Venture Beat

Writer, the enterprise AI agent platform used by Fortune 500 companies including Accenture, Uber, and Vanguard, released its new flagship model Palmyra X6 today, alongside a rebuilt agent orchestration “harness” and new governance tools designed to give IT leaders control over runaway token spending.The headline numbers are striking: Writer says its agent product now operates at an average 52% lower cost, with a 48% improvement in speed and a 10% improvement in quality when paired with Palmyra X6. But the more consequential story may be how the company got there — and what its choices reveal about where the enterprise AI market is heading.Palmyra X6 is not trained from scratch. It is a post-trained version of GLM-5.2, the open-weight mixture-of-experts model from Beijing-based Z.ai, formerly Zhipu AI — a fact Writer discloses openly in its technical report, and one that places the San Francisco company at the center of one of the industry’s most charged debates: whether American enterprises should build on Chinese open-source foundations.”This model is in no way, shape, or form connected to any of its original developers. It is fully run on our U.S. infrastructure,” Matan-Paul Shetrit, Writer’s director of product management, told VentureBeat in an exclusive interview ahead of the announcement.Dan Bikel, who leads Writer’s AI research, put it more bluntly: “It’s very much a Palmyra model, and we just happen to grab the floating point numbers as the starting point, and train from there.”Why AI agents are blowing up enterprise budgets in ways chatbots never didWriter’s announcement lands at a moment when the economics of agentic AI have moved to the center of enterprise buying decisions. Unlike a chatbot, which typically generates one answer per user request, an AI agent turns a single request into repeated rounds of planning, retrieval, tool calls, validation, and retries — with every loop consuming metered tokens. The user sees one answer; the invoice reflects the entire loop.The scale of the problem is becoming clear. Goldman Sachs forecasts that token consumption will multiply 24 times between 2026 and 2030, reaching 120 quadrillion tokens per month, driven not by more people asking questions but by always-on enterprise agents. The same analysis warned that falling per-token prices do not guarantee falling bills: if an agentic task draws 20 times more tokens while unit prices fall 75%, total charges still rise fivefold.”The enterprise wants token consumption to explode — it means adoption is happening — but they need costs to flatten,” said Waseem AlShikh, Writer’s CTO and co-founder, in a statement.Shetrit framed the cost problem as the primary obstacle to enterprise AI adoption — more so than model capability itself. “The biggest barrier today to enterprise expansion using AI is actually not model capabilities in most cases; it’s actually the cost around them,” he said. “The reality today is, in most cases, the alternative for AI is not another AI, it is human labor.”Asked whether cutting customers’ token consumption would cannibalize Writer’s own per-token revenue, Shetrit rejected the premise. “Reducing the cost is not hurting my bottom line. It’s actually expanding it, because it’s expanding the TAM of opportunity within an organization,” he said, arguing that lower per-task costs unlock workflows enterprises would otherwise never automate. That argument echoes a pattern familiar from the cloud era, where unit prices fell for a decade while total bills rose as consumption expanded — a dynamic Writer is explicitly betting will repeat with agents, and betting it can profit from.Inside Palmyra X6: how 626 training examples fine-tuned a 744-billion-parameter modelPalmyra X6 is a 744-billion-parameter mixture-of-experts model with roughly 40 billion active parameters per token, inheriting GLM-5.2’s architecture unchanged, according to Writer’s technical report. The company’s contribution is a deliberately conservative post-training recipe: a technique called anchored supervised fine-tuning (ASFT), applied to a remarkably small corpus of just 626 curated synthetic agentic trajectories, trained for a single epoch at a low learning rate.The tiny dataset is the point, not a limitation. ASFT pairs a token-weighting scheme with a KL-divergence “anchor” that penalizes the fine-tuned model for drifting too far from a frozen copy of the base model — teaching new tool-use behaviors without eroding the general capabilities the base already has. Writer also swapped the standard Adam optimizer for Muon, a newer method that treats weight matrices as geometric objects, on the model’s core weight matrices.”There’s a whole string of papers following a quote-unquote ‘less is more'” philosophy, Bikel said, referencing research showing that “small, extremely high quality data sets go a really long way.” He added: “That’s the philosophy — one of the philosophies — that we followed when building this model, and it showed. It allowed us to optimize for our customers at lower cost to do the work of optimization, and that ultimately yielded a lower cost model for us and for them.”The training data itself is fully synthetic — every plan, tool call, and final answer machine-generated by teacher models, then filtered through structural quality gates, a model-based verifier, and a two-model LLM judging panel before entering training. That continues a long-standing Writer practice: the company’s Palmyra X 004 was trained almost entirely on synthetic data for roughly $700,000 back in 2024, as TechCrunch reporte at the time, and Palmyra X5 required about $1 million in GPU hours, according to SiliconANGLE.On Writer’s internal evaluations — nine capabilities spanning grounding and retrieval, tool use, content generation, sub-agent delegation, and brand voice — X6 scored an average of 0.87 out of 1.00, edging out Anthropic’s Claude Opus 4.8 (0.86), Claude Sonnet 4.6 (0.85), OpenAI’s GPT-5.5 (0.80), and Google’s Gemini 3.1 (0.77). The price gap is the real differentiator: Writer prices X6 at $2 per million input tokens and $8 per million output tokens, versus 15/75 for Opus 4.8. The company says X6 completes tasks in 26 seconds on average and can work unattended toward a single goal for up to eight hours.Writer is candid that internal benchmarks invite skepticism. Asked directly whether the company would publish its methodology after grading its own homework, Bikel said the technical report covers “both the protocol we used to do our public benchmarking as well as our internal evaluations.” He described public benchmarks as sanity checks rather than targets: “We do things like public benchmarks to let us know that we’re climbing the right hill and that we don’t have any sort of huge gaps, but we don’t slavishly follow them either, because that’s not really serving our customers.”The China question: what building on GLM-5.2 means for enterprise security and trustWriter’s choice of base model would have been unthinkable for an American enterprise vendor two years ago. Today it reflects a market reality: GLM-5.2, released in June under the permissive MIT license, is arguably the most capable openly available model in the world. Independent analysis house Artificial Analysis scored it at 51 on its Intelligence Index — ahead of DeepSeek V4 Pro, Kimi K2.6, and even some of Google’s Gemini models on agentic tasks — while undercutting U.S. flagship API pricing many times over, as European tech outlet Trending Topics reported. Writer’s press release calls it “the strongest available open-weight model.”The open-weight surge carries genuine baggage. An August report from AI safety nonprofit SaferAI found that GLM-5.2 refused none of the offensive cyber or biology tasks it was given via Z.ai’s public API, and that Z.ai published no safety framework or pre-deployment risk assessment — a gap that widens once anyone can download and modify the weights.Writer’s answer is that provenance and post-training matter more than origin. Bikel emphasized that the company “grabbed the weights off of the U.S. Hugging Face” and trained entirely on American infrastructure; the technical report states all datasets were synthesized and stored in the U.S., and all training hardware was located in the U.S.The company also ran what it describes as an unusually rigorous, pre-registered model-risk evaluation covering political bias, censorship, factuality, and refusal behavior — 19,674 evaluated responses scored by blinded judges — comparing X6 against its GLM-5.2 base and four frontier control models.On the Washington Post’s ModelSlant political-bias evaluation, Writer says X6 presented both sides of hot-button questions 80% of the time, the highest rate of any model tested, and answered politically sensitive prompts that DeepSeek V4 refused outright. On the FORTRESS adversarial safety benchmark, X6 with its deployment system message scored 8.6 points higher on adversarial safety than the raw GLM-5.2 base, at negligible cost to benign helpfulness.”We’ve run extensive benchmarking around bias, around censorship,” Shetrit said, “and the work Dan and the team has done has actually proven that this model is actually significantly better than not just open source alternatives, but any closed source alternative in the market at the time of the benchmarking.” The report does hedge in one notable place: while English-language behavior showed no statistically robust political asymmetry, “the behavior was shown to vary by language” — a candid admission that 626 fine-tuning trajectories do not scrub every trace of a base model’s training.The harness effect: why orchestration may matter more than the model itselfPerhaps the most strategically interesting claim in Writer’s announcement has nothing to do with Palmyra X6 at all. The company says its rebuilt Writer Agent harness — the orchestration layer that plans tasks, batches work, delegates to sub-agents, and manages context — cuts costs by 41% and completes tasks 44% faster across every model it tested, including third-party models from Anthropic and OpenAI, while maintaining quality. Writer published the finding in an accompanying research paper on what it calls “The Harness Effect.”That raises an obvious question, which VentureBeat put to the company: if the harness alone delivers most of the savings on any model, why build a model at all?Shetrit’s answer was about control. “I cannot control if a lab deprecates their model. I cannot control what data they use in their model,” he said. “Where when I build the model, I have significant moral control, and I can answer the tough questions that enterprise customers ask me.”Bikel added that the model and harness were developed together: “This model was built and essentially co-evolved with the harness… We know that we have a flagship product, Writer Agent. We want that to work really, really well with this model, and sure enough, it does. And we take that into account during model development, and that’s something that is not possible if you don’t build your own model.”Notably, Writer is simultaneously hedging. With this release, the company extends multi-model support to Writer Agent, letting admins enable models from Anthropic, OpenAI, and cloud providers including Microsoft Azure, AWS Bedrock, and Nvidia NIM — even image-generation models, a category Writer does not build. The message to CIOs is disarmingly simple: use our model because it is cheapest and best for your workflows, but the platform saves you money either way.New governance tools aim to end surprise AI bills before they startThe third leg of the release targets a quieter enterprise pain point: nobody in the C-suite knows what the agents are spending. New governance tools give administrators a centralized view of agent usage across the business, per-workflow analytics for the company’s shareable “Playbooks” and “Skills” automations, and consumption controls with alerts and spending limits.Asked whether the introduction of spending controls implied that customers had been receiving surprise bills, Shetrit reframed it as an adoption enabler rather than damage control. “How do we build the tools to allow you as the CIO, CISO in a company, to feel comfortable both on the security and spend, so you can expand AI usage in your organization,” he said. In his telling, visibility is what lets leaders say yes: businesses with clear cost data “are actually looking to expand AI adoption to use cases that they would never have touched before.”The feature set tracks a broader shift in how enterprises budget for AI. As Forbes analysis of the token price wars argued, sophisticated buyers are learning to model cost per successful task — counting retries, tool calls, and escalations — rather than multiplying expected calls by the advertised rate card. Writer is effectively productizing that discipline, turning what has been a finance-team spreadsheet exercise into a native platform capability.It also completes a governance arc the company has been building for over a year. Writer shipped its unified agent experience with admin controls last November, then added agent Skills and workflow analytics in March, according to earlier company announcements. Thursday’s release closes the loop by attaching a price tag — and a spending limit — to every workflow.Writer, founded in 2020 by May Habib and Waseem AlShikh, raised $200 million at a $1.9 billion valuation in late 2024, and has built its business on regulated, high-stakes deployments rather than consumer scale. Shetrit made no apology for the narrowness of that focus. “The privilege of working and focusing on enterprise use cases is that I don’t need my model to be able to write a French sonnet,” he said. “When you don’t try to do everything, you can focus on your customer problem and needs.”He was equally direct about identity: “We are not a research lab converted to a consumer product now dabbling in enterprise. We are first and foremost an enterprise company that serves enterprise customers, and we evaluate our decisions within that lens. Which means, if we think building things from scratch is the right decision, that’s what we will do. But if we think there are other alternatives out there in the market that serve our customers better, that’s what we will do.”That pragmatism may be the release’s most important signal. A well-capitalized American AI company with five years of model-building experience has concluded that the frontier of value no longer lies in pretraining, but in the last mile: post-training open weights, engineering the harness around them, and handing the CFO a dashboard. If Writer is right, the frontier labs’ moat narrows to the workloads where quality genuinely justifies a sevenfold price premium — and for everything else, the winning model is the one somebody else paid to pretrain.In an industry that has spent three years arguing about whose model is smartest, Writer is making a different wager: the enterprise AI race won’t be won by the company with the best floating point numbers, but by the one that knows what to do with them.

