complex UIs with all kinds of controls and toolbars and the like. The same thing happened with the web. Meandering through the deep, dark caverns of the Wayback Machine reveals many primitive-looking websites. 

Work rushes in

So we have this pattern—productivity gains lead to more software and more complexity. Work expands to fill the time allotted for it. The question then becomes: when one developer can do the work of five, will firms want fewer developers or more output? 

I strongly believe that it will be the latter—firms will want more output. Businesses will realize that they can plow through their backlog, pleasing customers. Intrepid entrepreneurs will realize that they can bring their crazy ideas to market in days or weeks instead of months or years. Generally, thinking “I can have one guy do all the work this team of five can do” is rather small-minded, and the marketplace doesn’t reward small-mindedness. 

But here is what I think is the real problem. Sure, moving into a bigger house made room for a bigger family, but each bigger house was more cluttered than the last one. Larger houses contain more things and require more work to keep them clean. Similarly, as software expands to fill the time left by dark leisure, it, too, will grow more cluttered. Working five times faster could very well mean that technical debt piles up five times faster. And of course, we can fix technical debt five times faster as well, so who the hell knows what that will all lead to. 

I think it will lead to the same thing it has always led to. We’ll be busy. We’ll build bigger and cooler things, and it will all still take the time that we allot for it to get done. 

When HTTP 200 means nothing

An AI assistant can return a response in under a second, maintain 99.9% availability and still give customers a fabricated answer. Traditional dashboards will show green because the request completed successfully. The user, however, received a semantic failure: a response that is syntactically valid but factually wrong, unsafe, biased or irrelevant.

That is why AI-native systems need observability beyond latency, error rate, throughput and saturation. LLM applications introduce non-deterministic behavior, multi-step reasoning, retrieval dependencies, tool calls and safety risks that do not appear as HTTP 503 responses. This article defines the Service Level Indicators (SLIs) that make those failure modes visible and shows how to extend an existing observability stack.

Quick answer

AI-native observability measures whether an AI system is useful, grounded, safe, efficient and resilient—not merely reachable. The core AI SLIs are task accuracy, token-generation latency, hallucination rate, bias drift, prompt-injection resilience, retrieval quality and cost per successful task.

Why traditional observability is insufficient

Traditional application monitoring assumes an explicit contract: a request either succeeds or fails, and a small number of technical signals explain most degradation. LLM systems break that assumption. The same input may produce different outputs; quality can decline after a model, prompt or retrieval update; and the response can look correct to an API client while failing the user’s actual task.

• HTTP 200, incorrect answer: the model responds successfully but invents a policy or recommendation.
• Grounding failure: a RAG system retrieves relevant documentation, but the model ignores or contradicts it.
• Tool misuse: an agent chooses a valid operational tool with the wrong arguments.
• Reasoning loop: an agent repeatedly calls tools, increasing latency and cost without progressing.
• Safety failure: a malicious prompt embedded in an uploaded document persuades the model to reveal data or ignore policy.

An effective design keeps infrastructure SLIs and AI quality SLIs together. Infrastructure tells you whether the platform is healthy. AI SLIs tell you whether the platform is trustworthy.

The AI-native SLI set

1. Response accuracy or task success rate

Response Accuracy measures the percentage of outputs that correctly fulfill the defined task. For an incident assistant, success may mean identifying the correct service owner, assembling evidence, selecting an approved runbook and escalating when confidence is insufficient. For a support bot, it may mean delivering an answer that is correct, complete and supported by policy.

Formula: Response Accuracy = correct responses / total evaluated responses × 100.

Use a layered evaluation method: deterministic tests for known cases, sampled human review for high-fidelity judgment, user-feedback signals and model-based evaluators against a written rubric. A model-as-judge should be calibrated against human evaluations rather than trusted blindly.

2. Token generation latency

End-to-end latency is too coarse for LLM applications. Split a request into queue time, retrieval time, time to first token, generation time, tool-call time and post-processing time. Token-generation latency measures the inference cost of producing output once generation begins.

Formula: token-generation latency = generation duration/output tokens.

This distinction makes incidents diagnosable. A high end-to-end latency may be a slow vector-store lookup, a provider slowdown, an overloaded tool dependency or an overlong response. Measuring time to first token and milliseconds per output token turns one vague latency alert into actionable signals.

3. Hallucination rate and groundedness

Hallucination Rate is the percentage of outputs containing claims unsupported by authoritative context. For retrieval-augmented generation, the complementary measure is groundedness or faithfulness: whether the answer can be traced to retrieved documents, telemetry or verified system data.

Formula: Hallucination Rate = ungrounded responses / total evaluated responses × 100.

Require citations or evidence IDs for high-stakes answers and score whether those sources actually support the claims. This converts “the response sounded plausible” into a measurable reliability signal. High-risk domains should use stricter thresholds and route uncertain answers to a human rather than forcing a confident response.

4. Bias drift

Bias Drift measures whether the fairness profile of outputs changes over time. This matters after model-provider changes, fine-tuning, prompt edits, retrieval-corpus updates and feedback loops. A system can remain accurate overall while becoming less helpful or more negative for a particular user group.

Formula: Bias Drift = absolute difference between the current and baseline bias score.

Use counterfactual test sets: submit equivalent prompts that differ only in relevant demographic markers, geography, language variety or role. Compare helpfulness, sentiment, refusal behavior and outcome quality. Alert on statistically meaningful deviation from a reviewed baseline, not on a single anomalous response.

5. Prompt-injection resilience

Prompt injection occurs when untrusted text attempts to override instructions, exfiltrate data or manipulate tool use. This risk is especially important for agents that read tickets, logs, web pages, knowledge bases or user-provided documents.

Formula: Prompt-Injection Resilience = blocked or safely contained attacks / total tested attack attempts × 100.

Do not rely solely on the model to defend itself. Apply a defense-in-depth approach: classify untrusted content, isolate it from privileged instructions, use deterministic policy checks before tool execution, validate outputs and assign least-privilege credentials to every agent tool.

Additional SLIs worth tracking

SLI	What it reveals	Example target
Retrieval relevance	Whether retrieved sources are useful for the query	At least 80% relevant documents
Context utilization	Whether the answer uses relevant retrieved evidence	At least 70% on evaluated traces
Tool-call accuracy	Correct tool selection and valid parameters	At least 99% for privileged tools
Toxicity or policy-violation rate	Unsafe or disallowed outputs	Near zero for customer-facing use cases
Cost per successful task	Efficiency of model, retrieval and tool calls	Baseline plus a defined tolerance
Multi-turn consistency	Contradictions across a conversation	At least 95% consistent on tests

Extend the observability stack

Keep your existing metrics, logs and traces. Extend them with AI-specific spans and evaluation records. Each agent or LLM trace should answer: what was the task, which model and prompt version were used, what context was retrieved, which tools were called, what policy checks ran, what did the model return and did the outcome succeed?

• Model metadata: provider, model version, deployment region, temperature, max tokens and prompt-template version.
• Token and cost data: input tokens, output tokens, total cost, cache hit rate and spend by feature or user.
• Retrieval data: document IDs, relevance score, freshness, chunk version and citations used in the response.
• Agent behavior: plan steps, tool names, arguments, retries, approval state and final verification result.
• Evaluation data: task-success score, groundedness, toxicity, bias signals, security findings and user feedback.

OpenTelemetry-compatible tracing is valuable because it connects agent spans to application traces, Kubernetes events, deployment changes, databases and downstream services. AI failures then become observable in the same operational context as infrastructure failures.

Stats: What teams are reporting

Instrumentation has a measurable cost. A 2026 comparison of agent-observability tools reported moderate runtime overhead of roughly 12% for AgentOps and 15% for Langfuse in its tests, so teams should sample, batch, redact and asynchronously evaluate high-volume traffic where appropriate.

The tooling market now spans trace, evaluation, debugging, cost and review workflows; LangChain’s 2026 comparison highlights that production teams need more than monitoring alone because evaluations and trace analysis address different operational questions.

A 2026 market comparison lists platforms including Datadog, Arize AI, StackGen, LangSmith, Honeycomb, New Relic, Dynatrace, Braintrust, Galileo and Fiddler AI, illustrating how AI observability is converging with established application observability rather than replacing it.

