Amazon has joined the growing list of companies telling software engineers to stop tokenmaxxing just to look like you're using AI, and instead use the technology only when it actually makes sense.

That's the clear message from Amazon to its engineers via a memo the company chose to publish, telling staff: "if your work does not benefit from current AI tooling, that is a finding, not a failing."

The memo to staff follows reports earlier this year that suggested Amazon staff were using AI for unnecessary tasks in order to move up internal rankings on an AI adoption leaderboard.

The memo was sent in September to software development engineers (SDEs) and software development managers (SDMs).

Not every task needs AI

Terk Terkowitz, vice president and distinguished engineer at Worldwide Amazon Stores, said engineering leaders at the organization had created an "updated role guideline" after concluding that the key elements of software development hadn't really changed despite the impact of AI coding.

"Our most prolific engineers have demonstrated that neither the developer role nor their output is defined by the use of AI," Terkowitz said. "We're now in the era of the Renaissance Developer, blending AI tools with human judgment and domain expertise to build entirely new things."

The new attitude suggests a shift in thinking at the retail and tech giant, following a pattern of companies going all-in in AI only to take a step back — especially after facing big bills from "tokenmaxxing”.

This refers to a practice in which users ramp up their use of the technology, often regardless of whether it’s needed. Indeed, tokenmaxxing has been a recurring talking point across 2026 so far, with some companies rapidly accelerating their use of AI.

Uber, for example, was forced to introduce a cap on AI usage after chewing through its entire annual AI budget in just four months. As ITPro reported in late July, Accenture also followed suit, ordering staff to stop using the technology for basic tasks due to skyrocketing costs.

Elsewhere, Microsoft sent a similar memo to its engineers over the summer, telling them to seek value for customers and the business, as "tokenmaxxing is not what we are optimising for."

AI needs to add value

The memo still makes clear that AI is core to software engineering at Amazon, and a spokesperson told CNBC there was no cap on AI usage at the company.

"We are certain that whatever future best practices are, AI will be at the center of software engineering practice," the memo notes. "If you haven’t already, you should take the time to learn and apply AI into your daily work as soon as possible."

However, Amazon also admitted difficulties with its previous attempts to measure AI using "input metrics" like token usage or AI tool adoption, as well as throughput metrics like code changes or reviews.

"We are all aware of how deeply flawed these metrics are, primarily because they are disconnected from what matters," the memo added, admitting these metrics could be used as a target that would "drive negative outcomes".

These outcomes include high costs from tokenmaxxing and unnecessary complexity contrary to Amazon’s “invent and simplify” mantra.

That doesn't mean Amazon isn't considering metrics, however. Instead, the memo directed managers to consider the bottom tenth of teams when it comes to AI usage as well as the top, to understand why some aren't using the technology and why others are.

"Deploying AI in your organizations requires carefully balancing between exploring new and better ways to do things and investing in doubling down on the ones you already have," the memo said.

Amazon called on its engineers to tell the company when AI isn't useful. "An engineer who can explain where AI does not yet help their work is demonstrating the judgement we are asking for," the memo notes.

FOLLOW US ON SOCIAL MEDIA

Organizations are sticking with Microsoft Azure largely due to the risk of financial penalties rather than merit, according to a new survey.

A poll conducted by the Coalition for Fair Software Licensing (CFSL) has concluded that Microsoft's software licensing practices are a widespread barrier to competition and choice.

More than three-quarters (83%) of software and cloud decision-makers said Microsoft's rules meaningfully limit which cloud providers they can realistically consider.

61% that shopped around said they chose Azure to avoid fees, not because it was the better product. Nearly all reported at least one concrete harm from Microsoft’s licensing practices, with 65% reporting three or more.

Notably, if cost wasn't a factor, eight-in-ten said they would migrate workloads away from Azure if Microsoft's licensing restrictions were lifted.

These concerns have led nearly two-thirds of organizations to keep a workload on their own servers, rather than migrating to the cloud, according to the CFSL.

Microsoft licensing practices raise the stakes with AI ambitions

According to the survey, 82% of respondents with AI projects said Microsoft licensing practices have affected which AI platform they can use. More than half (52%) said they’ve subsequently delayed, scaled back, or cancelled a project.

Meanwhile, licensing cost increases have led 56% to raise prices for their own customers, with 42% of all organizations passing on most or all of the increase. More than half have cut other spending, with a third slowing hiring or reducing headcount. 

"Microsoft's customers are telling us the system is broken. Businesses are being steered to Azure by financial penalties rather than by merit," said Ryan Triplette, CFSL executive director.

"They are passing the costs on to their own customers and delaying the AI tools they need to compete. Some are choosing not to migrate to the cloud at all, rather than incur the costs associated with Microsoft’s licenses to do so."

More than two-thirds said they'd been audited in the past three years, with a quarter incurring unexpected added costs – and those who evaluated a competitor say they are 2.2 times more likely to face an audit.

As a result, 94% said they support letting businesses run software they already own on any cloud without added fees, and 86% said federal regulators should examine software licensing practices that limit which cloud providers businesses can use.

"The closer a decision-maker is to Microsoft's licensing practices, the more urgently they want regulators to step in," said Triplette.

"Regulators should take note: what happens next matters to every American business, and every consumer paying more because of Microsoft's anticompetitive licensing practices."

Licensing practices under scrutiny

Microsoft is already facing scrutiny over its software licensing, and is currently under investigation by the UK's Competition and Markets Authority (CMA) over its Microsoft 365 licensing approach.

The CMA also plans to look into the way Microsoft bundles products, whether customers have an effective choice, and the impact of Microsoft’s licensing practices on these choices.

ITPro approached Microsoft for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Fragmented enterprise communication practices are causing “information overload” for workers, and it’s severely affecting productivity.

That’s according to a new study from Forrester on behalf of Staffbase. The survey found that more than half of respondents typically receive “critical company news and information” across six or more channels.

Crucially, more than one-third (35%) of respondents said they receive conflicting, unclear, and often outdated information multiple times a week. The result is that broader workforce alignment takes a serious toll on employees and general productivity, Forrester warned.

Nearly half (48%) of respondents, for example, reported lower productivity levels and operational efficiency while 44% detailed a higher rate of errors, quality issues, and missed deadlines.

Frank Wolf, chief strategy officer and co-founder of Staffbase, said the study highlights a growing disconnect between how organizations invest in communications technology and how it’s used in daily operations.

“In the UK and Europe, we’re seeing organisations invest heavily in the systems that run the business, and increasingly in AI, but too often that value never extends the last mile to frontline employees,” he commented.

“This research shows both what that gap costs in productivity and accuracy, and how much employees want one place that brings everything together. Closing that gap means giving every employee a place they can trust to find out what matters, get the right answer and know what to do next.”

Tackling information overload

According to Forrester, employees are now pushing heavily for a more consolidated approach to workforce communication.

The consultancy noted that “consolidating what makes sense and connecting what remains helps information and experiences flow across applications, giving employees a simpler, more cohesive way to stay informed and productive.”

Around 83% of respondents said that a single application or platform that brings together “work-related activities and information” would have a positive impact on efficiency.

Demand for AI tools on this front is also growing, the survey found. Nearly half (47%) of respondents ranked AI-powered answers and employee guidance as “among the top three capabilities” they want to see moving forward.

The perils of “context switching”

Information overload has become a recurring pain point for workers and enterprises alike in recent years, with many operating across disparate communications systems and applications.

Research from Workplace 365 in March 2025, for example, found that six-in-ten employees had become overwhelmed by workplace solutions, with two-thirds calling for greater simplification and consolidation.

Working across multiple tools and applications forces workers into “context switching”, and separate research shows this has an adverse effect on productivity and mental wellbeing.

Indeed, context switching is an issue that now spans multiple industries and professions – from cybersecurity to software development and more.

More recent research from Workday shows that switching between disconnected tools and systems wastes nearly a full working day each week, per employee.

Analysis from the firm in May 2026 found that one-in-four UK workers spent seven hours or more each week copying information between applications and various platforms.

FOLLOW US ON SOCIAL MEDIA

Tesco appears primed to switch to an open source VMware alternative as the supermarket giant continues its feud with the virtualization provider.

The company has posted an ad for a new ‘Head of Software Engineering: Edge Platform’ role in recent weeks, with the ad first spotted by The Register.

According to the posting, the new engineering lead will coordinate “two major, interconnected engineering priorities”.

This includes the creation of a “robust, scalable software driven edge management platform” alongside modernization of the firm’s edge virtualization estate “through the migration from VMware to Proxmox”.

Proxmox Virtual Environment (Proxmox VE) is an open source server management and virtualization platform based out of Vienna.

Tesco’s “business-critical” focus

The new position, which is based in Bengaluru, is a significant one, according to Tesco.

Indeed, the supermarket giant said the edge platform is “business-critical” and provides the “underlying computing environment and software capabilities that enable applications to run across our stores”.

“Store technology must remain dependable despite connectivity disruptions, constrained local resources and the complexity of managing software and infrastructure changes across thousands of locations,” the job ad reads.

“Failures or poorly executed changes can directly affect store operations, colleague productivity, and customer experience.”

The ad notes that Tesco is primarily seeking those with:

• “15+ years of experience in software engineering and technology”
• “Strong technical foundations and credibility across Java, Micronaut or comparable Java frameworks, microservices, REST APIs, Python automation, and Terraform”
• “Solid experience with Linux operating systems, edge computing, server hardware, virtualization and storage technologies, including the design, integration, deployment, or lifecycle management of infrastructure platforms”

Those who fit the bill have their work cut out for them, based on the job description.

Tesco said the new engineering head will “define and execute” the company’s edge platform engineering strategy, modernization roadmap, the aforementioned migration, and implementation of automated engineering practices.

A long-running spat

The job ad – and apparent shift away from VMware – marks the latest in a long-running spat between the supermarket giant and VMware owner Broadcom.

As ITPro reported last year, the company filed a lawsuit against Broadcom for £100 million over VMware licensing contracts.

At the time, Tesco accused the company of failing to maintain support for business critical software which underpins operations across the UK.

Broadcom has been repeatedly criticised for changes to VMware’s licensing setup since acquiring the virtualization giant in 2022 for $61 billion.

In court filings last year, Tesco said licensing changes raised prices by 237% and accused Broadcom of refusing to negotiate terms or packages. The filing alleged that Broadcom is taking advantage of its market dominance to raise prices – an accusation it has faced from European industry stakeholders.

In March this year, CISPE lodged an antitrust complaint with the European Commission, alleging that Broadcom uses unfair software licensing terms to maintain a dominant position in the European cloud market.

FOLLOW US ON SOCIAL MEDIA

Entire, a startup launched by former GitHub CEO Thomas Dohmke, has officially unveiled an alternative to the popular development platform.

The new Git forge is designed specifically with agent-human collaboration in mind, according to the startup, and will offer users the same basic abilities as GitHub – albeit with a twist for the AI era.

Entire claims its platform is built on “fundamentally new primitives” compared to GitHub and other platforms. The system is built on a new distributed source control server compatible with Git, meaning that every developer has their own dedicated server.

Using this method, the startup claims it pushes up to 89 times faster than GitHub and six times faster than Cursor’s Origin.

“This makes Entire the fastest Git forge in product today,” the startup said in an announcement. “Developers can create, migrate, and natively host private repositories in the region of their choice, including the US, EU, India, and Australia.”

Other basic functions like code reviews have received a sprucing up with the ‘Trails’ feature, according to Entire. While other platforms rely on a classic pull request model to review code changes, Entire will provide users with a “heads-up display similar to an airline pilot”.

This will include rolling, customized evals that are assessed and scored by agents with each code push, the company added.

Notably, Entire also leverages continuous memory, which it said represents a “new approach” that allows agents and developer teams to sync sessions and prompts within the repository.

The advantage here, according to Entire, is that data is constantly available and searchable for coding agents. This approach relies on two core components: a codebase graph that allows agents to “find answers faster” and reduce token consumption, and an “agentic brain”.

This essentially stores previous agent sessions and prompts within a system of memory that can be referred to or queried further down the line.

Entire targets agentic orchestration gains

Dohmke said these features come in direct response to the growing use of agents in software development processes.

JetBrains’ Developer Ecosystem Survey found around 90% of developers now use AI coding agents at work on a weekly basis. More than two-thirds (68%), meanwhile, are using them on a daily basis.

“The Pull Request revolutionized first open source and later enterprise software development. Instead of sending diffs and patches on email lists, developers could fork a repo and send their code changes back to the maintainer,” he commented.

“But agents now write almost all of it, faster and more complex than ever before.”