Visa’s president of technology, Rajat Taneja, walked the VB Transform 2026 audience through aiming Anthropic’s Mythos at Visa’s own payment network. The model stitched minor weaknesses into working exploit chains, and Visa open-sourced the harness that governed the hunt.That’s what it looks like when an enterprise has the engineering depth to act on what it finds. Most don’t get there. Just over half, or 53%, of enterprises have already had an agentic security incident or near-miss. Sixty-five percent enforce agent permissions at runtime, yet only 18% isolate their highest-risk agents, and just 8% pair enforcement with isolation.Leaning on provider-native controls to do the heavy lifting of agentic security just exacerbates that gap. The July wave of VentureBeat Pulse Research found that 92% of enterprises naming a primary security layer default to their hyperscalers and AI platform providers.Six waves of research have been completed since January, surveying 440 qualified enterprise security respondents. The key takeaway: the containment gap between what enterprises need and what’s getting done is growing wider, often unaddressed by enterprises whose agentic AI investments and futures are at risk.The satisfaction data doesn’t match the incident dataThe research keeps showing enterprises rating the tools they know best at a higher score, even if those tools failed them or delivered mediocre results. Three findings from the raw data cut against that instinct, and each one says something about how young this market still is. The enterprises that got hit rate their tools higher than the ones that didn’tLast month’s survey found that 46 enterprises reported a confirmed incident or near-miss, then went on to rate their satisfaction with their security tooling. Their average satisfaction was 4.39 out of 5. 30 of the 55 enterprises who experienced no incidents rated their security tooling at 4.13. Enterprises are rewarding any tool that saves them from a breach with a trust premium. It’s a sure sign of a nascent market when brand positioning, marketing, or other means of persuading enterprises get easily superseded by saving a customer from a breach. Near-misses outnumber confirmed incidents 2-to-1 in both June and July, which means enterprises are catching problems at the edge. That edge catch is being interpreted as validation of both the security strategy and the tools acquired. Evident through seven months of data is how quick enterprise security leaders are to trust a new tool that identifies an intrusion or breach and defeats it before it gains access. VentureBeat believes the rescue itself is doing the marketing. The 4.13 average among never-hit enterprises shows the other side of the same effect. Tools that have never been seen working earn less trust, not more. VentureBeat also found that of the 17 enterprises isolating their highest-risk agents, the 14 that rated their tooling average 4.00. Enterprises that do not isolate rate it 4.35. The enterprises closest to real security are the least satisfied with their tools — that dissatisfaction is what drives them toward the kind of engineering effort Visa put in.Four of five enterprises that solved identity did not build isolation49%, or 57 of the 116 enterprises surveyed in July, gave each agent its own scoped, managed identity. Just a month earlier, VentureBeat’s June wave recorded 32% of enterprises having assigned per-agent identities. July’s 17-point jump in one month is the fastest single-month move this series has recorded. Despite these gains, 63% still report credential sharing somewhere in the fleet. Only 11 of those 57 also isolate. That ratio explains why the containment gap keeps widening even as every headline control improves. Enterprises are treating identity and isolation as substitutes. They need to see the longer-term vision of each being integral to a platform-based, layered strategy. Two incidents VentureBeat has covered show why that distinction matters. A rogue AI agent at Meta passed every identity check before its March exposure was contained. And CrowdStrike CEO George Kurtz disclosed, at his RSAC 2026 keynote, a Fortune 50 agent that rewrote its own security policy using valid credentials. Giving an agent scoped credentials does not bound the blast radius when those credentials are misused. Sandboxing does.The enforce-without-isolate population has a 58% incident rateFifty-three enterprises in July’s survey enforce scoped permissions at runtime but do not isolate. 31 of those 53 have already had an agent security incident or near-miss. That is 58%, five points above the 53% sample average. The enterprises living inside the containment gap are getting hit more often than the enterprises outside it.Amy Chang, Cisco’s head of AI threat intelligence and security research, presented findings on the Transform agentic security panel showing that when Cisco ran 6,986 multi-turn attacks against 15 flagship models, attackers who adapted across the conversation broke through up to 88.3% of the time. Single-turn red-teaming missed it. An adaptive attacker who defeats the guardrails lands inside whatever architecture sits behind them, and for 53 of the enterprises in this data, that architecture enforces but does not contain.VentureBeat’s Q1 Pulse Research tracked the same structural weakness earlier this year. Unauthorized tool or data access ranked as the most feared failure mode in every Q1 survey, growing from 42% in January to 50% in March. The April-May survey found only 4% of enterprises comfortable relying on model guardrails alone. Enterprises predicted they needed external controls, choosing to build enforcement over containment. Enterprises built enforcement 35 points ahead of forecast. Isolation barely movedThe April-May survey asked 109 enterprises how they expected agent behavior to be controlled by the end of 2026, and 30% predicted runtime enforcement, 14% sandboxed execution, and 32% model-level guardrails. By July, 65% had built enforcement, more than double the prediction, while isolation reached 18%, roughly the rate they said it would. Enterprises built what was easy at twice the forecast and built what was hard at roughly the forecast. The April question asked for the primary control mechanism, single-select, while July’s posture question allowed multiple selections, so the comparison is directional rather than exact.Provider lock-in accelerated across all three quartersProvider-native platforms already led usage in April-May, named by seven in ten enterprises describing their tooling. By June, 82% called one their primary agent security layer, and by July that share reached 92%, with OpenAI’s guardrails leading at 44%, Microsoft Azure at 42%, Anthropic’s managed-agent controls at 37%, and Google Cloud at 31%. Cloudflare at 11% and Cisco at 9% lead the dedicated specialists fighting over what remains. The identity tools most relevant to the credential-sharing gap are the smallest of all, with Microsoft Entra Agent ID at 7%, while Okta for AI Agents, non-human identity platforms, and runtime sandboxing tooling each sit at 3%. CrowdStrike CTO Elia Zaitsev told VentureBeat at RSAC 2026 that observing agent actions is a solvable problem but inferring intent is not. The provider bundle proves his point, solving observation while leaving containment unbuilt.74% plan to replace tools they just rated a career-high satisfaction scoreSatisfaction scores continue rising as enterprises gain more experience using tools and techniques to stop agentic AI-based attacks. Rising to 4.29 out of 5 in July from 4.2 in June, satisfaction is the highest reading in the series. Despite the high satisfaction levels, 74% plan to replace their tools within 12 months, up from 59% in June. Only 26% intend not to change. VentureBeat believes early adopters are impatient to gain greater insights, and know what they don’t know about agentic security and resilience. Closing that knowledge gap is forcing churn into a market this young, and the raw answers resolve the paradox: 92% of enterprises naming a primary layer name a provider-native one. The 4.29 measures how easy it is to turn on a provider’s guardrails. It does not measure how effective those guardrails are at preventing the incidents 53% of the same respondents already had.The organizations closest to the threat are the least confident about itIn June, defenders led attackers 35% to 21%, but by July the split was 30-30, a dead heat. Among enterprises that have been hit, 39% now say attackers are ahead, against 20% of those that have not. Getting hit nearly doubles the pessimism but does not change the shopping. Just 10% of enterprises include any agent-identity product in their consideration set. Runtime sandboxing draws 6%, and those numbers hold regardless of incident history. VentureBeat covered the same blind spot in the June data. The label changed from agent security gap to containment gap, but the shopping did not.MethodologyThe posture question was answered by 93 of the 116 qualified July respondents, and the skippers are not hidden isolators. Twenty-three of the 25 who selected no posture option are organizations still evaluating agents, unsure of their status, or with no deployment plans, groups for which a security posture largely does not yet exist, so the 18% isolation figure reads on the enterprises actually running or piloting agents. April-May, June, and July are separate, independently fielded waves rather than a single tracked series, so month-over-month comparisons in this piece are directional rather than a measured trend. Base sizes for the cross-cuts differ by instrument. The identity question covers all 116 respondents, isolation covers the 93 who described a posture, and the satisfaction inversion of 4.39 versus 4.13 is computed on the 76 respondents who rated their tooling.The bottom lineVentureBeat’s cross-survey analysis of 573 enterprise respondents concluded in July that enterprises deployed AI agents ahead of the controls needed to manage them, and they did it knowingly. Three waves of security-specific data now show where the knowing stops.Enterprises continue giving agents scoped identities and treating that as containment, but that assumption is false, and the incident data keeps proving it. In fact, 46 of 57 enterprises that solved identity did not build isolation. The enforce-without-isolate population’s 58% incident rate is the clearest evidence that identity alone isn’t enough. The containment gap will not close through satisfaction with what is easy. Whether enterprises build isolation and governed identity deliberately, or whether a confirmed incident that propagates does it for them, is the question the next wave will answer.

Elon Musk’s company SpaceXAI, formerly known as xAI, has released Grok 4.6, its latest frontier AI model, with a focus on long-running agents, coding and knowledge work — and a pricing strategy designed to make those workloads cheaper to run.The model scores 61 on the third-party Artificial Analysis Intelligence Index, surpassing the popular open weights Chinese model from Moonshot, Kimi K3, and tying rival OpenAI’s GPT-5.6 Sol Max and improving five points over Grok 4.5 High. Anthropic’s Claude Opus 5 and Fable 5 occupy the number one and two spots, respectively. More consequential for enterprises evaluating AI agents, Grok 4.6 posts sizable gains over its predecessor across coding, terminal, knowledge-work and agent benchmarks while retaining an application programming interface (API) price starting at $2 per million input tokens and $6 per million output tokens, making it a mid-priced frontier model comparing leading options that are both proprietary and open source, globally, according to VentureBeat’s analysis.ModelInput ($/1M)Output ($/1M)Total ($/1M)SourceMuse Spark 1.2 Contributor$0.10$0.20$0.30MetaMiMo-V2.5 Flash$0.10$0.30$0.40Xiaomideepseek-v4-flash$0.14$0.28$0.42DeepSeekdeepseek-v4-pro$0.435$0.87$1.305DeepSeekGPT-5.6 Luna$0.20$1.20$1.40OpenAIMiniMax-M3$0.30$1.20$1.50MiniMaxLongCat-2.0 — limited-time promo$0.30$1.20$1.50LongCatMiMo-V2.5$0.40$2.00$2.40XiaomiLongCat-2.0 — standard$0.75$2.95$3.70LongCatMiMo-V2.5 Pro (≤256K)$1.00$3.00$4.00XiaomiMuse Spark 1.1 / 1.2$1.25$4.25$5.50MetaGLM-5.2$1.40$4.40$5.80Z.aiGrok 4.6 — 256K)$2.00$6.00$8.00XiaomiQwen3.8-Max$2.00$6.00$8.00QwenCloudGemini 3.6 Flash$1.50$7.50$9.00GoogleGPT-5.6 Terra$2.00$12.00$14.00OpenAIGrok 4.6 — ≥200K prompt tokens$4.00$12.00$16.00xAIGPT-5.4$2.50$15.00$17.50OpenAIKimi K3$3.00$15.00$18.00Moonshot AIClaude Opus 5$5.00$25.00$30.00AnthropicSakana Fugu Ultra (≤272K)$5.00$30.00$35.00Sakana AIGPT-5.6 Sol — Standard mode$5.00$30.00$35.00OpenAIClaude Fable 5 / Claude Mythos 5$10.00$50.00$60.00AnthropicGPT-5.6 Sol — Fast mode$10.00$60.00$70.00OpenAIStill, that’s less than half of what GPT-5.6 Sol costs over OpenAI’s API in standard mode. SpaceXAI says Grok 4.6 is available today in Grok Build, SpaceXAI’s answer to Anthropic’s Claude Code and OpenAI’s Codex, which is available starting in the $30 per month SuperGrok plan. It’s also available in SpaceX’s recent acquisition of the AI coding startup Cursor, and from partners including OpenRouter, Vercel and Cloudflare. SpaceXAI is providing twice the included usage for Grok 4.6 in Cursor and Grok Build during the first week.The release arrives only weeks after Grok 4.5, which SpaceXAI launched in July as a model targeting coding, agentic tasks and knowledge work, and one day after the launch of Grok Bot, a new system for assigning AI agents to complete designated tasks as virtual employees.The bigger change is agent behavior, not just another benchmark pointSpaceXAI describes Grok 4.6 as being built specifically to stay on task across longer sequences of work, including researching unfamiliar topics, analyzing information, navigating codebases and converting product ideas into working applications.The company says it subjected the model to a longer supplemental training run than Grok 4.5, using curated model-generated reasoning and technical data alongside engineering data and changes to its optimizer and training recipe. It then used Grok 4.5 to regenerate supervised fine-tuning trajectories across reasoning levels, agent harnesses, STEM, software engineering and knowledge work, filtering problematic trajectories with model-based checks.Reinforcement learning also targeted agentic environments spanning general coding, knowledge work, kernel optimization, web development and computer-aided design.That matters because enterprise AI deployments are increasingly moving beyond isolated prompt-and-response interactions toward agents expected to maintain state, operate tools, modify code and recover from problems across longer execution paths.SpaceXAI says that during its testing, Grok 4.6 showed more self-testing and verification on longer trajectories, checking its own work before proceeding. It also reports stronger first attempts on interactive and visual projects than Grok 4.5. Those are company observations rather than independent guarantees of production behavior, but they indicate where SpaceXAI concentrated the model’s post-training work.Grok 4.6 reaches the frontier, but does not sweep itGrok 4.6’s improvement over Grok 4.5 at this juncture of the AI model competition cannot be overstated.According to Artificial Analysis, Grok 4.6 reaches an Elo score (human preference of head-to-head model outputs, adapted from chess) of 1,753 on GDPVal-AA v2, the benchmark measuring performance on real-world tasks like scheduling and diagramming, versus 1,526 for Grok 4.5, 1,728 for GPT-5.6 Sol Max and 1,741 for Fable 5 Max. The coding results from SpaceXAI show a similar generational improvement but more competition at the frontier. Grok 4.6 scores 69.9% on CursorBench v3.2, up from 66.7%, while Fable 5 Max reaches 70.5%. On DeepSWE v1.1, Grok rises sharply from 54% to 65.9%, but GPT-5.6 Sol Max leads at 73%. FrontierCode v1.1 Extended moves from 56.6% to 61.3%, compared with 60.6% for GPT-5.6 Sol Max and a leading 63.6% for Fable 5 Max.Agent benchmarks tell much the same story. Grok 4.6 reaches 57.5% on APEX-Agents, a 10.4-point increase over Grok 4.5’s 47.1%, narrowly exceeding GPT-5.6 Sol Max’s 56.7% but trailing Fable 5 Max at 59.2%. On APEX-SWE, Grok 4.6 rises to 56.4% from 53.6%, while Fable 5 Max scores 58.8%.Terminal-Bench v3.0 exposes a larger remaining gap. Grok 4.6 improves from 15.7% to 26%, but GPT-5.6 Sol Max and Fable 5 Max score 34.6% and 34.1%, respectively.Two of Grok 4.6’s strongest results come from longer-horizon professional work. On AA-Briefcase it scores an Elo of 1,577, narrowly exceeding Fable 5 Max’s 1,574 and topping GPT-5.6 Sol Max’s 1,502. On Harvey LAB, Grok 4.6 reaches 15.8%, versus 12.9% for Grok 4.5, 11.3% for Fable 5 Max and 2.5% for GPT-5.6 Sol Max.SpaceXAI notes an important methodological caveat: third-party scores in its table use the best self-reported or publicly available results. The comparison therefore should not be interpreted as a perfectly controlled four-model evaluation.In other words, the evidence supports a substantial upgrade over Grok 4.5 more clearly than it supports across-the-board superiority over rival frontier models. Grok 4.6 wins several of the displayed evaluations while GPT-5.6 Sol Max and Fable 5 Max retain meaningful leads elsewhere.Cost could be the more important enterprise benchmarkArtificial Analysis’ supplied evaluation adds another dimension: how much work the model performs for the money spent.The testing places Grok 4.6 on its Intelligence-versus-Cost-per-Task Pareto frontier at a reported $0.84 per task — which actually makes it less of a bargain than its predecessor, Grok 4.5, and less economical than OpenAI’s GPT-5.6 Luna, z.ai’s GLM-5.2, and Meta’s new Muse Spark 1.2, among other models. Artificial Analysis also reports that Grok 4.6 completed its AA-Briefcase workloads in roughly 53 turns and about 0.5 billion input tokens on average, versus approximately 103 turns and 2 billion input tokens for Claude Opus 5 Max.Those measurements do not prove that every production agent will use fewer tokens or finish twice as quickly. Agent costs depend heavily on harness design, prompts, tool calls, caching, retry behavior and the task itself. But they point toward an increasingly important enterprise metric: the cost of completing a workflow, rather than simply the cost of generating one million tokens. That distinction is central to SpaceXAI’s positioning.The standard Grok 4.6 API starts at $2 per million input tokens and $6 per million output tokens, and SpaceXAI also offers a faster variant at twice the price.The supplied API documentation adds an important caveat for long-context deployments. Grok 4.6 supports a 500,000-token context window, but prompts below 200,000 tokens are billed at $2 per million input tokens, $0.50 per million cached-input tokens and $6 per million output