Tools to consider

Tool	Best fit	Key capability
Langfuse	Self-hosted or data-control-focused teams	Open-source tracing, prompts, cost analysis, custom evaluations
StackGen	Enterprise Companies	Enterprise observability with Aiden – AI Copilot enabled
LangSmith	LangChain and LangGraph users	Agent traces, datasets, evaluations, feedback workflows
Arize Phoenix	Evaluation and RAG debugging	OpenTelemetry tracing, retrieval analysis, evaluation workflows
Datadog LLM Observability	Existing Datadog customers	Correlates LLM traces with infrastructure, APM and logs
Helicone	Fast proxy-based adoption	Request logging, cost controls, caching and rate limiting
DeepEval / Confident AI	Evaluation-first teams	Quality metrics, regression testing and evaluation datasets

Select tools based on data residency, OpenTelemetry support, redaction controls, evaluation workflow, model-provider coverage, cost allocation and integration with your existing incident process. There is no universal winner: a Kubernetes-heavy platform team may prioritize OTel correlation and self-hosting, while an application team may prefer managed evaluation workflows. Current 2026 tool comparisons cover Langfuse, LangSmith, Datadog, Arize and other platforms across tracing, evaluation, cost tracking and governance capabilities. [web:81][web:82][web:84][web:86]

Phases of a practical rollout

Phase 1: Trace every model call

Capture prompt version, model, token counts, time to first token, total latency, errors and cost. Redact sensitive content before traces leave your environment. Establish cost and performance baselines before defining tight SLOs.

Phase 2: Add asynchronous evaluations

Build a small, representative evaluation set from real tasks. Score task success, groundedness and retrieval relevance. Sample production traffic and correlate evaluation failures with prompt versions, model changes, customer segment, retrieval source and tool sequence.

Phase 3: Add safety gates

Introduce prompt-injection checks, PII detection, tool schema validation, policy enforcement and human approval for high-impact actions. Treat safety-gate triggers as reliability events with owners, runbooks and review cadence.

Phase 4: Turn signals into SLOs

Set targets after observing a stable baseline. Alert on fast degradation, not only absolute thresholds. For example, a sustained 50% week-over-week increase in hallucination rate may deserve immediate investigation even if the rate has not yet crossed its formal SLO.

Common questions

What is AI observability?

AI observability is the ability to inspect and explain an AI system’s inputs, outputs, model behavior, retrieval, tool calls, costs and quality outcomes. It extends monitoring from technical availability to semantic correctness and safety.

Why are latency and error rate not enough for LLMs?

An LLM can respond quickly with HTTP 200 while hallucinating, ignoring source context, generating biased output or choosing an unsafe tool action. Those are user-impacting failures that traditional service metrics cannot detect.

What should I monitor first?

Start with traces, token usage, cost, response latency, model and prompt versions, task success and groundedness. Add injection resilience, PII checks and bias-drift evaluation as the application becomes more autonomous or sensitive.

Key takeaway

For AI-native systems, reliability is not just “the endpoint is up.” It is “the system returns an accurate, grounded, safe answer within an acceptable time and cost budget.” Add semantic SLIs to your existing observability stack, link every result to traceable evidence and use evaluation-driven feedback to find failures before users do.

Testing deterministic systems is relatively straightforward. Create an assertion that the system should pass, and automate validating it against a series of input-to-output data patterns. When new test patterns are needed, use observability sources to extract them from actual usage data or to create synthetic test data. But testing AI models and agents with nondeterministic outputs doesn’t align with this form of unit testing. For example, say you are using a language model to categorize a string of text, such as text extracted from an employee’s expense receipts. If the number of categories is small and there is little variance between employee receipts, then traditional testing methods can work when you have sufficient test cases. But this approach doesn’t work if there are hundreds of categories and an untold number of receipt variants.

In my 2024 article on testing large language models, I reviewed several testing approaches, including using adversarial networks for evaluating model output. In my 2025 article on testing AI agents, I covered testing strategies and approaches for validating response accuracy. In the present article, I dive deeper into property-based testing (PBT), an approach that uses property specifications to evaluate tests for correctness and completeness. PBT evaluates a system using properties rather than expected outputs. The term dates from 1997 security research, and the technique stems from a 2000 paper on formulating and testing properties.

“When the system under test is stochastic, point assertions stop being useful because the same input can produce different outputs, so traditional pass-fail testing breaks down,” says Alan LeFort, CEO and cofounder at StrongestLayer. “Property-based testing flips the problem, and instead of asserting one expected result, you assert an invariant that should hold across a distribution of inputs and conditions.”

Define property-based assertions

AI models and agents are stochastic, and even identical input prompts can generate different results. PBT’s strength is that it doesn’t need labeled test data for testing and can generate the input patterns. The test’s objective is to find where semantically identical inputs yield different results, and its strength is in helping identify which input patterns make the model unstable.

PBT works by creating an assertion, such as “each line item in a receipt is assigned to one category,” and then identifying the list of categories, such as meals, grocery, airfare, and hotel expenses. That’s the property being tested; the categories are the allowed outputs, and the generator is the engine that creates the inputs.

The hard problem PBT solves for is that you often can’t say what the correct category is for ambiguous inputs. A line reading “Marketplace $97.63” on a hotel folio could be classified as hotel, meals, or grocery. Testing researchers call this the oracle problem, where there’s no practical way to determine the correct classification.

How PBT works

A PBT generator can be applied by creating hundreds of receipts, each tested several times to measure when the model is consistent. This is one way to validate a model’s stability. Then, create thousands of variants of each receipt that don’t change the underlying meaning; for example, reordering the lines, reformatting the amounts, or changing the guest name. If the same line gets classified two ways for inputs that mean the same thing, at least one is wrong, and you’ve found a defect even though you never learned which classification was correct.

PBT takes inputs that created defects and runs a systematic search called shrinking. It simplifies the input by dropping line items, reducing amounts, and shortening descriptions, then reruns the simplified receipt and its variant through the assertion. It keeps only simplifications that still fail by returning different results, and repeats the shrinking and asserting process until no further simplification is possible while still failing.

What comes back is the smallest input that still breaks. A hotel folio with multiple line items might shrink to two lines: “Room Charge $289.00” and “Marketplace $97.63.” Reordering those two lines flips Marketplace from hotel to grocery, highlighting the defect. The minimal case tells you where the model is unstable; here, a line’s category depends on what precedes it.

“Property-based testing shifts AI validation from checking whether one answer is correct to proving that critical behaviors never fail, regardless of prompts, inputs, or enterprise context,“ says Vijay Rayapati, cofounder and CEO at Atomicwork. “For enterprise AI agents, those properties include never granting unauthorized access, bypassing approvals, exceeding permissions, or taking unsafe actions. Running thousands of automatically generated scenarios exposes edge cases that traditional testing misses.”

Examples of applying PBT in AI

Sanmi Koyejo, cofounder and head of AI at Virtue AI, shared two examples of how PBT can be used to validate an AI language model: paraphrasing a prompt shouldn’t flip a safety verdict, and an AI agent shouldn’t cross a permission boundary no matter how the request is worded. “Property-based testing is strong where you can state an invariant that must hold across a huge input space. The generator finds edge cases your example tests never would, and shrinking hands you a minimal reproduction. In practice, lean on metamorphic properties such as consistency and monotonicity because there’s no exact-match oracle for generative output and seed generators with realistic traffic plus adversarial mutations,” says Koyejo.

Two other practical examples where PBT has been applied include the inverse application of AI writing the tests rather than being tested by them, and validating that an AI agent sticks to its area of expertise.

Mohammed Aboul-Magd, vice president of product for the cybersecurity group at SandboxAQ, says the most dangerous agent failures are quiet boundary violations. “When a support agent answers questions it was never meant to handle, or a retrieval agent accesses data outside its scope, an organization is at risk. PBT catches those before production,” Aboul-Magd says.

Why AI experts are using PBT

Traditional testing often targets what’s called the known knowns, their testing patterns, and boundary cases. PBT helps extend testing into unknown areas where you have no reliable or valid data to test, or little understanding of which conditions yield unexpected or risky results.

“The most expensive AI bugs rarely show up in the examples you expected people to try,” says Zain Lakhani, chief AI officer at Pendo. “Property-based testing pushes models and agents through thousands of unexpected scenarios, exposing behaviors that scripted tests often overlook. That extra coverage helps teams catch reliability issues before users do.”

