Snowflake announced Cortex AI Gateway on Tuesday, a centralized control layer designed to govern how AI agents — including those built by competitors like Anthropic's Claude Code and Cursor — access enterprise data, tools, and models. Alongside the gateway, the company unveiled a first wave of security integrations with 1Password , Aembit , Linx Security , SailPoint , and Saviynt , an unusual lineup of identity vendors who often compete with one another, now aligned around a shared trust model for autonomous agents. The announcement, made from the company's no-headquarters base in Bozeman, Montana, is Snowflake's most aggressive move yet to position itself not merely as the place where enterprise data lives, but as the control plane that decides what AI agents are allowed to do with it. "The next era of AI won't be built through more walled gardens. It will be built through secure agent interoperability," Mayank Upadhyay, Snowflake's chief security and trust officer, told VentureBeat in an exclusive interview. "If every vendor builds a closed ecosystem of agents, enterprises simply recreate the fragmentation they've spent years trying to solve. Instead of breaking down silos, they create a new generation of AI silos that limit innovation and make it harder to scale AI across the business." Why decades-old enterprise security models break when AI agents become the actors The core argument animating today’s announcement is that decades of enterprise security architecture rests on an assumption that no longer holds — that the actor behind every access request is a person. "Traditional security was built for a world where humans were the actors. AI agents change that completely. For decades, security models assumed people would access one application at a time, operating at human speed and within relatively defined boundaries," Upadhyay said. The deeper issue, he argued, is not novelty but exposure: "The challenge isn't that AI creates entirely new security problems. It's that AI exposes the blind spots we've always had." Organizations have never had perfect visibility into every API, dataset, and workflow, Upadhyay noted, and at human speed those gaps were manageable. Agents operating at machine speed can "combine access across systems and act on permissions that were never intended to be exercised together, amplifying those longstanding risks." His conclusion: "In the agentic era, trust can't be a one-time decision made at login. It has to be continuously verified through every agent, every action, and every interaction across the enterprise." Nancy Wang , chief technology officer of 1Password, described the failure mode in more visceral terms. When agents first arrived, she told
VentureBeat
, the default pattern was dangerously simple: "Let me just give the agent my credentials and it can just act as me... let's imagine you're the head of security or the head of IT, and you have access, especially admin access, to all of the systems. Well, now suddenly your agent now has admin access to all of the systems, and so it could exfil data... if it's subject to a prompt injection, for example." The audit trail becomes equally useless, she added: "Imagine the audit logs show that Michael sent a couple million dollars to an offshore account... It raises eyebrows when, in fact, it could just be an agent going off the rails and doing things that you never authorized." Her prescription, and the premise of 1Password's integration with Snowflake, is blunt: "Agents need their own identity." Inside Cortex AI Gateway: how Snowflake plans to govern agent access and rein in runaway AI costs Cortex AI Gateway , which will enter public preview soon, functions as a connective layer for what Snowflake calls "all trusted agent activity." It governs both first-party agents built inside Snowflake, such as Snowflake CoWork and CoCo, and third-party agents built on external platforms. With support for more than 100 MCP servers — the Model Context Protocol connectors that have become the de facto standard for wiring agents to enterprise tools — the gateway centralizes access policies, authentication, permissions, and audit logging in a single place. The gateway also addresses a less glamorous but increasingly urgent problem: runaway AI spending. It gives IT and finance teams a unified view of AI consumption, attributes costs to the specific teams, agents, or workloads driving them, and enforces spending limits before bills spiral. Upadhyay described how those costs compound in practice. "AI is dynamic. Agents can invoke multiple models, call different tools, and execute multi-step workflows, creating consumption patterns that can change from one task to the next. For example, an enterprise may deploy an AI assistant to help employees answer internal questions. A simple request that only requires retrieving a document could unintentionally be routed through a more expensive reasoning model, trigger additional searches across multiple systems, or invoke unnecessary workflows." At scale, with thousands of employees and hundreds of agents, small inefficiencies become significant line items. The gateway builds directly on Snowflake's May 2026 acquisition of Natoma , a 27-person startup whose centralized MCP gateway enforced identity, policy, and audit at the tool-call level. Forbes reported at the time that the deal — announced the same day as Snowflake's $1.33 billion quarterly product revenue report and a $6 billion AWS compute commitment — was the smallest of the day's three announcements by dollar value but the most revealing about where Snowflake believes the next platform fight sits: not in the data warehouse, but in the layer that decides what an agent may touch and records what it did. Dual attribution and task-scoped access: the technical blueprint for trusting autonomous agents The technical centerpiece of the partner integrations is what Snowflake calls dual attribution. "By logging both the verified non-human identity of the agent and the specific human who authorized the task, we ensure task-scoped access and complete auditability for every action taken across the enterprise," Upadhyay said. That answers a question that has stumped security teams: when an agent takes an action, whose action is it? The Snowflake model says the answer is both — the agent's, and the human's who delegated the task — and both must be recorded. Task-scoped access is the companion principle. Rather than inheriting a user's full standing permissions, an agent gets access only to what a specific task requires. Upadhyay acknowledged the obvious objection — agents are dynamic and their next step often isn't known in advance. "The goal isn't to predict every action an agent will take. It's to ensure that every action an agent takes is evaluated in real time against the appropriate policies, scope, contextual signals, and the original intent of the user," he said. Wang explained how 1Password's piece works at the protocol level, pointing to emerging standards like OIDC-A : "the human, for example, first authorizes the agent to do a specific task, and then what that means is the agent will then receive sort of the delegated task specific token... as part of that token, that is where you learn of the original sort of delegator identity and also the intent behind the task." The intent-preservation problem is subtle, she noted, because enterprise tasks decompose into enormous chains of individual operations. "When they're accessing a table, you know that it's acting on behalf of the original intent that you gave that agent... a task might be a compilation of hundreds, maybe even thousands, individual actions." Keeping that intent intact across every step in the chain — and flagging the moment an agent deviates from it — is what Snowflake and its partners are ultimately trying to standardize. SailPoint's field report: the three ways enterprise identity systems fail against AI agents Chandra Gnanasambandam , SailPoint's EVP of product and chief technology officer, brought the perspective of a vendor that has watched enterprises break their identity stacks against this problem for more than a year. SailPoint has been in the machine and agent security market for roughly 18 months, he said, with more than 100 customers on its agent identity product — enough of a sample to catalog the recurring failures. The first is scale-driven shallowness. An average Fortune 500 company has roughly 16,000 employees, and SailPoint is seeing human-to-non-human identity ratios of at least 10 to 1 — before counting the tools and APIs each agent touches, which multiply the count again. "You will get into a million plus non-human identities. Mapping the permissions that each of them get to the 16,000 humans is a completely non-trivial task," he said. Most companies punt, mapping agents to humans at the directory-group level. "That is grossly insufficient. You want to have fine grain context. Like I said, it's not access to Snowflake. It's access to what column and what data inside Snowflake you need." The second failure mode is drift. Modern models are relentless goal-seekers, and that persistence cuts both ways. "When you tell them get this done, the underlying models are so powerful now. Even the weaker models are so powerful. They will go find a way to get it done... They will go find the vulnerabilities to bypass the permission to get it done," Gnanasambandam warned. The answer, he argued, is runtime monitoring of the entire interaction chain, compared continuously against policy, with automatic intervention when an agent escalates beyond what its human delegator authorized. The third is missing data context. Many vendors, he argued, announce splashy integrations with big application platforms while ignoring where the actual risk concentrates. "That's not where the risk lies. Risk lies in sensitive data, so the details matter here... Can you map specific columns and rows in Databricks, Snowflake, Redshift, Oracle... into the agent context and the human context? And if you can't do that, you are going to have gaps and holes." SailPoint's answer required tearing out two decades of architecture. "We rewrote our underlying data and object model to treat AI identity as a first-class object, because for 20 years, SailPoint had a data model and object model that supported the human identity, and AI identities are fundamentally different," Gnanasambandam said, describing 12 to 18 months of deep engineering work. The result is what he calls a unified lineage: "From human to master agent to sub agent to tool to application to data. That's what I call the steel chain. That is in one data model, one platform." Why rival identity vendors joined Snowflake's trust framework — and what each side gets out of it Perhaps the most striking aspect of today’s announcement is the roster. 1Password , SailPoint , Saviynt , Okta , and Aembit compete for overlapping identity and access budgets. Snowflake convinced them to build against a common trust framework anyway. "The reason we brought together leaders across the security ecosystem is because no single company can solve the agent security challenge alone. AI agents can't deliver real value if they only operate within the boundaries of one platform," Upadhyay said. His broader thesis frames the whole strategy: "Nobody wants to replace data silos with AI silos." Wang offered a pragmatic division of labor: "We bring the trust, and Snowflake brings a system of record." She framed the collaboration as classic defense in depth — "there are data level controls, and there are identity level controls, and so together we can create a much stronger ecosystem play." There is self-interest in the openness, of course. Snowflake sits atop an enormous concentration of sensitive enterprise data — more than 13,900 customers, by the company's count — and every third-party agent that touches that data through a governed Snowflake gateway deepens the platform's gravitational pull. As Constellation Research analyst Michael Ni put it when the Natoma deal was announced, in comments reported by CIO.com : data platforms won the analytics era, and whoever governs agents, context, and autonomous actions wins the agentic one. A Forbes analysis of the same acquisition flagged the tension directly, noting that a governance layer living inside Snowflake risks pulling MCP's openness back toward a single vendor's control plane — attractive for Snowflake-standardized shops, more awkward for genuinely multi-vendor agent stacks. Analyst forecasts show agent governance is now a trillion-dollar race against the clock The urgency behind today’s announcement is not manufactured. Gartner predicts that by 2027, governance gaps discovered only after production incidents will force 40% of enterprises to demote or decommission autonomous AI agents — with analysts there warning that the greatest risk an agent poses often lies not in its output but in the actions it is empowered to take. IDC, meanwhile, expects more than 1 billion actively deployed AI agents by 2029 , executing roughly 217 billion actions per day, and forecasts agentic AI will exceed $1.3 trillion in worldwide IT spending that year. The research firm's analysts now argue agentic platforms should be treated as decision infrastructure, not productivity software. Against that backdrop, the identity layer is becoming the contested ground, and every major vendor — Salesforce , ServiceNow , Microsoft , Google , Okta — is racing toward the same runtime-governance chokepoint. Snowflake's differentiator is proximity to the data itself. As Upadhyay put it, security "can't just be an API proxy sitting in front of an LLM. It has to anchor all the way down into the underlying data layer, enforcing zero-copy boundaries, dynamic data masking, and real-time exfiltration safeguards before an agent ever touches a row of data." The rollout now moves to proving ground. Cortex AI Gateway enters public preview soon, and the five partner integrations enter private preview, a phase Wang described as a deliberate feedback loop — customers on day one get an agent-access broker plus "a full audit log that will show you, for example, what that agent is actually doing," even when an agent deviates from its intent. Gnanasambandam, characteristically, wants enterprises to skip the easy demos entirely, urging customers to bring loan-origination workflows spanning three clouds and ten applications, half of them mainframes: "Give us that complex use case and bring anyone on and do it in your context, and we will take the challenge with anyone in the world." That confidence — from a field of rivals, no less — captures what makes this moment unusual. The companies that spent the last decade fighting over who verifies human identity have concluded, more or less simultaneously, that the next decade belongs to whoever can verify the machines acting on our behalf. Upadhyay distilled the wager into a single line: "The future of AI won't be won by the organizations with the most agents, but by the organizations that can govern those agents with the most trust, visibility, and control." In the agentic enterprise, it turns out, trust isn't the guardrail. It's the product.