Dohmke added that Entire treats the “idea, the agent trace, and the outcome of a developer’s sessions as first-class artifacts for review alongside the code”.

The platform also uses multiple agents to conduct evals to ensure developers can confidently merge code without repeated reviews.

“This allows coding agents to address findings in a loop, while the human developer validates the progress,” he explained. “When all evals are satisfied, they can merge the code without needing to look at the code itself.”

Dohmke’s first move post-GitHub

The announcement marks the first big move by Entire since it launched earlier this year with an eye on building the “world's next developer platform for the era of AI”.

Entire hit the ground running in February backed by a $60 million seed round at a $300 million valuation. The investment round was led by Felic, with participation from Madrona, M12, 20VC, and Cherry Ventures.

That announcement also marked Dohmke’s first venture since departing GitHub as CEO.

When he announced his departure in August 2025, Dohmke specifically noted that his “startup roots have begun tugging on me”, prompting speculation about a new venture.

A viable GitHub alternative?

While Entire frames itself as a viable alternative to GitHub, it faces stiff competition on this front, and not only from the aforementioned platform.

As ITPro reported in August, vibe coding startup Cursor launched its own alternative to tap into what has become a highly lucrative market.

When Cursor launched Origin, the company said it was “starting with the essentials”, offering users much of the same basic features found in GitHub. Long-term, the plan is to provide “agent-native features”.

Alongside the launch, Entire revealed it has secured partnerships with Buildkite and Depot to ensure build and test pipelines “keep up with how fast agents ship”.

Entire said this will allow users to move off GitHub Actions by converting existing workflows using Buildkite’s bk pipeline or Depot CI, enabling them to subscribe the repository in its own platform.

This move by Entire mirrors Cursor, which also announced partnerships with Depot and Buildkite to build a broader “app ecosystem” aimed at tempting users away from GitHub.

FOLLOW US ON SOCIAL MEDIA

AI is speeding up coding, but what about everything else across the software development lifecycle? According to new research from Atlassian, developers still report mixed gains and growing frustration.

As part of its State of Developer Experience Report, 87% of respondents told Atlassian that AI helps them write code faster, but nearly three quarters still face the same – or even greater friction – across the development lifecycle as before.

Indeed, traditional organizational and workflow bottlenecks are still slowing down processes, and that's led to a reduction in time savings that can be attributed to AI.

Last year's version of the poll found that 68% of software developers saved at least ten hours every week thanks to AI. By this year, that had slipped to 25%.

Beyond that, half of developers polled said they spend at least four hours a week managing output from AI, with two thirds adding that they have to spend time fixing errors in work.

Atlassian's study is by no means the first to report mixed gains from AI in software development. Research from Harness, for example, showed that while the technology is speeding up coding, eight-in-ten developers now spend more time reviewing code and completing other "invisible work" tasks.

The AI coding conundrum

So what’s slowing down software development? The survey suggests half of developers are spending too much time finding information and attending meetings, with a further 45% pinning the blame on context switching.

That tracks with separate research from Workday, which found one-in-four UK workers spend seven or more hours a week copying information between apps including AI tools.

"AI can help developers move quicker, but faster code is not the same as better software delivered sooner," said Andrew Boyagi, Customer CTO at Atlassian. "If teams still struggle to find information, clarify requirements and move work through the delivery process, speeding up coding alone won’t translate into business outcomes."

Atlassian said that AI has potential to address some of these challenges – such as by streamlining knowledge discovery and automate handoffs – but most uses of AI across the software development lifecycle remains focused on code generation rather than workflow optimization.

"Making one task faster doesn’t improve the whole system," said Boyagi.

Measuring AI

Notably, the survey found that developers feel pressure to use AI, with four-in-ten using the technology more often than is strictly necessary because they feel it's expected of them.

That's perhaps no surprise given six-in-ten report that their employer sees AI usage as a measure of productivity – and that just 17% of devs and 23% of engineering leads say their own organization has a "clearly communicated and implemented AI strategy".

"Leaders need to be clear about the problems they want AI to solve and measure the outcomes for the whole team, not just how often the tools are used," added Boyagi.

When AI does manage to speed up software development successfully, it exacerbates another existing problem: burnout.

This has become a recurring issue for development teams since the advent of generative AI. As ITPro reported in March this year, research from Harness found that the increased velocity created by the technology is creating huge pressure.

Developers now face more after-hours work as a result of botched code and remediation tasks. The majority of those polled by Harness (96%) now report working evenings or weekend multiple times a month due to release-related work.

FOLLOW US ON SOCIAL MEDIA

Zoom has unveiled a new Unified Context Layer designed to help enterprises bridge gaps between the platform and internal business knowledge sources.

Announced at the Zoomtopia customer conference this week, the Unified Context Layer will help enterprise users link conversation histories with relevant documents and data, the company revealed.

Put simply, the company hopes to close what it describes as a traditional gap between the platform itself and internal operations. Details from various meetings, conversations, and team calls are often left by the wayside, particularly when used alongside third-party applications.

With the new Unified Context Layer, Zoom will now bring together conversations with “near real-time activity” across the platform as well as connected third-party applications.

Zoom CEO Eric Yuan said this trend shows “AI models are only as powerful as their understanding of your business”.

“That context makes all the difference,” he commented. “Fragmented product experiences isolate conversations, stall decisions, and drag businesses down.”

“With the Unified Context layer, we’re laying the groundwork for a system of action designed to turn conversations into completed work.”

Poor business context has become a recurring pain point for enterprises dabbling in AI, as research shows. In a recent study from Alteryx, 77% of firms said business context is critical for AI, yet 53% said they struggle to incorporate this within AI systems and workflows.

Under the hood of Zoom’s Unified Context Layer

With the new Unified Context Layer, Zoom is rolling out a range of new features and capabilities. Include the ability to “follow the meeting”.

This will provide users personalized transcripts and summaries for those who miss a meeting, or at least parts of it.

“Enriched notes” will also link shared screens, charts, slide decks, and in-meeting chat conversations to specific parts within a transcript.

A key talking point with the new features centers around new notes workflows, according to Zoom. This will carry over meeting summaries into various third-party tools such as Salesforce.

Zoom said this will provide users with “ready-made workflows for sales, marketing, and IT”, or custom workflows built by describing what to automate using natural language.

The result here is that no separate workflow builders are required, improving ease of use and creating a more consistent workflow.

Tackling deepfake challenges

Elsewhere, Zoom also unveiled new tools aimed at tackling deepfake-related security threats. Deepfake risk detection capabilities will automatically flag “potential synthetic media” in meeting scenarios, as well as in hiring processes and customer experience contexts.

The move by Zoom comes amidst huge growth of deepfake-related incidents at enterprises spanning an array of industries.

As ITPro reported in September, nearly half of CISOs reported being hit by AI deepfake voice calls in the last year, with a further 36% reporting the same in a video call.

Deepfake techniques are also being used by cyber criminals to secure roles at enterprises, research shows.

This is a common tactic used by fake North Korean IT workers, with a host of organizations having unwittingly hired cyber criminals over the last 18 months.

FOLLOW US ON SOCIAL MEDIA

Amazon unveiled TorchNeuron, a new developer tool designed to make it easier to deploy PyTorch applications on its Trainium chips.

PyTorch is a free, open source toolkit that developers use to build, train, and run AI models. According to Amazon, TorchNeuron will allow developers to run their existing AI code on AWS Trainium chips by changing just one line of configuration, making it easier to adopt new hardware.

Long-term, aim appears to be aimed at providing developers with an easy-to-use alternative to Nvidia’s CUDA ecosystem for AI training and inference.

"Today, 85% of AI researchers and developers write their code in PyTorch. Until now, the hardware that code could run on was far more limited than the code itself, and expanding to new chips meant rewriting and revalidating work that took months to perfect," said the firm.

"Amazon is now closing that gap. With TorchNeuron, the PyTorch code developers already write runs natively on Amazon's AWS Trainium chips, with a single configuration change and no rewrite."

The company said that when its engineers ran the same AI training script on a conventional chip and Trainium, the AI model learned the same things at the same rate; the only difference was a setting that told the code which chip to use.

This, Amazon noted, means that the tools developers already use to test, debug, and scale their AI models all work on Trainium without modification.

A boon for startups?

PyTorch said early adopters include startups, enterprises, machine learning industry partners, and academic institutions, with applications spanning autonomous vehicles, robotics, video generation, speech, telecommunications, healthcare, and geospatial modeling.

"With PyTorch native support on AWS Trainium, we ran our standard inference pipeline with minimal changes to our PyTorch code," said Arjun Desai, co-founder of voice AI firm Cartesia.

"Small, fast ops map efficiently through the native path, so we didn’t have to hand-write kernels for them. That lets our team concentrate on writing high-performance NKI kernels for the layers that are called repeatedly and drive end-to-end latency."

TorchNeuron will roll out as free and open source software under the Apache 2.0 license at PyTorch Conference North America.

Looking ahead, Amazon said that it's contributing changes upstream to PyTorch itself, working with the community to remove code that ties the framework to specific chips.

The aim is to make PyTorch more hardware-agnostic for the entire developer community, not just Trainium users. Google is already working on TorchTPU, a similar project to run PyTorch natively on its chips.

"By reducing the friction of adopting new hardware, TorchNeuron introduces something the AI industry has largely lacked: meaningful choice," said Amazon. "When developers can move between chips without penalty, chipmakers have to earn developers' business, and developers benefit from lower costs and faster iteration."

FOLLOW US ON SOCIAL MEDIA

Enterprises are spending more than one-quarter (28%) of their software budgets on upgrades and licensing changes – and rising fees are expected to cause additional financial strain.

That’s according to research from Dublin-based software provider Origina, which warned that IT leaders now face a troublesome “software tax”.

The company describes this as a “recurring burden embedded in the enterprise software model that consumes capacity, diverts talent, wastes working assets, and adds costs”.

Adding insult to injury, the study claimed many enterprises have “little practical ability to refuse” software upgrades, forcing them into paying up. A key factor behind this, according to Origina, lies in accelerating vendor-driven upgrade and refresh cycles.

The vast majority (95%) of IT leaders polled said they have paid for a vendor-driven upgrade in the past three years, for example. These cost large enterprises an average of $12.87 million, the study noted.

Moving away from major software vendors would create additional complexity and strain, according to 80% of IT leaders.

No wiggle room for IT leaders

According to Origina, IT leaders now have “little room” when it comes to software purchasing and subsequent upgrades.

More than three-quarters (78%) of respondents said their primary vendor “sets the timing and terms of change”, rather than their organization. A similar number (76%) also revealed they have “very little real leverage” in negotiations with major vendors.

Put simply, IT leaders are dancing to a tune set by their provider, preventing flexibility and forcing costs upon them. More than half (53%) also revealed that mandatory software upgrades impacted business value, performance, and reliability.

Tomás O'Leary, CEO and founder of Origina and co-author of the report, said this trend means many IT leaders stick with existing providers to avoid hassle. They ultimately end up paying higher costs, however.

“When the alternative to an unwanted upgrade is losing support on systems the business runs on, saying yes is often a rational response,” he said.

“That’s exactly the problem. The market has left some of the most experienced technology leaders in the world with little room to refuse, and that cost shows up in budgets, in engineering time and in innovation that never gets funded.”

IT leaders are increasingly pushing for stronger protections for enterprises, according to Origina. More than nine-in-ten (92%) said they would actively support legislation giving firms “protections comparable with those in long-term residential rental relationships”.

82%, meanwhile, could support software-support requirements akin to those imposed on manufacturers under EU hardware repairability rules.

Downstream impact

According to Origina, the effect of this trend reached “well beyond the IT budget” and has a direct impact on broader innovation goals – particularly AI adoption.

With enterprises ramping up integration of the technology, innovation budgets are feeling the pinch due to rising software-related costs.

More than one-third (34%) of respondents, for example, said vendor-related costs were a “major contribution” in their decision to slow, pause, or cancel AI projects outright.

AI projects aren’t the only enterprise domain affected by vendor-driven software upgrades, the study added.

Indeed, the company claimed “people and hardware are affected too”. Around 84% of senior engineers said they “always” or “often” spend time working on upgrades rather than “building future capability".

“Ninety-one percent report they have scrapped functional hardware in the past three years purely to meet a software vendor's support deadline, losing an average of 1.65 years of useful hardware life,” the company said in a blog post.

FOLLOW US ON SOCIAL MEDIA

Microsoft has reportedly pulled out of a deal with Nscale under which it would have been the anchor tenant for a major UK data center, over concerns about the power supply.

The development, in Loughton, Essex, was set to deliver 50 MW of AI capacity, scalable to 90 MW, and to initially house 23,040 NVIDIA GB300 GPUs. It's expected to create 250 permanent jobs.