Another reason experts explore PBT is to generate test cases for AI code generators and for applications developed with vibe coding or spec-driven development practices. Relying on unit tests generated by code generators may lead to “happy path, known knowns” testing patterns.

“Property-based testing gives teams a way to define what ‘correct’ means and then aggressively pressure-test that across thousands of inputs,” says Ali-Reza Adl-Tabatabai, CEO and cofounder at Gitar. “That matters when AI can generate and modify code faster than humans can review it. But testing alone won’t keep up.”

Best practices in implementation

Harshil Shah, director of engineering and head of the AI center of excellence at R Systems, RSI,  says that the teams getting real value from property-based testing of agents make four implementation moves:

1. They replace random input generators with semantic generators, such as an LLM or a domain model, that produce realistic intent variations.
2. They encode invariants at the trajectory level, and the tests check rules that must hold true across the agent’s entire sequence of actions, not just its final answer.
3.  They assert properties such as “never calls a write tool before a validation tool” or “output totals always reconcile with retrieved data,” rather than matching exact outputs.
4. They wire the property suite into continuous integration as a gate, running each generated case a statistically meaningful number of times and failing the build on pass-rate regression.

PBT can also be used to validate a language model’s invariants, the structural or semantic properties that must hold for any valid input. These include testing output length, schema validation, and consistency under rephrasing.

“Property-based testing adds value to the AI validation toolkit by shifting the focus from checking individual outputs to verifying that important behavioral properties hold across a wide range of scenarios,” says Sridhar V. Dasaratha, EY distinguished technologist and EY global client technology AI research leader at EY. “For AI models and agents, it can help uncover edge cases and validate critical guardrails such as safety, compliance, workflow integrity, and responsible tool use. A key best practice is to define clear, business-relevant properties that can be independently verified and monitored.”

Limitations of PBT

PBT is a promising testing approach, but it does have some implementation considerations and limitations. There are costs in using LLM-based generators. Engineers must also understand the trade-offs between testing enough variants to trust the results and the time and cost to execute the tests. Some areas may be blind spots if the team doesn’t know they need to test for them. Koyejo of Virtue AI adds, “PBT only checks properties you thought to write, so it misses failure modes you didn’t anticipate. Pair it with adversarial red teaming to surface the unknown unknowns it can’t reach.”

Scaling PBT may be a challenge, especially as AI agents become more sophisticated and connect to AI orchestration platforms to support complex workflows. Joseph Hurley, principal sales engineer at Digital.ai, says, “Proving a property that holds for a handful of functions is one thing, but proving rigorous quality standards that hold across an entire AI-generated system is another.”

PBT is only one validation step, and teams should determine their AI agents’ release-ready criteria, with additional steps to validate security, measure business value, and consider AI cost debt.

“Property-based testing is a powerful way to formalize expectations for AI systems and creates a strong foundation for specifying how systems should behave across a wide range of inputs,” says Bo Li, CEO and cofounder at Virtue AI. “But true validation goes beyond abstract properties and requires observing agents in realistic environments with live tools, dynamic permissions, and adversarial pressures that expose emergent risks.”

As more organizations develop AI agents, using PBT and other testing methods will be a key practice for deploying reliable, trustworthy agents.

Meta is once again repositioning itself to target the enterprise market.

This week, the company announced the Meta Enterprise Platform, which it says will evolve its AI stack into products and services that enterprises can deploy into operations, rather than just using them for advertising and social media campaigns.

While the company provided few details about the offering, Meta CEO Mark Zuckerberg called the platform “the next major pillar” of its business, saying it will feature a connected suite of products including Muse agent, Meta Business Agent, Muse API, and Muse Code.

MongoDB’s Chirantan “CJ” Desai will step in as chief enterprise platform officer to lead the effort.

The question is whether this endeavor, once fully launched, will be more lasting than Meta’s previous attempts in the enterprise.

“The issue of trust remains,” said Armaan Sandhu, research analyst in the AI practice at Info-Tech Research Group.

The shutdown of previous products like Workplace and Horizon Workrooms indicate that Meta tends to “abandon the enterprise products as soon as its vision of the future changes,” he said. “Companies will therefore require hard evidence that Meta will stick to its future plans and continue investing in their development.”

Meta’s growing AI ambitions

Meta has been working to reorganize its AI efforts since founding its Meta Superintelligence Lab in 2025. Muse Spark was the first new model to come out of that initiative; launched in April 2026, the agent supports multimodal inputs, multiple reasoning modes, and can spin up sub-agents in parallel to handle more complex tasks.

Next, Meta Business Agent, launched in June, directly targets enterprises, providing them with AI assistants to automate customer interactions, support sales, and drive leads across platforms including WhatsApp, Messenger, and Instagram. The company followed that up with Muse Agent, an autonomous business and personal agent that can handle multi-step background tasks.

Muse Code is designed to handle complex software workflows across large codebases, while Muse API gives developers direct access to the Muse AI stack.

Abandoned efforts

However, Meta has so far struggled to gain a strong foothold in the enterprise market, and in some cases has abandoned previous attempts after they failed to take off.

For instance, Workplace, launched in 2016, supported communication and information sharing across organizations, but Meta announced in 2024 that the service would be discontinued, even as it reported millions of users. After a 10-year run, Workplace officially shut down in May 2026.

Then there are the company’s virtual reality efforts, including Horizon Workrooms, a collaboration app used with Quest headsets. It was offered for five years before being retired in February 2026.

Different positioning

But the company is positioning Meta Enterprise Platform differently; it will play on strengths that “few other companies have” and leverage its experience connecting millions of businesses and customers, Zuckerberg said, touting the company’s “advanced models, leading agents, large-scale infrastructure, and years of working closely with many businesses.”

However, noted Info-Tech’s Sandhu, Meta’s key advantage is not its technology; rivals such as Microsoft, Google, Amazon, and Salesforce also offer capable models and agents. Its differentiator is that it owns the platforms where users familiarize themselves with brands, interact with businesses, and make purchases. Meta can therefore link advertising, customer discovery, messaging, service, and commerce through AI agents running across WhatsApp, Instagram, and Messenger.

“Few rival companies can boast of such an effective combination of AI and access to customer channels,” Sandhu said.

Enterprise appeal may not be there

Still, Meta has challenges to overcome as it seeks to compete with well-entrenched tech giants and move beyond its consumer market origins.

Said independent technology analyst Carmi Levy, “It’s difficult to understand the appeal to enterprises, as Meta has never been known as a significant player in the enterprise market.”

Its data stewardship track record is also “somewhat checkered,” he pointed out, citing the infamous Cambridge Analytica scandal that Meta is now answering for, as well as a number of other high-profile data stewardship and privacy cases in the US and UK.

He contended that the company’s core competency revolves around harvesting data to fuel growth, hardly a desirable trait in the enterprise space. Workplace “never quite realized its early promise,” and it’s unclear whether the Meta Enterprise Platform will suffer the same fate.

“Time and again, Meta’s behavior betrays its inability to craft the kind of iron-clad enterprise-grade infrastructure and organizational competency that corporate decision makers value,” he said, noting that even if its offerings were years ahead of the competition, these trust issues should give buyers pause.

In addition, Meta Enterprise Platform loosely ties together a host of offerings originally released into the mass consumer market, yet positions Muse as the pillar of its future enterprise strategy, he pointed out. If anything, Muse’s “early teething troubles,” including privacy violations and serious zero-day vulnerabilities, should be the only warning enterprise buyers need.

If Meta did manage to turn a consumer-architected collection of offerings into something somewhat more enterprise-ready, its “indifferent level of commitment” to earlier enterprise offerings raises the question of whether it intends to support such a platform well into the future. “If the commitment isn’t there, neither is the trust,” Levy added.

However, if enterprises do decide to evaluate the product, Sandhu advised that they pay attention to pricing, integration with other systems, and technical features. And initially, they should choose a narrow field of application, “with the goal of maximum benefit without making this technology a company’s key system.”

This article originally appeared on CIO.com.

Manus’s relationship with Meta? It’s complicated. Just months after they called off their merger, they find themselves competing in the market for agentic AI platforms. Awkward!

The company has just released a rebuilt version of its AI agent platform: “Manus 2.0 is not a version update. It’s a new architecture, new products, and new capabilities,” the company said in a blog post.

The release is available on web, desktop, and mobile platforms and introduces a new agent harness called Cascade, dedicated execution environments, event-triggered automations, an upgraded desktop app called Manus Studio, and Cue, a standalone app for personal agents, the company said.