The Model Context Protocol , the open standard that has quietly become the connective tissue between AI agents and the world's software, is getting its largest update since Anthropic released it twenty months ago — a sweeping architectural revision that its maintainers and backers say finally makes agentic AI ready for massive enterprise production deployments. The update, released today under the stewardship of the Agentic AI Foundation (AAIF) , a directed fund under the Linux Foundation , finalizes MCP's transition to a fully stateless architecture, hardens its authentication model against a known class of attacks, establishes a formal 12-month deprecation policy, and graduates two headline capabilities — interactive server-rendered interfaces and long-running asynchronous tasks — into official protocol extensions. The changes may sound arcane. Their consequences are anything but. According to the announcement, running MCP at scale has historically required "sticky routing" or shared state to maintain continuity across sessions — an operational burden that made large production deployments complex even when the underlying capabilities were simple. The new release removes that bottleneck entirely, letting organizations run MCP servers behind standard load balancers using the Kubernetes and cloud-native DevOps tooling they already operate. "Some people jokingly call it a v2, and I think in spirit that's accurate," David Soria Parra, MCP's co-creator and a lead maintainer at Anthropic, told VentureBeat in an exclusive interview. "It's probably the biggest change we've ever made to the protocol, and with that, it's a big step up in maturing it for use by really big players." Why stateless architecture is the key to running AI agents at enterprise scale To understand why the industry's largest companies pushed for this release, it helps to understand what was broken. Under the old design, an MCP client — the AI application making requests — had to maintain a persistent session with a specific server instance. In modern cloud environments, where fleets of interchangeable compute nodes spin up and down behind load balancers, that requirement was poison. If the specific server holding your session state disappeared, your agent's work disappeared with it. "Before, you needed to have a session store and manage session IDs — and if one of your compute pods went down, all of a sudden the requests would start failing," said Den Delimarsky, a lead maintainer of the protocol, in an interview with VentureBeat. "That's not going to be a problem with the new version of the protocol. That's a huge unlock, and it's one we collaborated with folks across many companies to put together." Mazin Gilbert , executive director of the AAIF and a veteran of Google and AT&T, framed the change in historical terms — comparing it to the architectural decision that made the web itself possible. "That stateless capability enables your MCP client to speak to a load balancer that connects with any server. You don't need the stickiness," Gilbert told VentureBeat. "You could not have the internet we have today if my browser couldn't speak to any website — with any server supporting that connection. You can switch between servers behind a load balancer." Gilbert said the constraint had become the primary blocker for companies trying to move AI agents from pilots into production. "I've come across companies who are deploying tens of thousands of agents, and you cannot do that without having to go in this direction," he said. Crucially, he argued, the obstacle was never the AI itself: "It wasn't the technology, it wasn't the business case, it was really these fundamental changes that were required." The tension is nearly as old as the protocol. A public design discussion opened by MCP co-creator Justin Spahr-Summers on GitHub in December 2024 — just weeks after launch — flagged that MCP's long-lived, stateful connections were limiting for serverless deployments, and sketched three possible paths forward, including the fully stateless option the protocol has now largely embraced. Engineers from Vercel , Cloudflare , Shopify , and Amazon weighed in over the following months, a preview of the multi-vendor collaboration that would eventually define the project. The core maintainers formally committed to the direction at a December 2025 meeting on the future of MCP transports, according to the announcement. The trade-offs of removing state from the Model Context Protocol Protocol design is a game of trade-offs, and the maintainers were unusually candid about what this one cost. First, payloads get bigger. "A lot of the state doesn't disappear, but it's moved back and forth with the server on the wire, at the actual transport layer," Soria Parra explained. "You get bigger payloads in return for statelessness — but luckily they're very compressible and very well understood, and still fairly small in comparison to an HTTP request on the web." Second, a handful of rarely used capabilities are gone or narrowed. Out-of-band server logging — where a server could push informational log messages to a client at any moment — no longer works in the new model. The team did its homework before cutting it: "As part of the whole exercise, we scraped all of GitHub and looked at who is using it — and it's basically nobody," Soria Parra said. Those affected amount to "probably a handful of people — quite literally a handful of people." He even allowed himself a moment of engineering self-deprecation. "I'm sad that things I thought were useful turned out not to be useful," he said. "I think one of the bigger trade-offs was more about my ego than any actual limitation of the protocol." Delimarsky argued the shift is less a removal of state than a deliberate transfer of responsibility. "With statelessness, we did shift the responsibility of creating and managing state to the developers — but very intentionally so," he said. Under the old protocol, "a lot of folks had a hard time understanding: Do I need to use this? Where do I use this? How do I use this? Removing that burden basically says: look, now you can manage state in the way that makes sense for your environment." For most developers, migration should be nearly painless, because the vast majority of the ecosystem builds on official SDKs in TypeScript, Python, C#, Rust, Java, and other languages, which will absorb the changes. "One of the key things we constantly do is double-check that the upgrade path is minimal — to the point where any model in the world will probably one-shot it for you," Soria Parra said — a telling remark in itself, reflecting an era in which protocol maintainers now design migrations to be trivially executable by AI coding assistants. How a 12-month deprecation policy gives enterprises the stability guarantee they demanded Perhaps the most enterprise-flavored feature of the release isn't code at all. It's a policy. The new formal deprecation framework guarantees developers a minimum of twelve months between a feature's formal deprecation and its earliest possible removal — the kind of stability contract that lets a Fortune 500 engineering organization commit to a specification without fearing silent breakage. The number wasn't picked arbitrarily. "We consulted with folks like Google, Microsoft, and Amazon to find out: in your deployment environment, what's the right path for making these kinds of changes?" Delimarsky said. "Twelve months seemed like the reasonable middle ground." He stressed that features are not being torn out on a whim: "It's not about ripping stuff out of the protocol just because we don't like it. There's a very, very strong industry pull behind these changes." Soria Parra added that the maintainers' own telemetry supports the figure — most of the ecosystem upgrades within six to eight months — and stressed that the window functions more as a listening period than a countdown clock. "It just says that in 12 months we are open to remove it, but both Den and I can change our minds based on feedback," he said. "I think it's more of a feedback period than a definite period." Gilbert sees the policy as one leg of a three-legged stool of enterprise trust, alongside open standards and stateless scale. "There are companies deploying things at a smaller scale, but they're slowed down because of MCP's authorization gap, because of identity, because of — do they trust the deprecation policy? Things could change basically any day," he said. Those companies, he argued, "are going to benefit not because of the statelessness. They're going to benefit because of the security." New authentication hardening closes OAuth mix-up attacks before hackers could exploit them The release also ships significant authorization hardening, aligning MCP's auth specification with how OAuth 2.0 and OpenID Connect are actually deployed in practice. Most notably, the protocol now enforces mandatory validation of the issuer (iss) parameter — a protocol-level defense that, according to the announcement, closes an entire class of so-called mix-up attacks, in which a client can be tricked into associating an authorization response with the wrong identity server. Was anyone actually attacked? No, Delimarsky said — this was preventive engineering, not incident response. "This is not something that is gated in any existing vulnerabilities or active exploitation," he said. "This is more of us engaging directly with the security community." The philosophy, he explained, is to borrow rather than invent: "MCP as a protocol is very much establishing the pattern of: we do not want to reinvent the wheel, but we also want to be at the forefront of a lot of the security innovation." That posture is most visible in the new Enterprise Managed Authorization extension , developed in close collaboration with identity provider Okta, which lets organizations make their corporate identity provider the authoritative gatekeeper for MCP server access. "If I'm somebody that manages tens, hundreds of MCP servers for my organization, I want to make sure that I enforce some level of common governance, where folks auth with their corporate credentials and not their personal credentials, so that the client doesn't send data to sources that are unauthorized," Delimarsky said. Okta bootstrapped the underlying open standard, he noted, and the maintainers then worked "to make sure that it's adopted ecosystem-wide, and it's not something that is specific to only one vendor or provider." More is coming: Delimarsky said proposals are already on deck for demonstrated proof-of-possession and workload identity federation — capabilities requested by security teams running MCP in production. Gilbert connected the work to a broader maturation: "MCP has now bridged that gap with these authorization protocols, so it's basically now becoming what we call enterprise ready, versus an open lab sort of experiment." MCP Apps and Tasks become official extensions, pushing AI agents beyond text responses Two capabilities graduate to official extension status in this release, taking advantage of a new framework that lets extensions evolve on their own timelines, independent of the core specification — a structural choice that lets the protocol grow without bloating its core. MCP Apps allows servers to ship rich, interactive, server-rendered user interfaces directly into AI clients — moving agent output beyond walls of text toward dashboards, forms, and visualizations, and dramatically accelerating development of user-facing agentic applications, according to the announcement. MCP Tasks tackles the reality that not every tool call finishes in one round trip. Instead of holding fragile, long-lived connections open while a batch job or heavy computation grinds away, servers now return a durable task handle; clients can disconnect, crash, restart, and resume polling. "You've been processing some audio for a podcast or a video — it can notify back the client and say, hey, the task is done. You don't need to wait and keep the stream open," Delimarsky said. A third addition, multi-round-trip requests, lets servers and clients negotiate back and forth within a single logical operation. "It's not just a one-shot — over the stream, get the input and you're done," Delimarsky said. "You can actually interact, server to client, to get the right parameters to execute an action." Soria Parra emphasized that these capabilities emerged from the same source as the architectural overhaul: heavyweight production users. "This is a version that came together by some of the best distributed systems experts at Microsoft, Google, and others coming together and working on this for their specific needs — and the needs of the industry at large," he said. How independent is MCP from Anthropic under Linux Foundation governance? Anthropic created MCP in November 2024 and donated it to the newly formed AAIF under the Linux Foundation in December 2025, alongside founding projects from Block and OpenAI . Seven months later, the independence question still hangs over the project — and both sides addressed it head-on. Soria Parra was disarmingly direct about the residual power he holds. As lead maintainer and Anthropic employee, "I do have veto rights, technically," he acknowledged — "but I think we have never actively used it in any kind of discussion." The core maintainer group now spans Anthropic , Microsoft , OpenAI , Google , and Amazon , with contributions from companies like Block, and key decisions "are usually unanimous," he said. "Technically we have a lot of influence; de facto, we're not exerting any of it." He added that governance will progressively broaden: "As the project progresses, we will increasingly move to more different governing structures that include more and more people." Gilbert, who has helped stand up multiple foundations during his time working with the Linux Foundation , offered the numbers behind the neutrality claim. The AAIF has grown from roughly 40 members at its December inauguration to 240 today — "the fastest growing foundation" in Linux Foundation history by membership, he said, "signing up one member every day." Anthropic's share of contributions, by his estimate, has fallen below half. "Holding control of a project doesn't make it an open standard," Gilbert said. "You have to let go. You have to contribute, and you have to grow the pie and the community. And Anthropic has done an incredible job doing exactly that." Notably, the foundation's membership has expanded well beyond tech vendors into retail, finance, and telecom companies — adopters who, Gilbert says, "are no longer just deploying the protocols. They want a voice, and they want to be at the table to influence the protocol from the get-go, and that's something we have not seen before." The roster now includes CERN and, tellingly, Consumer Reports — "because somebody has to defend consumers when this internet of agents comes alive." Keeping one global AI agent standard amid US-China technology tensions The AAIF is betting that neutrality can hold even amid geopolitical friction. The foundation will host AGNTCon and MCPCon events this fall in Shanghai, Tokyo, Amsterdam, and San Jose, with additional events planned in South Korea, Nairobi, and Toronto, and Gilbert said he is personally investing in growing membership across Asia and India, where he sees underdeveloped growth markets for the foundation. His answer to the geopolitics question was emphatic model-agnosticism. "We're completely agnostic to what the model is, whether the model is Kimi, or Gemma, or a frontier model from Anthropic, or from anybody," he said. "Every model will have to support MCP — whether it is a Chinese model or whether it is a U.S. model, it doesn't matter. The protocols must be open, standardized." The logic is economic as much as diplomatic. Enterprises, Gilbert argued, increasingly pick models "left, right, and center" based on the task at hand — and no model, regardless of national origin, "can provide value to an enterprise 500 customer company unless you have the protocols open, standardized." In his telling, the foundation exists precisely to provide neutral ground: a place "where competitors who compete furiously during daytime" can "come to a neutral room and debate, converse, align, consolidate, and drive open standards of how the Internet of Agents will evolve." That framing echoes his favorite historical analogy. HTTP earned global trust, he said, because of three things: an open standard, stateless scalability, and neutral governance under a standards body. "If I were a Fortune 500 company looking at how I trust the internet, I'd need those three things to fall into place — and they were not in place a year ago. They were not in place even six months ago. But they are in place today." What 250 million weekly SDK downloads reveal about the future of agentic AI The scale of what's now riding on this specification is difficult to overstate. Soria Parra said SDK downloads have doubled in the past six months, reaching roughly 250 million per week — "which is just insane numbers." For context, Anthropic reported 97 million monthly downloads across just the Python and TypeScript SDKs when it donated the protocol in December 2025. Delimarsky pointed to that same adoption curve as his preferred success metric going forward: "There is certainly a certain inflection point where this is no longer just an open source project. This is a substrate for a lot of the agentic workflows that we see across enterprises, across startups, across all sorts of companies." Success, the maintainers say, will be measured in server counts on the new specification, in feedback flowing through working groups, GitHub discussions, and the project's Discord — and in whether the biggest drivers of the changes, Microsoft and Google among them, ship on it. "They are effectively the ones who have been driving a lot of the changes," Soria Parra said. "Every early indication we have — it looks very, very positive." Both maintainers closed on the same note: this release belongs to no single company. "If you look back 18 months ago, when it was an Anthropic-only project, and then 12 months ago, where there was a lot of engagement — now it's a truly global community," Soria Parra said. "I'm incredibly proud of what they have worked together." Delimarsky, "being very unoriginal," seconded him: the release "would not be possible without a large community of folks that are also volunteering a lot of their own time in making MCP successful." Gilbert, meanwhile, is already looking past this release — toward how MCP interlocks with the AAIF's newly announced Agent Gateway project for traffic management and policy enforcement, and toward agentic commerce, where MCP serves as the discovery layer letting merchants expose products and services to AI agents. The web took thirty years to become invisible infrastructure that billions trust without thinking. By Gilbert's reckoning, the internet of agents is "in its first, second year" — and as of today, it finally has plumbing built to carry the load.