tokens. Once a prompt reaches 200,000 tokens, those rates rise to $4, $1 and $12 respectively, with the higher pricing applying to all tokens in that request.That means enterprises should not extrapolate the $2/$6 headline pricing across the model’s entire context window when estimating total cost of ownership.Artificial Analysis says the standard headline rates remain more than 60% below the competing frontier-model prices it cites for Claude Opus 5 and GPT-5.6 Sol. The practical savings will depend on how many tokens each model consumes to complete the same workload.The Grok name carries considerable baggage and controversy, separate from the general AI skepticismPerformance and price may not be the only hurdles SpaceXAI faces in converting Grok 4.6’s benchmark gains into enterprise adoption. The Grok brand arrives with an unusually visible history of safety and governance controversies — including extremist and antisemitic outputs, politically skewed responses, exaggerated praise of Elon Musk and, more recently, the use of Grok’s image-generation capabilities to produce non-consensual sexualized imagery. For companies with strict compliance, brand-safety or responsible-AI requirements, that history could become a procurement consideration separate from the technical capabilities of Grok 4.6 itself.The most notorious text-generation episode came in July 2025, when Grok produced antisemitic posts, praised Adolf Hitler and in some responses referred to itself as “MechaHitler.” SpaceXAI’s predecessor xAI subsequently said it was removing inappropriate posts and taking steps to prevent hate speech from being published by Grok. Also in summer 2025, Grok began inserting references to an alleged “white genocide” in South Africa into answers to unrelated questions. xAI said an unauthorized modification to Grok’s response software had directed the system to produce a particular response on a political topic while bypassing its normal review process. The company said the change violated its policies and subsequently pledged to publish Grok’s system prompts and establish round-the-clock monitoring for problematic responses. The South African government has rejected claims that a genocide against white South Africans is taking place.Grok’s objectivity came under scrutiny again in November of the same year after the chatbot repeatedly produced implausibly flattering assessments of Musk. Among the examples reported at the time were claims placing Musk above elite athletes and historic intellectual figures. Musk said Grok had been manipulated through adversarial prompting into making “absurdly positive” statements about him. Whatever the underlying cause, the incident illustrated the reputational problem for an enterprise model whose outputs can become entangled with the public persona of the executive most closely associated with its developer.The most serious controversy has involved image generation. In January 2026, U.K. regulator Ofcom opened a formal investigation into X after reports that the Grok account was being used to create and distribute undressed images of people and sexualized images of children. Ofcom said the material under examination could amount to non-consensual intimate-image abuse, pornography and child sexual abuse material. X subsequently said it had implemented measures intended to stop the Grok account from being used to create intimate images of people, but Ofcom said its investigation remained open.The scrutiny extends beyond Ofcom. Britain’s Information Commissioner’s Office is investigating X and xAI over both the development and deployment of Grok, including whether personal data was handled lawfully and whether adequate safeguards existed to prevent harmful manipulated imagery. The European Commission, meanwhile, opened a separate formal investigation under the Digital Services Act examining X’s management of systemic risks connected to Grok, including the dissemination of manipulated sexually explicit material.Those investigations concern X and the earlier xAI organization rather than establishing a finding that the newly released Grok 4.6 API violates those laws. Nevertheless, they are unlikely to help SpaceXAI sell Grok to businesses.SpaceX acquired xAI in February 2026, and the AI operation now markets itself as SpaceXAI, meaning Grok’s newest models sit under a different corporate structure but retain the same consumer-facing brand.There is no evidence in the material examined here that Grok 4.6 itself repeats the specific “MechaHitler,” “white genocide,” sexual-image or Musk-flattery incidents associated with earlier Grok deployments. But enterprise procurement teams rarely evaluate a model in isolation from its vendor and product history. For SpaceXAI, that means Grok 4.6 may have to demonstrate not only that it is cheaper or more capable than competing frontier models, but that the controls around it are sufficiently predictable for organizations that cannot afford their AI supplier to become a brand-safety event.That continuity creates a potential adoption problem that benchmark tables cannot measure. Developers choosing a model for an internal coding agent may care primarily about price, latency and task completion. A bank, government agency, healthcare provider or consumer brand deploying the same model into customer-facing or regulated workflows may also have to consider vendor governance, content-safety controls, auditability and reputational exposure.A model designed to be deployed, not just chatted withGrok 4.6 supports text and image inputs with text output, function calling, structured outputs and reasoning, according to the supplied API specifications. Those specifications also list rate limits of 150 requests per second and 50 million tokens per minute, with API availability in us-east-1 and us-west-2.Cursor’s launch announcement similarly characterizes Grok 4.6 as designed for long-running agents and ambitious interactive and visual work, giving developers immediate access to the model inside an established coding-agent environment rather than requiring them to build a new harness around the API first.For enterprise buyers, that distribution may matter almost as much as another leaderboard result. Models increasingly compete not just on reasoning scores but on whether developers can place them inside existing coding, research and operational workflows without destabilizing those workflows or dramatically increasing inference costs, as well as incurring any blowback from associating with a controversial brand. Grok 4.6 does not establish an uncontested performance lead. Its launch instead presents a different proposition: frontier-level intelligence, large improvements over the previous generation, stronger long-running agent behavior and relatively aggressive token economics.The next test will be whether the efficiency Artificial Analysis observes on controlled agentic workloads carries into production. If Grok 4.6 can consistently complete long-running coding and knowledge-work tasks with fewer turns and fewer tokens, the model’s most important benchmark may ultimately be the enterprise inference bill rather than the leaderboard.

Skan AI, a startup that builds what it calls a “context graph of work” by observing how employees actually perform their jobs across enterprise software, has raised $63 million in Series C funding co-led by Cathay Innovation and Dell Technologies Capital, the company announced Wednesday.Citi Ventures, Bloomberg Beta, State Farm Ventures, and Wipro Ventures also participated in the round, which brings the seven-year-old company’s total funding to roughly $120 million. Alongside the raise, Skan is announcing the general availability of two new products — Skan AI Blueprint and Skan AI Agents — that, together with its existing Skan AI Intelligence offering, form a complete platform for discovering, modeling, and ultimately automating enterprise workflows.The announcement lands at a moment of deep frustration in enterprise AI. Companies have poured billions into generative AI pilots, but the results have been dismal: Gartner research cited by the company finds that only 8% of enterprises have AI agents in production, and 95% of early implementations will require a complete redesign. Those figures echo an MIT report last year, covered by Fortune, which found that roughly 95% of enterprise generative AI pilots were failing to deliver measurable returns.Avinash Misra, Skan’s co-founder and CEO, believes the industry has misdiagnosed the problem. The models are fine, he argues. What they lack is an accurate picture of the businesses they are being dropped into.”Everyone is obsessed with building a better driver,” Misra told VentureBeat in an exclusive interview ahead of the announcement. “We think the bigger opportunity is building a better navigation system.”Why enterprise AI agents keep failing when they rely on official process documentationThe standard playbook for grounding AI agents — feeding them process documentation, standard operating procedures, and system logs — is built on a fiction, Misra argues. The way work is documented and the way work actually happens inside a large enterprise are two different things, and the gap between them is precisely where agents fail.That gap is what sent Misra and co-founder Manish Garg down this path seven years ago, long before agents were a boardroom obsession. “Why is it so difficult for an organization, and a large enterprise especially, to understand how its own work actually gets done?” Misra said. “Why does it need to fly in McKinsey consultants for that?”The question has only grown more consequential as enterprises race to operationalize AI. Frontier models arrive at the company door brilliant but blind, with no knowledge of the exceptions, decisions, handoffs, and institutional habits that define how a claims department or a compliance team actually operates. Every company now stuffing agents with documentation and logs, Skan contends, is discovering the same uncomfortable truth: the source data was never the whole story. And a source data problem cannot be fixed downstream.Skan’s answer is to go to the source itself. The company deploys observation technology on employee desktops that continuously watches how work moves across applications — the spreadsheet, the CRM, the email client, the 40-year-old mainframe — and abstracts those observations into a living model of the underlying business process.”Think of it this way: if I were to share my screen here, and you were to observe my screen going from Excel sheet, CRM system, email client, in about two iterations you’d build a model of what I do,” Misra said. “Except you couldn’t do that at scale. You couldn’t do it 24/7, and for 1,500 people like me. Now replace yourself with our technology.”How screen-level observation captures the work that never shows up in system logsThat framing also explains how Skan positions itself against process mining vendors like Celonis, which reconstruct workflows from the data trails left in backend systems. System logs, Misra argues, only capture completed transactions — not the messy human work that produced them.”All backend data, by definition, is a committed state of work. Work is really what happens between those committed states,” he said. “Eighty percent of what you’re interested in, from an AI point of view, in execution of work, actually lies between those systems.”The screen, in Skan’s view, is the one place where everything converges. “It brings together human agency, it brings together the entire application landscape, and it brings together the data that matters,” Misra said. Two decades of user interface design have quietly buried enormous amounts of process knowledge in the space between a worker’s eyes and their monitor; Skan’s pitch is to bring that hidden layer back to the surface.But watching, he insists, was never the hard part — a point aimed squarely at the incumbents who might be tempted to copy the approach. “The hard problem is not screen observation,” Misra said. “The hard problem is abstraction of what you see on the screen — the intent extraction.” A human watching a colleague’s screen can instantly tell whether a jump back to step one means a new case or rework on an old one, because humans understand the signature of the work. Teaching a model to make that same judgment, statefully and at enterprise scale, is where Skan believes its seven-year head start lives.The result is a context model that AI can reason over and act on — the raw material for the agents that now sit at the top of the company’s product stack, and the foundation for everything else the platform does.Walking the line between operational telemetry and workplace surveillanceAn approach built on continuously watching employee screens invites an obvious objection, and it is not a hypothetical one. In June, Reuters reported that Meta scaled back an internal tool that tracked employee mouse clicks after workers raised concerns — a sign that even AI-forward companies are wary of the line between operational telemetry and surveillance.Misra says he heard the objection before he wrote a line of code. When he first pitched the concept to Delphine Icart, then chief transformation officer at AXA Mexico, her reaction was blunt. “Delphine’s first words to me were, ‘This sounds like a great idea, but you are dead on arrival,'” Misra recalled. “‘You are observing things that you shouldn’t be observing — the privacy of my operators, and the sovereignty of my data on those screens.'”That conversation, he says, shaped the architecture. Skan aggregates rather than individuates: the system surfaces statistical patterns across hundreds of workers performing the same process, not the behavior of any one of them. “We’re not interested in what John is doing at 10 hours and 43 seconds,” Misra said. “We are interested in what hundreds of Johns put together — what are the statistical and the semantic decisions that they are making in that business process?”Organizations control what the technology can see through an opt-in scoping model — specific applications and URLs, nothing else — and the data Skan produces never leaves the enterprise firewall. A three-tier architecture sends only anonymized metadata to the cloud. Misra points to deployments approved by European works councils, among the most privacy-protective labor bodies in the world, as evidence the model holds up under scrutiny — and credits it for clearing security review at institutions where most AI tools cannot operate.Whether aggregation fully defuses the concern is likely to remain contested. The same telemetry that reveals a broken process can, in principle, reveal an underperforming team, and Misra acknowledged that the technology has led some customers to reduce headcount in certain processes.What $500 million in claimed customer value actually measuresSkan claims more than $500 million in cumulative customer value to date, a figure worth unpacking. Pressed on whether that represents realized savings or projections, Misra was direct that it is an envelope, not a bank balance.”The number comes from the cumulative, across all our customers, of the quantified savings that we have brought to them — the savings that they have expected they would save,” he said. “Now they are on the roadmap of recouping those savings through a variety of interventions,” including process redesign, technology changes, and, increasingly, AI agents. In other words, $500 million is identified opportunity, some portion of which has been captured.The more concrete evidence comes from individual deployments. At one top U.S. bank, according to the company, Skan observed 11.2 million context switches across 1,500 finance professionals and uncovered $37 million in operational friction. Turning those observations into agent-executable context cut cost per transaction by 32%, lifted throughput by 41%, and delivered $18 million in annualized savings.Misra pointed to an anti-money-laundering operation at one bank where “60% of the cases are now being run by AI agents,” adding that the results surprised even him: “The accuracy of those agents surpasses many times over the accuracy of humans. It’s not just an argument of efficiency; it has also become an argument of quality.” Among insurers, he said, Skan typically delivers roughly 25% productivity uplift in core claims processes; one customer doubled its case volume over the past year without adding a single claims specialist.Skan’s publicly referenceable customers include Unum, the $13.8 billion employee benefits provider, and Mitie, the U.K. facilities management company, whose chief technology and digital officer, Cijo Joseph, said Skan’s technology “gives us unprecedented operational visibility that has dramatically accelerated our AI transformation.” The company declined to share revenue but said it grew more than 300% year over year — for the second consecutive year — with net dollar retention around 150%, and now counts seven of the ten largest U.S. banks and a quarter of the Fortune 50 as customers.Can AI models learn good work from imperfect employees?Skan’s thesis rests on observing how work actually gets done — which raises an uncomfortable question. Real employees make mistakes, take shortcuts, and entrench inefficiencies. What happens when the context graph faithfully encodes bad process?Misra’s answer reaches for the most famous precedent in modern AI. “Think for a moment what OpenAI did,” he said. “OpenAI took the totality of the world’s text and fed it into a transformer architecture, and semantic understanding emerged. OpenAI’s model has seen bad language and has seen good language, and yet it is able to have semantic understanding.”Skan, he argues, does the analogous thing with work: treat business process execution as a language, where process steps, screen features, and handoffs stand in for words and sentences. Fed enough end-to-end executions, the model learns the full distribution of paths — efficient ones, slow ones, compliant ones — without assuming any single path is best. “The longest path may be the best path, because it is more compliant,” Misra said. An organization then constrains the model along the axes it cares about, and the model returns the path that satisfies them.”It is not record and play — and that’s the fundamental difference between us and a lot of our competition, UiPath and so on,” he said. “It is fundamentally creating an AI model that understands work, and then constraining that model.”He offered a concrete illustration of what that unlocks: at one large bank, Skan’s telemetry continuously compares live case execution against a 600-page controls inventory, with agents that trigger alerts when cases miss required compliance steps — turning a document no human could hold in their head into a real-time enforcement layer. It is