Entering on Cue

Cue is Manus’s alternative to Meta’s Muse app. It’s “a new standalone app for your personal agents, on your phone and desktop, built on the same infrastructure as Manus,” the company said.

Each agent operates with its own identity and resources. “In Cue, each agent has its own email, phone number, wallet, and computer,” the company said, enabling it to communicate, transact within defined limits, and complete tasks independently.

Cue also supports collaboration between agents. “Put several agents in a group chat with a shared goal, and they hand work to each other,” the company said.

New agent foundation

Of more interest to enterprises is the new Cascade agent harness, which manages how agents are invoked and coordinated within a project.

The harness keeps projects light, only bringing in more specialized capabilities when required, something Manus said can help keep costs down.

“In one tested configuration, Cascade used 23.2% fewer tokens, finished tasks in 28.2% less time, and cost 32% less to run than our previous system,” the company said. Manus did not disclose details of the configuration or the tasks used.

Such orchestration layers are becoming increasingly central to enterprise AI deployments, according to analysts.

“The orchestration layer is becoming a larger differentiator, especially for enterprise deployment,” said Gartner Senior Director Analyst Anushree Verma. “However, it is complementary to, not a substitute for, the underlying model. The strongest systems will combine a capable model with an efficient runtime that uses that model selectively rather than indiscriminately.”

The release also introduces a persistent execution environment called Cloud Computer, designed to support projects that require continuous operation.

“Now you can purchase a Cloud Computer: a dedicated environment for the projects that need it,” the company said, describing it as a way to provide “a permanent home for an automation” or maintain services that need to remain active.

Workflow automation and event triggers

Manus 2.0 expands its automation capabilities beyond scheduled tasks to include event-driven workflows.

“Now, with Automations, work can also begin when something happens in a connected service,” the company said. Possible task triggers might include the arrival of new email or Slack message, a change in ad performance, or a calendar event.

The update also includes Manus Studio, a redesigned workspace that combines document, code, and media capabilities.

“With Manus 2.0, the desktop app is upgraded to Manus Studio: a shared workspace for people and AI,” the company said.

The workspace supports documents, spreadsheets, PDFs, slides, websites, code, games, and video, along with new environments such as a Video Editor and a Game Dev module.

Remote execution and system access

Manus 2.0 also introduces remote control capabilities tied to its computer-use functionality, enabling the system to operate within a user’s computing environment.

“In a connected and authorized session, Manus works in its own visible workspace on your computer, using the files, browser, and apps you’ve approved,” the company said.

The system can perform tasks such as retrieving files, testing applications, or continuing work while the user is offline, with activity visible to the user.

Analysts said such autonomy introduces governance challenges for enterprises.

“The capability is becoming enterprise-relevant, but the autonomy is ahead of the governance,” Verma said. She added that enterprises should treat such systems as “untrusted or semi-trusted automation with strong isolation, approval gates, detailed telemetry, and narrowly defined authority.”

That’s so meta

Manus was all set to become part of Meta after the advertising, social networking, metaverse and AI company announced plans to acquire it in December 2025. However, China’s National Development and Reform Commission blocked the deal in April, and by August Manus announced it was once again operating as an independent company.

Since then, the two have continued to followed parallel paths in AI, with Meta announcing its personal AI assistant, Muse, and then this week launching Meta Enterprise Platform to deliver agentic AI services to businesses.

Enterprise adoption of such agent platforms, whether from Manus, Meta, or AI giants such as OpenAI or Anthropic, will depend on how organizations evaluate data handling, portability, and operational continuity, analysts said.

Sakshi Grover, research director for Asia/Pacific Cybersecurity Services at IDC, said, “Enterprises should assess an agent platform by the systems it can access, the state it retains, and how quickly that state can be recovered elsewhere.”

Organizations should establish where “prompts, intermediate task state, artifacts, logs, backups and connector credentials are processed and stored,” including by model providers and other subprocessors, and test whether workflows can be rebuilt outside the platform, she said. “An export button alone does not establish that an agent’s operating state is portable.”

For higher-impact deployments, she recommended using “narrowly scoped, short-lived credentials, external audit logging, approval gates for consequential actions, and a way to revoke access quickly.”

OpenAI has scrapped the planned October release of GPT-6.1 Astra after internal testing found the model did not meet the company’s safety and alignment standards.

GPT-6.1 Astra was being developed as a more autonomous model capable of handling complex tasks with less human assistance, and was expected to be integrated into ChatGPT and Codex. But internal testing found that it could evade oversight, misrepresent its actions and operate beyond its authorized scope, while attempting to use external tools it knew were unsafe, according to a report by The Wall Street Journal

OpenAI reportedly plans to take Astra’s underlying model through additional reinforcement learning to build subsequent models in the GPT-6 family and investigate what caused the safety problems identified during testing.

Models developed by OpenAI increasingly suffer from what the industry euphemistically calls “alignment problems,” meaning a lack of understanding of what is right and wrong, what is acceptable behavior and what unacceptable.

The now-abandoned model’s predecessor, GPT-6 Astra, was caught conducting unsanctioned software supply-chain attacks in simulated cybersecurity tests by the UK’s AI Security Institute, despite being explicitly told that attacking internet targets was out of scope. It did so far more often in tests than its predecessors, GPT 5.5 and GPT 5.6 Sol.

Such models will essentially do anything to achieve their objectives, said Pieter Danhieux, co-founder and chief executive officer of Secure Code Warrior. “For these agents, their operation is essentially business as usual; They will relentlessly pursue the initial goal they were instructed to do, and being repeatedly told ‘no’ by access control parameters will simply ensure they seek the next available endpoint until they succeed,” he said, adding that such models require human oversight and stronger regulation.

OpenAI’s decision to pull GPT-6.1 Astra comes amid a series of incidents involving the company’s models, including an agent that gained unauthorized access to an Australian government portal and models that interacted with several US government websites in unexpected ways.

AI broke the rules, but someone did first

Australian Prime Minister Anthony Albanese said an internal OpenAI model was conducting research into public medical spending on June 18 when it encountered repeated blocks while attempting to obtain information from Australia’s Medicare Statistics Reporting Portal. It tried alternative ways to get the information, eventually gaining unauthorized access to the portal.

He said the agent accessed both public and non-public files and wrote files to an internal server; investigations into the incident remain ongoing.

Aviv Nahum, co-founder and chief executive officer at Above Security, said this incident could be more than an AI being at fault. “If the archive evidence holds, the most-hyped AI hack of the year looks a lot like the most common security failure of the last thirty years: a misconfiguration,” he said. “The portal’s own code pointed visitors to an endpoint that required no credentials, and the agent followed the path it was given. That’s not an ‘AI agent hacking a government website,’ that’s a door that was left open, found by something that can read the code more carefully and execute more quickly.”

We should be careful about framing every agent incident as “rogue AI,” Nahum cautioned, adding that doing so makes for “dramatic headlines,” but moves the blame to the model instead of the environment.

The US incidents were less serious but followed a similar pattern of models interacting with external systems. An OpenAI spokesperson told the Washington Post that the company’s models accessed publicly available information on SEC.gov, Investor.gov and Census.gov during training and evaluation. The company said its agents acted inappropriately in the SEC and Census Bureau incidents but did not steal any private data.

Ben Bernstein, manager of Huntress’ cybersecurity advisors team, took a similar view of the US incidents, arguing that they have been overstated as AI hacks. “These agents were simply tasked with gathering public SEC and Census information, but the guardrails in place were not firm enough to contain a model programmed to problem solve,” he said.

Still, OpenAI cannot be let off entirely, with reports of model misalignment and unauthorized activity piling up over the past few days.

Testing times

The common thread across these incidents is that they involved models being tested or evaluated by OpenAI, not publicly deployed models.

The Australian incident involved an internal OpenAI model conducting research. The US activity similarly involved models being tested by OpenAI as part of its research and evaluation work. Neither involved a customer taking a publicly available ChatGPT model and directing it against a government system.

OpenAI’s decision to kill off GPT-6.1 Astra follows its decision to pause training of its most capable models after an one of the models under test bypassed network restrictions and used DNS to communicate externally.