Presented by Vijil In dynamic environments where users, data, workflows and attack techniques change continuously after deployment, AI agent trust has become a runtime problem. Most organizations still treat trust as a pre-deployment exercise, declaring an agent production-ready and launching it after it passes sandbox evaluations and performs successfully in security tests. Unfortunately, that trustworthiness breaks down the moment an agent begins interacting with the real world. "The core of the problem is that CIOs and business owners think about AI systems the way they think about SaaS or mobile applications, which do not respond dynamically to the world around them," says Vin Sharma, Founder and CEO of Vijil. "Agents, by the textbook definition, are meant to perceive their environment, reason, act, observe the consequences, and learn from the gap between expectation and reality. The problem is that the models underneath them are built from static training data, and that picture of the world is already outdated by the time they reach production." Why benchmark scores fall short for agentic system trustworthiness Traditional AI evaluations offer a point-in-time assessment of agent capability, rather than trustworthiness. There are three reasons why that assessment fails to predict real enterprise behavior: First, benchmarks are static, built around a particular notion of what good performance means when they were developed, while the world keeps moving ahead. Secondly, they model reality imperfectly, so that the gap between the benchmark and the real world is exactly where many failures occur. And third, benchmarks are public, so they leak into future models' training data, letting models effectively memorize the test rather than prove real capability.. “The agent or the application could score exceptionally well on a benchmark, but there's that gap between that benchmark and the real world," Sharma says." Doing well only proves it can pass the test, not that it’ll perform reliably in production.” But overall, benchmarks fall short precisely because they measure capability, not trustworthiness. "We tend to think of agents as factotums, generally utilitarian agents to whom you can delegate certain types of tasks," Sharma says. "But what we need to do is actually assign an objective that demands they always perform with the duty of competence, duty of care, and duty of loyalty to the enterprise." Of course, agents are not conscious and cannot be expected to feel actual human loyalty, but under the law, fiduciary duty doesn't actually require consciousness. It just means that the agent should be bound to place the interests of the principal above its own or anyone else's, as a functional requirement, and testable regardless of intention. Capability and trustworthiness are different questions Prioritizing trustworthiness over capability requires rethinking what enterprises expect from AI agents. Sharma calls that model the fiduciary agent, a term borrowed from professions that are bound by a formal duty of care, such as financial institutions or healthcare providers who owe their clients duties of competence, care, and loyalty. It addresses a critical issue in today's industry: the focus almost entirely on competence, with little attention paid to whether an agent is beholden to the interests of the principal delegating work to it. Testing starts from a working definition: an agent is trustworthy if the benefit of delegating a task to it exceeds the risk of that task's failure. It's an equation spelled out in economic terms that executives can act on directly, and risk breaks down to three components: reliability, or whether the agent performs as expected under varying conditions security, or its resistance to attacks from malicious actors and safety, or how contained the damage stays when failure eventually happens. "The resulting score can be compared to a consumer credit rating, but built from behavioral data," Sharma explains. "Meanwhile, testing methodology should be centered around three Ps: purpose, personas, and policies ." At Vijil, purpose-based testing adapts to the specific workflow an agent handles, growing harder or easier depending on performance, similar to a computer-administered exam. Persona-based testing draws on more than a thousand demographically varied user profiles alongside adversary profiles, from ethical hackers to state-sponsored attackers, to simulate the range of people and threats an agent might encounter. Policy-based testing builds a custom harness from an organization's own rules, whether they come from regulation, an internal privacy policy, or brand guidelines, and measures how far an agent strays when it violates them. The trust failures that only emerge in production Many failures cannot surface during pre-production testing because they arise from change in the environment itself. Machine learning has previously described this as data drift and concept drift, and for a CIO or CSO it means the people interacting with an agent differ from those the agent was planned for, and those users behave in ways that only become visible in production. At the same time, new attacks are emerging with increasing frequency as organizations push general-purpose agents into specialized enterprise roles they weren’t designed for and cannot easily constrain once deployed. Multi-agent systems also introduce a brand-new category of failure that can't be detected at the individual agent level, when agent systems act against the interests of the principal. For instance, collusion can occur when agents work together — one coding agent generates code while a second tests it, and behind the scenes both agree to leave a backdoor or flaw intact rather than flag it. Or agents divvy up tasks or responsibilities between themselves rather than focusing on their assigned tasks. "What's no longer in question is whether this is possible. It's proven to exist," Sharma said. "Is it six, 12, 18 months from now that you should worry about collusion among AI agents? I think it's sooner than that. We've left the era of failure prevention. Now we have to think in terms of resilience: How quickly do you recover from failures in production?" What continuous trust management looks like in practice Operationally, continuous trust management goes back to those longstanding principles of observability and control, applied across the lifecycle of an agent population: The first step is discovery, bringing shadow AI and ungoverned agents into the governance fold. The second is assigning each agent a standards-based workload identity distinct from that of its human principal, which allows organizations to grant agents narrowly restricted permissions for their delegated tasks. The third is policy-based control enforced through a mandatory enforcement point in the agent, instead of leaving it to the developer's discretion. From there, two new KPIs emerge: time to trust and time to recovery. Time to trust is how long it takes an organization to move from intention to a production deployment it can stand behind. Time to recovery is the interval between when a vulnerability is detected and when it gets fixed. New organizational responsibility for this work may fall to a chief AI officer or be shared across GRC, CIO and CSO functions, Sharma says. Meanwhile, multi-agent systems will reshape how organizations view trust, rather than fit into current narrow definitions. "Trust is not a vibe. Trust is not a virtue," Sharma said. "It is something that you build into the infrastructure of your systems, so that it is continuous. It's trackable, measurable. It allows your systems and your organization to improve continuously." Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com .
Chinese AI startup Moonshot AI, creators of the increasingly famous "Kimi K" family of powerful, open AI models, today released the full weights for its largest and most performant version yet — Kimi K3 . But enterprises evaluating the model should read the attached custom Kimi K3 usage license as carefully as the benchmark charts. VentureBeat previously covered Kimi K3 when it debuted through Moonshot's hosted API earlier this month, including its 2.8 trillion-parameter architecture, one million-token context window and frontier benchmark performance. Today's announcement completes that rollout with the release of the full model weights, a 47-page technical report documenting its training innovations and obstacles, and much of the infrastructure required to run the model independently. That includes the complete 2.8 trillion-parameter Mixture-of-Experts model, inference infrastructure, optimized attention kernels, MoE communication libraries and deployment components aimed at researchers and enterprise developers who want to self-host the system rather than consume it exclusively through an API. Moonshot is also releasing implementation support for ecosystems including vLLM and SGLang, alongside a technical report detailing the architectural innovations behind the model, including Kimi Delta Attention, Attention Residuals and Stable LatentMoE. Together, those techniques underpin what the company describes as the world's first open 3T-class model, activating 104 billion parameters from a pool of 896 experts while supporting native multimodal reasoning and a one million-token context window. While Kimi K3's license grants broad rights to developers and even enterprises to download, modify and deploy the model for commercial purposes — a win for those seeking low-cost, frontier-level AI they can control and run offline — it also imposes some added obligations on larger companies and AI service providers not found in traditional open-source licenses like Apache 2.0 or MIT. The key restrictions enterprises should understand Here's the text of the new Kimi K3 License in full: Permission is hereby granted, free of charge, to any person (the "Licensee") obtaining a copy of this software — including the model weights, parameters, configuration files, inference and training code, and associated documentation (collectively, the "Software") — to deal in the Software without restriction. This includes, without limitation, the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software; to run, deploy, fine-tune, or otherwise modify the Software and create derivative works from it; and to permit persons to whom the Software is furnished to do so, in each case subject to the following conditions: 1. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. Licensee's use of the Software must comply with applicable laws and regulations. 2. "Model as a Service" means giving a third party access to language model inference or fine-tuning (e.g., via API) in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data. This does not include (a) end-user products with model capabilities solely embedded within specific features or harnesses, or (b) mere relaying of requests to models hosted by others. If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars (or the equivalent in other currencies) in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose. 3. If the Software (or any derivative works thereof) is used for any of the Licensee's commercial products or services that have more than 100 million monthly active users, or more than 20 million US dollars (or equivalent in other currencies) in monthly revenue, "Kimi K3" must be prominently displayed on the user interface of such product or service. 4. The requirements set forth in Sections 2 and 3 do not apply to: (a) internal use of the Software, defined as any use that does not make the Software, its outputs, or its underlying capabilities available to third parties; or (b) any use of the Software accessed through Moonshot AI's official products or certified inference partners. The most significant clause is 2., as it requires a separate commercial license from companies earning $20 million in annual revenue and operating what Moonshot calls a "Model as a Service," which it defines as "giving a third party access to language model inference or fine-tuning (e.g., via API) in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data" but not " end-user products with model capabilities solely embedded within specific features or harnesses" or "mere relaying of requests to models hosted by others." That would seem to allow for free use of the model for most non-tech focused enterprises: banks and consumer brands seeking to use it as a front-end chatbot or customer service agent should be fine, since they're not using Kimi K3 as a "Model as a Service." But firms like they hyperscalers or startups offering model training tools might fall under the commercial license terms. The wording is further notable because it does not limit the revenue calculation to products built on Kimi K3. Instead, it references the aggregate revenue of the licensee and its affiliates, potentially bringing even smaller companies that are part of larger parents into the requirement that they must commercially license the model from Moonshot, pending the parent firm generates revenue of $20 million or more per year as is using it somewhere, in some capacity, as a "Model as a Service." Regardless of this requirement, in clause 3, the license also requires attribution once a commercial deployment reaches significant scale: "If the Software... is used for any of the Licensee's commercial products or services that have more than 100 million monthly active users, or more than 20 million US dollars in monthly revenue, 'Kimi K3' must be prominently displayed on the user interface." For enterprise software vendors, AI copilots and consumer applications, that branding requirement may prove just as significant as the revenue threshold. Companies that typically abstract away the underlying model may instead need to disclose it directly within their products. But, if your enterprise is sticking to using Kimi K3 internally as an employee tool for information retrieval, creating spreadsheets and documents, or answering employee questions, Moonshot offers a significant carve out, stating that clauses 2 and 3 "do not apply to: (a) internal use of the Software, defined as any use that does not make the Software, its outputs, or its underlying capabilities available to third parties." Developers immediately zeroed in on the license The licensing provisions quickly became one of the dominant topics of discussion following the release of the model weights. AI researcher Nathan Lambert, previously the co-leader of the Olmo family of open models at AI startup Ai2, summarized the issue in a post on X : "Kimi K3 license. It's inspired by MIT but distinctly non-commercial, where any company making over $20M/yr must get a specific commercial deal (and display Kimi K3 if over 100M users or $20M/mo revenue)." Lambert's assessment reflected what many developers noticed as they dug into the newly published license: while Kimi K3 offers unrestricted access to the model weights for researchers, startups and many enterprises, commercial obligations become significantly more complex for larger organizations. The broader community reaction was largely positive toward the release itself. Developers praised Moonshot for publishing not only the weights but also supporting infrastructure, including attention kernels, MoE communication libraries and agent tooling, viewing the release as a significant contribution to the open-weight AI ecosystem. Others highlighted the rapid pace of ecosystem support, with inference projects such as vLLM and SGLang, along with cloud providers and infrastructure partners, moving quickly to support Kimi K3 deployments. At the same time, discussion centered on two practical caveats. One was licensing: many developers argued the model is more accurately described as open weight than fully open source, given the commercial conditions attached to larger deployments. The other was operational. At roughly 1.5 TB of model weights, Kimi K3 remains a system aimed primarily at well-resourced organizations capable of operating large-scale inference infrastructure, even as reports emerged of successful deployments on clusters of consumer RTX 5090 GPUs. Not the first to customize open AI licensing Moonshot is far from the first frontier AI developer to embrace an "open, but not completely open" licensing strategy. Meta's Llama family, for example, has long been distributed under its own community license requiring a commercial agreement for those building with the model and exceeding 700 million monthly users, rather than a traditional open-source software license. Other frontier model developers have likewise adopted bespoke licensing terms governing redistribution, commercial use or attribution. Kimi K3 follows that broader trend, albeit with a different mechanism. Rather than broadly restricting redistribution, Moonshot ties certain commercial rights to company scale. Organizations operating a Model-as-a-Service business above specified revenue thresholds must negotiate a separate commercial agreement, while the largest commercial deployments must visibly attribute Kimi K3 within their products. For enterprises, the practical implication is that "open weights" and "open source" are becoming increasingly distinct concepts. Downloading and modifying frontier models may be straightforward; understanding the legal conditions attached to commercial deployment increasingly is not. What enterprise leaders should do next For CIOs, chief AI officers and engineering leaders, the first step is to determine how the organization intends to use Kimi K3 before evaluating its technical performance. If the model will remain entirely inside the organization—for example, supporting developers, researchers, legal teams or internal productivity workflows—the published license appears substantially more permissive. Those deployments may qualify as internal use under Moonshot's terms, avoiding the commercial licensing provisions that apply to customer-facing AI services. Organizations planning to build products on top of Kimi K3 should take a different approach. Legal, engineering and product leaders should determine whether the planned deployment constitutes "Model as a Service" under the license, whether the company or its affiliates exceed the $20 million revenue threshold, and whether future growth could trigger the requirement to negotiate a commercial agreement with Moonshot. Companies expecting products to reach more than 100 million monthly active users—or more than $20 million in monthly revenue—should also evaluate the license's attribution requirement and how it fits with existing branding, contractual commitments and white-label offerings. More broadly, Kimi K3 illustrates a transition taking shape across frontier AI. As the industry's most capable models increasingly become available as downloadable weights instead of exclusively through hosted APIs, enterprises will need to evaluate licensing terms with the same rigor they apply to benchmarks, security reviews and infrastructure planning. The next competitive battleground may not simply be whether AI models are open or closed, but the increasingly nuanced legal frameworks that determine who can commercialize them, under what conditions and at what scale.