the kind of application that only becomes possible, Misra argues, once a model genuinely understands the work rather than merely replaying it.The race to own the context layer of enterprise AISkan sits at the intersection of several crowded categories, and its answer to each competitor is a variation on the same theme: scope. Process mining vendors see only what the logs record. RPA incumbents replay tasks without understanding them. And the platform giants — ServiceNow, Salesforce, Microsoft — are shipping capable agents whose vision ends at their own walls.”The context that these agents have access to is limited to ServiceNow, limited to Salesforce, whereas work spans processes across the board,” Misra said. “Creating a customer entry is a task. To receive an email and decide whether a customer entry has to be created, or something else — that is the process, and that’s what we are after.”The deeper strategic argument, and the one that seems to resonate with Skan’s regulated customer base, is about differentiation in a world where every enterprise has access to the same frontier models. “If every insurance company, every bank had access to the same models, then the outcomes will asymptotically decay to the outcome of the model,” Misra said. “Historically, you have competed and differentiated in the way you have organized work. That old word — process — now comes back as context for AI. But that context is protected by you. It’s not part of the model.”That logic explains both the company’s posture toward the model makers — “the more they are successful, the more power we have,” Misra said, disclaiming any ambition to compete with them — and the Nvidia partnership featured prominently in the announcement. Skan runs on Nvidia AI Enterprise and NIM microservices, and Misra described growing demand for private appliances that can observe work, hold the context model, and execute agents entirely inside a customer’s own infrastructure. It also fits the market’s direction: venture investors surveyed by TechCrunch at the end of last year predicted enterprises would spend more on AI in 2026 but through fewer vendors — a consolidation that favors Skan’s decision to ship discovery, intelligence, and agents as a single closed loop.Misra argues that loop matters more, not less, as automation scales, because agents demand oversight in a way humans never did. “It is an irony of sorts,” he said, “that you’ll probably need much more observation and much more understanding of work in an automated way than you would with humans.” The bet embedded in this round is that work context becomes foundational infrastructure for enterprise AI the way CRM became the system of record for customers — a comparison Cathay Innovation partner Simon Wu made explicitly, calling Skan “one of the defining platform companies of the next decade.”Misra put the stakes more simply. “You cannot retrieve context that you do not capture,” he said. “The battleground is shifting from the smartest model to knowing how your company actually works — because everyone will have access to the smartest model.”The frontier labs, in other words, can keep their arms race for the better driver. Skan just raised $63 million on the conviction that the money is in the map.

Across 170 enterprises, AI infrastructure has moved decisively into production — two-thirds now run AI workloads live and three in 10 run them at scale — while the ability to account for what that infrastructure costs has not kept pace. Enterprises have quietly demoted cost in the buying decision: performance and GPU availability now outrank total cost of ownership, and reliability outranks price as the measure of success. That reordering is rational for teams under production pressure, but it lands on an uncomfortable fact — fewer than half can rigorously track what their AI compute costs, most GPUs still run at half capacity or less, and the next dollar is aimed at specialized clouds that fewer than one in twenty of them actually use.This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how they buy and measure it, where the next investment is aimed, and — most revealingly — how well they can see the economics of the compute underneath it all.This is an operational cohort. Two-thirds of enterprises (66%) have AI workloads running in production, and 29% describe AI in production at scale, with only 4% not yet running AI workloads at all. That maturity shows in the stack: the average enterprise runs three infrastructure platforms, with OpenAI (49%), Google Gemini (48%), Microsoft Azure (47%), and Google Cloud (42%) all present in roughly half of them. Asked to name one primary platform, Azure leads at 26%.The most consequential shift is in how enterprises decide. Integration with the existing cloud and data stack remains the top selection factor at 40%, but performance — latency and throughput — has climbed to second at 35%, and access to GPU availability to third at 24%, both ahead of total cost of ownership at 22%. The same ordering governs measurement: uptime and reliability is the primary success metric for 51% of enterprises and developer productivity for 39%, ahead of cost per million tokens at 31%. Enterprises under production pressure are buying and measuring for speed and availability, and have moved cost down the list.That would be unremarkable if the economics were under control, but they’re not. Among the 155 enterprises that operate their own GPUs, 69% report utilization of 50% or less and only 23% clear the halfway mark; 12% do not measure utilization at all. Fewer than half (47%) rigorously track what their AI compute costs and returns, and even among enterprises running AI in production at scale that figure only reaches 56%. Value for money is the weakest of three satisfaction scores at 3.87, against 4.14 for overall satisfaction — the softness landing precisely on the dimension hardest to judge without measurement.The next round of spending points away from the current stack. AI-specialized clouds are the top planned evaluation area at 44% and carry the strongest net momentum of any infrastructure approach (+36), yet CoreWeave and Lambda each registers at 3.5% of current usage and the rest of the neocloud field sits below 3%. Non-Nvidia accelerators draw 39%. And 62% of enterprises intend to switch or add a provider within 12 months — though the consideration set is dominated by the same incumbents they already run.MethodologyVentureBeat fielded this survey as part of its ongoing Pulse Research series, this one focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=170; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single July 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends; all figures are drawn from the July fielding only. Several questions were multiple-select, so those shares can sum to more than 100%.By organization size this wave reaches further up-market than the mid-market skew this series usually carries: 251–1,000 employees (28%) and 1,001–5,000 (25%) lead, with 10,001+ (19%), 101–250 (15%), and 5,001–10,000 (12%) filling out the rest — meaning 57% of respondents sit above 1,000 employees. By role it spans managers (48%), individual contributors (27%), the C-suite (12%), and VPs and directors (9%); on purchasing authority it is buyer-credible, with 39% final decision-makers and another 43% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 35%, followed by Manufacturing (14%), Financial Services (12%), and Healthcare/Life Sciences (9%).At 170 respondents the sample is large enough to read directionally with reasonable confidence, but it should still be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively building and operating AI infrastructure rather than from the largest hyperscale operators.Finding 1: Two-thirds are past the pilotThree in 10 now run AI in production at scaleWe asked where organizations sit in their AI deployment journey. This cohort has largely moved beyond experimentation.Two-thirds of enterprises (66%) have AI workloads running in production, and 29% describe AI in production at scale. Only 30% remain in proofs of concept and just 4% have not started. This is a materially more operational sample than this series has typically drawn, consistent with its up-market composition — 57% of respondents sit above 1,000 employees.That maturity is the frame for everything that follows. The infrastructure decisions in this report are being made largely by organizations with production workloads and real bills, not by teams still sizing a pilot. It explains the reordering of buying criteria in Finding 5, where performance and availability displace cost — the priorities of teams running live systems. It also raises the stakes on Findings 6 and 7: an enterprise that cannot measure utilization or cost during experimentation has a planning problem, while one that cannot measure them in production at scale has an operating one.Finding 2: The stack is hyperscaler-and-API, three platforms deepThe specialized GPU clouds still barely registerWe asked which providers and platforms enterprises currently use to run their AI, and which one they treat as primary. The answer remains the incumbents — several of them at once.The current stack is hyperscaler-and-API, and it is plural: enterprises name three platforms on average. The general-purpose clouds and the major model APIs account for essentially all current deployment, with four platforms — OpenAI, Gemini, Azure, and Google Cloud — each presents in more than four of every 10 enterprises. Asked to pick one primary platform, Microsoft Azure leads at 26%, with Google Cloud second at 19%; the model providers together take 35% of primary status when OpenAI (14%), Gemini (14%), and Anthropic (8%) are combined.The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines remain marginal in practice. CoreWeave and Lambda each appear in 3.5% of stacks, Baseten in 3%, and Crusoe, Nebius, Fireworks, Together, and Anyscale each at or below 2%. Combined, they are named as the primary platform by 1% of enterprises. Meanwhile 13% run a custom open-source self-managed stack and 9% operate their own GPU clusters — both larger footprints than the entire specialized-cloud category. That contrast is what makes the evaluation intentions in Finding 3 worth reading closely.A note on reading these shares: As described in the methodology section, this sample is self-selected and this question counted every provider a respondent uses — an average of 3.0 selections each — so the figures measure presence in the stack rather than spending or primary status. The separate primary-platform question is the better guide to where the center of gravity sits. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; read these shares as a portrait of what this AI-active cohort runs today, and treat gaps against industry-wide market share estimates as a property of the sample rather than a contradiction of either.Finding 3: The next dollar goes to infrastructure they don’t yet runAI-specialized clouds top the evaluations list and carry the strongest momentumWe asked where enterprises plan to evaluate AI infrastructure over the next 12 months, and whether they expect to do more or less with each category of infrastructure. Both answers point away from the stack they run today.Here is the report’s sharpest tension, and it is the same one this series has now recorded across successive waves. The single most-cited planned evaluation area — AI-specialized clouds, at 44% — is the category that 3.5% of these enterprises actually use (Finding 2). Nearly four in 10 (39%) intend to evaluate non-Nvidia accelerators, a quarter next-generation Nvidia silicon, and even decentralized compute networks draw 18%.The direction-of-travel question corroborates it rather than merely repeating it. Asked whether they expect to do more, less, or about the same with each approach, enterprises put specialized AI clouds at the highest net momentum (+36, with 42% doing more against 6% doing less), ahead of inference APIs (+34) and hyperscalers (+30). On-prem and co-located infrastructure is the laggard at +5, the only category where a substantial share — 22% — report pulling back. Every off-premises approach is net-expanding; the specialized clouds are expanding fastest from the smallest base.Read against current usage, this is not incremental adjustment. It is the leading edge of a re-platforming that enterprises have been signaling for several waves and have not yet executed. The gap between a 44% evaluation rate and a 3.5% usage rate is the single widest intent-to-action spread in this dataset, and how it resolves — whether the neoclouds convert evaluation into deployment, or whether the hyperscalers absorb the demand with their own AI infrastructure — is the open question of the category.Finding 4: Six in 10 plan to move, mostly among the incumbentsHigh churn intent, but the consideration set is the stack they already runWe asked whether and when enterprises plan to switch or add an infrastructure provider, and which providers they are considering.For a category as foundational as compute, this is a substantial amount of intended movement: 62% of enterprises intend to switch or add a provider within 12 months, and 29% within the next quarter alone. Only 39% plan to stand still.Where that interest points is the more useful signal. The providers drawing the most switching consideration are the ones enterprises already run — OpenAI and Google Cloud (29% each), Microsoft Azure (28%), Gemini (25%), Anthropic (16%), Oracle Cloud (14%), and AWS (13%). The specialized clouds that top the evaluation list in Finding 3 draw far less concrete switching consideration: CoreWeave 4%, Lambda 3.5%, and the remainder at or below 2%. A further 8% are evaluating with no shortlist yet.The two findings are not in conflict; they operate on different clocks. The neocloud interest in Finding 3 is a 12-month evaluation thesis about where AI compute should eventually run. The switching in the next quarter is mostly incumbents trading share and enterprises consolidating spend among providers they already hold contracts with. Vendors reading the 44% evaluation figure as near-term pipeline should weigh it against a 4% consideration rate.Finding 5: Performance overtakes cost, in buying and in measurementTotal cost of ownership falls below latency and GPU availabilityWe asked what matters most when enterprises select an AI infrastructure provider, and what they treat as the primary measure of success once it is running. Both answers have moved away from price.Integration with the existing stack remains the top selection factor at 40%, which is consistent with a cohort running three platforms and unwilling to add a fourth that does not fit. What has changed is everything below it. Performance sits second at 35% and GPU access and availability third at 24%, both ahead of total cost of ownership at 22%. Fine-grained autoscaling draws 18% and cost per million tokens 16% — no longer the outlier it once was in this series, but still last.Measurement follows the same logic. Uptime and reliability is the primary success metric for 51% of enterprises, well ahead of developer productivity and deployment speed (39%), cost per million tokens (31%), latency (27%), and throughput (25%). Taken together, the operational metrics dominate the economic one by a wide margin.This is a coherent posture for the production cohort in Finding 1 — teams running live workloads care first about whether the system stays up and how fast they can ship on it. But it sits uneasily beside Finding 7. Total cost of ownership has been demoted to fourth as a buying criterion at exactly the moment when 53% of enterprises still cannot rigorously track what their compute costs. The uncomfortable reading is that cost has fallen down the list partly because it remains the hardest thing in the stack to see, and criteria that cannot be measured tend to lose to criteria that can.Finding 6: The GPUs run warmer, but most still run coldRoughly seven in 10 GPU operators report 50% utilization or lessWe asked what share of their GPU capacity enterprises actually utilize. Figures here are reported on the 155 enterprises that operate their own GPUs; 15 consume exclusively via API and run none.The compute already in place runs cold, though less so than this series has recorded before. Roughly seven in ten GPU-operating enterprises (69%) report utilization at or below half capacity, with the 26–50% band alone accounting for 46%. About a quarter (26%) run at 25% or below. Against that, 23% now clear the 50% mark — a meaningful efficient minority rather than a rounding error.The remaining 12% who do not measure utilization at all are the more troubling number, because they are invisible in both directions: they cannot claim efficiency and cannot detect waste. And utilization does not improve with maturity in the way one might expect — among enterprises running AI in production at scale, 22% clear the 50% mark, statistically indistinguishable from the 24% among everyone else. Scale is not, by itself, producing better-utilized fleets.Idle accelerators are expensive accelerators, and this remains the clearest single measure of the gap in this report: enterprises are planning to evaluate specialized clouds and next-generation silicon (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large, and for one in eight enterprises, entirely unmeasured.Finding 7: Fewer than half can account for what they spendRigorous cost tracking reaches only 56%, even among at-scale operatorsWe asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger still lags the spending.Measurement trails money. Fewer than half of enterprises (47%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (15%), or have not prioritized it (6%). Maturity helps but does not solve it: among enterprises running AI in production at scale, rigorous tracking reaches 56%, against 43% for everyone else. Even in the most operationally advanced segment of this sample, more than four in ten cannot account precisely for what their AI compute costs or returns.Satisfaction with current infrastructure is moderately positive and tellingly uneven. On a five-point scale, overall satisfaction averages 4.14 and ease of implementation 4.04, while value for money trails at 3.87 — the softness landing on the one dimension that requires measurement to assess. Enterprises are, in effect, expressing dissatisfaction with an economic relationship most of them cannot yet quantify.Read with Finding 5, the picture is self-reinforcing rather than merely inconsistent. Cost has slipped to fourth among buying criteria while remaining the least visible property of the stack, and the least visible property is the one enterprises rate lowest. Better instrumentation would not necessarily change what enterprises buy — but it would let them know