Qualys used discussions at Black Hat USA to argue that cyber risk management should shift from dashboards to faster, autonomous remediation using AI-assisted detection, exploit validation, and patching. Thakar said only 1% of discovered vulnerabilities are actually exploitable, and only a smaller share leads to business loss. The approach changes by prioritizing validated, business-relevant fixes via a centralized Risk Operations Center that normalizes multiple risk sources into a financial view for CISOs and boards.
Rippling, after spending millions on AI tools internally in just months, launched AI Spend Console, a product that tracks individual and team spending on AI services. The company did not disclose the specific amount spent or timeframe in detail. Organizations can now monitor and potentially control how much their employees spend on AI tools, addressing the challenge of ungoverned AI tool adoption in the workplace.
Uber spent its entire 2026 AI budget within months after encouraging excessive token consumption through leaderboards, then adjusted course by improving prompt caching and efficiency metrics rather than restricting access. The company quadrupled AI tool adoption while reducing cost per token, with Uber's CTO declaring the "tokenmaxxing" trend over as enterprises shift focus to efficiency. However, this shift risks triggering Jevons paradox, where cost reductions lead to increased total spending as companies deploy more AI agents and workflows.
Coinbase, Shopify, and Ramp have each built internal coding agents for their developers but continue paying Anthropic for Claude and other frontier models, revealing that enterprises are taking ownership of the orchestration layer—the agent harness—rather than the underlying LLM. Shopify reports River participates in one out of every eight merged pull requests, while Coinbase reduced overall AI spending despite processing more tokens through intelligent routing, prompt caching, and model selection policies. This architectural pattern suggests the competitive advantage for enterprises is shifting from owning the model to controlling the execution environment, governance, and cost optimization layer that sits between developers and foundation models.
Fortinet outlined its Security Fabric strategy at Black Hat 2026 to converge network security platforms and reduce complexity for enterprises adopting AI. The plan extends across on-premises and cloud using a shared policy in its SASE Firewall concept. As AI moves toward production, Fortinet says it is also adding governance tools to control sanctioned agents and MCP servers and to monitor token usage for internal AI infrastructure.
TReNDS Center at Georgia State University built an automated root-cause analysis system using Amazon Bedrock and the Strands Agents SDK that detects errors in CloudWatch logs and investigates them autonomously.The system reduces manual investigation time from 15–30 minutes for straightforward errors to near-instant by having an AI agent fetch log context and source code from GitHub, then deliver structured analysis via SNS.Engineers now receive detailed root-cause reports with severity levels, code context, and fix suggestions instead of manually reading stack traces and tracing execution paths.
Simon Willison’s Weblog·2 months ago·
32
● 4 sources
Accenture's internal data reveals that non-engineers are driving excessive token consumption at the company, with inefficient practices like converting PDFs to images and then to markdown files being major culprits. According to leaked meeting audio, converting PDFs to markdown is identified as one of the biggest token consumers, suggesting widespread inefficient AI usage patterns. Companies may need to train employees on more efficient AI workflows to control spiraling inference costs.
Airbnb reports that AI assistance has accelerated internal development, with the company claiming a 60% reduction in time from concept to feature launch and an 80% increase in shipped features over six months. The company is now testing an AI-powered search function with natural language input and toggle-based switching, while its AI customer support agent handles 45% of issues without human intervention across 50+ languages. These internal AI gains have contributed to Airbnb's Q2 revenue of $3.6 billion and a 16% year-over-year reduction in support cost per booking.
Companies should retrain and redeploy existing employees into new AI-enabled roles rather than hiring externally or cutting jobs, as internal moves cost less and preserve institutional knowledge. Standard Chartered saved $49,000 per employee by redeploying staff from declining roles to emerging positions, and external hiring for complex roles can require up to 24 months of ramp-up time. Organizations that invest in upskilling current workers gain retention benefits, with 63% of employees preferring skill development opportunities over a 10% raise.
The 'AI kill switch' metaphor is simpler than the reality of shutting down AI systems embedded in complex production environments with multiple dependencies, integrations, and undocumented pathways. Organizations often lack visibility into where AI is running across their infrastructure, making it difficult to identify what needs to be shut down when risk emerges. Before any shutdown can work, enterprises need accurate inventories of AI systems, their dependencies, and operational controls—challenges that existing governance processes struggle to address.
Hadrian, an AI-powered manufacturing startup building automated factories for US defence contractors, raised $1.37 billion at a $7.87 billion valuation, nearly five times its January price. The Series D funding, co-led by five major firms with JPMorgan Chase as anchor, values the company at roughly five times its January valuation of $1.6 billion. Hadrian plans to use the capital to expand factory operations and enter new production areas including munitions and autonomous systems, addressing America's need to rebuild defence manufacturing capacity.
Apollo Research launched Watcher, a security platform that monitors and blocks dangerous actions by AI coding agents like Claude Code and Codex in real time across organizations. The system deploys policies via MDM, blocks risky operations during execution, and reviews sessions for incidents, with cloud and self-hosted deployment options available. Organizations gain centralized control over AI agent behavior, reducing the risk of breaches that cost an average of $6 million while maintaining developer velocity.
Boson has released a platform that converts images into talking avatars paired with voice agents for business applications. The system includes real-time voice capabilities, speech-to-text, text-to-speech, and avatar generation designed to operate in customer support, sales, and product assistant workflows. Companies can now deploy voice agents customized to their specific domains and trained on proprietary data for production use.
SuperIntern launched an AI email and meeting assistant inside chat apps to draft emails, manage schedules, and handle voice replies. The page says it is “Launching today” and describes SuperIntern 2.0 as a second launch. It adds 24/7 proactive drafting and follow-up handling with the requirement that users approve every message before it is sent.
Every AI story that matters,
in your inbox by 8am.
TLDRocket reads all relevant sources, removes duplicate coverage, and summarises the
day in two minutes. Follow companies and topics for alerts, or get the
briefing in Slack. Free, no spam, unsubscribe anytime.
Reading TLDRocket needs no cookies, and the readership counts we rely on come from
our own cookieless analytics. Google Analytics is the exception: it sets cookies and
reports to Google, so it stays switched off until you allow it. You can change your
mind any time from “Cookie settings” in the footer.
Strictly necessary
Session security and form protection (tldrocket-session,
XSRF-TOKEN, 2 hours). The site cannot work without them,
so they need no consent.
Always on
Google Analytics 4 (_ga,
_ga_<id>, up to 2 years). Measures which
stories and sections readers use. Google acts as a third-party processor and may
store the data outside the EU. No advertising, no profiling, no data sold.