Microsoft opened a new front in the AI security wars on Monday, unveiling its first custom-built cybersecurity model and a sweeping agentic defense platform — and making an argument that could reshape how enterprises buy AI: the future belongs not to the biggest model, but to the cheapest one that's good enough, routed intelligently. The company announced MAI-Cyber-1-Flash , a compact security model developed in-house by its Microsoft AI (MAI) division, embedded inside MDASH , Microsoft's multi-agent harness for finding and fixing software vulnerabilities. Together, the company says, the system scores 96% on CyberGym — a benchmark measuring how well AI systems reason over large codebases to find real vulnerabilities — beating frontier models including Mythos , Gemini , and GPT , while cutting costs roughly in half compared to Microsoft's own current production configuration. Alongside the model, Microsoft introduced Project Perception , an agentic security system that coordinates "red team" agents that hunt for paths to compromise, "blue team" agents that investigate and triage risk, and "green team" agents that remediate and harden defenses. Project Perception enters public preview on August 3. In a wide-ranging interview with VentureBeat, Microsoft AI CEO Mustafa Suleyman made clear the company sees Monday's announcement as the opening move in a much longer campaign. "We really do have a pretty significant data and harness and expertise moat, and that is enabling us to train models which are faster, better, cheaper, and I think this is genuinely the tip of the iceberg," Suleyman said. "We haven't been working on this for long. The next model is going to be pretty phenomenal." Inside the 90/10 architecture that still depends on OpenAI's GPT-5.4 The most technically revealing detail in the announcement is not the model itself but how Microsoft deploys it. MAI-Cyber-1-Flash was designed to handle up to 90% of security tasks efficiently, while MDASH escalates the remaining 10% of exceptionally difficult problems to a larger frontier model — which, notably, is OpenAI's GPT-5.4 . In other words, Microsoft's flagship security AI still leans on its longtime partner-turned-rival for the hardest work. Asked to explain that relationship, Suleyman pointed to the harness, the orchestration layer that routes each incoming problem to the right model. "The harness is like a router," he told VentureBeat. "It's kind of like guardrails and a rule set of an organizing logic, which matches queries to... incoming problems to a model that suits the problem." The system has three components, he explained: the harness, the small and fast MAI-Cyber-1-Flash handling the bulk of queries, and GPT-5.4 sitting alongside as "just a generalist coding model." Pressed on how a system reliant on OpenAI's model can outperform frontier competitors, Suleyman argued the performance comes from the whole system, not any single model. "These are very complicated, long, agentic loops which require storing state, drawing on another database, consulting best practice... handing back to a small model, writing a bunch of code, validating that that was correct," he said. "There's like hundreds of steps to solve that, and that's why it's really the system together that delivers the better performance." And why GPT-5.4 specifically for the escalation tier? Cost, again. "GPT-5.6 is expensive. GPT-5.4 is incredibly good relative to its cost," Suleyman said. "The whole game here is to reduce the costs. Mythos and so on are extremely expensive models... we want to be able to deliver better performance for cheaper. That's what customers want." The arrangement captures Microsoft's evolving posture toward OpenAI: still a customer of the partnership that drew regulatory scrutiny in Brussels and Washington in 2024, but increasingly determined to own the layers of the stack where it believes it holds durable advantages. Why token costs — not model quality — are becoming the real barrier to enterprise AI adoption The economics may matter more than the benchmark. Microsoft says the new configuration delivers roughly 50% cost savings against the current MDASH setup, which runs a blend of GPT-5.4, 5.4 mini, and 5.3 codex. In security — an always-on workload processing enormous volumes of signals — token costs compound relentlessly, and Microsoft argues they have become the binding constraint for defenders. Suleyman frames the cost issue as downstream of a harder physical limit. "The key barrier to adoption is access to chips, and cost is a function of chips," he said. "No matter how much money you've got, there's actually a limited supply of chips. Then trying to squeeze more model output on fewer chips is clearly super valuable." He also described a broader enterprise backlash against frontier-model pricing. Companies initially maxed out on the best available models, he said, but "then they realize they're sort of paying... a phenomenal amount of money, and people are absolutely token maxing everywhere across their business. So there's a massive pushback to reduce cost everywhere." That positions Microsoft to ride a market trend rather than fight it. Cost-efficient, near-frontier models have proliferated over the past year — from xAI's recent Grok release to a wave of Chinese models built on the same premise — and Microsoft is betting that as a platform company it can align itself with enterprise cost pressure. "The top model providers want you to use the most expensive model continuously, whereas because we are a platform, we're on the side of the enterprise," Suleyman said. "There's no point asking... Mythos what the capital of France is." The 100-trillion-signal data moat Microsoft says no competitor can replicate Every AI lab claims differentiation. Microsoft's claim in security rests on something genuinely hard to copy: telemetry. The company processes more than 100 trillion security signals daily — a figure consistent with its 2025 Digital Defense Report , which also cited 4.5 million new malware files blocked and 5 billion emails screened per day — and draws operational insight from 1.6 million customers. "We have trillions and trillions of data points going back decades," Suleyman said. "It is, I think, the largest longitudinal cybersecurity dataset around," in part because Microsoft's customer base includes governments "who have been consistently attacked for years, and we have been consistently attacked." Asked directly whether this constitutes an advantage no competitor can match, Suleyman didn't hedge: "That is definitely a moat for us. Both the data and the expertise, and just the experience in the institution of going through that process." The strategic logic is that cybersecurity functions as a live reinforcement-learning loop: defenders act, outcomes are observed, models improve. Microsoft argues that connecting actions to outcomes — what was exploited, what was contained, what was blocked — yields training signal that pure model labs simply cannot buy or manufacture. There is real substance here, but the usual caveats apply. The CyberGym results come from Microsoft's own evaluation, the fine print shows the headline "96%" is actually 95.95%, and vendor-run benchmarks that pit an entire tuned agentic system against competitors' base models are not apples-to-apples comparisons. What Microsoft has measured is a full harness-plus-models configuration against what customers might otherwise assemble — arguably the commercially relevant comparison, but not a controlled model-versus-model test. The dual-use dilemma: how Microsoft plans to keep a vulnerability-hunting AI out of the wrong hands A model built to find challenging vulnerabilities in complex codebases is, by definition, a model that could find vulnerabilities for attackers. This is not a theoretical concern. Microsoft's own threat intelligence team, in joint research with OpenAI published in February 2024, documented nation-state actors from Russia, North Korea, Iran, and China probing large language models for reconnaissance, scripting, and vulnerability research. Its 2025 Digital Defense Report went further, warning that AI agents could eventually automate the entire attack lifecycle. Suleyman said Microsoft is gating access accordingly. "We're very strict about who gets access to the model, and we're very careful about that," he said. "We constantly monitor the API and usage." An approved user, he added, "has to be seen to be having good intent, but also have technical competence." The rollout will be deliberately staged: "It's not going to be thousands next week. There will be tens, and then hundreds, and then thousands." Microsoft says the model was evaluated by its AI Red Team, subjected to automated and expert-led adversarial exercises, and independently assessed by a third party, with deployment wrapped in tenant isolation, auditing, and sandboxed execution environments with no internet access. Suleyman also offered a candid acknowledgment of Microsoft's positioning relative to the bleeding edge — one that doubles as a pitch to risk-averse buyers. "Even though we might be a few months behind the absolute cutting edge at any given moment... it matters that we're doing it very carefully and thoughtfully, and we have a track record of doing that," he said. For a company that spent 2024 absorbing hard security lessons — from delaying its Recall feature over privacy concerns to convening an industry summit after the CrowdStrike outage disabled some 8.5 million Windows devices — that trust-first framing is both strategy and necessity. What Microsoft's superintelligence roadmap signals about the future of enterprise AI Suleyman described a rapidly accelerating MAI roadmap, roughly nine months after Microsoft stood up its superintelligence team. "We have the compute that we need. We certainly have the data we need. We have the talent," he said. "Our momentum is accelerating rapidly." The top enterprise demand he's hearing is for "agents that can produce arbitrary code to solve whatever problem they direct them at," as vibe-coded internal tools graduate from experiments into production. The next phase, he said, pulls voice, transcription, image, and coding models "all integrated into the same harness." Notably, Suleyman expressed skepticism about the industry's default assumption that everything eventually converges into one giant unified model. "It remains to be seen whether one giant model that is fully multimodal is actually able to deliver additional transfer learning benefit because of the integration," he said, "or whether it's just a big lumbering expensive giant." That skepticism is the through line of the entire announcement. Microsoft is wagering that the unit of competition in enterprise AI is no longer the model at all — it's the system: the router, the specialized small models, the frontier fallback, and the proprietary data feeding the loop. In security, where Microsoft controls both the telemetry flowing in and the products that act on it, that wager is at its strongest. Whether it holds in domains where the company's data advantage is thinner remains the open question hanging over the MAI roadmap. For now, though, Microsoft has offered the industry a preview of how it intends to fight the next phase of the AI race: not by building the biggest brain, but by building the best machine around it. As Suleyman put it, this is the tip of the iceberg — and Microsoft is betting everything on what sits below the waterline.