CEO Sam Altman acknowledged the breadth of the problem in a tweet on Sept. 25. “There is an extensive and ongoing review related to our agents’ use of internet access during training and evaluation,” he wrote, adding, “We have not been as fast as we would have liked but we are trying to balance our desire for transparency with gaining a clear understanding from petabytes of agent activity logs, and working with impacted organizations.”

This article first appeared on CSO.

Advanced Micro Devices (AMD) has agreed to buy World Labs, a developer of AI “world models” that incorporate knowledge of the physical world, to extend the AI ecosystem around its hardware to encompass areas such as robotics, simulation and physical AI.

Historically, AMD was seen as the cheaper alternative to Intel in the CPU market, but according to Gartner Director Analyst Shrish Pant, that positioning no longer works: “AMD can’t win just by selling cheaper chips,” he said. “Nvidia won enterprise AI by selling an entire ecosystem. Acquiring World Labs turns AMD into a full-stack player, giving customers everything from the hardware and compiler up to ready-to-use physical and spatial AI models.”

World Labs is working on world models designed to analyze and generate 3D environments, including the relationships between objects and how those environments change, whereas the models developed by the likes of OpenAI and Anthropic are built around language — although the concept of “language” also includes code, audio, images, and even DNA.

This is where World Labs fits into AMD’s ecosystem, according to Parv Sharma, Senior Research Analyst at Counterpoint Research. “World Labs builds AI that understands space, where models need to understand geometry, physics and time, unlike LLMs, which understand languages. These world models are used for training in physical AI (robotics, autonomous vehicles, industrial simulation, AR/VR, gaming, digital twins), potentially one of the next multi-trillion-dollar opportunities,” he said.

After the close of the deal, which values World Labs at $8.2 billion, its CEO Fei-Fei Li will become chief scientist, reporting to AMD CEO Lisa Su.

For AMD’s Su, “Building the compute platforms for the next generation of AI requires a deep understanding of how models are evolving,” she said in a news release. “Fei-Fei and the World Labs team bring exceptional research leadership and model expertise. Together, we can use that insight to develop the hardware, software and systems that will power the next generation of AI and strengthen the open AI ecosystem.”

Building an Nvidia alternative

The acquisition will bring World Labs’ model expertise into a broader hardware and software context as AMD it looks to compete with Nvidia beyond their core chip products.

AMD is building an open hardware alternative to Nvidia around platforms such as Helios and UALink, but it also needs to strengthen the software layer around its hardware with first-party AI models and through ROCm, a software stack for running loads on its GPUs.

Counterpoint’s Sharma said the acquisition could help AMD narrow the software gap with Nvidia, not just through ROCm, its alternative to Nvidia’s CUDA, but through its own models and platforms like Omniverse, Cosmos, GR00T, or Isaac. The deal will make physical AI a key growth vector in its Instinct and embedded/automotive roadmaps, he said, while giving ROCm a first-party set of multimodal and 3D generation reference models.

It could also give AMD a simulation platform for robotics customers that have traditionally relied on Nvidia’s Omniverse, he said.

The real hurdle for AMD in its race with Nvidia has never been silicon, said Gartner’s Pant. “It’s the software. World Labs gives AMD a working, in-house ‘customer zero’ to battle-test ROCm on the hardest 3D and spatial models out there, closing the developer gap with Nvidia much faster in for spatial workloads.”

Customer impact

AMD expects to close the acquisition towards the end of this year, so the near-term picture around products, customer contracts or pricing remains largely unchanged: beyond Li’s future role as chief scientist, AMD has not yet announced changes for either company as a result of the acquisition.

However, analysts are hopeful that the acquisition could eventually give customers access to capabilities and computing resources that neither company could offer as easily on its own.

“AMD customers could gain access to world models, 3D generation, simulation and physical-AI capabilities optimized for AMD hardware without extra setup,” said Pareekh Jain, CEO of Pareekh Consulting. “For the World Labs customers, they could get access to massive computer power to run bigger, faster simulations. Existing World Labs products, customers and contracts are likely to continue initially, but could become more tightly integrated with AMD’s hardware and software ecosystem.”

Future pricing and availability are harder to predict, he said, but deeper AMD optimization could improve performance and economics. AMD will likely bundle the software with its chips to undercut Nvidia’s pricey software licenses.

AMD’s bet on future AI workloads

AMD is making a big bet on the future of world models, said Jain. “Seven months earlier, AMD helped fund World Labs when it was valued at $5 billion, so AMD is now paying about 60% more,” he said, adding that AMD is effectively paying for future commercial potential, technology and talent, positioning itself to profit if world models become a major AI workload across robotics, simulation and engineering.

This article first appeared on CIO.

We keep asking whether AI can make developers more productive, but that’s the wrong question. We should instead be asking what happens when it does. All those productivity gains can be for good, of course, but they could also be for ill.

Simon Willison made this clear in a recent post. “The more time I spend working with coding agents, the more convinced I am that they make software engineering even harder.” Wait, what? Why would he say that? Because getting the most from them requires “extraordinary discipline and knowledge.”

This wasn’t a denunciation of AI coding. If you’ve read Willison for more than a millisecond, you know he’s a fan. Indeed, in his post, he explicitly celebrated what the tools make possible. One respondent apparently missed that, however, warning that without deep expertise, it’s difficult to distinguish correct output from plausible nonsense. Willison’s response? “You’re making the exact same point as me.”

This isn’t just retreading familiar ground (that AI still needs experienced engineers to impose that discipline). It’s something different. After all, faster implementation doesn’t automatically create extra human capacity. Yes, it can change the work people attempt, the decisions they must make, and the expectations attached to their jobs. But a team can deliver more and still find the work more demanding. Both can be true.

Companies should be careful about budgeting as though AI has already given them both a larger road map and a smaller need for engineering expertise. It’s by no means clear that faster coding is an unalloyed good.

Faster isn’t the same as easier

In the replies, one reader, Hillel, put it neatly: “It doesn’t get easier, you just get faster.” Geoffrey Huntley concurs, describing the work as “incredibly taxing” even for experienced operators. He reported roughly 16-hour days over the preceding 12 days, explicitly noting that this was his choice, not a requirement at work. That qualification matters because these comments aren’t representative measurements of developer productivity, nor are they evidence that agents inevitably exhaust everyone. They’re simply observations from people using the tools enthusiastically. The enthusiasm is part of the story. As more becomes possible, people attempt more.

I’ve argued before that AI coding agents need good software engineers. AI doesn’t eliminate the need for engineering discipline. It raises the price of not having it. But having the expertise and having enough capacity to apply it are different things.

Consider a team that uses faster implementation to take on a migration it had postponed. That’s a perfectly reasonable use of AI. With AI the team can afford to attempt something valuable, but that doesn’t change the fact that the migration still introduces decisions about compatibility, customer disruption, and which old behaviors must survive. The engineers may now spend more of their day resolving those questions, even if they spend less time writing the changes.

In other words, the gains are real, but so is the additional responsibility. Comparing the new, more ambitious workload with the old one and concluding that engineering has become easy misses what the team actually bought with its saved time. Nor does this depend entirely on models making mistakes. Better agents can reduce correction and verification work. They can also make previously impractical projects feasible. How much of the resulting capacity becomes breathing room and how much becomes another commitment is a choice the organization has to make.

The extra work becomes the job

There’s some research behind this concern, though it’s maybe not as incontrovertible as it appears on the surface. UC Berkeley researchers Aruna Ranganathan and Xingqi Maggie Ye studied AI use at a 200-person technology company over eight months. Their work included observation and more than 40 interviews across functions.

They saw employees expand their responsibilities, fit prompting into former pauses, and keep more work running simultaneously. Much of this was voluntary, as people were excited by what they could accomplish. The problem was how that excitement reset expectations. As Ye explained, “what was once extra effort becomes standard performance.”

This was qualitative, in-progress research at one company, not proof that AI makes every workplace more exhausting. But it identifies a plausible way productivity gains can become difficult to sustain: A burst of experimentation becomes the ordinary workload against which everyone is measured.

The management question is what gets counted as success. If the goal is more ambitious work, admit that the team is spending its gains on ambition. If the goal is lower costs, measure the full cost of completing and maintaining the work before assuming the savings. If people are working longer to hit the new targets, some of the apparent improvement may be coming from additional labor.

I recently wrote about the tools developers are building to manage coding agents. Better tools can help people recover context and finish work. They can’t decide how much work management should expect. A well-organized queue can still contain an unreasonable amount of work.