But now, according to the Daily Telegraph, power supply problems mean that the project will face significant delays. UK Power Networks (UKPN), which owns the electricity grid across London and the south-east of England, is believed to have told Nscale that it won't be able to supply enough power to the site until the early to mid-2030s. The development was originally set to be finished early next year.

The two companies are still working together on projects in Norway, Portugal and the US – although the Norway facility is believed to be behind schedule too.

"We remain committed to our partnership with Nscale, including work to build robust digital infrastructure and support AI growth globally," a Microsoft spokesperson told ITPro. "This decision relates to a single site."

Supplying adequate power to data centers is becoming an increasing problem, with Gartner warning as far back as two years ago that 40% of data centers could face constraints in power availability by 2027.

And late last year, a report from Savills found that the issue is slowing data center construction, with only 850MW of power capacity delivered across EMEA since the start of 2025, down by 11% compared with the same period in the previous year. New transmission, distribution, and generation capacity could take years to come online, said the firm.

UKPN recently signed up as a strategic partner of the Data Centre Alliance (DCA) as part of efforts to strengthen engagement with the data center sector and ease supply problems, publishing an Introduction to Connections guide on the DCA's member portal.

To try and deal with power supply constraints, it said it could offer a range of connections beyond non-curtailable or unconstrained connections, including ramped connections, with flexible capacity that increases over time; flexible connections managed in real time; and profiled connections, in which customizable capacity profiles are created to match operational patterns.

Energy regulator Ofgem, meanwhile, has complained that many applications are speculative in nature, and is proposing that data center projects should have to pay between £237,500 and £712,500 per megawatt when they accept a connection offer.

Microsoft is currently the only customer to have signed up for the Loughton data center, and its decision to pull out could have an effect on Nscale's planned flotation in the US later this year, where it is targeting a valuation of $35 billion.

But the move is not only a problem for Nscale, but a potential embarrassment for the UK government. Last year, as part of its AI Opportunities Action Plan, it trumpeted plans from Nscale to invest $2.5 billion to support the UK's data center infrastructure over three years. These plans included the building of the Essex data center, described as the UK's largest sovereign AI data facility.

In a statement, Nscale told ITPro: "We remain committed to both the Loughton project and the UK and we are exploring alternative power sources for the site, in addition to other expansion sites in the UK. Our relationship with Microsoft remains strong and long-term, and this unfortunate London-wide grid issue has no impact on our other contracts."

FOLLOW US ON SOCIAL MEDIA

The UK Competition and Markets Authority (CMA) has proposed designating Microsoft a Strategic Market Status (SMS) firm, meaning it would come under stricter market scrutiny.

The regulator is looking into the company's position in business software and how this impacts businesses and public sector organizations. It’s now calling for views on where it should gather further evidence.

The CMA already plans to investigate – and potentially take action over – issues such as how Microsoft bundles its software and wants to make it easier for developers to integrate their products with Microsoft’s business software ecosystem.

"We’re now consulting on whether to designate Microsoft with strategic market status," said Sarah Cardell, chief executive of the CMA. "If we do, our focus would be on promoting competition and giving businesses greater freedom to choose and combine products in business software."

The proposal relates to Microsoft's position across personal computer operating systems, productivity software suites, security software, server operating systems, and relational database management systems.

The CMA also said Microsoft’s strength in business software comes from the barriers customers face when switching. This includes commercial practices and integration advantages that incentivize customers to adopt the company’s products, making things harder for other software developers.

Before taking action, though, the CMA is planning further investigation into whether customers can freely choose the best AI tools and functionalities for their needs. It’s also investigating whether alternative AI providers have a level playing field when competing with Microsoft’s Copilot.

The regulator also wants to examine:

• Whether the way Microsoft bundles and integrates its security products limits customer choice
• Whether customers have an effective choice over which cloud to deploy their software licenses
• The impact of Microsoft’s licensing practices on these choices

"Business software and cloud services underpin workplaces across the UK, from small firms to vital public services. The evidence shows Microsoft has a long-standing and significant presence in the UK’s business software market," said Cardell.

"Organizations should be able to choose the products that work best for them, switch provider when they want to and combine services from different suppliers. We want to ensure businesses have the freedom to choose how they use Microsoft’s products alongside alternatives."

Unusually, the CMA hasn't set a timeline for its actions – something that concerns the Computer & Communications Industry Association (CCIA) UK.

"It is welcome news that the CMA still has software licensing restrictions in its sights. However, the lack of a firm timeline for action is hard to square with claims that the lack of guardrails in its new digital markets powers was necessary so the CMA could respond promptly to well-evidenced barriers to competition," said CCIA senior director and head of CCIA’s London office Matthew Sinclair.

"We have now had an Ofcom investigation, a CMA Cloud Market Investigation which found the restrictions had an adverse effect on competition, and could have taken action directly, and still no timeline from the CMA for action."

The CMA has been looking at cloud services in the UK for some time. It's already secured commitments from AWS and Microsoft to connect their data centres with rivals, scrap data transfer fees for customers changing cloud providers, and reduce these fees where customers use more than one cloud provider.

The firms are also introducing a new mechanism for competitors and customers to request greater interoperability, and rolling out AI tools to automate the technical steps needed to make the switch.

In-office meeting rooms leave a lot to be desired in terms of experience. Improving that won’t just make life better for your employees, one company has claimed, it may even directly lead to positive business outcomes.

That was the main message from Logi Work 2026 in London, where VP and GM Henry Levak talked more about its own solution to the problem, the recently released Rally Bar 2.

As most office workers will tell you, the spaces we use for hybrid meetings and video conferencing are complex environments. While there will be some organizations that have made bad decisions, in most cases it isn’t really the fault of IT decision-makers or the business as a whole – it’s the sheer complexity and depth of choice that causes the issue.

Much like a home, a meeting room will be a collection of products bought over time. Unless everything was shrewdly purchased from one vendor in one go and the room specifically designed for the purpose of holding hybrid meetings, it’s likely there’s a mixture of different vendor hardware and software all cobbled together. Some of it works fine but parts of it need upgrading and there’s always a difference in experience between those in the office and those at home.

This can affect office morale and productivity, according to Logitech’s own research: while 89% of employees believe a good workplace experience directly affects business outcomes, only 27% feel they have the necessary setup in the office.

“It’s a broad view of the overall IT landscape, not just specific to video,” Levak told ITPro after his keynote. “But I think most people would agree that when the office works well – that’s everything from the social elements to collaboration, the whole spectrum of collaboration – you get better outcomes from your team.”

When any of those in-office essentials break, that creates a problem, according to Levak – and these aren’t the only problems he believes need solving.

“There’s still more to do around space reservation and space management,” Levak explained. “Wayfinding, I feel like it still hasn’t been completely solved in a lot of offices. So I think from a broad spectrum of tools, IT managers and AV leaders would say there are still areas and pockets where there is still an opportunity for innovations… in some ways, that’s what we’re doing with Rally Bar 2; that’s what our announcement was saying. A lot of what people love about Logitech and meeting room experiences in small, medium, and large rooms are coming to much larger rooms. So hopefully we can bring that number (27%) up a little bit. So that people feel that outcomes are high and they have more solutions and spaces that they really want.”

The simplification of Rally Bar 2

Announced a week before Logi Work, the Rally Bar 2 and the Meeting Room System are Logitech’s answer to overly complex video conferencing setups. The second generation of the Rally Bar is a simplification itself, incorporating the original Rally Bar and the Rally Mini into one piece of kit.

“We looked at both and thought about the feedback. What is the feedback we’ve gotten over the years? What is it that people love? And simplicity is also about fewer options,” Levak said. “As long as you can still satisfy different use cases. Having a long menu of options and things to consider is complex. So we always try to distill things down to their core essentials, and what we find is that the technology today is actually quite capable of doing both things really well in one device.”

The original Rally Bar is a good example of this. Logitech used an optical camera system as it was keen to prove that Android devices could exist in much larger rooms than they were originally designed for.

Levak argued that they had achieved that pretty well, however they also wanted a wide field of view for certain rooms that just needed the different angles. Technically, it was unrealistic to do an optical camera without the wide view they wanted, Lovack admitted, as the camera solution would be quite large.

With new technology, like bigger sensors, better ISP, and faster processing, though, Logitech was able to do wide camera angles and still get that nice in-room zoom.

“Now the technology has sort of caught up; it allows us to simplify even the product catalogue, so instead of having two options, you have one option,” Levak said. “And that one option is even better than the two because it satisfies both use cases.”

The Logitech Rally Bar 2 is available now with prices starting at £3,899.

IBM and Red Hat have fixed more than 400 previously unknown vulnerabilities in widely used Java libraries through their Lightwell Clearinghouse initiative.

Announced earlier this year with a $5 billion investment and more than 20,000 engineers, Lightwell Clearinghouse lets enterprise customers submit open source software dependencies for priority review and fixes.

"For over two decades, Red Hat has backported security patches across thousands of packages," said Matt Hicks, president and CEO of Red Hat.

"Lightwell scales this exact model across a wider scope of open source ecosystems. We are applying the same discipline, upstream commitment, and engineering rigor across all active application layers."

Since the initial Lightwell launch, the duo said they have uncovered, remediated, and backported fixes for hundreds of previously unknown bugs in widely deployed, production-grade software.

"Finding and neutralizing 400-plus novel vulnerabilities so quickly shows how fast Lightwell can move, and we are just getting started," said Gunnar Hellekson, vice president and general manager, Lightwell, Red Hat.

IBM and Red Hat’s combined capabilities

Lightwell is designed to make the most of the two firms' open source engineering expertise, together with Red Hat’s secure software supply chain capabilities, build infrastructure and open source community relationships.

The project uses AI-assisted engineering workflows, although AI-generated patches aren't automatically distributed to customers but are first tested and validated by humans.

It develops version-specific fixes for open source application dependencies in production systems that are delivered through secured repositories that connect with customers’ existing IT processes.

This, the two firms said, allows organizations to address difficult or previously unknown vulnerabilities without needing to replace their current security scanners, software repositories, development pipelines or testing processes.

Through Lightwell Network, IT teams can access verified patches, bring remediated software into their existing workflows and establish an ongoing process for addressing vulnerabilities.

Broader open source gains

The fixes that are developed through Lightwell are contributed to upstream open source projects under responsible disclosure protocols, said the firms, maintaining embargo protections for Lightwell Clearinghouse participants.

Lightwell Network launched commercially in July, with more than 6,500 patched and digitally signed software dependencies for Java, Python, and other languages. Universities, non-governmental organizations and think tanks were given free access in August, and it's now been made generally available.

"AI agents shifted the threat landscape overnight, exploiting old dependencies at machine speed. They do not care if a codebase is ten years old or otherwise considered stable, because one small crack is all it takes to chain an attack together," said Hellekson.

"Finding those bugs is only half the battle: the real work is backporting fixes directly into active production apps so customers do not have to pick between security and uptime."

FOLLOW US ON SOCIAL MEDIA

Google is expected to introduce full access permissions for Gemini that would allow it to access any file on a macOS device, open apps, browse the web, and perform actions without asking for permission every time.

As spotted by AI news tracker TestingCatalog, the permission has been included in a new "Additional sandbox options" setting.

It allows Gemini to read, create, modify, or delete files residing anywhere on a Mac, including files outside connected folders and even files belonging to other people stored on the device.

Data could be sent and received over the network without approval for each connection, including accessing websites, APIs, and services that the user is logged into.

Notably, it could also communicate with other Mac applications such as Mail, Safari, or Messages, and carry out actions through them without specific permission.

"Gemini will still ask user permission before purchasing products, creating accounts, accepting legal terms, or modifying sensitive information about you," the report reads.

Deeper AI integration

The news highlights the lengths to which vendors will go to gain access to high-quality, up-to-date and unique AI training data, according to Ilia Kolochenko, founder of ImmuniWeb.

"Today, 99% of websites, online archives and web libraries have erected technical barriers to ban AI data scrapers, leaving AI vendors without access to free data,” he said.

“We will almost certainly see all major AI companies following Google and collecting their AI training data via various 'creative' techniques.”

Kolochenko added that access to training data is an “existential question for all Ai vendors,” but most will “probably accept the risk”.

The situation is even riskier for smaller vendors, he noted, many of whom are limited by funds and other resources to procure training data for in-house AI models.

"They form the so-called AI training pools, where hundreds of smaller players submit some data and, in exchange, can use all other data from the pool," he said. "Eventually, once you share your data with a small AI startup, it may end up in thousands of wrong hands around the globe."