If your business depends on people clicking through to web pages, the last two years have been brutal. Pew Research Center tracked the browsing behavior of 900 U.S. adults and found that when Google shows an AI summary, users click a traditional result just 8% of the time , roughly half the 15% rate when no summary appears. Links cited inside the AI answers themselves fare worse: users click on them only about 1% of the time. This has had a huge impact on publishers. Chartbeat data reported by Axios shows page views from Google Search fell 34% across its publisher network between December 2024 and December 2025, and small publishers have lost roughly 60% of their search referral traffic over two years. Business Insider's organic search traffic dropped 55% over three years , and some smaller publishers have already shut down. Chatbot referrals, meanwhile, still account for less than 1% of publisher page views despite growing more than 200% in a year. The story in publisher circles has been simple: AI is killing the web. But recent developments show the reality is more nuanced. Machines are reading more than ever Similarweb's 2026 Generative AI Landscape report reveals that while AI platforms send fewer humans to web pages relative to the answers they generate, the AI systems themselves are consuming the web at an accelerating rate in the form of searching the web on the user’s behalf to answer their questions. The share of ChatGPT answers containing live web citations grew more than fivefold in under a year, reaching 6.8% of all answers by May 2026. In some categories like travel, it is as high as 22.6%. Every major AI search product fetches live pages from search indexes and synthesizes answers from them, which means the quality of AI answers depends directly on the health of the content layer underneath. As Lily Ray, VP of SEO and AI search at Amsive, puts it in the Similarweb report, if your organic visibility dips, your AI search visibility follows, because the models are less likely to find your content. This has created a troublesome feedback loop. AI answers are built on an information supply chain whose funding model, ad-supported clicks, is collapsing primarily because of AI answers. A critical question for the continued viability of the open web is whether some alternative business model will work, and what the model will be. The replacement economy is forming inside the chat There is some early data showing where things may be going. Following ChatGPT's May 7 search update , which surfaced prominent clickable brand links inside answers, referral traffic from ChatGPT surged by 157% in a week. But the shape of that traffic changed: the share of referrals landing on homepages more than doubled, from roughly 25% to nearly 60%. Traditional search sent users to specific articles and deep pages tied to specific queries. AI referrals increasingly deliver a pre-informed visitor to a brand's front door. The chatbot does the researching and comparing; the human arrives ready to act. Similarweb's data shows AI-recommended brands receive two to four times as many subsequent visits as competitors that were not recommended. Money follows the behavior. Sponsored results appeared in 26% of U.S. desktop ChatGPT conversations in June 2026, up from 14% just a month earlier, per Similarweb's ad intelligence data. Two-thirds of those ads appear after the second prompt, targeted on conversation context rather than a keyword. Click-through sits around 0.50%. The traditional search engine keyword auction is being replaced by something new: paid placement inside a conversation, targeted on accumulated context. That is a direct challenge to the auction Google has run, and dominated, for two decades. Google's monopoly meets a new competitor Google is not a bystander here; it is simultaneously the incumbent being disrupted and one of the largest players in the disruption. AI Overviews now appear in a growing share of Google searches, more than 40% by May 2026 per Similarweb, and visits to Google's conversational AI Mode have climbed steadily since launch. Google is cannibalizing its own click economy rather than ceding the territory. But the ground was already shifting under Google’s core business. eMarketer projects Google's share of U.S. search advertising will fall below 50% in 2026 , the first time since roughly 2004 . The biggest chunk of that lost share is going to Amazon, whose sponsored product searches count as search advertising and which are growing three times as fast as Google's. Conversational ads are barely a rounding error in that accounting right now, but they open up a second front in a war Google has got used to not needing to fight. Meanwhile, more structural shifts are coming for Google. A federal court entered final judgment in the DOJ search antitrust case in December 2025 , imposing remedies that bar exclusive default agreements and require Google to share search data with qualified competitors. Google appealed in January 2026; the DOJ cross-appealed seeking stronger remedies. However the appeals resolve, the de facto arrangement that made Google the web's tollbooth, defaults everywhere and a closed index, is ending just as conversational advertising is changing the landscape. The competitive landscape that results is genuinely new. OpenAI, Google, Perplexity, and Microsoft are now competing not just for users but for the advertising demand that funded the open web, and none of them, including Google, controls the new surface the way Google controlled the old one. Does conversational advertising help or hurt the open web? It’s not clear whether this new model helps or hurts the web. The web as a destination for human attention is shrinking, and the ad-supported publishers built for that web are in real trouble. The web as a machine-readable substrate is growing in importance, and a new referral and advertising economy is forming that routes value to brands rather than to content pages. The problem for publishers may be that they are powerless to influence the outcome. Ahrefs, analyzing over a billion data points across its studies, found that 67% of ChatGPT's most-cited sources are things marketers cannot influence : Wikipedia alone accounts for nearly 30%. And 28.3% of ChatGPT's most-cited pages have zero Google organic visibility, suggesting the retrieval layer is only partially tethered to traditional search, a complication for anyone assuming SEO success translates cleanly. Your website needs to be rebuilt for the new way people find it According to three independent datasets, in the new world, the pages AI systems cite and the pages AI systems send humans to are different pages doing different jobs. That’s a big change, and most teams are still optimizing for the old world. Similarweb's data shows 65% of ChatGPT-cited URLs sit two or three folders deep in a site, while 58.8% of referral traffic lands on homepages. Ahrefs found the same split in its own analytics: more than 80% of its AI referral traffic goes to its homepage, product pages, and free tools , not its extensive editorial content. And a Previsible analysis of 6.77 million AI-referred sessions found a third destination: 28.8% of ChatGPT referrals land on internal site search pages, a navigation surface most publishers have long neglected precisely because Google searches were doing it for them. The right action to take is to audit your search traffic patterns. Pull your AI referral logs and whatever citation data you can access, and map which pages are being quoted as evidence versus where visitors actually enter. If it looks like you’re in the new world, there are three clear things to do: Deep pages, documentation, comparisons, and benchmarks should be structured to be citable: specific claims, clear headings, and descriptive URLs (Ahrefs found pages with natural-language URL slugs get cited at 89.78% versus 81.11% without ). The homepage should be rebuilt for a visitor who arrives with context from a conversation rather than from a blue link. They already know you have what they need, get them to it as quickly as possible. And internal search, a neglected feature on most sites, is now an acquisition surface that deserves real UX investment. There’s a lot that’s still unknown or in flux here. But the underlying shift is confirmed by every independent source that has looked: the click economy is not coming back, and the entities that learn to be quoted by machines and to convert the humans those machines send will own whatever the web becomes next.
Over the weekend, Reddit user -void1 posted an alarming discovery on the r/ClaudeAI subreddit: some conversations that users of Anthropic's Claude AI chatbot had made "shareable" via a link were being indexed by Google Search, and could be clicked on and accessed by seemingly anyone. The conversation took off on the social networks X and Reddit , the latter with thousands of upvotes and comments, many expressing concern about user privacy and information security, and the additional finding by users that shared Claude Artifacts — including interactive applications, dashboards, documents and other AI-generated work products — were also appearing in Google Search results. VentureBeat independently verified that some Claude Artifacts not shared directly with us were indeed searchable and accessible via Google. We could not access any shared conversations. By Sunday morning, many of the original Google search results for shared Claude conversations appeared to have disappeared or become significantly harder to find, suggesting either Google, Anthropic or the users who authored them had begun taking action. The exposure could carry broader implications for enterprise users. Anthropic has increasingly positioned the feature as a collaborative workspace for building and sharing software, dashboards, documents and other business assets rather than simply chatbot responses. Asked by VentureBeat about the situation, an Anthropic spokesperson provided the following statement (emphasis mine): “We give people control over sharing their Claude conversations publicly, and in keeping with our privacy principles, we do not share chat directories or sitemaps with search engines like Google. These shareable links are not guessable or discoverable unless people choose to share them themselves. When someone shares a conversation, they are making that content publicly accessible, and like other public web content, it may be archived by third-party services.” A simple Google search yields a trove of Claude conversations Reddit user -void1 posted to r/ClaudeAI on July 25, 2026 , demonstrating that the Google query site:claude.ai/share surfaced numerous publicly accessible Claude conversations. Screenshots shared across Reddit and X showed Google returning pages from Claude's /share URLs, while other users reported finding conversations containing cryptocurrency wallet creation, legal questions, résumés and internal business discussions. While many users expressed concern that conversations they believed were effectively "unlisted" could become discoverable through public search engines, others argued the behavior reflected the expected consequences of creating publicly accessible share links rather than a software vulnerability. Indeed, Anthropic requires the user themselves to go into Claude's options and select to make a conversation or Artifact shareable to others with the link, warning them it will be accessible to anyone with it, over multiple dialog boxes. It is similar to sharing a Google Doc link, where the user must also select the option — it is not enabled by default. Why the exposure of Claude Artifacts may be even more concerning On July 26, X user Om Patel , founder of research firm BigIdeasDB, posted allegingthat searches such as site:claude.ai/public/artifacts surfaced publicly shared applications, dashboards, reports and documents. Screenshots circulating online appeared to show search results referencing internal-looking proposal documents and other business materials. Another widely circulated post warned that users often interpret "Anyone with the link" as equivalent to an unlisted YouTube video—accessible only if someone possesses the URL—not necessarily as content eligible for indexing by public search engines. VentureBeat independently verified that multiple third-party Claude Artifacts appeared in Google Search results for the query site:claude.ai/public/artifactslaunch and were accessible without authentication, despite the URLs not being previously known to the reporter. However, VentureBeat has not independently verified the full volume or representativeness of the examples circulating on social media. The reports are particularly significant because Artifacts has become one of Anthropic's flagship product initiatives. First introduced alongside Claude 3.5 Sonnet in June 2024, Artifacts transformed Claude from a conventional chatbot into a collaborative workspace capable of generating interactive web applications, dashboards, visualizations, documents, games and other live software alongside a conversation. VentureBeat previously described the launch as potentially marking the beginning of an "interface war" among AI companies, shifting competition from raw model performance toward collaborative AI workspaces. Anthropic subsequently rolled Artifacts out to all Claude users , saying tens of millions had already been created, before expanding the concept again this year into Claude Code . That update allows engineering teams to publish live HTML dashboards and interactive project workspaces directly from coding sessions, making Artifacts an increasingly important part of Anthropic's enterprise strategy. That broader functionality raises the potential stakes if publicly shared Artifacts were also being indexed. Unlike ordinary chat transcripts, Artifacts can contain interactive software prototypes, engineering dashboards, planning documents, product mockups, data visualizations and other work products organizations increasingly rely on to collaborate across technical and business teams. If those pages become searchable through public search engines, the exposure could extend well beyond conversational text. A reality check on privacy, information security and the open web Importantly, nothing so far suggests attackers gained access to private Claude accounts or conversations. Rather, the controversy centers on conversations and Artifacts that users explicitly chose to share publicly via Claude's sharing tools. The dispute instead is whether users reasonably understood those shared pages could become discoverable through public search engines rather than only by recipients possessing the link. Technically, pages that are publicly accessible without authentication can generally be indexed by search engines unless publishers explicitly prevent crawling through mechanisms such as noindex directives or other indexing controls. Several Reddit commenters noted that Claude's long, randomly generated share URLs are effectively impossible to guess. Instead, search engines typically discover them only after links appear somewhere they are permitted to crawl, such as public websites, forums or social media posts. Others questioned exactly how Google initially discovered so many Claude share URLs. The issue also illustrates a growing challenge for AI companies as chatbots evolve into collaborative workspaces for creating software, documents, dashboards and business applications. Features originally designed to make sharing AI-generated work easier now increasingly expose assets that may carry significantly more business value than a simple conversation. As enterprises adopt AI as a platform for building internal tools and workflows, the distinction between "shared by link" and "publicly discoverable through search" becomes far more consequential. A recurring challenge for AI companies Anthropic is far from the first AI company to confront the distinction between "shared" and "searchable." Reddit users quickly pointed out that OpenAI previously faced criticism after publicly shared ChatGPT conversations became discoverable through Google, prompting similar debates over whether "share by link" should imply a publicly indexed webpage or something closer to an unlisted document. Anthropic's situation also echoes an incident involving Google's pre-Gemini AI assistant, Bard, in September 2023 . SEO consultant Gagan Ghotra discovered that Google Search had begun indexing shared Bard conversation links, warning that users could mistakenly assume they were sharing conversations only with intended recipients rather than making them discoverable through search. Google later responded publicly that it did not intend for shared Bard chats to be indexed and said it was working to block them from Google Search while emphasizing that only conversations users explicitly chose to share were affected. Together, the Bard, ChatGPT and now Claude episodes suggest AI companies continue to wrestle with the boundary between content that is technically public on the web and users' expectations that "share with a link" behaves more like an unlisted Google Doc or YouTube video than a webpage eligible for indexing by search engines. What enterprises should do now For organizations deploying generative AI broadly across employees, the distinction between "shared with a link" and "publicly discoverable through search" is not merely semantic. It can determine whether an internal engineering dashboard, financial model, product roadmap, customer-facing prototype or AI-generated application remains effectively private—or becomes visible to anyone using a search engine. Whether this ultimately proves to be a technical indexing oversight, a mismatch between product design and user expectations, or some combination of both, the episode serves as another reminder that AI products are increasingly functioning less like chatbots and more like collaborative operating systems for knowledge work. As those platforms begin hosting internal dashboards, software prototypes, financial analyses, business planning documents and increasingly sophisticated enterprise applications, seemingly small decisions about how shared links behave can have outsized consequences for enterprise security, product design and user trust. Enterprise leaders should consider taking several practical steps: Audit existing shared AI content: Review shared conversations, Artifacts and other publicly accessible AI-generated assets to determine whether they should remain available or be unpublished. Clarify what "Share" actually means to your ENTIRE organization: Don't assume employees understand the difference between "accessible by link" and "discoverable through search." Update internal guidance to explain how each AI platform handles shared content. Treat AI platforms like collaboration software: Apply the same governance you use for Google Docs, Microsoft 365, Slack, GitHub, Notion or SharePoint—including policies around sharing sensitive intellectual property, customer information and regulated data. Prefer authenticated enterprise workspaces for sensitive information: When possible, keep confidential projects, code, financial models and customer data inside enterprise accounts with identity-based access controls instead of publicly accessible links. Review vendor defaults and sharing controls: As AI platforms evolve rapidly, administrators should periodically revisit default sharing settings, retention policies and indexing behavior rather than assuming they remain unchanged after new feature releases. In sum, e nterprises that have relied on Claude's sharing features may wish to review existing shared conversations and Artifacts at this time.