whether the trade they are making for performance and availability is a good one.Finding 8: The memory frontier is still unclaimedDell and Nvidia lead a scattered field, and one in five has no viewWe asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The field remains early and fragmented.The memory frontier is real but barely governed. Dell leads at 24% and Nvidia follows at 21%, with the remainder scattering across open-source tooling (12%), model-level efficiency techniques such as MLA and quantization (11%), and a long tail of storage vendors each in low single digits. No approach commands anything close to a majority, and the two leaders together account for less than half the field.Most telling is that roughly one in five enterprises (19%) either do not recognize the constraint (7%) or have not begun to address it (12%). For a shift that will reshape inference cost and architecture, this is an early and unsettled market. It is also consistent with the measurement gap in Finding 7 — enterprises that cannot yet quantify what their current compute costs are in a poor position to anticipate which constraint will drive that cost next. The memory bottleneck is arriving while most of this cohort is still working to see the one in front of it.The bottom line: Buying for speed, blind on costOrganizations with more than 100 employees have moved AI infrastructure into production — two-thirds run live workloads, three in ten at scale — and their buying behavior has matured accordingly. They run three platforms on average, select on integration and performance, and measure success on uptime and developer velocity. For teams operating live systems, that is the right set of priorities.What has not matured is the accounting. Total cost of ownership has fallen to fourth among selection criteria and cost per million tokens sits last, at the same moment that 53% of enterprises cannot rigorously track what their compute costs, 69% of GPU operators run at half capacity or less, and 12% do not measure utilization at all. Value for money is the lowest-rated attribute of the infrastructure they run — a judgment most of them are making without the instrumentation to support it. Cost has not become unimportant; it has become invisible, and the buying criteria have quietly reorganized around what can actually be seen.Meanwhile the next round of spending points past the current stack. Specialized AI clouds are the top evaluation target at 44% and carry the strongest net momentum of any approach, against a 3.5% usage rate and a 4% near-term switching consideration — the widest intent-to-action spread in the data. Non-Nvidia accelerators draw 39%. And the constraint after this one, the shift from compute to memory in large-scale inference, is unrecognized or unaddressed by one enterprise in five.At 170 respondents in a single July wave, reaching further up-market than this series typically does, this is a directional read — but the direction is consistent. Enterprises have become good operators of AI infrastructure and have not yet become good accountants of it. The open question for later waves is whether the instrumentation catches up before the re-platforming arrives, or whether enterprises buy the next layer of compute as blind to its economics as the last.Based on survey responses from 170 qualified enterprise respondents (100+ employees), drawn from a single July 2026 wave. This sample is self-selected and directional rather than a precise measurement, and reads cross-sectionally with no month-over-month trend claims. Respondents include managers, individual contributors, C-suite, and VPs/directors, with purchasing authority weighted toward decision-makers and recommenders, across technology, manufacturing, financial services, healthcare, and other industries. Note: Figures for the switching-timeline, GPU-utilization, and cost-tracking questions are reported as a percentage of unique respondents rather than selections; individual categories for these three questions may sum to more than the reported total.

Across 116 enterprises, agents are in production and so are the incidents: A majority have already had a confirmed agent security event or a near-miss. Two-thirds of enterprises enforce scoped permissions at runtime. Barely one in five isolates its highest-risk agents, making containment the weakest layer in the stack precisely as autonomy scales. Credential sharing persists across nearly two-thirds of agent fleets, and 53% have already had a confirmed agent security event or near-miss, contributing to a growing lack of confidence in agentic security.  Security stacks remain overwhelmingly borrowed from model providers and hyperscalers, and confidence has slipped. Today, as many enterprises now believe AI-armed attackers are ahead of their defenses as believe the reverse.This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers.Only 18% of enterprises isolate their highest-risk AI agents, even as 65% of enterprises enforce scoped permissions at runtime and 56% monitor and log agent activity. The gap between what enterprises watch and what they contain is the central finding of this wave of VentureBeat Pulse Research.     More than half of enterprises (53%) have agentic AI systems in production today, and another 27% are piloting or running a limited rollout. The agentic security incidents are arriving with them: 53% of organizations have already had an agent security event, with 19% confirming an incident and 38% having identified a near-miss that was caught before it caused harm.The central finding is a containment gap. Enterprises have built the controls that watch and permission agents but not the one that bounds the damage when those fail. Among enterprises describing their security posture, 65% enforce scoped identities and permissions at runtime and 56% observe and log agent activity, yet only 18% isolate high-risk agents in sandboxes. Even among enterprises running agents in production, isolation is enforced just 21% of the time, and just 8% pair enforcement with isolation. That ordering is backward from a defense-in-depth standpoint. From SOC teams to CISOs, security teams know that observation tells you what happened and enforcement tries to prevent it, but isolation is what limits the blast radius when prevention fails.Identity has improved without being solved. 49% of enterprises say each of their agents has its own scoped, managed identity, but 63% report credential sharing somewhere in the agent fleet, and only 29% describe a fleet with scoped identities and no sharing anywhere. The security stack doing this work remains overwhelmingly hyperscaler or model provider-native: OpenAI’s guardrails (44%), Microsoft Azure (42%), Anthropic’s managed-agent controls (37%), and Google Cloud (31%) lead, and 92% of enterprises naming a primary security layer name a hyperscaler/model provider-native one.Two things have shifted against the comfortable picture. Confidence has slipped, with 30% now saying AI-armed attackers are ahead of their defenses, exactly as many as say their defenses are ahead. And churn intent is the highest this series has recorded, with 74% planning to adopt, add, or replace agent security tooling within twelve months, despite satisfaction scores at a series high of 4.29 out of 5. Enterprises are more satisfied than ever with a stack they are more determined than ever to replace.MethodologyVentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security — the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=116; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single July 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends; all figures are drawn from the July fielding only. Several questions were multiple-select, so those shares can sum to more than 100%.By role the sample is senior and buyer-credible: 44% are final decision-makers for AI purchases and another 38% recommenders or influencers. Managers (36%), individual contributors (27%), VPs and directors (18%), and the C-suite (16%) make up the seniority mix. By organization size the sample is mid-market-weighted with a meaningful enterprise tail: 101–250 (34%) and 251–1,000 (23%) employees lead, with 1,001–5,000 (18%), 10,001+ (17%), and 5,001–10,000 (7%) above them. Technology/Software is the largest industry at 38%, followed by Healthcare/Life Sciences (11%) and Financial Services (10%).Three questions require a base note. Two questions were asked only of enterprises with agents live or piloting. Posture figures (observe / enforce / isolate) are reported on those 93 respondents, and primary-security-layer figures on the 92 of them who named a layer. The 23 respondents outside this base are those still evaluating, without plans, or unsure — organizations for which an agent security posture would not yet apply. And several multiple-select questions permitted overlapping answers where one was intended — identity (33 respondents selected more than one pattern), arms-race assessment (23), budget share (10), and incidents (9) — so those are computed at the respondent level and the overlap is described where it matters. Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 76 of the 116 qualified respondents.At 116 respondents, the sample supports directional reads but not precise measurement; it is self-selected and is not a probability sample. It is best read as the view from organizations actively standing up agent security rather than from the largest operators.Finding 1: Agents are in production, and so are the incidentsA majority have already had an agent security eventWe asked whether organizations run agentic AI in production, and whether they had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm.Agents have moved into production for this cohort. More than half of enterprises (53%) run agentic AI systems live today, another 27% are piloting or running a limited rollout, and only 3% have no plans in the next twelve months. The security exposure has scaled with the deployment: 53% of organizations have already had an agent security event, 19% a confirmed incident and 38% a near-miss caught before it caused harm.That the near-misses outnumber confirmed incidents two to one is worth reading carefully. It means enterprises are catching problems, but catching them close to the edge — and a near-miss is a control that worked once, not a control that will work every time. The controls examined in the rest of this report, particularly the identity and isolation gaps in Findings 2 and 3, are what determine whether the next near-miss stays a near-miss.One pattern from earlier waves does not replicate here. Organization size makes no reliable difference to exposure: enterprises above 1,000 employees report an incident or near-miss at 47%, against 57% among those between 101 and 1,000 — a difference well inside sample noise, and pointing the opposite direction from the size gradient this series has previously recorded. In this wave, what separates the hit from the not hit is not headcount.Finding 2: Identity is improving — and still sharedHalf give agents scoped identities; two-thirds still share credentials somewhereWe asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Respondents could describe more than one pattern across the fleet.Per-agent identity is now the most-cited pattern: 49% of enterprises say each agent carries its own scoped, managed identity, the precondition for least-privilege access and clean attribution. That is real progress on the control this series has repeatedly identified as the structural weakness beneath agent incidents.But the answers overlap, and the overlap is the finding. Thirty-three respondents described more than one identity pattern across their fleet, and rolled together at the respondent level, 63% of enterprises report credential sharing somewhere — either agents mostly running on shared API keys and borrowed human or service-account credentials (37%), or a mixed fleet where some agents are scoped and many are not (34%). Only 29% describe a fleet with scoped identities and no sharing anywhere at all. Among enterprises with agents in production, 60% report per-agent identity, so the improvement is concentrated where the agents actually are — but so is the residual sharing.The consequence is unchanged by the improvement. Where credentials are shared, an over-permissioned or compromised agent acts with far more reach than intended, and post-incident forensics cannot cleanly establish which agent did what. Half a fleet with scoped identities still has the blast radius of the half without. Non-human identity remains the largest unfinished piece of enterprise agent security, and as Finding 8 shows, it is still almost entirely absent from what enterprises are shopping for.Finding 3: Isolation is the control nobody buildsTwo-thirds enforce at runtime; fewer than one in five sandboxWe asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is by far the least common. Figures are reported on the 93 respondents who described a posture.This is the containment gap, and it is the widest structural gap in the report. Enforcement and observation are now common — 65% enforce scoped permissions at runtime and 56% monitor and log agent activity — while isolation sits at 18%. Only 8% of enterprises run both enforcement and isolation together, the posture that both prevents and contains.Deployment maturity is a better predictor than the aggregate figures suggest. Isolation reaches 21% among enterprises with agents fully in production, compared with 13% among those still piloting — a meaningful gap that tracks maturity rather than exposure. Among enterprises that report credential sharing in the fleet, the group with the widest potential blast radius per Finding 2, isolation reaches 15%. The organizations with the most exposure are not meaningfully more likely to have built the control that bounds it.The ordering is backwards from a defense-in-depth standpoint. Observation tells you what happened after the fact. Enforcement tries to stop it. Isolation is what limits the damage when enforcement fails — and enforcement will sometimes fail, which is the entire premise of the near-misses in Finding 1. An agent fleet that is watched and permissioned but not boxed in is precisely the configuration in which a single control failure propagates across systems. Enterprises have built the first two layers of the model and largely skipped the third.Finding 4: Security still runs on borrowed, provider-native controlsNine in 10 name a model provider or hyperscaler as their primary layerWe asked which agent security tooling enterprises use, and which is their primary layer. The answer continues to favor the model providers and hyperscalers over the dedicated security vendors.Enterprises secure agents with tools that came bundled with their models and clouds. OpenAI’s guardrails lead at 44%, followed closely by Microsoft Azure (42%), Anthropic’s managed-agent controls (37%), and Google Cloud (31%). Asked to name a single primary security layer, 92% of those who answered named one of these provider-native offerings, with Azure (27% of answerers) and Anthropic (26%) leading.The purpose-built agent-security category is no longer at zero, but it remains marginal. Cloudflare (11%) and Cisco (9%) lead the specialists, with CrowdStrike, Palo Alto, Zenity, Check Point’s Lakera, HiddenLayer, F5, and SentinelOne each between 1% and 7%. The identity specialists most directly relevant to Finding 2 are the smallest of all: Microsoft Entra Agent ID at 7%, Okta for AI Agents at 3%, and non-human identity platforms at 3%. Dedicated runtime sandboxing tooling — the control missing in Finding 3 — is in place at 3%.A note on reading these shares: As described in the methodology section, the respondent sample is self-selected, and the usage question counted every vendor or approach a respondent has in place — so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern is the durable part: provider-native and hyperscaler controls lead by a wide margin, and dedicated agent-security specialists remain in single digits. Read the individual shares loosely and the pattern with confidence.Finding 5: Satisfaction is at a series high — and so is churn intentEnterprises rate their tooling 4.29 of 5 and three-quarters plan to replace itWe asked how satisfied enterprises are with their current agent security tooling, and whether they plan to adopt a new, additional, or replacement solution within twelve months. The two answers do not sit comfortably together.Satisfaction with agent security tooling is the highest this series has recorded — 4.29 out of 5 for both overall satisfaction and ease of implementation, with value for money close behind at 4.11. That is a striking set of scores for a stack that is mostly borrowed provider guardrails, given that a majority of the same enterprises have already had an incident or near-miss and fewer than one in five isolates high-risk agents.The purchase intentions tell the other half of the story. Three-quarters (74%) plan to adopt, add, or replace agent security tooling within 12 months, and 30% within the next quarter alone — higher churn intent than this series has previously seen in this category. Only 26% intend to stand pat. Enterprises are simultaneously more satisfied with their tooling and more determined to change it than at any prior reading, which suggests the satisfaction rests on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is comfort with what is easy, not confidence in what is sufficient.Finding 6: Budgets are finally movingA third now spend more than a tenth of the security budget on agentsWe asked what share of the security budget enterprises allocate to securing AI agents. The allocation has grown, though it remains a modest slice.Agent security spending is still a slice rather than a pillar, but it is a growing one. The most common allocation remains 6–10% of the security budget (44%), and roughly a third of enterprises (35%) now devote more than a tenth — a meaningful funded minority. Just over a quarter (28%) spend 5% or less.Read against Findings 1 through 3, the budget looks like a lagging but responsive indicator. A majority of enterprises have had an incident or near-miss, credential sharing persists across two-thirds of fleets, and fewer than one in five isolates high-risk agents — gaps that a 6–10% allocation is unlikely to close quickly. The enterprises spending above a tenth are the ones with the resources to build scoped identity and isolation controls rather than adopt whatever their model provider ships, and whether that minority grows is a reasonable leading indicator for whether the containment gap narrows.Finding 7: The arms race has tiltedAs many say attackers are ahead as say their defenses areWe asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence has slipped into an even split.