Apple's AI security focus

The news comes as Apple tightens up Mac security for AI agents, announcing plans to introduce additional controls that will require Mac users to take "very explicit" action to enable Full Disk Access.

"Some developers are using Full Disk Access in ways that could put users at risk, exposing everything on their systems —including files, mail, messages, and even browsing history —without users’ full knowledge and understanding," said the firm.

"Going forward, we will introduce additional controls to ensure that users who genuinely wish to grant an app this extraordinary level of access can only do so with very explicit user action."

The new Gemini feature hasn't yet been enabled, and it's not clear when Google might plan to do so.

ITPro approached Google for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

AI and software spending is skyrocketing in Europe, and new research warns organizations are failing to curb costs by rationalizing their software bills.

According to analysis from Spendesk, AI spending has risen by 340% in the last year, but finance teams are failing to keep on top of increasingly fragmented and unpredictable spending.

Companies are spending an average of around £213,000 per year on software, while 72% of businesses using AI are paying for two or more competing tools.

All told, Spendesk calculates that almost £6 billion could be saved across Europe by tackling duplicate software.

UK small businesses alone could save almost £399 million by rationalizing their software spend, the company claimed.

Spending volatility

AI-related spending is also highly volatile, according to Spendesk, with six-in-ten of the companies analyzed showing significant month-to-month variations. Bills varied by up to 61% from one month to the next, with peak months for spending costing up to eight times more than low-spending months.

This, the company noted, makes budget forecasting far more difficult and could land some businesses with huge, unexpected bills.

Spending with certain suppliers is growing rapidly, with Anthropic increasing sevenfold in six months, while spending related to Cursor more than doubled.

"We’re entering a new phase of AI in the enterprise. We’ve moved beyond using AI to produce and analyse information; we’re now taking it a step further by entrusting it with part of the work itself," said Axel Demazy, CEO of Spendesk.

“For finance teams, that means moving from controlling every single flow to letting AI take on the tasks it can handle, while flagging only those that genuinely require human intervention."

The perils of software duplication

A key concern for businesses lies in software duplication, according to Spendesk, and it’s often a result of neglect. Average license utilization stands at just 49%, meaning that around half the seats a typical company pays for go unused.

Meanwhile, the same software sold to companies the same size, doesn't cost the same amount twice. Researchers described this as the “scale-up danger zone”, noting that headcount often grows faster than procurement discipline does.

"A company can run 30-plus SaaS tools before it has anyone whose job is negotiating the rate on a single one of them."

Spendesk said that dealing with this requires benchmarking. Indeed, SaaS vendors are notoriously opaque about pricing, and finance teams can't negotiate when they don't know what other companies are paying.

Spend efficiency is also a blind spot, with cost-per-output becoming the metric that separates companies scaling AI profitably from companies just scaling AI spend.

Those that treat AI spend as a strategic input, not a line-item afterthought, will spend the next twelve months pulling ahead of the competition, researchers noted.

"The next step is to connect software and AI spend to business outcomes: the time saved, output generated, customers supported or revenue enabled," advised the firm.

"A tool may be worth keeping even if it overlaps with another, provided its role is clear and its value can be measured. The question is not simply 'what can we cut?' but 'what is this spend helping the business achieve?'”

FOLLOW US ON SOCIAL MEDIA

Google has revealed it will pause its open source bug bounty program, attributing the move to a “significant rise” in AI slop submissions.

In a statement on 1 October, posted both to X and the program brief, the tech giant revealed the pause will be enforced until at least the first quarter of 2027.

“As of October 1 2026, we are no longer accepting product vulnerabilities submitted to the OSS VRP,” the statement reads. “This pause is due to a significant rise in automated submissions, the vast majority of which are not valid.”

Google noted that it still might accept some reports covering product vulnerabilities through Cloud VRP. Similarly, the changes do not affect vulnerability reports submitted before 1 October.

“We will continue to reformat and work on this aspect of the OSS VRP and commit to giving an update in Q1 2027. In the meantime, we encourage you to find impact across our other VRP programs and submit there instead, or pursue the Patch Rewards Program,” the company added.

AI slop submissions are a menace

The move by Google marks the latest in a series of efforts to clamp down on AI slop vulnerability reports in recent years. It’s an issue that has caused repeated issues across the open source community.

As ITPro reported in January this year, a bug bounty program run by Curl was shut down due to an onslaught of AI-generated contributions.

Daniel Stenberg, lead maintainer at the open source data transfer service, said teams were dealing with a torrent of submissions. Indeed, Curl recorded seven AI-generated contributions within just a sixteen hour period.

In an announcement at the time, Stenberg said this was placing a “high load” on security practitioners and the move aimed to “reduce the noise” created by AI-generated submissions.

The scale of AI slop reports across the open source community has reached such an extent that big tech companies have taken drastic action to tackle the issue.

In March, a consortium of companies pledged financial support for Alpha-Omega and the Open Source Security Foundation (OpenSSF), both of which are security initiatives within the Linux Foundation.

That consortium included several industry big-hitters such as Anthropic, Google, Microsoft, GitHub, OpenAI, and AWS. The $12.5 million funding package aims to develop sustainable security solutions and help eliminate slop reports.

At the time, AWS’ Mark Ryland said AI-generated reports were overwhelming open source maintainers and impacting broader security processes.

FOLLOW US ON SOCIAL MEDIA

Businesses face a multitude of risks on a daily basis, from financial and operational to technical, reputational, and strategic. Risk management allows organizations to identify, assess, and mitigate these threats, giving teams the ability to minimize the likelihood they will occur. It also enables them to plan how they will handle them if they arise.

Enterprises typically follow deterministic modeling practices in risk management, which correlate to fixed inputs, single-point estimates, and predefined scenarios. Deterministic risk modelling uses input features to predict a single definite outcome; for example, estimating revenue based on a fixed growth rate or planning a project timeline based on previous projects.

The problem with a deterministic risk model is it ignores changing conditions. Put simply, they’re imperfect. “All models are wrong”, said English statistician George E P Box when sharing model limitations in 1976. Any failure in risk management may lead to unexpected losses, downtime, or even corporate failure.

The real world is fluctuating and dynamic: risks are interdependent, nonlinear, and evolve continuously, where output no longer depends on input values. Enterprises are considering iterative models to handle risks and in model planning, and tend to ignore probability distribution. That’s where probabilistic models come into play.

What is probabilistic programming?

The main function of probabilistic programming languages (PPLs) is to enable statistical modeling.

Most probabilistic programming languages are extensions of general-purpose programming languages with the rand () function and all the necessary tools to perform specialized statistical modeling. Sometimes, probabilistic programming languages can be standalone, for example:

• PRISM extended from B-Prolog
• Hakaru extended from Haskell
• bayesloop extended from Python
• ProBT extended from C++ and Python
• Standalone Church developed at MIT

Probabilistic programming languages are predicated on Bayes' theorem, an iterative process that updates or changes with respect to incoming evidence. The arrival of data at every step pushes the posterior update. This may seem dense, but probabilistic programming will become even more relevant in the coming years, to bridge the gap between outputs from quantum computers and traditional compute architectures.

Use cases in enterprise risk modeling

Based on a deterministic risk management model, enterprises weigh every object or event equally on similar checklists.

Supply chain risk modelling

According to an insight by Gartner, IT decision-makers must incorporate probabilistic approaches to adapt and recover during supply chain disruptions.

Supplier data metrics, such as performance, price justification, and ROI, update the model continuously to predict risks. Some suppliers might be more exposed to geopolitical factors that could disrupt their operations. Other suppliers might continue to operate, although their rate of output could be affected. As a result, enterprise resource planners can assess vendor relationships throughout the year.

Workplace health risk modelling

In factories and chemical industries, where on-site safety is crucial, probabilistic programming can be used for workplace health risk modelling. Enterprises define deterministic threshold levels as part of general analysis but each human is unique and will respond differently. This represents a gap in the data. Probabilistic health and safety management suggests risk concentration and forward-looking liability estimates.

Clinical trial risk modeling: Clinical trials are completed in three phases that cost billions of dollars. Based on historical data, cardiovascular drugs pass around at 12%, while Alzheimer’s drugs incur a high failure rate of 99%. Pharmaceutical companies running probabilistic models can save money by dropping trials when posterior efficacy gets too low.

Financial risk management: Probabilistic credit assessment deduces a credit score as a function of probabilities over a predefined range rather than a single deterministic number. JP Morgan is already using Bayesian inference for robust earnings estimates in financial risk management. Catastrophe and actuarial modeling in insurance markets focuses on updating posterior tables to formulate rates.

Cybersecurity risk modeling: Factor analysis of information risk (FAIR) is a framework that measures security and operational risks as quantitative, enabling enterprises to measure risks in financial terms (numbers). Probabilistic programming can share loss linked to an enterprise asset or process in dollars, rather than a qualitative result for best or worst-case scenarios.

When will probabilistic programming be mainstream?

Probabilistic programming significantly reduces the amount of training data, model development time, computation costs, and power budgets required to produce rich results. Nevertheless, deterministic models are still the most widespread when it comes to risk modelling and planning. Probabilistic programming is starting to make its way into enterprises, as seen by JP Morgan using Bayesian inference in its financial risk models – but the process is slow.

Probabilistic programming is used in research or complex fields due to its computational intensity, slow inference speed, and complex structure. It’s also very difficult to validate and debug such models. This means that, while they may be more dynamic and responsive to real world issues, they could ultimately be more effort to maintain.

Huawei has become the latest enterprise hardware vendor to show off its open source credentials – a trend that’s manifested repeatedly across 2026.

“At Huawei Connect last year, I talked about one of our core strategies: growing open source and open system being Huawei’s clear ecosystem strategy,” said David Wang, Huawei’s current rotating chairman, during his opening keynote at this year’s Connect conference in Shanghai.

“We will focus on open source and open systems talent development, global collaboration and strategic investment.”

A key part of this is CANN. CANN is the company’s chip software, similar to Nvidia CUDA and AMD Rocm. Like the two US chip makers, Huawei is using this to attract open source developers to its Ascend chips.

At the 2025 launch of the program key named partners included PyTorch, Triton, and vLLM. While these have remained, the total number of partners and developers has grown significantly.

“Over the past year, two of our business units have been working with partners and developers to build out our CANN and Ascend industry ecosystems,” Wang said.

“To date, the platform ecosystem has attracted over 4.16 developers and more than 7,200 ecosystem partners all over the world. The community supports over 560 open source projects worldwide [and] over all has seen over 20 million installations securing the largest share in China’s server OS market.”

Linux CEO drives home the message

Following Wang’s statement, one of the most significant players in open source took to the stage: Linux Foundation CEO Jim Zemlin.

Zemlin laid out the evidence for the power of open source in AI, saying: “At every single layer of the agentic AI stack, there's an open source project powering that technology.”

“At the infrastructure layer, Linux and Kubernetes,” he said. “At the training layer, PyTorch is used to train both open and proprietary models. At the inference layer, VLOM [and] Ray are used to serve up those models and even at the agentic layer, we're seeing protocols like MCP, A2A, and other technologies emerge – all open source – that are powering this boom.”

“Even at the model layer, we're seeing an explosion of open weight models. It's an amazing investment. Simply put, the entire AI stack is built on open source,” he added.

When it comes to contributing to open source projects, Zemlin described it as a “non-zero sum game” – that “nobody’s gain requires anyone else’s loss”.

Citing a Harvard Business School paper, Zemlin highlighted what this means from a financial perspective: for every $1 invested in shared code, $2,000 of shared value is returned to those who build on it, he said.

In closing, Zemlin praised Huawei, reflecting that his statement from 2016’s Connect conference that Huawei is “doing the hard work [and] betting on managing shared R&D” holds true.

“Huawei has continued to contribute in the age of agentic AI, and I expect them to continue to do that far into the future,” he said.

FOLLOW US ON SOCIAL MEDIA

Hybrid work has become embedded in how US organizations operate, with 70% of managers believing that working hybrid has made their team more productive, according to our research.

Simultaneously, many organizations are investing heavily in AI initiatives, with the majority (87%) of US employees having already experimented with AI in their work.

Despite the rapid acceleration in AI use across workplaces, many employees still face basic hardware issues: most frequently, meeting room technology that barely works. The most important ritual of modern work, communication, has in turn become fractured, with each attempt to collaborate seeming to bring another glitch or requiring another workaround.

For the organizations battling these frustrations, there is a clear drag on productivity. For the resellers supplying these organizations with technology, the challenges are something far more useful. They represent an opportunity to solve repeated, everyday technical problems that, for many organizations, almost nobody has yet provided an answer for.