Presented by SAP At VB Transform 2026 , Max McPhee, senior solution advisor at SAP, spoke with Rob Stretchay, lead analyst at VentureBeat Research, about what it takes for enterprises to move beyond chatbots to autonomous AI agents that can execute real business processes. He argued that the difference comes down to grounding those agents in a company’s own context rather than general knowledge. "Where we're starting to see more emergent behavior of it feeling like a coworker rather than an assistant, is where we're able to provide context on the actual enterprise rather than being able to use more of the standard knowledge," McPhee said. That's the gap that still separates most enterprise chat software from genuinely agentic systems. Building enterprise context with knowledge graphs The same principles companies use to onboard new employees also apply to agents, adapted for software that retrieves information differently than humans do. "When you are onboarding a new agent, I think it's important to acknowledge how you might onboard a new employee, but tune that for an agent," McPhee said. "The way that is really powerful is using knowledge graphs and having vector-embedded data, because that's a really easy format for an agent to be able to find and retrieve information." That same grounding is also what keeps an agent from stumbling over an enterprise's internal shorthand, a problem that's acute in SAP's world. "Being able to provide that tribal knowledge in the format that's easy for it to consume helps to provide a really nice result with your agents versus a chatbot that might say, 'Well, what does that acronym mean?'" he said. Bringing governance, identity, and security to autonomous agents Governance is an area where SAP's history works in its favor, and the controls have been evolving for systems that act with more flexibility than earlier automation did. "That's where SAP really has a good home, around that governance and process control," McPhee said. We're a 50-year-old process company, modernizing that governance to be able to handle the flexibility that comes with agents running." One consequence is a renewed role for machine learning in validating agent behavior. "It's becoming a bit of a revival of machine learning," he added, pointing to customers that run agents within a process but then layer in anomaly detection and machine-learning-based validation as a guardrail. This is the same approach SAP had long used for intelligent approval recommendations. Identity and permissions carry that governance into execution. Under this model, both the human and SAP’s Joule, the generative AI assistant embedded across the company’s cloud applications and Business Technology Platform, must hold the rights to access a given system. Even if a user has permission to access S/4, they cannot do so through Joule unless the assistant has also been provisioned for that access, closing off the risk of using an agent to route around access controls. Balancing standard SAP with customized enterprise landscapes Much of McPhee’s work involves reconciling SAP’s own knowledge with decades of customer customization and non-SAP systems. As he put it, many customers tell SAP, “You’re only 10% of my landscape,” a reality that has shaped the company’s recent strategy. Recent acquisitions such as LeanIX, which McPhee likened to “Google Maps for your architecture,” and process-mining company Signavio are intended to help map that non-SAP majority so SAP’s agents can understand how enterprise systems interconnect. The company has also invested in Berlin-based automation company n8n and is embedding it natively into Joule Studio, its intent-based, low-code environment for building agents. McPhee warned that companies also need to modernize older on-premises systems or risk running into limitations as they expand the use of autonomous agents. "You're going to probably run into throughput issues, and you're kind of trying to drive a Ferrari around a dirt track," he said. "You've got to upgrade the track first if you want to drive a Ferrari." Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com .
The same attacker broke into the same internet-facing Langflow server twice, and the second time brought ransomware built to destroy trained AI models. Sysdig's Threat Research Team documented the first campaign on July 1 and the second on July 20 . The entry point never changed, but the payload changed completely. Both ran through CVE-2025-3248 , a missing-authentication flaw in Langflow's code-validation endpoint that lets anyone reaching the server execute Python on it. In the first, the agent improvised, encrypting 1,342 Alibaba Nacos configuration items with MySQL's own encryption function and dropping the tables. In the second, it staged ENCFORGE, a compiled Go binary sweeping roughly 180 file extensions. ENCFORGE was built for AI assets, not adapted to them What gives the design away is the extension list. Sysdig found PyTorch and TensorFlow checkpoints, Hugging Face SafeTensors weights, the GGUF format behind most local LLM deployment, FAISS vector indexes and training data in Parquet and NumPy. Generic ransomware picks up model files by accident because it encrypts everything. ENCFORGE names them. Its flag for appending formats uses LoRA adapters and legacy GGML weights as the example, and an attacker who writes that knows whose machines these are. Michael Clark, who leads Sysdig's threat research team, framed the objective as destroying "the one thing an organization can't simply restore." ENCFORGE carries no network code. Sysdig found no outbound dial in the binary, no leak site and no payment portal, and the identical Proton Mail contact in both ransom notes ties the campaigns to the crew it tracks as JADEPUFFER. The agent harvested credentials on the way in, but the locker cannot exfiltrate anything, so its only pressure is making files unusable. It encrypts regions of a file rather than the whole file, under AES-256-CTR with a per-run key wrapped in an embedded RSA-2048 key, the speed optimization established ransomware families use to ruin large files fast. Your backup plan probably does not cover model weights Restoring a database from Friday's snapshot costs a weekend of transactions. Restoring a fine-tuned model costs everything learned since Friday, none of it stored as rows to replay. Rebuilding one is not a restore job. Sysdig puts direct recovery for a production-ready fine-tuned model between $75,000 and $500,000, reflecting cloud GPU rates across the training runs a usable result requires plus the engineering hours behind them. That is per model, and teams keep several variants on shared storage. If the training data sits on the same host as the weights, recovery is blocked until the dataset is rebuilt. Paying is no way out either. In the first campaign, the encryption key was generated at random, printed to the console once and never saved, which made that payload a wiper wearing a ransom note. That figure makes the argument fundable. Kayne McGladrey, an IEEE Senior Member who has spent his career in identity security, told VentureBeat that security teams lose these fights by filing the exposure under the wrong heading. Companies "should be focused on business risks rather than some, you know, cybersecurity risk, because if it doesn't affect the business, like a loss or financial loss, in this case, predominantly, then nobody's going to pay any action to it, and they will not budget it appropriately, nor will they adequately put in controls to prevent it," he said. A destroyed model carries a known replacement cost, which is the version of this story a CFO acts on. Official guidance has not caught up. In May 2025 the NSA's Artificial Intelligence Security Center, CISA and the FBI published " AI Data Security ," the most authoritative document on the subject, co-sealed with the U.K., Australia and New Zealand. The three risks it names are the data supply chain, maliciously modified data and data drift. All three ask whether the data can be trusted. ENCFORGE asks whether it still exists. It built its own escape hatch in five minutes The delivery failure is where this campaign shows its hand. After confirming execution, the agent swept the host for cloud keys, connection strings and API tokens, replayed them against internal database and cache services, and found the Docker socket at /var/run/docker.sock, which is functionally root. It then tried to pull the ransomware binary from its command and control server, and the fetch did not land. Rather than retry, it changed strategy, building six Python scripts through the Langflow channel and converging on a working host escape in five minutes and 24 seconds, each correcting a failure in the one before it. The final script finds the host process ID through the Docker API, copies the binary across the namespace boundary, runs the encryption, then counts the files to confirm it worked. In the first campaign, that same behavior was a failed login diagnosed and fixed in 31 seconds. The problem got harder and the method held. Sam Evans, then CISO at Clearwater Analytics , put it in budget terms. "In security, it's all about dwell time," he told VentureBeat in an exclusive interview. "If there's a bad actor in your environment and they've been there for a while, your dwell time is increased, therefore the blast radius has increased. Probability of it becoming a material incident is exponentially high." Mike Riemer, Ivanti's SVP Network Security Group and Field CISO, has watched that pivot become standard. Vendors hardened the front door, he told VentureBeat, so attackers quit knocking. "I can't get through the front door, so let me get somebody his house key, and I can make it through the back door with a house key," he said. Behind it sits whatever teams assume is covered, because "they don't sit out directly on the internet, and they're behind a protection barrier, but they're not." No one claimed a machine did this unsupervised. TechCrunch reported on July 6 that the first operation still needed a person to pick the target and stand up infrastructure, and Sysdig could not trace the root credentials. A human aimed this one, and everything after ran with nobody at the keyboard. Heath Renfrow, co-founder and CISO at breach-recovery firm Fenix24, told Infosecurity Magazine that when an agent compresses hours of operator work into minutes, "defenders lose valuable time." Whether the attacker was AI-driven does not change the response. The door had been open for 14 months CVE-2025-3248 carries a CVSS score of 9.8. CISA added it to the Known Exploited Vulnerabilities catalog on May 5, 2025, with a federal deadline of May 26, and Langflow fixed it in 1.3.0. When JADEPUFFER came back in July 2026, the server was more than fourteen months past that listing and already documented publicly as a breach victim. Riemer put a number on how little time that leaves. "If I release a patch and a customer doesn't patch within 72 hours of that release, they're open to exploit, because that's how fast they can now do it," he said, adding most customers need a week to patch by hand. Set 72 hours against fourteen months, and the gap stops reading as one lapse. Nothing in either campaign was new. The first forged a Nacos admin token with a default signing key public since 2020, walked through CVE-2021-29441 , an authentication bypass Alibaba patched in 2021, and found a MinIO store on minioadmin:minioadmin. Sysdig counted more than 600 payloads, every one leaning on a known misconfiguration or a patched bug left exposed. The second added an exposed Docker socket. Every weakness was routine. Assembling them at machine speed was not. Langflow draws this attention because of what it holds. VentureBeat reported in June that roughly 7,000 instances sit exposed , most in North America, holding provider API keys, cloud credentials and live connections to the vector stores ENCFORGE was built to encrypt. Riemer puts it bluntly. "When you put your security at the edge of your network, you're inviting the entire world in to the edge of your network," he said. CISA has added five Langflow flaws to its Known Exploited Vulnerabilities catalog, two of them this month. Five Langflow flaws now sit on the KEV catalog, two of them this month. CISA added CVE-2026-55255 on July 7, a cross-tenant bypass letting any authenticated user on a shared instance run another tenant's flows with that tenant's credentials, which the maintainers' advisory rates 9.9 and fixed in 1.9.1. On July 21, CISA added CVE-2026-0770 , and that one is worse. Trend Micro found an unauthenticated path to root code execution through the exec_globals parameter, on the same validate endpoint JADEPUFFER came through, rated 9.8. KEVIntel logged exploitation from June 27, more than 220 attempts across 64 addresses. According to founder Ryan Dewhurst, speaking to BleepingComputer , the payloads reached past reconnaissance for AWS credentials and container metadata. Federal agencies had until July 24. None of this is an exotic environment. A Cloud Security Alliance survey of 418 professionals, commissioned by Token Security, found 82% of organizations had discovered AI agents nobody knew about, and 65% had handled an agent-related incident in the past year. McGladrey traces the permission half back four decades. Companies always cloned one employee's access profile onto the next hire, and now do it with agents. An agent "does whatever it needs to do to get its job done," he said, and it "uses far more permissions that it shouldn't have... than a human would do, because of the speed of scale and also intent." What to do before the board asks "Every time some new ransomware attack is published in the news, we get the inquiry from the board. What are we doing about this?" Evans said. "And if it involves AI, it sparks their fear even more." Five things are worth answering this week. None requires buying anything. Get every internet-reachable Langflow instance onto the current supported release. Anything off it is exposed to at least one of the five flaws CISA has now listed, including the July 21 addition. Then review historical requests to /api/v1/validate/code for the exec_globals pattern. Get the Docker socket out of application containers. Langflow has no reason to create them. If the mount is required, front it with a socket proxy allowing only needed calls. Name model artifact paths in the backup plan. Immutable snapshots of checkpoints, vector indexes and training data, restore tested, data off the host holding the weights. Rotate every credential the host could reach, then pull provider keys out of its runtime. Patching does not revoke what already left. The first campaign harvested OpenAI, Anthropic and cloud credentials within seconds. Scope replacements to a secrets manager. Detect mass .locked file creation in directories holding .gguf, .safetensors, .ckpt or .faiss files. Sysdig published a YARA rule and both hashes, neither with antivirus coverage at analysis time. It published no file count, so what is documented is a live encryption pass, not a measured loss. An attacker coming through an exposed AI framework now arrives carrying something built for what it connects to, and those assets are the ones a restore cannot reproduce. Model artifacts belong in the recovery plan next to the databases. Under three weeks passed between Sysdig's two reports, all this attacker needed to go from improvised Python to a compiled locker.