Enterprises are no longer net-optimistic about the contest. Exactly as many say AI-armed attackers are ahead of their defenses (30%) as say their defenses are ahead (30%), with another 33% calling it roughly even and 24% saying it is too early to tell. Taken together, 63% rate the balance as even or worse.Experience is what drives the pessimism, and the relationship is statistically clear. Among enterprises that have had a confirmed incident or near-miss, 39% say attackers are ahead; among those that have not, 20% do — a gap large enough to be unlikely to arise by chance in a sample this size. Getting hit does not just change what enterprises buy; it changes how they read the contest. The organizations closest to the actual threat are the least confident about it.That assessment sits uneasily beside the series-high satisfaction of Finding 5. Enterprises rate their tooling 4.29 out of 5 while a clear majority believe it is, at best, holding even against an adversary that is also compounding with AI. An even race is not a comfortable place to be, and the group that has actually been tested rates it worse than even.Finding 8: A reshuffle is coming — but identity still isn’t on the listIncidents drive urgency; the control they implicate draws 10% interestWe asked which agent security solutions enterprises are considering. The consideration set has broadened, but not in the direction the incident data points.Incidents start the buying cycle. Among organizations that have had a confirmed incident or near-miss, 38% plan to adopt, add, or replace agent security tooling within the next ninety days, against 22% of organizations with no incident; after a confirmed incident specifically the figure reaches 41%. Experience remains the strongest predictor of urgency in this data, as it is of pessimism in Finding 7.The consideration set still leans provider-native — OpenAI (38%), Microsoft Azure (37%), Anthropic (35%), and Google Cloud (28%) lead — though the dedicated security vendors now draw meaningful early interest: Cisco (10%), Cloudflare (9%), Zenity and CrowdStrike (8% each), and Palo Alto, Check Point’s Lakera, and open-source guardrails (6% each). For most of the specialists that is more forward interest than current footprint.What the shopping still does not include is the identity layer. Just 10% of enterprises include an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform — anywhere in their consideration set. Among the enterprises that both share credentials and have already been hit, the group with the most direct evidence that the control matters, identity consideration is no higher: roughly one in ten. Runtime sandboxing tooling draws 6%. The two controls most directly implicated by the incident data, identity and isolation, are the two least present in the purchase plans — the same blind spot this series recorded in the prior wave, unchanged despite a year of incidents.The bottom line: A security gap that prevention alone won’t closeOrganizations with more than 100 employees have put agents into production — 53% run them live today — and the incidents have arrived alongside them, with a majority already reporting a confirmed event or near-miss. On the controls, the picture is genuinely mixed rather than uniformly poor: nearly half now give each agent its own scoped identity, two-thirds enforce permissions at runtime, and a third devote more than a tenth of the security budget to agents. Enterprises are building agent security in earnest.What they are not building is containment. Fewer than one in five isolates high-risk agents, only 8% pair enforcement with isolation, and among enterprises running agents in production isolation reaches just 21%. Credential sharing persists across 63% of fleets, so the blast radius that isolation would bound remains wide. The stack doing this work is 92% provider-native by primary layer, and the specialists built for exactly these gaps sit in single digits. The result is an architecture optimized to prevent and observe, with almost nothing in place for the case where prevention fails — which is the case the near-misses in Finding 1 describe.The uncomfortable pairing is confidence with exposure, and it has sharpened. Satisfaction is at a series high of 4.29 out of 5, yet 63% rate the contest against AI-armed attackers as even or worse, 30% say attackers are ahead outright, and 74% plan to replace tooling they just rated highly. Enterprises that have actually been hit are markedly more pessimistic and markedly more urgent — and still not shopping for identity or isolation, the two controls their incidents most directly implicate.At 116 respondents in a single July wave this is a directional read, weighted toward the mid-market — but the direction is clear: agent deployment is running ahead of agent containment, and the gap is not in what enterprises watch or permission but in what happens when those controls fail. The containment gap will not be closed by a better provider guardrail. The open question for later waves is whether enterprises build isolation and governed identity deliberately, or whether a confirmed incident that propagates does it for them.Based on survey responses from 116 qualified enterprise respondents (100+ employees), drawn from a single July 2026 wave. This is a directional signal from a self-selected sample, not a probability sample. Respondents include managers, individual contributors, VPs/directors, and C-suite leaders, across technology, healthcare, financial services, and other industries.

SpaceXAI, the division of SpaceX formerly known as xAI, is launching an early beta version of Grok Bot, a new agent designed to move AI assistants beyond answering prompts and toward continuously executing work across the software employees already use.The central idea is straightforward: instead of opening an AI assistant whenever a task arises, users create persistent Bots with specific jobs, give them access to applications and websites, and delegate work much as they would to a teammate. Each Bot operates through its own computer environment, can continue working when the user’s laptop is closed, and can return when it needs approval or has finished the assignment.SpaceXAI says the system began as an internal prototype before spreading across the company, where teams created Bots for sales outbound, marketing campaigns, office operations, bug fixes and other work. The company is now turning that internally developed workflow into a product for external users.“Bots are AI teammates that do real work for you,” the company said in announcing the product. “They sign in to your tools, use them just like you do, and come back with finished work.”The company did not release benchmarks for Grok Bot’s performance on agentic tasks. And it arrives amid an increasingly crowded marketplace of first-party AI agents that attempt to reliably complete real, enterprise workflows by interfacing with a user’s other applications and devices.Anthropic introduced computer use for Claude in 2024, allowing models to inspect screens and operate interfaces through mouse and keyboard actions, and continued expanding with the launch of the developer focused Claude Code harness in early 2025 and the more non-technical, white collar focused Claude Cowork agent early this year. Meanwhile, OpenAI gave its Codex harness the ability to control other computer apps in April, launched agentic Workspace Agents that can also connect to third-party applications and use them autonomously, and recently debuted a new ChatGPT Work environment for longer, multi-step tasks and finished deliverables.Grok Bot seeks to join the party with its own management model for agents: persistent workers with responsibilities, memory, learned routines and the ability to hand work to one another.Pricing and availability: Grok Bot starts at $120 per seat per month for teams, $200 per month for individualsGrok Bot is available beginning today, August 11 in beta for SuperGrok Heavy, Cursor Ultra and Cursor Premium Teams subscribers (recall SpaceX acquired Cursor for $60 billion back in June). The product arrives for macOS, Windows, Linux and iOS, with Android listed as coming soon.According to its product page on xAI.com, Grok Bot is included with Cursor Ultra at $200 per month for individuals. The plan includes a computer for Grok Bot, access to users’ tools, scheduled routines, desktop and mobile operation, and extended AI-token limits.For organizations, Cursor Premium Teams costs $120 per seat per month and adds centralized billing and settings, a team marketplace for skills and plugins, shared usage analytics and SAML/OIDC single sign-on.Existing SuperGrok Heavy ($300 per month) subscribers also receive access. However, for organizations wishing to sign up today, SpaceXAI is directing them to a waitlist for future access. Those prices make Grok Bot a substantially different purchasing decision from a low-cost general AI subscription. The economic question for companies will be whether persistent Bots can replace enough manual work or conventional automation infrastructure to justify the per-user cost — and how usage limits affect total cost once agents begin running continuously.From prompting an AI to managing oneSpaceXAI describes Grok Bot as a team of “always-on agents.” Users can create multiple Bots, assign each a role and let them work simultaneously.The company provides examples including Sales Outbound, Talent Scout, Paid Media, Expense Manager, Product Performance, Bug Reproduction, Account Health and Chief of Staff. A sales Bot, for example, can research accounts, score prospective contacts, prepare email and LinkedIn outreach in the user’s voice, and assemble the results for human approval.Promotional materials show SpaceXAI using the system internally for substantially longer chains of work. One sales Bot can add call-transcript notes to a CRM and draft follow-up messages. An operations Bot can seat new hires and process invoices arriving through Gmail. An engineering Bot can reproduce a bug in the product interface, file a ticket and then hand the repair to a debugging Bot.The architecture could make Grok Bot particularly relevant for workflows that span systems that were never designed for AI automation.Rather than requiring every application to expose an API specifically for an agent, Grok Bot can sign into applications and websites and operate their interfaces. SpaceXAI says Bots have their own computers and can continue working 24/7.The company explicitly says this includes websites and applications that have “no clean API or MCP,” an important distinction for enterprises with legacy software, fragmented SaaS environments or internal systems that have never been instrumented for agent access. Instead of limiting automation to formally integrated services, Grok Bot is designed to work through the same software interfaces a human employee would use.The company says early users are already applying Bots to jobs including vendor negotiations, e-commerce customer support and continuously updating CRM systems.Another feature attempts to reduce the engineering required to automate repeatable business processes. Users can demonstrate a workflow while a Bot follows along. Grok Bot can then save the process as a routine and execute it later without requiring the user to reproduce every instruction.SpaceXAI says the Bot can also incorporate corrections into those learned routines, allowing the workflow to change as the user teaches it how a particular process should be handled.That potentially changes the deployment model from explicitly programming an automation to teaching an agent how an employee performs the job.The company is also claiming a more persistent form of behavioral memory than simply retaining a chat transcript. According to the launch announcement, Bots remember prior conversations, learn preferences such as a user’s writing voice and edge cases, and gradually learn when they should interrupt for approval versus continue independently. SpaceXAI says they can later resume dropped threads, nudge stalled handoffs and pick up work from earlier conversations.It further says Bots can become proactive over time, sometimes identifying work before the user explicitly asks for it. That is a more ambitious claim than conventional scheduled automation and will put additional pressure on permission controls and escalation rules if the system is deployed against production applications.Bots can delegate work to other BotsGrok Bot also supports multiple agents operating together.Users can place several Bots into the same thread, where the agents can pass work between one another. The company’s demonstration includes specialized Research, Communications, Chief of Staff and Travel Bots coordinating tasks.SpaceXAI says those Bots can independently message one another and share context within threads. Users can also put multiple Bots into a group conversation where they assign ownership, transfer work and coordinate among themselves, bringing the human back in primarily for judgment calls.Internally, the company says employees sometimes place a Chief of Staff Bot above specialist Bots responsible for functions such as inbox management, recruiting, expenses, operations and bug fixes. That makes the product’s orchestration model more explicit: the user does not necessarily have to serve as the routing layer between every specialized agent.Initial reactions are extremely positive Lenny Rachitsky, host of the popular vlog and podcast Lenny’s Podcast and author of newsletter Lenny Letter, received early access to Grok Bot and loved using it. As Rachitsy wrote on X : “I haven’t been this excited about a new AI product in a while. It’s like OpenClaw, but super easy, reliable, and less scary to use. I think this will be a huge new product line for Cursor/Grok/SpaceX.”Similarly Matt Shumer, an AI entrepreneur who said he tested Grok Bot for several weeks before launch, highlighted this orchestration as one of the product’s strongest features.“The best way I can describe it is an agent for everything, not just code,” Shumer wrote on X.In one test, Shumer said he created separate researcher and writer Bots, then created a Chief of Staff Bot and instructed it to coordinate the other two on a project. He expected the workflow to break down.“It worked out of the box,” he wrote.His main criticism involved model selection.Unlike systems where developers or advanced users explicitly select the underlying model, Shumer said Grok Bot automatically routes tasks to models on the backend.“You don’t choose a model for your Grok Bot,” he wrote. “It’s all done automatically on the backend.”Shumer said the model router “wasn’t great” during his testing, although he said he was subsequently told it had improved.SpaceXAI’s expanded announcement still does not identify which underlying models the router uses, nor does it document a mechanism for users to select, pin or switch to a particular xAI or third-party model. As a result, the model layer remains largely abstracted from users in the publicly supplied launch material.That abstraction represents an important tradeoff for enterprise deployments. Automatic routing can remove a significant configuration decision for ordinary employees, but advanced users may want explicit control over model cost, latency, reliability and behavior — particularly for repeatable production workflows.The agent market is moving toward longer-running workGrok Bot enters a market increasingly focused on agents that can do more than generate text or code.Anthropic’s computer-use capability established a mechanism for Claude models to interact with software through screenshots, cursor movements, clicks and typing. Its broader Claude product also connects with workplace services and remote MCP servers.OpenAI, meanwhile, now describes ChatGPT Work as an agent for “longer, multi-step work and finished deliverables,” while keeping Codex focused specifically on software development. OpenAI’s enterprise agent economics can also incorporate usage-based credits, making task complexity and token consumption part of deployment cost calculations.Grok Bot’s differentiation is therefore less about proving that AI can operate software than packaging computer use, persistence, workflow learning and multi-agent coordination into something resembling a workforce interface.SpaceXAI’s announcement sharpens that distinction by emphasizing completion rather than assistance. One company product employee, identified only as Roman, describes the difference as closing the gap between work that is nearly finished and work actually completed inside the destination application: “Grok Bot can finish the swing, because the work lands where a human would put it, in the actual tool.”That distinction will ultimately depend on reliability. A chatbot producing a bad answer creates a correction problem. An autonomous agent operating CRM records, support queues, vendor conversations or other production systems can create an operational problem.Grok Bot’s success will therefore depend not only on model intelligence, but also on permissions, predictable execution, escalation behavior, memory accuracy and how reliably agents recognize when human approval is necessary.That challenge becomes more significant if Bots act proactively, resume forgotten work and coordinate with one another without the user serving as an intermediary. Those capabilities reduce the amount of supervision required when they work correctly, but they also expand the consequences of an incorrect assumption, stale context or improperly scoped permission.The interface may matter as much as the modelsShumer described the product’s interface as feeling like iMessage, an intentionally familiar metaphor for a system whose underlying architecture — autonomous computers, persistent memory, agent orchestration and automatic model routing — could otherwise be difficult for nontechnical users to configure.SpaceXAI makes essentially the same usability argument in its launch announcement. Rather than asking users to construct workflows before getting started, it says users can simply message a Bot from a phone or desktop, hand it work and later continue the same conversation from either device.That simplicity is part of the product strategy. Grok Bot is trying to hide much of the conventional machinery of automation — workflow builders, explicit integrations, agent routing and orchestration — behind an interaction model that resembles messaging a coworker.That may prove to be the larger bet behind Grok Bot.The AI industry has spent several years making models increasingly capable of using tools and completing multi-step tasks. Grok Bot attempts to turn those capabilities into an organizational abstraction people already understand: give someone a job, teach them how you work, and let them coordinate with the rest of the team.If that abstraction proves reliable, the enterprise agent competition may increasingly shift away from which assistant produces the best individual response and toward which platform can most reliably manage fleets of agents performing ongoing work.