The lingering seven-minute problem

Every hybrid meeting tends to start the same way, with someone hunting for the right link or coaxing a reluctant camera into life. US employees lose time per meeting simply getting started. Add that up across various meetings and offices, and organizations start to rack up hours of lost time that could have been spent being productive.

The noise around AI in meeting rooms is also growing louder every quarter, and often for good reason. Used well, AI can make the hybrid experience feel more grounded, more human, and less like a battle with technology. But none of that earns its keep if a call cannot be started easily in the first place. The smartest feature in the world means nothing to someone still staring at an empty screen two minutes in.

This is where a smarter sales story can take shape. Resellers can lead with a simpler promise: rooms that simplify work, every time someone walks in. By standardizing meeting rooms with consistent, certified setups that get meetings going quickly and smoothly, resellers turn a complicated pitch into a clear one, with additional smart features positioned as the upside rather than the headline.

Why consistent kit protects profit

The flip side of unreliable rooms is the support burden, and that is where partner margin quietly disappears. Every mismatched cable and every ad hoc fix raises a ticket and eats into an engineer's afternoon. The customer remembers the room that never works, and more importantly, they remember who supplied it.

This compounds in organizations with a high volume of meetings. When a reseller moves a customer onto consistent, right-sized packages instead of a drawer of assorted equipment, the number of issues drops, and so do the tickets. Fewer surprises in the field mean a predictable cost to serve, which lets the reseller price with confidence and protect margin rather than firefighting it away. It is also how the channel escapes the single-transaction trap, shifting from hardware sold once into a managed relationship that pays over years.

The importance of reliability with channel resellers

Ultimately, there are three priorities that matter more than the rest for resellers. Firstly, they must prioritize reliability first. The room that starts on time delivers more value than any feature bolted onto a room that does not, so the foundation has to come before the finishing touches.

Moreover, insisting on standards-based certification is essential. For example, in one or two rooms, anyone can improvise; across 50 rooms and a dozen sites, improvisation becomes chaos. A kit lets an organization deploy and scale without redesigning each room from scratch, allowing resellers to reassure their customers that what works in one office will work in all of them.

Finally, organizations are desperately looking to close the gap between in-room and remote attendees. If the people dialing in cannot be seen, heard, and treated as equals, hybrid working quietly fails. The rooms that give every participant a fair seat are the ones organizations keep funding, and the resellers who deliver them become trusted advisors rather than box shifters.

The everyday frustrations of hybrid work are not going away on their own. Most organizations have simply accepted them as the cost of working this way, and that acceptance is the gap.

The resellers who win the next few years will not be those with the most customers, nor those selling the most individual pieces of kit. They will be the ones who turn a familiar, repeated annoyance into a standardized offer that customers can buy, scale, and rely on. Resellers who fix the everyday meeting for their customers do more than tidy up the technology. They build the kind of recurring, services-led business the channel has been trying to reach for years.

Apple has launched its long-awaited, privacy-focused Siri AI upgrade, but the new assistant and its dependent features will not be available in the EU or China.

Released on Monday, the reimagined assistant relies on on-device processing and a private cloud system to protect user data, but its global rollout has hit a regulatory roadblock.

Siri AI will "initially" not be available on iOS, iPadOS, and watchOS in the EU, including any features that rely on the software to function, according to Apple. Notably, these restrictions do not include the UK.

Some of the new functionality users will miss out on have been long-awaitied AI updates, powered by the newest generation of Apple Intelligence in partnership with Google, that put Apple in a competitive position among other AI providers like OpenAI.

With its dedicated Siri AI app, which uses iCloud to "privately sync conversational history" across different Apple devices, Apple has created a 'chatbot' experience to rival well-established counterparts such as ChatGPT and Google Gemini.

The company said it's "working hard to find a path forward that preserves its users' privacy and security".

Similarly, the company said Siri AI and other new Apple Intelligence features will also not be available in China while it "works through regulatory requirements".

Apple vs the EU

Although the exact reasons behind this delayed launch to the EU market have not been revealed, signs point to friction between Apple's closed ecosystem interacting with EU mandates.

"The stand-off between Apple and the EU is an ongoing saga that currently shows few signs of being resolved," Ben Wood, Chief Analyst at CCS Insight, told ITPro.

According to Wood, Apple's approach to user privacy currently doesn't comply with EU regulations as parts of its platforms, such as Private Cloud Compute, are completely closed off.

The EU's new AI Act rules, some of which came into force last month, are focusing heavily on AI transparency and visibility.

Apple said that when in use, Private Cloud Compute does not store any data or make it available to anyone, including Apple itself, adding that "outside experts can continue to verify this privacy promise at any time".

"Despite months of lobbying the EU, little progress has been made, and the EU is refusing to flex. This means Apple users in the EU will not get the full benefit of the new Apple Intelligence and Siri AI features for the foreseeable future," Wood added.

Although there is some hope that the two entities can come to an agreement, Apple has also recently announced some important updates to its App Tracking Transparency in the region, which it said is "part of agreements with select European competition authorities".

Users caught in the crossfire

While Apple and the EU lock horns, Wood said it's the consumers who are losing out at the end of the day.

He said the situation is akin to "two parents in an unhappy marriage who are constantly arguing; It's the kids (in this case, Apple iPhone owners) who suffer the most".

EU users will miss out on Siri's new capabilities, which include on-screen awareness, allowing users to ask it to take actions related to content on their screen; improved understanding of images with visual intelligence; and more accurate dictation.

This will be in addition to improved capabilities across everyday apps, with Apple stating that the new Siri "helps users get more done than ever before".

Wood said he'll be interested to see how public sentiment towards the delayed launch becomes affected as "at present, neither Apple nor the EU will back down".

"Consumers will either vent their frustration towards the politicians, Apple, or both. I suspect it's the politicians who will get the most heat initially," he added.

Dreamforce 2026 ended with a resounding bang in San Francisco, with the Dreamfest concert welcoming Usher and Gwen Stefani to Oracle Park for a blockbuster show.

Indeed, the event topped off a week in which Salesforce spared no expense touting a sweet escape from the traditional user interface customers have relied on for years.

The big talking point from the annual conference centered around the launch of AIforce, which the company describes as a new "live interface layer" designed specifically for the agentic AI era.

If you're wondering exactly what that means, you're not alone. Admittedly, I left the opening keynote with more questions than answers. Yet over the course of the week and deeper dives in subsequent keynote sessions, the aim becomes quite clear.

Historically, users have accessed the Salesforce platform through a traditional interface such as a web browser or application. That not only limited who could use Salesforce, but also how much information they could access at any one time.

Thousands of enterprises host their most valuable data across their ecosystem. From CRM records and unstructured data to a myriad of documents and assorted metadata, it's a veritable gold mine.

But accessing those various data sources and workflows meant traversing an array of different dashboards and interfaces. That can be a laborious task, and it creates blind spots for users and prevents them from unlocking value from this data.

Salesforce repeatedly used the term "trapped value" across the event, highlighting the impact this has on enterprises, particularly amidst a period of rapid agentic AI adoption.

Opening up for agents

Salesforce seems determined to ensure that agents are front and center moving forward. Building on two years of development on this front, beginning with Agentforce.

With AIforce, the aim here is to simplify access for agents, allowing them to plug into the data, workflows, and business logic hosted on the platform. That not only gives agents a direct line to business data, but also removes the need for users to even log into the platform. Agents from Claude or OpenAI can be used to access data, while Slack also gives users a mainline.

This clearly builds on the company's Headless 360 service, which "exposes" databases to agents through APIs, command-line interfaces (CLIs), and model context protocol (MCP) tools.

Unveiled in April, this marked the first big push toward a Salesforce without a traditional UI. With AIforce, the company wants enterprises to finally "break free".

At the time, co-founder Parker Harris pondered, "Why should you ever log into Salesforce again? Maybe you never will."

On this, he was clearly correct. Exactly how many enterprises are comfortable giving agents a direct line to mission-critical data is up for debate, though. "Trust" ranked among the most used terms throughout the keynote and subsequent sessions, and it's obvious the company is keen to calm lingering concerns on this front.

Historically, Salesforce has put its money where its mouth is in this regard, but I suspect this latest push isn't entirely about improving ease of use for customers.

Salesforce is insulating itself

The move here comes at a critical time for Salesforce and the software industry at large. While Marc Benioff shrugged off claims of a looming 'SaaSpocalypse' during his opening keynote, there's no denying that AI is having a marked impact on the SaaS space.

Research from Gartner earlier this year noted that agentic AI will break the traditional SaaS model, urging providers to ditch "legacy dashboards".

The firm projected that up to $234 billion of application spending will be exposed to "agentic arbitrage" by 2030. This is a process whereby agents render services obsolete by removing the need to work through traditional user interfaces. Sound familiar?

While Benioff thinks the SaaSpocalypse is "nonsense", it appears that Salesforce is insulating itself from future market shocks such as those witnessed earlier in 2026.

When Anthropic unveiled Claude Cowork in January, it sent software stocks into meltdown amidst concerns it was muscling in on software providers. The CRM giant was caught up in this, with share prices plunging 40% in the first half of 2026.

I suspect this was a wake-up call for Salesforce and prompted a rethink on how it can remain relevant in an era where highly aggressive AI developers are keen to tap into any possible revenue streams.

As I noted ahead of the conference, Salesforce appears to have an "if you can't beat them, join them" mindset right now. The Claudeforce launch earlier this month and now the arrival of AIforce are a testament to that.

The OpenSSF Governing Board has called for more support from enterprises that rely heavily on public registries, saying the current funding model is no longer sustainable.

In a pledge signed by organizations including GitHub, Google, IBM, Microsoft, and Sonatype, it said that package registries are facing growing operational and financial pressures, including rising infrastructure costs and a need for more investment to strengthen security and improve the developer experience.

"Public package registries are critical infrastructure for the global software supply chain. Every organization that builds software depends on them, yet these registries face growing demands for security, reliability, compliance, and developer experience," the firms said.

"We have a stake in changing this. Registries cannot deliver the scale, availability, security, and observability enterprises need without sustainable funding."

Public registries including PyPI, Maven Central, crates.io, RubyGems, npm, and NuGet now serve trillions of downloads each year, with download volumes growing by between 30% and 50% per year.

So far this year, 1.8 million malicious packages have been discovered, and, said OpenSSF, AI-discovered vulnerabilities are expected to cause a three-to-fivefold increase in publish events, as more package versions and updates are pushed to public registries.

However, as things stand, many registries still rely heavily on donated infrastructure credits and small teams of just two to three people. They can no longer deliver the scale, availability, security, and observability enterprises need without sustainable funding.

And, as a result, there's increasing potential for outages, slower threat response, and weaker visibility across the software supply chain.

However, with predictable, recurring revenue, said OpenSSF, registries could deliver reliable publication, discovery, and distribution services with monitoring, alerting, and operational support that minimizes downtime.

They could offer dedicated support channels, private or peered access for high-volume consumers and caching and distribution optimizations for high-demand packages.

They could also offer advanced analytics on publishing and consumption patterns, ecosystem-level insights that individual organizations can't gather on their own, compliance and policy controls and audit trails.

And security and compliance could be significantly improved, with artifact signing, trusted publishing, malware scanning and quarantine, build provenance attestations, SBOM and VEX generation, threat detection and incident response SLAs.

"These are the kinds of capabilities registries can deliver when they have the resources to operate beyond survival mode," said OpenSSF.

"Sustainable funding models unlock them for the entire ecosystem, including the individual developers and small organizations who will continue to access registries for free."

The new model – which OpenSSF said doesn't commit individual registries to specific pricing, terms, or tiers – targets enterprise commercial customers, rather than the broader developer community.

"Every organization that builds software depends on package registries. We invite enterprise consumers across the industry to engage with the registries they rely on, understand their sustainability needs, and be prepared to participate in funding models that keep this infrastructure strong," it said.

"Sustainable registries are more secure, reliable, and observable. Supporting them strengthens the open source ecosystem for enterprises, maintainers, developers, and users alike."

FOLLOW US ON SOCIAL MEDIA

2026 has been dominated by claims of a looming ‘SaaSpocalypse’, with AI heralding the doom of software as we know it. Marc Benioff and Jensen Huang aren’t convinced.

During the opening day keynote at Dreamforce 2026, the Nvidia and Salesforce CEOs dismissed the prospect of SaaS dying off.

Concerns on this front mounted earlier this the year with the launch of Anthropic's Claude Cowork. The new service, which offered enterprises agents equipped with sector-specific capabilities, prompted a mass sell-off of software stocks

In early February, the S&P 500 software software and services index slipped by nearly 5%, losing $830 billion in market value in a matter of days.

Huang told Benioff that even amidst growing industry concerns, he wasn’t fully convinced. AI might have an impact on the software industry, but more in the sense that it will complement and redefine SaaS.