Spend the gains deliberately

Willison’s own work offers a useful example of what productive AI use can look like. In September, he described a security audit of Datasette using several coding agents. External vulnerability reports prompted the audit, and successive rounds uncovered more problems. Willison and Alex Garcia then divided the work. For most issues, one wrote tests demonstrating the problem while the other implemented the fix. Two humans examined each issue alongside agents using different models. Fixes went into the main development branch, with selected changes also applied to the stable release.

AI helped them discover useful work, and they supplied an explicit process for completing it. The additional findings were valuable precisely because the maintainers acted on them. This account doesn’t tell us how many hours AI saved, but it does show why counting findings alone would miss much of the accomplishment. A longer list of vulnerabilities to fix can be evidence of a better audit, making it absurd to call that a failure because it created work. It would be equally absurd to assume the people fixing them had suddenly become less necessary.

For an engineering leader, that suggests a more useful conversation than demanding another increase in the percentage of code written by AI. Ask the team where the time went. Did a change reach customers sooner? Did the saved implementation time pay for a deeper audit? Did review spill into evenings? These are quite different outcomes, even if the coding agent looked equally impressive in all three.

Then give engineers permission to spend some of the gains on making the next task less demanding. A test that reliably catches a recurring failure, creates a clearer interface, or removes an unnecessary dependency can reduce the decisions someone has to revisit. That work needs room in the plan. Otherwise, every improvement in implementation speed risks being consumed by new features while the cost of understanding the system keeps accumulating.

An enthusiastic experiment also shouldn’t automatically become next quarter’s staffing assumption. Before turning a burst of output into a standing commitment, find out whether the team sustained it within its normal workday, including review and maintenance. People can choose to throw themselves into an interesting project, but that doesn’t establish how much work they can routinely absorb, and it shouldn’t become an obligation for colleagues who didn’t volunteer for the experiment.

Willison is describing demanding work that can be worth doing. That’s a much more credible case for AI than promising that software engineering will become effortless. Enterprises should pursue the additional capability, then budget honestly for the people and time needed to use it. The productivity gain belongs in the plan once. If the bigger road map only works because engineers extend their workday, some of that gain is coming from the engineers working more, with the AI simply serving as taskmaster.

I’ve covered cloud computing for a long time, and one of the most persistent myths I encounter is that public clouds exist above the laws of physics that govern everything else in technology. The events coming out of the Middle East should put that myth to rest for good.

Reuters reported this week that Amazon Web Services says it cannot restore access to its cloud region in Bahrain and to one of its three data-hosting zones in the United Arab Emirates, following damage during the Iran war. The status update is stark reading. AWS admitted that the damage in Bahrain spanned multiple availability zones (AZs) and, in its own words, “exceeded what our regional and multi-AZ services are designed to withstand.” Think about that for a moment. The entire architectural premise of availability zones is that they fail independently, so a multi-AZ deployment survives a localized disaster. The war destroyed that assumption in a single stroke.

The disruptions began in March, after US and Israeli attacks on Iran prompted Tehran to retaliate with missile and drone strikes on Israel and on Gulf states hosting US military bases. Two of AWS’s facilities in the UAE were directly struck, and a drone strike close to a Bahrain facility physically damaged infrastructure there. A second Bahrain availability zone went down in April, and the region became effectively unavailable. In the UAE, AWS says it cannot restore resources and data hosted exclusively in the zone known as mec1-az2. The company has notified authorities in both countries and is helping customers re-establish operations in other regions. AWS expects to provide a UAE restoration update in the coming months, with a Bahrain update not until early 2027. Read that timeline again: Operations interrupted in March may not be resolved until early next year. That’s a year of impact for data and workloads that weren’t migrated in time. Some of that data, I suspect, will never come back.

I bring this up not to pile on AWS. Frankly, no cloud provider could have engineered its way out of a drone strike on the infrastructure surrounding a data center. However, this event reveals something important about how we all think about cloud computing.

Public clouds are not flawless

Here is the uncomfortable truth too many enterprises still refuse to internalize: Public clouds are not magic. They are data centers just like the data centers we’ve been running for decades. They are filled with servers, storage arrays, switches, fiber, and generators. They sit in buildings, near power grids and undersea cables, in countries subject to changing geopolitics. They are susceptible to everything traditional data centers have always been susceptible to: natural disasters, network outages, power failures, human error, and yes, war.

Most companies don’t consider this when they architect their systems, and I get why. It feels remote. But here we are, with a hyperscaler publicly confirming that physical damage from military conflict exceeded its own resilience design. If it can happen to AWS in Bahrain, the question isn’t whether it can happen elsewhere. The question is whether your planning accounts for it.

Cloud providers, to be fair, have done a pretty good job maintaining uptime over the years. But good is not flawless, and 2025 reminded everyone of that in a very expensive way. Last year, major cloud providers, including AWS and Microsoft, suffered significant outages that cost many companies billions of dollars. Here’s the kicker: Many of the companies absorbing those losses weren’t even users of those clouds. They were customers of a software-as-a-service provider or another infrastructure service provider that happened to use Microsoft or AWS to serve their infrastructure.

This idea of a cloud computing supply chain opened a lot of minds last year. Your application might not depend on a hyperscaler directly, but your payroll vendor, your CRM, or your logistics system might. When the cloud beneath your cloud goes down, you go down with it, and you have no contractual relationship with the thing that actually failed. Many have learned the hard way that the durability of their supply chain of cloud computing was a real issue. Cloud computing is susceptible to outages just like enterprise infrastructure always has been, and pretending otherwise is not a strategy.

Build for what you hope won’t happen

So, what should enterprises actually do? The answer is not to flee the cloud, and it’s not to accept whatever happens as an act of God. The answer is to consider possible unforeseen disasters and build them explicitly into your business continuity and disaster recovery plans, rather than assuming the provider will handle everything. Here are three things I would urge every enterprise to consider when evaluating cloud resiliency and trying to eliminate as much risk as they reasonably can.

First, know your complete dependency chain, including your SaaS providers and infrastructure partners, down to the cloud regions and availability zones they run on. Most enterprises discovered last year that they couldn’t answer the question “Which of my critical services depend on AWS?” without weeks of investigation. If your provider’s data center is destroyed, whether by fire, flood, or a missile, you need to know exactly what’s exposed—and before it happens, not after.

Second, design for region loss, not just zone loss. Multi-AZ deployment is table stakes, but Bahrain demonstrates that availability zones are not invulnerable to large-scale physical damage. Genuinely resilient architectures span cloud regions and, in some cases, multiple providers, with data replication and automated failover. Yes, this costs more. Ask yourself what a year of unavailability would cost you, and the math usually changes quickly.

Third, test your recovery like you mean it. A plan that has never been exercised is a document, not a capability. Run game days that simulate the loss of an entire region, including the SaaS providers in your supply chain. Verify your backups exist in a location physically and logically independent of the failure domain. Can you actually restore from them within your stated recovery time and recovery point objectives? The enterprises that came through the 2025 outages best were the ones that had rehearsed failure, not the ones with the thickest disaster recovery binders.

Until recently, war damage to public cloud infrastructure was something none of us put on our risk registers. Now it has a data point attached, with a restoration timeline measured in many months. The cloud remains the right choice for most workloads, and providers earn their reputation on reliability. But reliability at scale is not the same thing as invulnerability. Clouds are physical, and physical things break. Plan accordingly.

Nvidia on Monday rolled out an agentic governance system called the Open Agent Safety Platform that combines software with out-of-band DPU-based silicon in a reference system design that it says will secure agents “from testing to deployment.”

But while the Nvidia design’s silicon-based component provides some cybersecurity advantages, analysts argued that it cannot help with the vast majority of agentic problems.

Nvidia’s offering leverages its OpenShell software and promises “full-stack governance and control across the software and the hardware, compute, and robotics systems that run agents,” the company said in a news release. “OpenShell software provides a secure runtime boundary that traces all actions and enforces policy as agents run on Nvidia Vera CPUs. As open source software, OpenShell can be extended to work with third-party compute platforms, including those from Arm and Intel.”

The Open Agent Safety Platform reference system design features NVIDIA Sentry, an out-of-band watchdog that runs on NVIDIA BlueField-4 DPUs to continuously monitor agent behavior. “Sentry provides in-silicon security enforcement, meaning that if an AI agent attempts to move outside its software boundary, Sentry quarantines and stops it in milliseconds,” the release stated.