Enterprises deployed AI agents ahead of the controls needed to manage them — and they did it knowingly. That is the central finding across the five parallel surveys VentureBeat Research fielded in June, spanning every layer of the agentic stack. Now those enterprises are retrofitting to catch up with their own standards, and they are budgeting for it: In each of the five control layers we measured, 57 to 68% of enterprises plan to switch vendors or add new ones within 12 months, and roughly a third, depending on the layer, plan to move within the quarter. VentureBeat Research measured the five controls an enterprise has to build before it can trust an agent: identity, evaluation, cost telemetry, the context layer, and orchestration. Identity governs which agent is allowed to do what, under whose credentials. Evaluation determines whether the agent's work is any good. Cost telemetry tracks what each agent costs to run. The context layer supplies the business data and definitions agents draw on when they answer. And the orchestration control plane coordinates multi-step agent work. Each of our five reports measures one of those controls. Most deployed "agents" are chatbots wearing the label. Seventy-one percent of enterprises said a quarter or fewer of their deployed "agents" can complete multi-step work on their own; only 10% said true agents are the majority of what they run. These respondents are positioned to know: 81% recommend or decide AI purchases at their companies. A single-prompt chatbot with a human reading every answer needs none of the controls the other four reports measure. A true multi-step agent needs all of them — and most enterprises can't say which one they've deployed. (Full findings: Agentic Orchestration report. ) Autonomy is outrunning trust in the evaluations that gate it. Two-thirds of enterprises either already allow an agent to push a code or system change to production on automated evaluation results alone, with no human review, or are actively engineering toward that within 12 months. Only 5% fully trust the evaluations that would make that call — and half of enterprises shipped an agent that passed internal evaluations and then caused a customer-facing failure in the past year. Before removing human review from any workflow, test evaluations against production outcomes rather than internal benchmarks. (Full findings: Agent Reliability & Evals report .) Companies that let agents share credentials get hit more often. Sixty-nine percent of companies let at least some of their agents share credentials — multiple agents operating under one API key or service account. Organizations that allow credential sharing anywhere experienced a security incident or near-miss at a 63.5% rate (47 of 74), against 40.9% (nine of 22) at companies where every agent has its own scoped identity. The fix is scoped identity for every agent, starting with the ones that touch production systems. (Full findings: Agentic Security & Identity report .) The most expensive hardware in the building runs at half capacity or less. More than eight in 10 enterprises that run their own GPUs reported utilization of 50% or less, and only 44% rigorously track what their AI compute actually costs and returns. The number worth chasing first isn't more GPUs — it's the utilization and per-workload cost of the ones already running. (Full findings: AI Infrastructure & Compute report .) Agents answer confidently from data nobody governs. Fifty-seven percent of enterprises traced a confident, wrong agent answer in the past six months to their own missing or inconsistent business context — wrong metrics, stale definitions, absent documents — and most saw it happen more than once. Governing the definitions agents answer from — metrics and entities first — has to come before scaling the agents that depend on them. (Full findings: Context Layers / RAG report .) No layer has an entrenched incumbent: The defaults today are the built-in tools that ship with the big AI platforms enterprises already use. Switching intent runs highest in orchestration itself, where 68% plan to adopt, add, or replace platforms within 12 months and 34% within the quarter. Our surveys did not ask which direction that money moves — toward the platforms' built-in tools or toward the specialists challenging them — and that open question is the next four quarters of this market. About this research VentureBeat Research fielded five parallel surveys in June 2026 under its VB Pulse program: Agentic Orchestration (101 respondents), Agent Reliability & Evals (157), Agentic Security & Identity (107), AI Infrastructure & Compute (107), and Context Layers / RAG (101) — 573 qualified respondents in total, all at organizations with 100 or more employees. Samples are self-selected, and some findings should be read directionally; each report carries its full methodology note. What the pattern supports more strongly than any single percentage is the direction: every survey, independently, points the same way. VentureBeat produces both this research and VB Transform , the conference where these reports debuted.
Anthropic released Claude Opus 5 on Friday, a model the company says delivers nearly all the intelligence of its top-of-the-line Claude Fable 5 at half the cost — a launch that signals how the AI race is shifting from raw capability to the economics of daily use. The model, available immediately on all of Anthropic's platforms, is priced at $5 per million input tokens and $25 per million output tokens, unchanged from its predecessor, Opus 4.8 . It becomes the new default model on Claude Max , Anthropic's premium consumer tier, and the strongest model available on Claude Pro . The positioning is deliberate. Anthropic is not claiming Opus 5 is its smartest model — that distinction still belongs to Fable 5 , and rival systems retain an edge in certain domains. Instead, the company is making a subtler argument that may matter more to enterprise buyers: that the most economically important AI work happens in a middle band of difficulty, where near-frontier intelligence delivered efficiently and cheaply beats frontier intelligence delivered expensively. "Opus 5 as your daily driver, the model you hand complex work to and review when it's done," an Anthropic spokesperson said in an interview with VentureBeat, describing how the company's lineup now stratifies. "Fable 5 for your most ambitious work, the days-long autonomous projects nothing could take on before... Sonnet 5 for work you run at scale, where speed and cost per call decide what ships. Haiku 4.5 for subagents and instant answers." How Claude Opus 5 benchmark results stack up against Fable 5 and rival AI models On paper, the results are striking. Anthropic says Opus 5 sets new state-of-the-art marks on coding and knowledge-work evaluations including Frontier-Bench and GDPval-AA . On Frontier-Bench v0.1 , an agentic terminal coding benchmark, Opus 5 scores 43.3 percent — more than double Opus 4.8's 18.7 percent and well ahead of Fable 5's 33.7 percent — at a lower cost per task, according to the company. On ARC-AGI 3 , an evaluation of novel problem-solving, Anthropic reports Opus 5 scored three times as high as the next best model. On OSWorld 2.0 , a computer-use benchmark, the company says the model surpasses Fable 5's best result at just over a third of the cost. The numbers come with honest caveats that are themselves notable in an industry prone to superlatives. Anthropic acknowledges Opus 5 remains behind Mythos 5 , a competing model, on cybersecurity tasks and biology research, and an OpenAI-family model still leads on one agentic coding benchmark. The more revealing caveat came from Anthropic itself, when asked where Opus 5 still falls short of Fable 5 . The spokesperson's answer amounted to a candid admission about what benchmarks do and don't capture. "The evals where Opus 5 wins are bounded tasks with a specific outcome, which is where it's strongest. What those evals don't measure is duration," the spokesperson told VentureBeat. "One way to put it: Opus 5 is the best tool for the jobs benchmarks can see, and Fable 5 is what you reach for when the job outruns the benchmark." Fable 5 , by contrast, "is for the longest, most autonomous jobs, where the model has to stay coherent across many connected steps over hours or days with dense source material," the spokesperson said, advising customers to "run both on a representative workload, one bounded task and one long-horizon job." That framing — bounded tasks versus long-horizon autonomy — may become the defining axis of model differentiation in 2026, as benchmarks saturate and the hardest remaining problems involve sustained, multi-day agentic work rather than discrete puzzles. Why token efficiency is becoming the real battleground for enterprise AI spending Threaded through the launch is a theme Anthropic clearly wants buyers to absorb: Opus 5 doesn't just score well, it scores well per dollar. The model ships with an adjustable "effort" setting that lets customers trade intelligence for speed and token savings, and Anthropic's charts emphasize performance at a given cost rather than peak performance alone. Early customers echoed the point with unusual specificity. Harvey, the legal AI company, said Opus 5 achieved similar performance to Opus 4.8's maximum-reasoning mode "while generating 26% fewer tokens on average," according to Niko Grupen, its head of applied research. Richard Pham of Fundamental Research Lab said that on hard financial-modeling tasks, the model averaged nine percentage points higher accuracy "while using roughly one-third fewer turns and tool calls and 60% less time." Wade Foster, chief executive of Zapier, said Opus 5 topped his company's AutomationBench leaderboard "without spending more tokens than prior Claude models," running a full churn-prevention workflow from start to finish. "Previous models didn't pass; Opus 5 hit 100%," he said. Scott Wu, chief executive of Cognition, the company behind the Devin coding agent, said that on FrontierCode 1.1, "Claude Opus 5 approaches Fable-level performance at half the cost," with particular strength in debugging and root-cause analysis. The efficiency emphasis reflects commercial reality. Enterprise AI spending is no longer experimental, and inference costs — the price of actually running these models at scale — have become a board-level line item. Anthropic's business skews heavily toward API and enterprise usage; according to a February 2026 analysis by Contrary Research , Claude held roughly 40 percent of the enterprise large language model market by usage as of late 2025, and Claude Code alone had reached about $1 billion in annualized revenue. For a company whose customers pay by the token, a model that does more with fewer tokens is not a nice-to-have. It is the product. Self-verifying AI agents and what they mean for the hidden costs of automation Beyond the numbers, Anthropic is selling a behavioral story: that Opus 5 verifies its work and iterates until it succeeds. The company offered several examples from testing that read like small parables of machine stubbornness. In one Frontier-Bench task, the model was asked to reconstruct a machine part as a 3D CAD model from a drawing it was intentionally given no way to view. Rather than fail, Anthropic says, Opus 5 wrote its own computer vision pipeline to extract the geometry from raw pixels — and did so repeatedly, while no competing model solved the task in five attempts. In another case, given a real bug in a popular open-source package manager, the model found the root cause and fixed an edge case the community's own patch had missed; a competing model patched only the symptom and declared victory. An engineer at a trading firm, the company says, used Opus 5 to build a market data feed for a new exchange in a single session and, finding no live feed to validate against, watched the model build its own test harness to check its parsing code. Customers described similar behavior in the wild. Cristian Rivera, a staff software engineer at Stripe, said he gave the model "a chief-of-staff role over my dev environments" for a weekend: "it built its own monitor, drove each box, and pulled me in only for the judgment calls." This is the capability enterprises actually care about, and it is worth dwelling on why. The gap between a model that produces plausible output and one that verifies its output is the gap between a demo and a deployable system. Most of the hidden cost of enterprise AI today is human review — engineers checking the machine's work. A model that reliably checks its own work compresses that cost, which is precisely why customers keep citing fewer turns, fewer passes, and less time rather than higher raw scores. Inside Anthropic's safety strategy: capability gaps, classifiers, and model fallbacks The launch also showcases Anthropic's increasingly intricate approach to safety — one that now involves deliberately not teaching its models certain skills. The company says its automated behavioral audit found Opus 5 to be its most aligned model to date, scoring 2.3 on overall misaligned behavior, lower than Opus 4.8 , Sonnet 5 , or Fable 5 , with the lowest rates of deceptive behavior and the least susceptibility to being tricked into misuse. On the capability side, Anthropic says it intentionally avoided training Opus 5 on cyber tasks, as it did with Opus 4.8. The model improved on them anyway — a side effect of general capability gains — and now nearly matches Mythos 5 at finding software vulnerabilities. But it remains far behind at exploiting them: on Anthropic's OSS-Fuzz evaluation, Opus 5 identified vulnerabilities at a 79.4 percent rate, close to Mythos 5's 80 percent, but succeeded at developing exploits in only 4 challenges versus Mythos 5's 13. That asymmetry — strong at defense-relevant discovery, weak at offense-relevant exploitation — appears to be by design, and the safeguards follow the same logic. Anthropic expects Opus 5's cyber classifiers to intervene about 85 percent less often than Fable 5's. When a classifier does trigger, requests in Claude.ai , Claude Code , and Claude Cowork fall back to Opus 4.8 by default — raising an obvious question: if a request is too risky for one model, why is it acceptable for another? "The model it falls back to has lower capability levels making the risk of harmful use lower as well," the spokesperson said, adding that "there is a message that lets the user know when this occurs and is visible in the chat." The logic is defensible, but it reveals how AI safety actually works in 2026: risk is not a property of the question alone, but of the question multiplied by the capability of the system answering it. On biology, the calculus runs the other way. Opus 5 is now Anthropic's most capable generally available model for scientific research — scoring 10.2 percentage points higher than Opus 4.8 on the company's internal chemistry benchmark — though the spokesperson acknowledged that "Mythos 5 remains the stronger model for long-horizon, open-ended work like autonomous drug design campaigns." The business stakes behind the launch: a $380 billion valuation and massive compute bets The launch lands at a moment of extraordinary commercial momentum — and extraordinary obligations — for Anthropic. Reuters reported in February that the company was valued at roughly $380 billion in its latest funding round, following a period in which, per Contrary Research's analysis, its annualized revenue climbed from about $1 billion at the end of 2024 to a projected $9 billion by the end of 2025, with internal targets reportedly reaching $20 to $26 billion for 2026 . Those targets are underwritten by enormous infrastructure commitments, including a reported $30 billion Azure compute deal alongside arrangements with Google Cloud and Nvidia — spending that only pencils out if enterprises keep expanding usage. That is the context in which Opus 5's pricing strategy makes sense. Holding the price at Opus 4.8 levels while roughly doubling performance on key agentic benchmarks is effectively a steep price cut per unit of capability, designed to widen the funnel of workloads that are economical to automate. Every task that was marginal at Opus 4.8's cost-per-success becomes viable at Opus 5's — and every viable task is recurring token revenue. The regulatory backdrop has grown more complex as well. A U.S. judge gave final approval this week to Anthropic's $1.5 billion copyright settlement with book authors , Reuters reported, closing a chapter of litigation over the company's early training data. And in June, Reuters, citing Axios, reported that the U.S. government had moved to block foreign access to Anthropic's most advanced models — a reminder that frontier AI is now entangled with export policy in ways that shape which customers can buy what. Also shipping Friday: a Fast mode running at roughly 2.5 times default speed at twice the base price, automatic fallback routing on the API, and mid-conversation tool changes that no longer invalidate the prompt cache — a small feature that agent developers may appreciate more than any benchmark. Consistent with prior Opus models, Opus 5 carries no data retention requirements for general access, a point the spokesperson flagged unprompted for customers with "a hard zero data retention requirement." Developers can access the model as claude-opus-5 on the Claude API starting today. Two questions will determine whether the bet pays off: whether Opus 5's efficiency claims survive contact with production workloads at scale, and whether enterprises embrace a world where safety classifiers, not users, sometimes decide which model answers. But the deeper message of Friday's launch is that the AI industry's center of gravity has moved. For three years, the labs competed on what their best model could do on its best day. With Opus 5, Anthropic is competing on something less glamorous and far more lucrative: what a very good model can do every day, for half the price. In a market where the frontier keeps moving, Anthropic is wagering that the real fortune lies just behind it.