“I was the first CEO to come out - not in the software industry - to say the end of software is nonsense,” he said. “This is going to be a layer on top of software. This new layer on top of software is going to be agentic.”

“It’s going to make software so much better.”

Huang’s comments came after Benioff reflected on the state of the software industry earlier in the keynote, describing claims this year as “crazy nonsense”.

“We've been hearing all this kind of crazy nonsense about the SaaSpocalypse, especially over the last six months,” he told attendees. Similar to Huang’s outlook on this front, Benioff noted that AI will ultimately be a net positive for the software industry and users.

“We realize that the SaaSpocalypse isn’t about the end of software, but it may be about the end of software that makes humans do all the work,” he said.

Salesforce’s earnings on this front, Benioff said, are testament to the fact that it’s weathered this storm so far. The CRM giant’s Q2 earnings, released in August, marked its best performance on Wall Street since 2020 and among the best in the company’s history.

Revenue in areas such as Agentforce and Data 360, for example, reached nearly $3.9 billion, marking a 210% increase year-over-year.

SaaS isn't dying, but it's still changing

Huang and Benioff join a host of tech industry leaders to shrug off claims that AI will render SaaS obsolete. As ITPro reported in February this year, AWS CEO Matt Garman said “much of the fear is overblown” but admitted that the technology will prompt huge changes in the industry.

The arrival of AI, particularly agentic AI, will change how software is built and consumed, he said at the time. That means existing providers will face a more competitive business landscape and force them to work harder to secure – and maintain – market share.

Research from Gartner in late June highlighted this new reality for software providers. Agentic AI does pose a threat to traditional software revenue models, according to the consultancy, with up to $234 billion of application spending exposed to “agentic arbitrage”.

This is a process whereby agents render some services obsolete and removes the need to work across multiple interfaces. Salesforce, it seems, is ahead of the curve on this front.

The company unveiled AIforce ahead of Dreamforce. This is a new ‘live interface layer’ that sits on top of its core product ranges, such as Agentforce, Data 360, and Customer 360.

Put simply, AIforce means users can use Salesforce without actually accessing the platform through traditional dashboard routes. Instead, users can access services, data sources, and information through agents such as Anthropic's Claude with their own custom-built UIs.

FOLLOW US ON SOCIAL MEDIA

Microsoft has become the latest big tech firm to weigh in on the dangers of AI, with a new Humanist Code of Conduct that's up for public consultation.

The document sets out the principles on which the company plans to train its models, saying it's motivated by a single overriding objective: that humans must retain meaningful control over AI.

The principles it outlines are not yet being used to train Microsoft's models, with the company saying it wants to gather feedback through a public consultation. It will then publish a revised version of the code towards the end of this year, which will be used to guide model development in 2027 and beyond.

"The recent safety incidents of large scale, highly coordinated, and persistent hacking campaigns of AI agents prove that there's no time to waste. The stakes are high and only getting higher," said the firm.

"We believe it is more important than ever to create safe and reliable AI in service of people, and to be transparent about how we go about it."

The document prohibits AI models from certain behaviours: they mustn't help with chemical, biological, radiological or nuclear weapons, generate violent or sexually explicit content or carry out offensive cyber operations.

They must not try to evade human oversight, engage in large-scale manipulation or make claims to consciousness, feelings or legal personhood.

"Whilst the science of AI consciousness is far from settled, we believe that training these systems to imitate consciousness-like states increases the challenge of containment, control, and alignment," Microsoft said.

The company said it's already consulted with experts in AI, law, ethics, philosophy, linguistics, and public policy, as well as business leaders from across industry, and has also held a series of focus groups with members of the public.

However, it's calling for more public input into the code of conduct, with a six-week consultation now open.

"We are especially interested in the hard parts: how can we better cement the right values in our models? How to be more concrete about the meaning of 'human flourishing'? Where is the language too loose to evaluate? How do multi-agent scenarios impact things?" it said.

"And perhaps most importantly of all, how do we continue to accelerate progress, whilst also ensuring we maintain healthy and necessary safety constraints?"

The release of the code of conduct follows a surge of concern over AI safety, including the resignation of Anthropic researcher Jacob Coxon. AI could, he said, lead to the extinction of the human race if more controls aren't put in place.

Anthropic's Dario Amodei has weighed in with a call to slow down AI development, as has OpenAI's Sam Altman – but not Donald Trump, who has described such concerns as 'a hoax'.

"AI's opportunity to deliver transformational benefits for humanity is real. And yet, if mismanaged, it will also pose grave dangers, including new and as-yet poorly understood frontier risks," Microsoft said.

"Models, and the process by which they are developed, deserve public scrutiny and engagement."

FOLLOW US ON SOCIAL MEDIA

If you're having trouble with copy and paste in Excel, you're not doing it wrong; it's simply been disabled by Microsoft's latest Patch Tuesday update.

Unfortunately, it's going to be like that for some time, as there isn't a fix, at the time of writing.

Patch Tuesday is a monthly update from Microsoft where it fixes and updates various parts of its software. Much of it focuses on Windows security and improvements to its suite of applications.

However, these fixes sometimes cause problems elsewhere. Case in point: the latest security patch for Excel has taken down the copy-paste function. Users first reported issues with Excel 2016 after the update, known as KB5002914, was installed. Soon after, users reported the issue in other versions of Excel, and Microsoft has acknowledged it and said it is working on a fix.

Under 'known issues', Microsoft posted: "In Microsoft Excel 2024, 2021, 2019, and 2016, the paste operation might fail silently. Although users try to paste content, the source remains selected, and the destination is unmodified. When this issue occurs, users receive no indication of the failure, such as a beep or error message. Microsoft is researching the issue and will post more information in this article when the information becomes available."

Bugs and issues are expected when updating a sprawling software stack like Microsoft's, and the company's Patch Tuesday releases have been known to come with some downsides. In May, bugs where images would not display inside mail were reported, and in June, the main email messages were hidden. Both were a result of monthly updates.

Thankfully, Microsoft has spotted and acknowledged this issue introduced by KB5002914. Unfortunately, it has yet to come back with a fix, so there isn't anything you can do except painstakingly type out everything in Excel.

Enterprise software has never been especially simple to buy, but the commercial side is becoming harder to untangle. AI features can introduce new consumption charges and vendor-specific pricing metrics, while expanding software suites make it harder to isolate the cost and value of individual capabilities.

To understand how the buying process is changing, ITPro spoke to Haritha Khandabattu, VP Analyst at Gartner, Mickey North Rizza, Group VP for Enterprise Software at IDC, and Faram Medhora, Principal Analyst at Forrester.

All three describe a market in which the relationship between licence counts and eventual spend is becoming less predictable. IT leaders now have more to work out before they can judge whether a deal will still make sense once the software is in use.

The unit of software is changing

For many seat-based enterprise products, the basic maths was relatively easy to follow: multiplying the number of users by the licence price gave buyers a reasonable estimate of spend across the contract term.

AI consumption models make that calculation trickier.

Khandabattu says pricing has shifted towards vendor-specific units such as tokens, credits, work units, and currency multipliers, often layered on top of existing seat or subscription charges; those units rarely translate neatly between suppliers. “One vendor’s token isn’t another’s, credits get repriced, and metrics get renamed mid-contract,” she says.

Consumption pricing also weakens the traditional relationship between user numbers and software spend, according to Khandabattu. A single AI agent can trigger chains of API calls and other metered activity, with usage varying considerably according to the task.

“A seat is a budget line; an agent is a behavior pattern,” Medhora says. “If buyers do not model the behavior pattern, they have not modeled the cost.”

Procurement teams can enter negotiations with little production data on how heavily an AI service will actually be used. Forecasting lifetime spend becomes much harder when they have yet to see that consumption at scale.

Something as simple as a misconfigured agent could burn through many more tokens than procurement teams were expecting, and stopping agents in the act is difficult.

It’s becoming harder to know what you’re actually buying

Pricing is only part of the problem. AI capabilities are being added to software that businesses already use, and organizations are consolidating more functions into larger software suites. Procurement teams need a clear picture of what a new feature adds before paying for another licence or upgrading an existing one.

Medhora suggests judging AI add-ons by the business outcome they produce, including whether they measurably improve an existing process or provide something the current software estate cannot. “If the answer is only a better-looking prompt box, it is not a value case; it is a packaging exercise,” he says.

The same capability may already exist elsewhere in a sprawling software estate.

North Rizza points to the continued accumulation of tools across organizations, often without a complete view of which products are being used or where their functions overlap.

IDC’s research also shows businesses consolidating around larger software suites, which can reduce the number of separate vendors while leaving individual capabilities inside those bundles harder to price and track.

North Rizza highlights moves from perpetual licences towards subscription bundles and AI capabilities folded into renewals. She also points to the importance of preserving portability and exit rights when software is acquired through a wider services contract.

Buyers also need to consider how the product might be repackaged or renewed, and what replacing it would involve if the commercial terms change.

Procurement has to adapt to uncertainty

Khandabattu recommends setting an internal measure of value before comparing vendors, then translating each supplier's pricing units into it. For example, a token, credit, message, or seat can then be expressed as a cost per support ticket resolved, invoice processed, or another meaningful business outcome.

Khandabattu distinguishes that internal benchmark from vendor-defined outcome pricing, which she says remains immature and can tie buyers to measures whose value is difficult to establish.

She also advises buyers to test representative workloads rather than relying on vendor calculators. Running production-like tasks can expose how quickly consumption builds up, including cases where what looks like a single action triggers several separately metered steps.

Modelling that usage over two or three years gives procurement teams a firmer basis for comparing suppliers. Khandabattu also recommends looking at fully loaded costs, including integration, governance, and human oversight, rather than the metered charge alone.

North Rizza puts estate rationalisation ahead of another purchase or renewal. IT teams should first identify what is already deployed and where functionality overlaps, a process that can also reveal products that can be retired or replaced.

IDC also recommends treating AI cost governance as an ongoing responsibility shared across IT, finance, engineering, and FinOps rather than a one-off procurement exercise.

Contract negotiations need to account for that uncertainty as well.

Khandabattu recommends defining billing units clearly in the contract and pushing for protections against unilateral changes to pricing metrics, alongside measures such as credit rollover where appropriate.

North Rizza points to modular licensing, meaningful evaluation periods, portability, and exit rights as ways to reduce exposure if usage or vendor strategy changes after deployment. “Don’t wait for pricing models to settle down – build your forecasting discipline now, because the volatility is the new normal, not a transition phase,” North Rizza says.

Medhora says procurement teams should put greater weight on metering rights and usage visibility, while modelling different commercial scenarios and preserving leverage if they need to exit.

Keeping control after the contract is signed

The buying process increasingly extends through the life of the contract.

IT leaders need to see how costs develop in production and whether the promised benefits survive real-world use. They also need enough visibility to identify capabilities that are no longer worth paying for.

A large discount at signing offers limited protection if usage is opaque or the contract is difficult to unwind; a better deal gives the buyer enough visibility to keep measuring value, with room to change course if costs move beyond the original business case.

Atlassian is upgrading its AI coding agents with new capabilities across Jira, Confluence, and DX.

The updates include the extension of Code Context to ground agents in multi-repo codebases, Agentic loops in Jira to convert Jira backlogs into pull requests, and DX for Agentic Development to measure AI delivery impact.

The aim is to help engineering organizations adopt and scale agentic workflows across the AI software development lifecycle by connecting agent context, execution, governance, and measurement in the systems where teams are already planning and delivering work.

“The biggest bottleneck in AI software engineering isn't model intelligence, it's organizational context,” said Taroon Mandhana, Atlassian CTO, AI & Teamwork.

“Enterprises need more than isolated sessions and one-off prompts. Jira has long been the system of record for how teams work. By extending that foundation to orchestrate agents alongside engineers, we’re giving teams a safe, measurable way to scale agentic workflows across the SDLC.”

Atlassian eyes deeper context

First up is the introduction of Code Context, built on Atlassian’s Teamwork Graph and giving Rovo and coding agents secure intelligence across multi-repository codebases.

This, Atlassian said, enables more accurate results across the entire lifecycle, from vetting backlog ideas for architectural feasibility and generating code-aware implementation plans to accelerating bug triage and root-cause discovery.

Agent Context Controls, meanwhile, let platform teams govern which agents can operate in a space and exactly what they’re allowed to see.

Also new is the introduction of agentic loops in Jira to convert Jira backlogs into pull requests, by continuously scanning for well-defined, unassigned work items, delegating them to Jira Coding Agent for execution and testing, and opening ready-to-review PRs directly in Jira.