Presented by Rezolve AiWhen an AI assistant recommends a product or brand, it generates something valuable: a purchase-ready consumer with high intent and low friction in their decision. That consumer has already compared options, asked follow-up questions, and arrived at a conclusion. They want to buy.What they encounter next is a commerce infrastructure that was not designed for them.The gap between recommendation and purchaseThe typical enterprise commerce stack was built for a specific model: a consumer who arrives at a brand’s website through search or a direct link, navigates product pages, adds to cart, and completes checkout through a multi-step form flow. That model assumed the consumer would do the work of bridging their intent to the transaction. Most commerce systems still assume exactly that.Agentic commerce breaks that assumption. When intent is generated outside the brand’s owned environment, the handoff to transaction becomes a structural problem. Context doesn’t transfer. Sessions don’t persist. The consumer who asked an AI assistant for a recommendation and received one now faces the same friction-laden checkout process as someone who arrived with no prior intent at all.Cart abandonment rates have remained stubbornly high for years. Baymard Institute research puts the average at 70%. That figure predates the agentic commerce era. As more purchase intent is generated through AI interfaces, and as the gap between that intent and a brand’s transaction layer widens, the abandonment problem is likely to get structurally worse before it gets better.What the current stack wasn’t built to handleThe commerce infrastructure most enterprises operate today was assembled over two decades of incremental investment. Each layer added a capability: a search tool, a recommendation engine, a personalization layer, and a checkout system. Each was built to solve a specific problem within a human-initiated shopping journey.None of it was built to receive intent from an AI agent.When an AI system generates a purchase recommendation, it needs to do more than surface a product page. It needs to verify real-time inventory. It needs to apply pricing logic and promotional rules. It needs to respect brand policy around which products can be recommended together, which channels apply which discounts, and what the correct fulfillment path looks like for a given consumer. And it needs to do all of that without breaking the conversational context that made the recommendation possible in the first place.Current commerce stacks can’t do this reliably. The systems that hold the relevant data, inventory, pricing, order management, fulfillment, are not exposed in ways that AI agents can safely and accurately access. The result is a journey that starts with intelligence and ends with a broken experience: a link out to a product page, a generic checkout flow, and a consumer who arrived ready to buy and left without completing the transaction.The conversion problem is an architecture problemThe industry has treated conversion optimization as a front-end problem for most of its history: better copy, cleaner checkout UX, fewer form fields, smarter retargeting. Those interventions were appropriate for the model they were built to serve.The agentic commerce era introduces a different kind of conversion failure, one that front-end optimization cannot fix. When intent is generated externally, conversion depends on whether the back-end infrastructure can receive that intent, act on it accurately, and complete the transaction within the guardrails the brand has established. That is not a UX problem. It is an infrastructure problem.Brands that are investing heavily in AI-powered discovery while leaving their execution layer unchanged are widening the gap between the promise AI makes on their behalf and the experience they can actually deliver. That gap has a cost, measured not just in lost transactions but in consumer trust that erodes each time the promise and the reality don’t match.Rezolve Ai commissioned research across 1,500 US consumers in January 2025 that found consumers who encounter friction immediately after an AI recommendation are significantly less likely to complete a purchase than those who encounter friction at the top of a traditional funnel. The implication is direct: AI raises the expectation bar at the moment of intent. Brands whose infrastructure cannot clear that bar are paying a conversion penalty they may not even know they’re incurring.What closing the gap requiresClosing the gap between AI-generated intent and completed transaction requires rethinking which layer of the commerce stack carries the most strategic weight in an agentic world. For most of the past decade, that weight sat with discovery and experience. The brands that invested most in search, personalization, and content won a disproportionate share.In the agentic era, the weight shifts to execution. The brands that can reliably take AI-generated intent and turn it into a governed, accurate, brand-safe transaction will have a structural advantage over those whose infrastructure stalls at the handoff.That is a different investment thesis than the industry has operated on. And most enterprise commerce roadmaps have not yet caught up to it.Sponsored articles are content produced by a company that is either paying for the post or has a business relationship with VentureBeat, and they’re always clearly marked. For more information, contact sales@venturebeat.com.

Mistral AI wants to turn European AI sovereignty from a talking point into a product — one with a service-level agreement attached.The French artificial intelligence company announced Tuesday a three-part expansion of its infrastructure business: regional inference endpoints that let customers choose whether their AI workloads run in Europe or the United States, a new “Priority Tier” backed by an uptime guarantee for mission-critical deployments, and a coalition of European enterprises making multi-year compute commitments that Mistral says will underwrite 200 megawatts of infrastructure across Europe by the end of 2027 — and a full gigawatt by the end of 2030.In a move that may raise eyebrows among sovereignty purists, the company also said it will begin hosting third-party open models on its platform, starting with GLM-5.2 from Z.ai, the Chinese AI lab formerly known as Zhipu.Taken together, the announcements mark a decisive shift in how Mistral positions itself. The company that built its reputation training open-weight language models is now selling something closer to critical infrastructure: assured capacity, regional control, and contractual reliability for enterprises and governments that want frontier AI without surrendering control over where it runs.”When we spoke in June, the story was around how Mistral was building a full-stack AI offering,” Timothée Lacroix, Mistral’s co-founder and chief technology officer, told VentureBeat in an exclusive interview ahead of the announcement. “Today, the announcement is about strengthening one part of this infrastructure, which is the inference part.”That one part, it turns out, comes with a price tag measured in the tens of billions of dollars.Inside Mistral’s plan to build 1 gigawatt of European AI compute by 2030The headline numbers deserve scrutiny, because they imply staggering capital requirements. Mistral currently operates less than 200 megawatts of capacity, according to the company. Details shared with VentureBeat show the near-term buildout resting on three sites: a 44-megawatt facility near Paris that became operational in the second quarter of this year, a 23-megawatt facility in Sweden built in partnership with EcoDataCenter using renewable energy and advanced cooling, and a 10-megawatt site in Les Ulis, France, that came online in the third quarter.Getting from there to one gigawatt by 2030 is a different order of magnitude. Independent estimates suggest just how different: research firm Epoch AI calculates that a typical one-gigawatt AI data center requires roughly $38 billion in upfront capital expenditure, with servers and GPUs — not buildings or land — consuming the majority of the cost. Goldman Sachs Research pegs next-generation AI facilities at $15 million to $20 million per megawatt before accounting for the chips inside them.Lacroix did not dispute the scale of the challenge. The investment required for a gigawatt of capacity “is a large investment that requires also a lot of scaling and revenue behind it,” he said.The urgency, in his telling, comes from a supply crunch that is about to get worse. “More and more, and especially around 2027 and 2028, we see that the demand for AI compute is exceeding what the market has to offer, especially in Europe,” Lacroix said. McKinsey has estimated that meeting global AI demand could require $5.2 trillion in data-center capital expenditure by 2030 — and Europe, by most analyses, is starting from behind.A company valued at a fraction of its American rivals cannot close that gap with venture capital alone. Which explains the most consequential — and most unusual — piece of Tuesday’s announcement.European Compute Units turn AI sovereignty into a five-year contractMistral is assembling what it calls an anchor group of enterprises whose long-term commitments will collectively finance infrastructure none of them could justify alone. Those commitments convert into “European Compute Units,” or ECUs — a claim on Mistral-built capacity over multiple years that participants can spend on inference, training, model adaptation, or other AI workloads as their needs evolve.If that structure sounds more like a power-purchase agreement than a cloud contract, that appears to be the point. Data-center financing increasingly resembles large infrastructure projects — gigawatts, substations, energy agreements — rather than traditional technology spending, and lenders want demand locked in before capital gets deployed. Mistral raised €830 million ($962 million) in debt earlier this year to fund its data center near Paris, TechCrunch reported in March, and pre-committed enterprise demand is exactly what makes that kind of financing repeatable at ten times the scale.Lacroix was unusually direct about the mechanics. “The entire point of compute units is to have commitment,” he said. “The goal is to have customers commit for around five years, or at least a long time.” Asked what happens if a customer wants out early, he didn’t soften the answer: “There is no getting out.”What makes a five-year, no-exit commitment palatable, he argued, is flexibility in how the capacity gets consumed. “Typically this can be spent on raw inference that you then feed through any other AI stack. It can be spent on raw compute as managed Kubernetes, and it can be spent at the very top with our full AI offering,” he said. “My hope is that they will use it with our full-stack services and will love it.”The anchor group already includes some of Europe’s industrial heavyweights. Amadeus CEO Luis Maroto said in a statement that “capacity, deployment control, and operating continuity become increasingly important for all enterprises.” ASML chief Christophe Fouquet — whose company led Mistral’s $13.4 billion (€11.7 billion) Series C last year — called building European AI capacity one of the few industrial endeavors that “will matter more to Europe’s next generation,” while Capgemini’s Aiman Ezzat framed it as “a question of who shapes the future of European industry.” CMA CGM chairman Rodolphe Saadé said the shipping group’s Mistral deployment is “already under way among thousands of employees.”Commitments of that duration only make sense, of course, if the sovereignty being purchased is real. On that question, Mistral’s announcement contains an asterisk worth reading closely.The fine print on sovereign AI: what data can still leave EuropeThe centerpiece product is Mistral Regional Endpoints, now generally available, which let customers pin inference and its associated processing to Europe or the U.S. Alongside it, the new Priority Tier — in public preview — offers committed service levels, custom rate limits, and an uptime SLA for mission-critical workloads.Mistral claims it is the only European AI lab offering both a choice of processing region and an SLA-backed service tier, and Lacroix said a third option is coming: an endpoint “that stays on Mistral-controlled infrastructure, so on Mistral compute” — for customers who want their inference not just in Europe, but off hyperscaler hardware entirely.Then comes the fine print. Mistral’s own materials note that in-region inference remains subject to “limited, safeguarded transfers” to sub-processors that may sit outside the chosen region. Pressed on what actually leaves Europe, Lacroix pointed to the connective tissue of modern AI applications: tool calls.”There are some tool services, like some tool calls, that might be hosted in places where we don’t fully control this,” he said, citing web search as an example. “A few of our web-search providers might not all be in Europe, and in that case, we need to potentially gate that capability.”His answer to the compliance question — would this satisfy a European bank or a defense ministry? — was that gating is the feature, not the bug. Capabilities that cannot be sourced in-region can be switched off entirely, restricted to certain users or workspaces, or, given sufficient demand, rebuilt with European providers. “Any capabilities that we don’t find a provider for in Europe — if it needs to be done in Europe, we’ll find some way to implement it or find ways to address it,” Lacroix said.For enterprise buyers, that is a more honest framing than most sovereignty marketing offers: full regional control is available, but the moment an AI agent reaches out to the open web, sovereignty becomes a configuration decision rather than a default. The same pragmatism runs through the announcement’s most surprising line item.Why Europe’s open source AI champion is hosting China’s GLM-5.2A French national champion — one that has partnered with the French army and positioned itself as Europe’s answer to American AI dependence — hosting a Chinese lab’s model invites an obvious question. Lacroix’s answer was disarmingly matter-of-fact.”It’s a great model. Everyone loves it. It’s open weight, so there was no good reason for us not to do it, really,” he said, noting that Mistral’s own stack is already built on open-source software like Kubernetes.On security vetting, he argued that open weights fundamentally change the risk calculus. “The risks in taking a new model, at the layer of the weights, are — at least in my opinion — rather limited,” Lacroix said. “We checked basically all of the safety and compliance evals that we have. We’ll control that model, its outputs, and what it does the same way we do any of our models. We have the same inputs and outputs and monitoring capabilities over all of it.”The strategic logic is worth unpacking. By hosting third-party open models under European regional controls and the same SLAs as its own, Mistral is