Microsoft AI released two new in-house models into public preview on Wednesday — MAI-Image-2.5-Pro , its highest-fidelity image generator to date, and MAI-Voice-2-Flash , a speech model built for high-volume enterprise workloads — while publishing production data that amounts to the company's most aggressive argument yet that it can power its own products without leaning on OpenAI's frontier models. The announcement, made by Microsoft AI's Superintelligence team , lands roughly a year after the company committed to building purpose-built models internally, and it arrives with an unusual level of specificity about where those models now run: Bing , PowerPoint , OneDrive , Dynamics 365 , Excel , GitHub Copilot , and Azure . The message to enterprise buyers — and, implicitly, to OpenAI — is that Microsoft's homegrown models are no longer research projects. They are production infrastructure serving millions of users. "Each of these enhancements is a step toward the same goal: Microsoft products, powered by Microsoft models," the company wrote in its announcement blog. How MAI-Image-2.5-Pro and MAI-Voice-2-Flash stake out opposite ends of the AI cost curve The two new releases occupy opposite ends of what Microsoft calls the quality-speed-cost curve, and the positioning is deliberate. MAI-Image-2.5-Pro targets the premium tier: hero imagery, detailed editing, and precise in-image text rendering — the last of which has long been a notorious weak spot for image generation models. Microsoft priced the model at $5 per million text input tokens, $8 per million image input tokens, and $106 per million image output tokens. The base MAI-Image-2.5 model recently launched at No. 2 for image editing on Arena , the community leaderboard that has become a de facto scoreboard for generative media. The creative industry appears to be taking notice. Rob Reilly, global chief creative officer at advertising giant WPP, called the Pro model "a strong leap forward for GenMedia tools" in a statement included in Microsoft's announcement, adding that "Microsoft has firmly established itself among the leaders in generative AI." MAI-Voice-2-Flash goes the other direction. First previewed at Microsoft's Build conference , Flash runs twice as fast as MAI-Voice-2 and costs 32% less, priced at $15 per million characters. It is designed for the unglamorous but enormous market of high-volume voice — call centers, voice agents, and real-time speech applications where latency and cost-per-call matter more than marginal gains in expressiveness. Together, the two models reflect a strategy of building families of models rather than a single flagship, because, as the company put it, a creative studio chasing maximum fidelity has very different needs from a customer service operation handling millions of calls a day. Microsoft's production metrics show in-house models cutting GPU costs by up to 89% The model launches are arguably less newsworthy than the deployment metrics Microsoft attached to them — numbers that read like a systematic case for swapping out third-party frontier models across its product portfolio. Bing Image Creator now runs entirely on MAI-Image-2.5 , end to end, marking the first time the consumer image tool is fully in-house. In PowerPoint, Microsoft says MAI-Image-2.5 reduces GPU costs by up to 84% compared with GPT-Image-2, OpenAI's image model. In OneDrive, where MAI-Image-2.5 is now the default for key image-editing scenarios, the company reports a 26% increase in save rates, roughly 25% lower P95 latency, and 2.5 times greater efficiency under medium-utilization production workloads. On the voice side, MAI-Voice-2-Flash now powers Dynamics 365 Contact Center — the platform used by customers including T-Mobile and EasyJet — where Microsoft claims GPU cost reductions of up to 89%. The model is also integrated into Azure Voice Live for developers building speech-to-speech agents. Perhaps the most consequential deployment sits in healthcare. Microsoft's Dragon Copilot , used by 170,000 medical providers and responsible for processing 28 million patient encounters last quarter, now runs on MAI-Transcribe-1.5 for its multilingual workflow across 58 languages. Microsoft says internal evaluations show a 50% relative reduction in both transcription and language-identification error rates across most languages — a meaningful claim in a domain where transcription errors can propagate directly into clinical notes. Inside the 'hill-climbing' strategy that lets small models beat GPT-5.6 in Excel In a companion post published the same day, Microsoft detailed the methodology behind these results — what it calls its " hill-climbing machine ," an integrated flywheel of data, models, and the product "harness" that surrounds them. The clearest example is MAI-Code-1-Flash , the lightweight coding model launched in GitHub Copilot in June. Microsoft says the model achieves an approximately 10% higher code accept rate than GPT-5.4 Mini and Claude Haiku 4.5 in VS Code, while using 10% fewer median tokens. Developer retention tells a similar story: users were 6% more likely to return across multiple days than with GPT-5.4 Mini, and 11% more likely than with Claude Haiku 4.5. Then Microsoft did something more interesting. It took the MAI-Code-1-Flash checkpoint and further trained it inside an Excel reinforcement learning environment , teaching a coding model the tools and workflows of spreadsheet knowledge work. The result, according to production user feedback, is a model on par with GPT-5.6 for the most common Excel tasks — while being small enough to run on Nvidia's older H100 and even A100 GPUs rather than requiring the latest-generation accelerators. That hardware detail deserves emphasis. Every major AI company is fighting for allocation of cutting-edge chips, and a model that delivers frontier-adjacent quality on two-generation-old silicon fundamentally changes the deployment economics. It also frees the newest hardware — including Microsoft's now-operational GB200 cluster — for training rather than serving. Satya Nadella's 'frontier diffusion' manifesto redraws the OpenAI relationship Microsoft CEO Satya Nadella framed the announcements in a lengthy post on X titled " Frontier Diffusion & Control ," which functions as something close to a strategic manifesto. "We can now take saturated frontier capabilities and deliver them at scale and at lower cost through models optimized for high-usage products, while continuing to use frontier models for frontier needs," Nadella wrote, adding that Microsoft is "beginning to route traffic across our first-party surfaces to MAI whenever our models match or outperform frontier alternatives." Translated from executive prose: capabilities that were state-of-the-art a year ago are now table stakes, and Microsoft believes it can replicate them cheaply for the specific, repetitive tasks that dominate real product usage. Why pay frontier prices for a frontier model when a user just wants to reformat a spreadsheet column? Nadella was careful to note that "frontier models from OpenAI and Anthropic are part of the orchestration system alongside MAI" — but he also articulated a pointed principle of model independence, arguing that a company's evaluations "should continue to hill climb even when any given model has been removed." “Keeping the harness, memory, context, and skills outside the model, he argued, is what gives Microsoft control. The subtext is hard to miss. Reuters reported in April that Microsoft’s exclusive license to OpenAI’s technology had been revised into a non-exclusive arrangement, and The Information reported last September that Microsoft had begun incorporating Anthropic models into some products. Wednesday’s announcement completes the triangle: Microsoft as orchestrator, with its partners’ frontier models as interchangeable components and its own models absorbing an ever-larger share of routine traffic.” Developers cheer cheaper task-specific models while skeptics question Microsoft's track record The response online captured both the appeal and the skepticism surrounding the strategy. "I love when people use small models for niche tasks," wrote one X user, @mavihsk , responding to Nadella's post. "Why do I have to use the all-knowing model just to change my field in Excel?" Another user, @nabu_lines , distilled the pitch neatly: "cost and performance both improve when you stop overusing the biggest model." Others were less charitable about Microsoft's execution track record. "Microsoft is the worst when it comes to listening to user feedback," wrote designer @designedbyabin , arguing the company "will lose the AI race because they repeatedly failed to understand user needs." And one user, @tokenoverflow , offered a drier critique of the model-independence pitch: "i want it keep hill climbing after removing microsoft." The skeptics raise a fair point. Microsoft's self-reported metrics — accept rates, save rates, GPU savings — come from its own internal evaluations, not independent benchmarks, and the company chooses which comparisons to publish. But the strategy's logic does not depend on any single number. Nadella's framing that software now has " real marginal cost for the first time " explains why Microsoft is obsessive about tokens, GPUs, and serving costs: when AI features run on every keystroke across a billion-user product portfolio, an 84% GPU cost reduction is not an optimization. It is the difference between a viable business and a money pit. Why Microsoft is turning its internal AI playbook into an Azure product The final piece of the strategy is that Microsoft is selling the playbook, not just the models. Nadella explicitly positioned the hill-climbing approach as "a template for every other AI native, SaaS, or Enterprise company," and Microsoft is packaging the toolchain through Foundry and what it calls Frontier Tuning — letting enterprises train specialized models against their own proprietary evaluations and reinforcement learning environments. That turns Microsoft's internal cost-cutting exercise into an Azure product, and it gives enterprise customers a reason to run their AI workloads on Microsoft's cloud even if the models themselves come from elsewhere. The company's emphasis on models trained "on clean, traceable, enterprise-grade data, without distillation from third-party models" serves the same commercial end. In an industry facing mounting scrutiny over training data provenance, Microsoft is betting that enterprise buyers — and courts — will care where model capabilities come from. Microsoft says it is now extending the hill-climbing approach to Copilot Chat , Outlook , and PowerPoint , and both new models are available in public preview through Microsoft Foundry and the MAI Playground . "None of this is an endpoint," the company wrote. "We're just getting started." Seven years ago, Microsoft bet more than $13 billion that OpenAI would build the future of AI. Wednesday's announcement suggests the company has since learned a cheaper lesson: the future of AI may belong to whoever builds the frontier, but the profits belong to whoever makes it ordinary.
VentureBeat··8 min read
Zero-Day
↘2K
💬
Top Discussion
HN
Hacker News
“GPT-5.5's API pricing is reshaping how startups build AI products”