Standards enables platform teams to define organizational coding standards once and map them to repositories, creating consistent guardrails for code quality, and AI review uses a dedicated agent to review pull requests against organizational standards, flagging issues before code ships.

Meanwhile, Atlassian claimed engineering organizations need automation, auditing, and measurement built into their systems if they're to be able to make agentic work accountable and measurable.

DX for Agentic Development measures AI impact across throughput, quality, adoption, and cost, mapping total AI investment directly to engineering outputs. It includes AI Code Insights, tool and MCP tracking, model-to-task fit, and academic-validated Agent Experience (AX) research.

Keeping tabs on agents

Finally, Jira Agent Usage Dashboard is designed to help team leaders understand which agents are used in their workflows, correlate agent sessions to Jira work, and improve team delivery velocity with agents.

"This is what takes governed agent loops from an experiment to something you can put in front of your board," said the firm.

Code Context is being gradually rolled out to paid Atlassian customers through open beta, while Agent loops, Standards, and AI Review are already available in private early access.

Agent Context Controls and Agent Usage Dashboard will be generally available to paid Jira customers in the coming months, said the firm, and DX for Agentic Development will be generally available for Atlassian DX customers this quarter.

FOLLOW US ON SOCIAL MEDIA

Agentic AI adoption is surging in software engineering, but new research shows security is still a persistent issue for teams.

Analysis from Harness shows 87% of engineering teams have experienced an “agent-related security event” over the last year.

Harness said a key factor behind this lies in a lack of visibility and controls, while overconfidence is creating an environment where engineers overlook potentially dangerous actions.

More than three-quarters (77%) of respondents said they are confident they have a complete inventory of every agent, MCP server, and LLM in their environment, yet fewer than half (44%) are able to verify this.

Crucially, 75% said they are confident that their agents are secure “end to end”, but respondents in this group had security incidents at nearly the same rate as those who weren’t.

Confidence in agent security has almost no relationship to actual resilience. 75% say their agents are secure end to end, but that group had security incidents at almost the same rate (88%) as the overall respondent population (87%).

Keith Mann, Field CTO and Head of Research at Harness, said these findings bear similarities to security-related issues during the early days of mobile and cloud development.

Both of these trends “went through a phase where confidence outran governance,” he said. Reaching a point of maturity in terms of governance and security took time, and that same process is unfolding in agentic development.

“Eventually the controls caught up because the underlying systems stayed predictable once you built the guardrail,” he added.

Mann noted that agents create a new risk layer for engineering teams, however, especially in terms of visibility and verification.

“Agents don't hold still in the same way. A control that worked in testing can still miss something in production because an agent doesn’t behave the same way every time,” he said.

“That's why closing this gap takes real verification. Organizations need to test whether a control actually holds up against an agent's variability, not assume it does because the control exists.”

Nipping problems in the bud

Harness warned that a concerning number of engineering teams aren’t prepared for agent-related security issues when they arise.

While 74% are confident that testing could catch a “production-impacting failure”, only 19% have a ‘gate’ in place to prevent this.

A gate is essentially a checkpoint in the software development lifecycle that blocks potentially flawed code from advancing until it meets the necessary criteria.

Similarly, in the event that something does go wrong, most couldn’t react quickly enough. More than three-quarters (76%) believe they could “disable a misbehaving agent” in under 15 minutes.

Only around one-third have a kill switch in place to rapidly shut down agents, however.

With enterprises scaling the use of agents in engineering, Harness warned that incidents will likely continue to climb. More than half (58%) have already reported an increase in production-related incidents since deploying agents, the study noted.

"The truths we found in the report are the same ones we're hearing in daily conversations with customers," said Trevor Stuart, SVP and General Manager at Harness.

"Teams moved fast to build and release agents, and are now circling back to ask how to actually govern what they've already shipped. The teams furthest ahead have already adopted a governed orchestration engine for agent changes, instead of waiting for an incident to force the question."

FOLLOW US ON SOCIAL MEDIA

Technical failures during meetings hampering productivity, according to new research, yet organizations are failing to address the issue.

More than seven-in-ten IT leaders told Logitech that employees experienced technology issues such as failed audio or connection drops, with 30% saying they experienced them often or very often.

Researchers noted that these glitches have created at least one business cost for 94% of survey respondents, with 51% citing a loss of productivity. They slow meetings, create a support burden, interrupt collaboration, and create employee distrust.

"Leaders believe a strong workplace experience delivers outcomes such as improved collaboration and productivity. However, technology issues, inconsistent setups, and poor support create friction," the researchers said.

"We are in the middle of a monumental evolution in how we work, and the spaces that work today may not be the ones we need tomorrow. Employees want to be productive wherever they are, across every setting, remote, on-site, or split between, and those expectations keep moving."

But while leaders recognized the direct impact of workplace experience on productivity and collaboration, they said that siloed decision-making and delayed IT involvement are leading to widespread friction, lost time, and heightened security risks.

Although 86% linked strong workplace experience directly to improved productivity, and 90% to collaboration, only 58% felt confident they possessed the right ROI data to justify workplace experience and technology investments. Only 29% said they treated workplace experience as a core business strategy.

Workplace experience boosts productivity

Logitech also highlighted a gap between priorities and execution, with 87% saying collaboration between IT, HR, and real estate or facilities is very or extremely important for improving workplace experience.

Despite this, only 34% say their organization has a unified WX function that owns a shared roadmap for workplace investment decisions.

"When everyone owns a piece, no one owns the problem. With fragmented WX ownership, issues inevitably fall through the cracks. The friction impacts both workplace flow and the teams architecting the experience," the researchers said.

"Architecting the workplace for elevated experiences requires proactive planning. Yet, only one-in-four WX leaders involve IT and AV before space planning begins. That means most organizations design the office before thinking about the technology that has to support the people working in it."

Investing in workplace technology

Logitech said good planning means connecting workplace investments to measurable outcomes. This includes building a friction map to identify where employees lose time, such as starting a meeting, audio/video, room booking, device connection, space availability, meeting equity, or complex setups.

IT, HR, and real estate should come together early, with cross-functional teams sharing metrics before space planning begins. Workspaces should support both in-person and remote participants without requiring employees to troubleshoot the experience.

Ticket volumes, device performance, and delays to the start of meetings should be measured alongside standard employee experience metrics, and sensor and sentiment data should be combined to prove ROI and continuously adapt as business and employee demands continue to shift.

FOLLOW US ON SOCIAL MEDIA

The Swiss government is running a trial of OpenDesk as part of efforts to reduce reliance on Microsoft software.

OpenDesk will be trialled for a small tranche of workers who focus on business critical functions. The move comes amid wider digital sovereignty efforts across Europe.

France, for example, has started to shift away from US software for government purposes while one German state has switched four out of five administration computers away from Microsoft.

The Swiss government said it plans to shift office computing to open source software, following a feasibility study that suggested the move should be possible.

With OpenDesk, the aim is to switch 3,000 government employees by the end of next year for core office functions, effectively a trial to see if shifting away from Microsoft is sensible and to estimate the cost of a large-scale implementation.

These core functions include email, calendar, documents, presentations, video conferencing, and telephony. The standalone solution will operate alongside Microsoft 365, targeting employees who are responsible for critical business processes.

That's because the aim is to not only strengthen the digital sovereignty of the federal administration, according to a translated press release, though that is a "central theme" of the government's digital strategy.

Beyond that, Swiss authorities hope to boost crisis resilience, ensuring the government can continue operating even if Microsoft goes down.

The idea of digital sovereignty as a means to boost resilience gained credence following the US temporarily banning exports of key Anthropic models earlier this year, as well as the massive Crowdstrike outage in 2024.

In the UK, authorities have warned about the impact of phishing attacks on food supply following outages at major retailers last year.

Challenging proposition

The initial solution tested in the feasibility study was found sufficient to maintain standard core processes and could prove useful in an emergency such as a Microsoft Office 365 outage, the government noted.

However, the feasibility study also spotted limitations, in particular around video conferencing, saying that significant adaptations and security work would be required.

Indeed, the many apps tied to Microsoft's architecture present a significant challenge to shifting the entire federal government to open source alternatives, so a wider shift depends on the results of the trial.

But the Swiss government has partnered with the German state of Schleswig-Holstein, which has shifted much of its workstations to OpenDesk. The 3,000 workstations make up about 7% of the Swiss federal administration's employees.

What is OpenDesk?

OpenDesk is owned by the German Center for Digital Sovereignty, and offers workspace tools via a web browser, including documents, email, project management and identity management.

The government stressed the point of the study was not to replace Microsoft 365, nor does the OpenDesk platform need to replicate or integrate with all of the Microsoft 365 features.

The shift is long awaited: the feasibility report was finished last year, and reports from April suggested the government had decided to slowly reduce its dependence on Microsoft.

This move was, at least in part, driven by an incident in which the foreign affairs department stored classified documents on a Microsoft Cloud, meaning American authorities could potentially view the information.

In July, the Swiss Armed Forces said it would replace Microsoft Office 365 with OpenDesk by this October for its cybersecurity workers.

Over the last two years, Microsoft has worked to reassure governments in Europe that data is safe, pointing to locally stored private cloud as an option as well as European data centers that keep data away from the US via its EU Data Boundary — and the tech giant has invested significantly in Swiss data centers, too.

FOLLOW US ON SOCIAL MEDIA

The cybersecurity industry is awash with products.

Every time a new attack technique is discovered, vendors will rush to develop a product to address the challenge.

Whether it be malware prevention, privileged access management, next-generation firewalls, or email security platforms, the industry is flooded with platforms promising to improve defences and make it harder for attackers to infiltrate systems.

But in reality, this has made security very noisy.

Instead of improving security, the volume of tools organisations must manage has actually amplified risks.

There are too many alerts coming in to understand and identify threats quickly. Too many platforms to manage, which overburdens resources and amplifies costs, and too many interfaces to navigate, which makes managing security far from seamless.

Overall, while the objective of the platforms is to strengthen security, the products can actually jeopardise it.

However, these problems are significantly worse when it comes to Managed Service Providers (MSPs).

Tool sprawl in the channel

Consider an MSP delivering security services to 50 customers.

One customer may use Microsoft security technologies, another CrowdStrike, while others could have different SIEM, vulnerability management, ticketing, and endpoint security platforms.

However, the MSP is often forced to operate them all.

All simultaneously, and all expertly, knowing the capabilities of each platform and how to operate them.

The MSP must maintain the knowledge, processes, and integrations required to operate across all of the platforms they manage for their clients. However, not only does this create resourcing challenges it also amplifies costs.

There is the cost of purchasing each platform that clients depend on, plus there is the cost of employees to manage the platforms.

Furthermore, with MSP staff continually navigating between platform interfaces, this wastes valuable time, reduces productivity, and can make managing security for clients more cumbersome.

Individually, these delays can appear insignificant. However, across hundreds or thousands of incidents, tickets, and customer interactions, they quickly accumulate.

Plus, as an MSP grows its customer base, the challenges can become even harder to manage.

When growth introduces more complexity

Every business wants to grow its customer base, but for an MSP this can also mean introducing more tools into their environments.

If every new customer introduces another combination of technologies, integrations and processes, onboarding customers also introduces additional operational complexity.

Providers can find themselves in a position where growing the business requires continually adding more people to manage the additional workload.

This has obvious implications for margins, but it can also put pressure on existing teams.

Skilled cyber security professionals are already difficult and expensive to recruit. Using their time to perform repetitive administrative tasks or manually move between disconnected platforms is neither efficient nor sustainable.

Ultimately, the channel therefore needs to look beyond simply adding more technology and consider how existing technologies are operated.

There will always be customers that want or need different technologies. Channel providers therefore need to find ways to embrace this diversity without allowing it to dictate how efficiently they operate.

But how can this be achieved?

The importance of technology-agnostic platforms

One of the best ways to overcome this challenge is by working with partners that deliver technology-agnostic platforms that simplify the management of security for MSPs.

These platforms can seamlessly integrate with the security platforms MSPs rely on for their customers, but they can be managed via a single dashboard.

This allows an MSP to more efficiently manage security, but without having to navigate across multiple platforms.

These platforms can deliver everything a partner needs to track, monitor, and manage the security of their customers, without overburdening resources or amplifying costs.

Instead, everything can be managed via a single unified platform, reducing complexity and cutting out the chaos of managing multiple solutions.

A technology-agnostic platform doesn't replace customer investments; it provides a common operational layer across them.

Analysts can investigate incidents, automate workflows, manage tickets, and monitor security posture from one interface while still supporting whichever technologies each customer has chosen.

The channel doesn't need fewer security technologies; it needs a better way to operate them.