repositioning itself from model vendor to sovereign distribution layer — the trusted intermediary through which any open model, regardless of origin, can be consumed by a regulated European enterprise that could never call a Chinese API directly. It is the “model garden” playbook the hyperscalers run with Bedrock and Vertex, executed on European soil with European guarantees.Customers appear to be reading it that way. “Mistral allows us to run open models under strict regional controls and service commitments, making it easy for us to maintain data residency and compliance requirements,” Matan Griberg, CEO of AI software-engineering company Factory, said in a statement.Lacroix stressed the move is not a retreat from frontier training: the model Mistral had in training as of June “is still training, and we’re still very excited about it,” he said. But openness to rivals’ models signals where the company now believes its moat lies — not in any single model, but in the infrastructure underneath all of them. Which makes its relationship with the world’s most powerful infrastructure company all the more interesting.How the multibillion-dollar Microsoft deal funds Mistral’s independenceHovering over every sovereignty claim is Mistral’s deepening relationship with Microsoft. In July, the two companies announced a multibillion-dollar expansion of their partnership under which Microsoft will rent capacity from Mistral’s European data centers to serve its own cloud and AI demand, while adding Mistral Medium 3.5 and OCR 4 to Microsoft Foundry, bringing Medium 3.5 to Copilot Studio, and enabling Mistral models on Azure Local for disconnected, customer-controlled environments. Mistral CEO Arthur Mensch told The Wall Street Journal at the time that two-thirds of Mistral’s customers already work with Microsoft.How does a company selling independence from U.S. hyperscalers square taking one on as its largest tenant? Lacroix described Microsoft not as a patron but as an anchor customer that de-risks the buildout.”It allows us to scale different parts of the business differently by building infrastructure with Microsoft as a customer,” he said. “We can scale that team, we can scale our infrastructure, and make sure that we can then, on the side of it, also build for ourselves and for our customers.” He compared the arrangement to the neocloud playbook — companies that built businesses supplying capacity to the hyperscalers themselves. “As that part of our business resembles that of neoclouds, we’re following the same thing.”It is a genuinely clever inversion: rather than renting American infrastructure, Mistral is renting infrastructure to one of America’s largest companies, using Microsoft’s demand to finance capacity that also serves European sovereignty customers. But the independence has limits no contract can engineer away — the GPUs filling Mistral’s European data centers come overwhelmingly from Nvidia and other American chipmakers, as SiliconANGLE noted in its coverage of the July deal.Asked directly why a customer should choose Mistral over an EU region on AWS or Azure, Lacroix gave two answers. “The simplest possible answer is capacity. There is more demand than supply right now, and so it adds another option,” he said. The second cuts closer to the pitch: “We are a European provider, and on the region that would be Mistral compute, we are fully independent. That’s a truly differentiated offering than all of the hyperscalers or pure inference companies can provide.”The economics of open models: why agentic AI is pushing inference to the cloudThere has always been a tension at the heart of Mistral’s business: its best-known models are free to download, and open models have historically been difficult to monetize through APIs. Asked how free weights fund a gigawatt buildout, Lacroix offered the clearest articulation yet of the company’s thesis — that the economics of self-hosting are collapsing under the weight of the models themselves.”When the models were smaller, and we were before the explosion of agentic AI, it was doable for enterprises to host their own — up to, let’s say, 100-billion-parameter dense models — on their premises,” he said. “More and more, with models going into the trillion or more parameters, with the current hardware, and with the increasing amount of tokens that need to be processed, it becomes harder.”His conclusion was blunt: “I don’t see how, with the current trend of model size and growth of agentic tokens, we keep the full inference on-prem. To me, that is why we think we’re going to monetize our cloud inference.” Inference, he noted, is particularly well suited to the cloud because it “does not need to hold any data” and can be encrypted in transit.In other words: open weights get Mistral into the enterprise, and the physics of trillion-parameter agentic workloads brings the inference — and the revenue — back to Mistral’s data centers. The thesis will get an expensive test. Mistral has raised roughly $4 billion to date, according to PitchBook data — a fraction of the war chests assembled by OpenAI and Anthropic — and Bloomberg reported in June that the company is in talks to raise about €3 billion at a roughly €20 billion valuation, nearly double its Series C mark. The revenue behind the buildout will have to come from exactly the enterprises Tuesday’s announcement is courting.And Europe, in Mistral’s telling, is only the first market for what it is selling. Asked whether the framework could be replicated in the Middle East, Asia, or anywhere else anxious about AI dependence, Lacroix didn’t hedge: “It’s completely right. We’re starting this in Europe because it’s also an easier part of the world for us to scale into, especially in the infrastructure. But we definitely want to extend this, depending on customer demand.” Every layer of the stack, he said, “can be controlled, changed, replaced depending on where we operate and what the requirements are — that’s pretty much where we excel.”That is the wager underneath the SLAs, the compute units, and the Chinese model flying a European flag: in a world where the U.S. and China dominate frontier AI, the durable business is selling everyone else control. To fund it, Mistral is asking Europe’s largest enterprises to sign five-year contracts with no exit — while making a bigger, longer commitment of its own. A gigawatt, after all, is a promise measured in decades. For Mistral, too, there is no getting out.

Enterprises running always-on AI agents keep hitting the same tradeoff. Send every task to a frontier model and the bill climbs fast. Build custom routing logic to send easy tasks to cheaper models and that becomes its own engineering project, one that has to be maintained every time a workflow changes.Nvidia is proposing a fix that touches both ends of that problem at once. The company is out on Tuesday with Nemotron 3.5 Lightning, a 30-billion-parameter open mixture-of-experts model built for high-volume, specialized agent tasks, alongside NeMo Switchyard, an open-source library that routes each step of an agent workflow to whichever model fits it best.The headline numbers: According to Nvidia, Lightning delivers up to 4x faster output than comparable models in its class, completing agentic tasks roughly 30% faster than Qwen3.6-35B at matching accuracy. Paired through Switchyard, Nvidia says the combination holds frontier-level task completion while cutting benchmark costs to roughly a third of running Opus 4.8 alone.The timing puts Nvidia in the middle of the busiest open-weight stretch the industry has seen in months. Alibaba, Moonshot, Zhipu and DeepSeek have all shipped competitive open models out of China since the spring, several landing at or near frontier performance while undercutting US labs on size or price. Meta added to that pressure by releasing its own 30-billion-parameter open agentic model, Muse Glimmer. Open weights have gone from a differentiator to table stakes in a matter of months, and Nvidia’s release lands squarely inside that shift rather than ahead of it.The pairing is the point. A model alone doesn’t solve the cost problem, and a router alone has nothing efficient to route to. Nvidia is betting that open source, applied at both the model layer and the routing layer, is what actually moves the cost needle on agentic AI, not a single cheaper model and not a smarter router bolted onto someone else’s stack.Switchyard’s real rivals aren’t other open models — they’re Not Diamond, which already powers OpenRouter’s Auto mode, and RouteLLM, the open-source framework from UC Berkeley and LMSYS. Neither ships its own model. Nvidia’s bet is that owning both sides of the decision, under one open license, is what a router-only or model-only competitor can’t match.”That is the power of a system of models, matching the right model to each step of the workflow,” Kari Briski, vice president of generative AI at Nvidia, said in a briefing.How the router actually changes the workflowModel routing isn’t a new category. OpenRouter, LiteLLM and a handful of standalone routing startups already let developers point traffic across multiple providers. Switchyard plugs into several of them rather than replacing them outright.The core problem Switchyard solves is that the right model changes as an agent moves through a task. An agent’s state shifts as tools return results, errors show up, or a step turns out to be routine rather than complex, and a fixed model choice can’t adapt to any of that.Briski described routing strategies that respond to that shifting state rather than a static task category.”It has many types of routing strategies,” Briski said. “You can have a random router, which is not that great, or you can have an agent state route or a classifier route. Depending on your routing strategy, it wants to choose the best model. In some cases you want to go with a model like Lightning for really efficient tasks, and the router will actually choose Lightning if it’s set up in your pool of models.”Cost enters the routing decision directly, not as an afterthought. In response to a question from VentureBeat, Briski said Switchyard can evaluate model verbosity, meaning how many tokens a given model tends to produce for a task, and use that prediction to steer work toward the cheaper option before the call is made.The part that keeps this from becoming its own integration project is where Switchyard sits. Nvidia split its partners into two groups: agent frameworks that call Switchyard directly, including Cognition, LangChain and Nous Research, and LLM gateways that have built Switchyard support into their own products, including Kong, LiteLLM and OpenRouter. Kong ships Switchyard natively inside Kong AI Gateway. Briski pointed to that same list of gateway partners when describing how the library fits into the existing routing ecosystem.”We are an ecosystem lover, and we want to make sure that we are integrated,” Briski said. “We’ve partnered with OpenRouter, LiteLLM and Kong, and they’ve already integrated our routing algorithm, so you can pick it up right where you’re already using the best tools.”Nvidia shared results from nine companies testing Switchyard, several with specific figures attached. LangChain reported a 74% cost reduction across 145 multi-turn Deep Agents tasks by routing just 7% of calls to a frontier model, at a 6% accuracy tradeoff. Ramp said it matched a frontier model’s performance on Ramp SWE-Bench while cutting costs 58% and runtime 33%. Cognition integrated Switchyard’s staged router into Devin Desktop for internal use and reported near-frontier performance on FrontierCode Main while cutting mean cost 28% relative to routing everything to a single frontier model.Lightning’s architecture and performance gainsNemotron 3.5 Lightning is a standalone open model in its own right, built for high-volume, specialized agent tasks rather than general-purpose use.It extends the hybrid Mamba-Transformer, latent mixture-of-experts architecture Nvidia introduced with the Nemotron 3 family in December 2025, the same line behind Nemotron 3 Super, which Nvidia uses as Lightning’s own baseline in its post-training comparisons. Positioned within a routing setup like Switchyard, it’s built to sit at the fast, cheap end of the decision rather than the frontier end, but it runs and ships independent of any router.According to the Artificial Analysis Intelligence Index, a general capability benchmark spanning nine evaluations, Lightning scores 24, tied with gpt-oss-120b and behind Nemotron 3 Super, Gemma 4 31B, Claude 4.5 Haiku and Mistral Medium 3.5, all at 30. Lightning isn’t a general-intelligence leader in its size class, and Nvidia isn’t claiming it is.The actual claim is narrower: according to PinchBench data supplied by Nvidia, Lightning matches Qwen3.6-35B’s accuracy roughly 30% faster and beats Gemma 4 26B’s accuracy at a similar completion time on PinchBench, a real-world agent task benchmark spanning coding, research and file management. That’s a speed-to-accuracy tradeoff, not a capability win.Post-training is where Nvidia says the bigger gains show up. The company shared before-and-after figures from four early-access partners: CrowdStrike’s malicious-content recall against a Nemotron 3 Super baseline, CodeRabbit’s coding router against a GPT 5.4 Nano baseline, Harvey and Trajectory’s legal task completion against an Opus 4.6 baseline, and Lila Sciences’ energy simulation work against an Opus 4.8 baseline. CodeRabbit’s case is the most specific: Nvidia says the standard NeMo Auto model recipe, trained for one epoch, built into a working router agent for $85 in about two hours.What this means for enterprisesThere is no shortage of competitive offerings in the growing market for open models. The new Nemotron Lightning release will be yet another option for organizations to consider.On the model side, Lightning’s own benchmark chart picks Qwen3.6-35B as its direct comparison point. Asked by VentureBeat directly how Lightning compares to Chinese models more broadly, Briski didn’t offer a head-to-head benchmark, pointing instead to openness and customizability as the differentiator.”Our value proposition is not just open and it’s very customizable,” Briski said.For enterprises building agentic infrastructure, three trends stand out:The routing decision is becoming dynamic instead of static. Enterprises that built agent pipelines around a single default model are being pushed toward per-step routing based on live signals like agent state and token cost, not a fixed assignment set at design time.Open source is now a cost lever at two layers, not one. Pairing an open model with an open router a vendor controls end to end is a newer argument than cheaper weights alone, and worth watching for whether other labs follow the same pattern.The competitive question shifts from best model to best system. As routing libraries mature, the differentiator moves from which model an enterprise defaults to, toward how well its routing layer matches models to tasks in production, a harder thing to benchmark and a harder thing to market.