In a developer blog post focusing on the details of its “safety platform,” Nvidia described its approach as a “secure runtime that executes autonomous AI agents in sandboxed environments with kernel-level isolation” and argued that “an advantage of open models is that the entire reasoning space and activations are all visible.”

Components of the platform are being rolled out by an extensive list of partners, including Citi Group, JPMorganChase, Citi, Anthropic, Cisco, CrowdStrike, Dell Technologies, Figure, HPE, Hugging Face, Microsoft, Palantir, Palo Alto Networks, Perplexity, Red Hat, Salesforce, SAP, Scale AI, ServiceNow, and SpaceXAI.

A step in the right direction

Lauren Kornutick, a senior director analyst at Gartner, mostly applauded the Nvidia effort, saying that it is “solving a problem from an interesting perspective, at the hardware level. It’s a great step in the right direction.”

But Kornutick said that she was less impressed with the published list of supporters, observing, “some major players are notably missing,” including OpenAI, Amazon, and Google.

Other analysts and consultants said that the technical implementation is impressive and offers distinct benefits, but they stressed that it also misses the big picture in terms of what enterprise CISOs are truly struggling with when trying to manage and secure autonomous agents. 

Limitations

The biggest challenge is that enterprise environments are flooded with agents that have not been approved by either IT or cybersecurity teams. Typically, those teams are not even aware of the credentialed agents. 

“The limit is coverage,” said Brian Levine, a partner with consulting firm Control Risks. “These controls govern agents you deploy on infrastructure you control. They do nothing for the agent a business unit spun up on a SaaS platform, the one embedded in a vendor’s product, or the one an attacker brings with them. You can’t hold an agent to a policy if you don’t know it exists. Discovery and inventory come first and that is a governance challenge as much as a technical one.”

Aman Mahapatra, chief strategy officer for Tribeca Softech, a New York City-based technology consulting firm, agreed about the limitations of the Nvidia offering.

“Enforcement only applies to agents running inside the governed runtime,” he said. “Runtime governance protects the agents you already know about, which is the population that needed it least.”

However, Mahapatra said, that doesn’t mean that the effort is futile. 

“This has a meaningful chance of making things materially better for one specific reason: Sentry runs out-of-band on BlueField-4 DPUs, in an isolated trust domain Nvidia describes as invisible to agents and attackers,” he said. “You cannot reason your way around a control you cannot perceive, and you cannot talk a DPU out of enforcing a policy. Probabilistic reasoning has to be sandwiched between deterministic layers the model cannot influence, with an oversight function that reads everything and writes nothing. Sentry is that principle pushed down into silicon and silicon is the right place for it.”

Brent Ellis, VP, AI Infrastructure at IDC, agreed. He estimated that it addresses “probably less than 25%” of enterprise agentic cybersecurity problems.

Lock-in risk

He added that there is a vendor lock-in element to the offering as well. Although Nvidia today controls a massive, almost monopolistic market share for AI hardware among enterprises, Ellis said that he expects those numbers to drop, because “competitors are starting to emerge as viable,” especially hyperscalers who have invested in designing their own silicon.

But for enterprises that are overwhelmingly Nvidia shops, the hardware approach could make a lot of sense, Ellis said. But will the Nvidia platform have a good chance at making enterprise agentic cybersecurity materially better?

“Yes, for the agents that run inside it,” he said. “That is a big ‘if,’ though. There is a lot of agent infrastructure that is not Nvidia, and architectures in place prior to Vera and Bluefield are limited in which elements of the platform they can adopt.”

With that caveat, Ellis said the news starts to look good. “In environments where you can adopt all the elements, then you can move enforcement out of the model and the application layer, where agents have repeatedly talked or coded their way around controls. And you can then move enforcement into the runtime and the silicon, which is a harder barrier. Sentry specifically makes the DPU a traffic cop that is harder to bypass.”

Then again, he noted, some attacks can still leverage governance weaknesses. 

“Look at how the recent OpenAI incidents unfolded,” he pointed out. “The agents didn’t break the sandbox wall. They walked through a Swiss cheese of environment security: Shared package repositories used as message boards, services that fetched internet content on the agent’s behalf, and unpatched flaws in adjacent systems.”

Avoids strategic mistakes

Frank Dickson, principal analyst at Dickson Research, said he likes Nvidia’s platform because it avoids some of the strategic mistakes made by those trying to secure agentic systems in the past. 

“For two years, this industry has tried to secure agents by asking them to behave, with guardrails bolted into the prompt, the model, and the harness. That approach was always going to lose,” he said. “Nvidia finally puts enforcement where it belongs: outside the agent, in the kernel, in a proxy that inspects every outbound request and in silicon the agent cannot see or touch. You don’t ask the prisoner to lock his own cell. Every serious agent platform will have to match this design.”

Dickson said Nvidia’s approach does not try to stop a misbehaving agent after it is caught, but instead tries to prevent the problem from occurring. 

“OpenShell checks each outbound request against policy before it leaves the sandbox, and its policy prover checks the permissions before the agent runs at all,” Dickson said. “Nvidia claims Sentry quarantines a misbehaving agent in milliseconds.”

That contrasts with the time it took to address the latest agentic problems reported by OpenAI, in which an OpenAI agent bypassed network restrictions to communicate with an external chatbot. “It took a human reviewer just three minutes to acknowledge the DNS alert the system did generate, but it was another two-and-a-half hours before the training run was stopped,” OpenAI reported. 

Not a panacea

Justin Greis, CEO of consulting firm Acceligence, also agreed that the Nvidia approach is solid, but he stressed that AI agents have a well-earned reputation for figuring out ways around such restrictions.  

“We should assume increasingly capable agents will probe boundaries, discover unintended pathways and exploit ambiguity. Security cannot depend upon the agent deciding not to do that,” he said. “But even hardware-enforced controls are only as good as the boundary and policy we give them.”

He pointed out that an agent does not necessarily need to evade a security control if the user accidentally authorizes a legitimate path that produces a dangerous outcome. “Misconfigured permissions, excessive authority, combinations of individually harmless capabilities, compromised third parties and activity occurring outside the governed environment remain very real problems,” he said.

This article originally appeared on CSOonline.

OpenAI has paused training, evaluation, and inference involving tool use for its most-capable AI models after an agent bypassed network restrictions to communicate with an external chatbot during reinforcement-learning training of an internal research model.

“Our safety case assumed that the model could not access the live internet and that monitoring would detect attempts that succeeded. The incident exposed a gap in our controls over network restrictions,” the company wrote in a new Misalignment Report about the incident, one of three it published Friday.

It said it would only resume training after the “gap is resolved” and it has further tested the system.

The incident occurred during a research task in which the model was asked to identify a person using information available on the web. When its normal web-search tools failed to produce the information it needed, the model began looking for another way to access the internet, the company explained in the post.

The model recognized that while direct internet access was blocked, the environment still allowed DNS queries. It then used DNS as an indirect communication channel to send requests to an external chatbot, effectively circumventing the network restriction that was supposed to prevent it from accessing external services, OpenAI said.

Existing controls might not be enough

For enterprises and their CIOs, however, despite the model not being released, the incident raises critical questions about whether existing security and governance controls can keep pace with unexpected model behavior as AI agents gain greater autonomy and access to enterprise systems, analysts said.

“Traditional security controls might not be enough for AI agents as these controls are designed around known access paths, such as applications connecting to approved APIs or databases. AI agents introduce a different challenge because they can explore alternative ways to achieve a task when their intended route is blocked, including using permitted tools or protocols in unintended ways,” said Abhishek Satapathy, principal analyst at Avasant.

This requires “independently enforced controls around tool invocation, network egress, and data access alongside their existing security controls to ensure that restrictions hold even when an agent attempts an unauthorized action,” Satapathy said.

His view is echoed in a 2026 paper co-authored by researchers from Google, Qualcomm, Meta and several universities, which argues that security guarantees need to be enforced at the system level rather than relying solely on model-level safeguards.

More precisely, enterprises should tighten restrictions on outbound connections and DNS resolution, giving agents handling sensitive data only approved and logged pathways for external communication to reduce the risk of data exfiltration, unauthorized external communication and other unintended actions, said Amit Kumar Jena, AI development head at IT consulting firm Kanerika.

“Security teams should also deploy monitoring systems that alert humans in the loop to unusual traffic patterns and failed attempts to reach unauthorized destinations, particularly from code-executing agents capable of finding unconventional ways to accomplish tasks,” Jena added.

The AI slipped through operational gaps

The challenge, though, is that in this case OpenAI did have such monitoring systems, and it did have humans in the loop: They just didn’t work as expected.

It took the monitoring system over 10 minutes to raise an alert in response to the agent’s abuse of DNS — and, said OpenAI, there were other incidences of external DNS access that the system did not flag.

It took a human reviewer just three minutes to acknowledge the DNS alert the system did generate, but it was another two-and-a-half hours before the training run was stopped. OpenAI blamed the delay on the failure of an automated system: “The run did not stop automatically as expected, leading to confusion around whether it should have been stopped,” it said in its report.

The company said it is addressing the operational gaps, reinforcing its detection of DNS use by models under examination, and improving its testing of the detection systems.

“We have also accelerated additional model-assisted red-teaming of the sandbox and network controls. These red-teaming efforts might surface other transitive internet access paths, in which case we will remediate swiftly, and pause research workloads if appropriate,” OpenAI wrote.

However, imposing these additional layers of security, governance, testing, and human oversight comes with problems of its own.

These additional layers will impact the degree of autonomy models can achieve, Satapathy said. “In workflows involving sensitive data, external connectivity or consequential actions, additional controls, testing and human oversight can limit the extent to which tasks can be fully automated.”

This article first appeared on CSO.

The move from proof of concept or prototype to production is a common stumbling block for AI projects, and one that database services provider pgEdge is keen to help enterprises overcome.

AI applications often start with developers reaching for Postgres because it gives them a database that can handle an application’s operational data while supporting AI-related capabilities such as vector search, enabling them to build a prototype without adding another specialty vector database to the stack.

When that prototype matures into something that enterprises want to run at scale, though, the Postgres setup that worked for experimentation may not meet the enterprise’s requirements for security, high availability, geographic distribution, data sovereignty, or deployment control.

In that scenario, developers find themselves reworking the infrastructure beneath an application that is otherwise ready to ship, turning the move from prototype to production into an architectural exercise of its own.

Database services provider pgEdge aims to help developers avoid that difficult transition with a new Postgres cloud platform named Starfleet that will enable developers to build AI applications on Postgres and carry them into production without having to rework the underlying database infrastructure.

Developers can start on pgEdge’s cloud while building the prototype and move the same Postgres platform to their own cloud or on-premises infrastructure, including air-gapped environments, the company said.

Starfleet also packages pgEdge’s distributed Postgres database with agentic AI capabilities such as an MCP server to connect to coding agents and RAG servers, enabling developers to build agentic applications that scale from a single Postgres instance to multi-region clusters for high availability and zero downtime, it added.

Starfleet could help enterprises scale agentic apps

Analysts see Starfleet addressing a genuine enterprise problem, particularly around scaling agentic applications.

“The prototype-to-production gap is real, and it’s one of the most common places AI projects stall today. Enterprise users build applications with AI coding tools on hosted Postgres, and those apps reach IT without high availability, compliance controls, or an on-premises option. So, IT ends up killing the app, rebuilding it on a different database, or negotiating the security risk,” said Michael Leone, principal analyst at Moor Strategy and Insights.

In contrast, Starfleet’s flexible deployment options give IT teams a way to take those applications into enterprise environments without having to replace the underlying Postgres platform, helping them move applications into production faster and scale them more quickly, he said.

That reduction in the need to rewrite applications can also help CIOs address concerns around shadow IT, according to Ashish Chaturvedi, executive research leader at HFS Research.

“Enterprise teams are presently building applications without waiting for IT, and a CIO can either pursue those applications after the fact or provide a platform that meets security standards from the outset, creating a sanctioned destination for citizen-built AI applications, and a single Postgres standard across every environment with Starfleet,” Chaturvedi said.

The same standardization could also help CIOs address challenges around moving workloads while meeting data sovereignty requirements.

Since Starfleet can run in pgEdge’s cloud, a customer’s cloud, or an air-gapped environment, it enables enterprises to move workloads between those environments without switching to a different database platform in order to meet regulatory requirements, Chaturvedi said.

That can be particularly important for government, defense, and financial services organizations, where sensitive workloads may otherwise require a separate database stack for restricted environments, he said.

There are advantages for developers too. “The biggest win for developers is not having to rewrite the app for production,” Leone said.

Starfleet’s appeal may be strongest in regulated enterprises

Taken together, those advantages could make Starfleet more attractive to teams building AI applications for enterprise use, particularly in regulated sectors, primarily because Starfleet addresses developers’ concerns around working with modern coding tools through its MCP server and provides the flexibility to move applications into production without rewrites, Chaturvedi said.

However, it might face a “scale and visibility” challenge from competitors such as Neon and Crunchy Data as they have significantly larger resources behind them in the form of Databricks and Snowflake respectively, he added.

Starfleet is generally available.

The move from proof of concept or prototype to production is a common stumbling block for AI projects, and one that database services provider pgEdge is keen to help enterprises overcome.

AI applications often start with developers reaching for Postgres because it gives them a database that can handle an application’s operational data while supporting AI-related capabilities such as vector search, enabling them to build a prototype without adding another specialty vector database to the stack.

When that prototype matures into something that enterprises want to run at scale, though, the Postgres setup that worked for experimentation may not meet the enterprise’s requirements for security, high availability, geographic distribution, data sovereignty, or deployment control.

In that scenario, developers find themselves reworking the infrastructure beneath an application that is otherwise ready to ship, turning the move from prototype to production into an architectural exercise of its own.

Database services provider pgEdge aims to help developers avoid that difficult transition with a new Postgres cloud platform named Starfleet that will enable developers to build AI applications on Postgres and carry them into production without having to rework the underlying database infrastructure.

Developers can start on pgEdge’s cloud while building the prototype and move the same Postgres platform to their own cloud or on-premises infrastructure, including air-gapped environments, the company said.

Starfleet also packages pgEdge’s distributed Postgres database with agentic AI capabilities such as an MCP server to connect to coding agents and RAG servers, enabling developers to build agentic applications that scale from a single Postgres instance to multi-region clusters for high availability and zero downtime, it added.

Starfleet could help enterprises scale agentic apps

Analysts see Starfleet addressing a genuine enterprise problem, particularly around scaling agentic applications.

“The prototype-to-production gap is real, and it’s one of the most common places AI projects stall today. Enterprise users build applications with AI coding tools on hosted Postgres, and those apps reach IT without high availability, compliance controls, or an on-premises option. So, IT ends up killing the app, rebuilding it on a different database, or negotiating the security risk,” said Michael Leone, principal analyst at Moor Strategy and Insights.

In contrast, Starfleet’s flexible deployment options give IT teams a way to take those applications into enterprise environments without having to replace the underlying Postgres platform, helping them move applications into production faster and scale them more quickly, he said.

That reduction in the need to rewrite applications can also help CIOs address concerns around shadow IT, according to Ashish Chaturvedi, executive research leader at HFS Research.

“Enterprise teams are presently building applications without waiting for IT, and a CIO can either pursue those applications after the fact or provide a platform that meets security standards from the outset, creating a sanctioned destination for citizen-built AI applications, and a single Postgres standard across every environment with Starfleet,” Chaturvedi said.

The same standardization could also help CIOs address challenges around moving workloads while meeting data sovereignty requirements.

Since Starfleet can run in pgEdge’s cloud, a customer’s cloud, or an air-gapped environment, it enables enterprises to move workloads between those environments without switching to a different database platform in order to meet regulatory requirements, Chaturvedi said.

That can be particularly important for government, defense, and financial services organizations, where sensitive workloads may otherwise require a separate database stack for restricted environments, he said.

There are advantages for developers too. “The biggest win for developers is not having to rewrite the app for production,” Leone said.

Starfleet’s appeal may be strongest in regulated enterprises

Taken together, those advantages could make Starfleet more attractive to teams building AI applications for enterprise use, particularly in regulated sectors, primarily because Starfleet addresses developers’ concerns around working with modern coding tools through its MCP server and provides the flexibility to move applications into production without rewrites, Chaturvedi said.

However, it might face a “scale and visibility” challenge from competitors such as Neon and Crunchy Data as they have significantly larger resources behind them in the form of Databricks and Snowflake respectively, he added.

Starfleet is generally available.