MSPs that standardize their operations across diverse customer environments will reduce costs, improve analyst productivity, and deliver a more consistent service.

In an increasingly competitive market, operational efficiency isn't just an internal advantage; ultimately, it's a differentiator that leads to better security outcomes for customers and healthier margins for MSPs.

Thousands of Microsoft 365 customers worldwide are still affected by a lengthy outage but the tech giant says a fix is on its way.

Reports of an outage affecting Outlook first emerged on Monday 31 August, with Downdetector flagging a surge in issues at around 3pm UST. Issues with other applications also spiked around that time.

Microsoft has since confirmed the outage with a Service Health Status report, attributing the outage to a “core authentication configuration used by multiple Microsoft 365 services”.

Services impacted in the outage include:

• Microsoft 365 Copilot
• OneDrive for Business
• SharePoint Online
• Exchange Online
• Microsoft Teams
• Microsoft Purview
• Microsoft Defender XDR

What Microsoft 365 users have encountered

Microsoft highlighted a series of potential problems users may experience due to the outage, such as their Copilot prompts failing.

OneDrive and SharePoint Online users, in particular, have been dealing with acute problems since the outage began. Some have reported being unable to load or refresh both applications, according to Microsoft, while others have been unable to access search results and content.

“Some users may also experience delayed or failed file opening, Office policy-label retrieval, OneDrive synchronization, mobile camera upload, and video playback,” Microsoft noted.

Microsoft Teams users have also experienced issues with calendar functionality and search features.

A fix is underway

In the most recent status update issued at the time of publication, Microsoft said it has applied a fix to the affected authentication component. The company noted that services are beginning to recover but this could still take some time.

“Service telemetry continues to indicate recovery, with availability increasing across previously impacted scenarios as remediation progresses,” the company said.

“We’re validating that authentication, connectivity and search operations are returning to expected service levels while monitoring for any residual impact and confirming that the remediation is delivering broad mitigation across affected Exchange Online scenarios.”

FOLLOW US ON SOCIAL MEDIA

Apple has unveiled new Mac Mini and Mac Studio models, boasting an “extraordinary leap in performance and AI capabilities”.

The new devices wil be equipped with Apple’s M6 and M5 Ultra chips, the latter of which is described as its most powerful to date.

“Today we’re debuting the next giant leap in performance and AI compute for Apple silicon with the incredibly advanced M6 and the most powerful M-series chip yet,” M5 Ultra,” said Sri Santhanam, Apple’s vice president of Silicon Engineering Group.

The move by Apple comes amidst a sharpened focus on local, on-device AI capabilities for developers globally. The Mac Mini, for example, has emerged as a go-to option on this front, enabling users to run agentic workflows locally.

Santhanam said the new Mac Studio M5 Ultra, for example, will provide the “ultimate desktop performance and the ability to run massive AI models” on the device.

Under the hood of the M6 Mac Mini

The new Mac Mini will feature Apple’s M6 chip, which is built using a 2-nanometer process. This will boast a 12-core GPU, two more than the M5, along with a neural accelerator in each core.

Using this design, Apple said this will deliver a near 30% increase in GPU performance for AI compared to the M5, and more than eight-times compared to the M1.

“The super cores blaze through single-threaded workloads, the performance cores use less power and join the super cores to run demanding multithreaded workloads, and the efficiency cores handle everyday background tasks — all with industry-leading performance per watt,” Apple said in a blog post.

Elsewhere, the Mac Mini M6 will support up to 32GB of unified memory, along with 170GB/s of unified memory bandwidth. The firm said this marks a 10% increase over the M5 and will help users run LLMs on the device more efficiently.

The M5 Pro Mac Mini

Alongside the new M6 range, Apple also unveiled the Mac Mini equipped with an M5 Pro chip. This will boast a CPU ranging up to 18-cores alongside a 20-core GPU, and is catered specifically for complex tasks such as 3D design, VFX, and game development.

The device also supports up to 64GB of unified memory, alongside 307GB/s of unified memory bandwidth. Once again, Apple touted the device's capabilities in terms of local AI orchestration.

"With industry-leading performance per watt, Mac mini with M5 Pro is quiet, efficient, and ideal as an always-on desktop for AI agents or creative workflows," the company said in a blog post.

What to expect with the M5 Ultra Mac Studio

According to Apple, the new Mac Studio featuring the M5 Ultra chip is the “ultimate powerhouse for pro workflows” - again placing a strong emphasis on local AI capabilities.

The M5 boasts a next-gen GPU with up to 80 cores, with each also boasting a neural accelerator to provide up to 4.5-times the GPU performance compared to the M3 Ultra chip, and over six-times that of the M1 Ultra.

“The GPU includes Apple’s latest shader core with second-generation Dynamic Caching, as well as hardware-accelerated mesh shading and third-generation ray tracing, delivering up to 40 percent faster graphics performance than M3 Ultra,” the company said in a blog post.

On the memory front, the new device also boasts significant improvements, featuring up to 512GB of unified memory and 1.2TB/s of unified memory bandwidth.

Apple said this will enable users to “store huge datasets entirely in local memory” and run LLMs ranging in the hundreds of billions of parameters locally.

What to expect with pricing

Customers looking to get their hands on the Mac Mini with M6 or M5 Pro chips can pre-order today (25 August), although the devices will set you back.

In terms of pricing, the Mac Mini with M6 will start at $899 in the US, although users in education can get it for a reduced price of $799. The Mac Mini with M5 Pro, meanwhile, starts at $1,699 and $1,599 for education.

Elsewhere, the Mac Studio with M5 Ultra starts at a whopping $5,499 and $5,099 for education.

Designed for devs

Notably, Apple’s various developer frameworks and tools, such as Core AI, Core ML, and Xcode, will “tap directly” into both chips.

This offers marked advantages in terms of local AI orchestration, the company said.

“With these frameworks and new chips, developers can run and fine-tune large AI models locally on their Mac,” Apple said in a blog post.

“Apple’s developer tools and frameworks automatically optimize performance across the CPU, GPU, and Neural Engine, and give developers the ability to use Apple Foundation Models, App Intents to tap into Apple Intelligence features, or their own proprietary AI models to build and run powerful AI workloads entirely on device.”

Another pint-sized powerhouse

Apple’s pint-sized powerhouse, the Mac Mini, is back with an M6 chip – and it comes at a time when mini PCs are having their moment.

Smaller players from China such as Geekom and Beelink are finding more and more markets with their innovative and powerful desktop boxes, but they will struggle to match the pulling power of Apple.

And they won’t be anywhere near as adorable as the Mac Mini.

FOLLOW US ON SOCIAL MEDIA

AI represents a prime opportunity for security teams to keep pace with accelerating development timelines, according to GitLab CISO Chaim Mazal. But this will require tweaks to traditional processes.

The use of AI in software development is fast approaching near-universal levels, with figures from Stack Overflow’s 2025 Developer Survey showing 84% of developers have adopted the technology.

While AI is helping speed up code production, streamline development lifecycles, and drive productivity, Mazal told ITPro it’s also creating new security risks.

“Businesses have decided that in order to be successful in this next wave of the journey, AI has to be leveraged and teams have to go full bore,” he said.

“I think in tandem and parallel, security teams have been working on figuring out how they can build appropriate solutions to be able to enable their organizations to do that.”

Mazal noted that enterprises are still working around the “same practices and principles that we’ve historically followed” - robust testing, reviews, and security checks.

But with the advent of agentic AI and the pace of change, there’s a risk that blind spots could emerge somewhere in the process.

Indeed, it’s an issue that GitLab recently highlighted in a study. Analysis from the company in June warned that eight-in-ten organizations are adopting AI tools faster than they can develop policies to govern them.

The influx of AI-generated code is also proving troublesome for enterprises, with a study from Tricentis showing that roughly 60% of organizations have shipped untested code.

The result here is that security teams now face a confluence of challenges. Potentially dangerous AI-generated code and increasingly fast development timelines are placing huge pressure on teams to ensure products ship in both a timely and secure manner.

An engineering-first approach

Keeping pace with AI-powered development will mean security teams essentially have to start operating more like their counterparts in development in an ‘engineering-first’ approach.

This is an operating model that takes core engineering principles such as automated testing and CI/CD pipeline techniques and embeds them within security processes. Simply put, rather than acting like manual auditors and policy enforcers, they play a more involved role in development processes.

Moreover, they build parallel products designed to support development from the get-go. Fundamentally, this is about being a “first-level contributor” in software development, Mazal said.

“As our engineering teams move fast, having the security team have the ability to contribute code, make iterative adjustments, and be part and parcel with the development process is key to our success,” he told ITPro.

“Being able to move fast, iterate fast, and not just be consultative in nature, and being able to really roll up our sleeves and work alongside the rest of the teams to build that secure path and the secure guardrails is something I think most modern security teams don’t have the luxury of foregoing.”

When it comes to AI, what’s good for the goose is good for the gander. Security teams should view the technology as a means to keep up with development processes – as with developers, teams need to automate where they can.

Humans in the loop

Ensuring humans remain in the loop throughout the development and testing process will still be vital moving forward, according to Mazal. The exact scope of human involvement is still up for debate, however, and the long-term goal is to automate as much as possible in the safest way

“I think most organizations who make commercial-level software want to get to a place where there are only humans in the loop in places that it’s absolutely necessary, based on the risk to the organization,” he said.

“They’d like to be able to have the overwhelming majority of their code auto-generated and auto-reviewed.”

Mazal said this has the potential to pose new challenges for developers, testers, and security teams alike. Fully-automated pipelines are still evolving, and as ITPro recently reported, some enterprises are exploring the concept of ‘dark testing factories’ to ramp up automation with little human input.

“Collectively we’re still trying to figure out as an industry what those best practices are, but we’re definitely making very big leaps and bounds in very short periods of time.”

GitLab itself is ramping up the use of agents in a software factory approach, Mazal noted, focusing intently on a security-conscious strategy. Agents need strict guardrails, and enterprises need to implement certain restrictions from the get-go.

“How we’re thinking about this at GitLab from a software factory perspective is that you have the ability from the very initial inception of design to bake in those security guardrails and requirements,” he explained.

“You can go ahead and create and craft them and define them based on the data sensitivity and requirements that you have, and you can uniformly implement governance controls across the board.”

These processes will naturally evolve as requirements change, Mazal said, and teams will “continuously make adjustments along the way”.

FOLLOW US ON SOCIAL MEDIA

GitHub has revealed the root cause behind a nearly eight-hour long outage on Monday: a misconfigured policy that triggered a cascade of failures.

On Monday, GitHub users began struggling to use the service around 1:28pm UTC, reporting issues with API requests, Actions, Webhooks, Pull Requests, and GitHub Copilot. At the time, GitHub said it was seeing error rates between 20% to 50% for different tasks, with other services also impacted.

"At peak, web/API error rates were approximately 20%, while archive and raw-content downloads reached approximately 50%," GitHub said via an update on its status report.

"SAML/OIDC authentication, SCIM, and Team Sync were also affected, as well as Actions workflows in GHEC with Data Residency that depend on public workflow step definitions hosted on GitHub.com."

Within a few minutes the problem was spotted, but it took a total of seven hours and 47 minutes for the issues to be totally resolved, the company said.

"Most services recovered by 16:36 UTC as our Central US datacenter recovered; Actions was degraded until approximately 18:03 UTC; and Copilot Token Service fully recovered by 21:02."

What happened with the GitHub Outage?

After an investigation, GitHub said the issue was due to “network saturation” of load balancers due to new peak traffic in the Central US hosting region.

"Originally this was caused by an Istio sidecar pod reaching its concurrency limits and failing to auto scale correctly because of a misconfigured policy that watched host service but not sidecar limits,” the company explained in a post-mortem report.

That failure cascaded, the post noted, with four HAProxy nodes exhausting their flow limits, degrading the gateway authentication path — all of which led to further authentication latency and failures, the GitHub said.

"The problem was worsened by optimistic retry logic which overloaded internal load balancers," the post added. "Pausing HAProxy on those nodes simultaneously produced immediate broad recovery."

Slow recovery

GitHub immediately moved some traffic away from the failing Central US data center location to Northern Virginia to give time to debug and resolve the issues. But Northern Virginia was quickly flooded with traffic too because of a retry bug.

That was pinned on "client retry behaviour" – in other words, client software kept trying to make it work over and over again, leading to failed requests and amplified load.

GitHub managed to temporarily block the "retry storm" but still saw a huge increase in Copilot authentication.

"Copilot Token Service traffic increased from a normal 7–9K RPS to 70–100K RPS. Reducing gateway authentication retries and blocking retry-triggering responses stabilized Copilot Token Service and completed recovery," the post noted.

External factors exacerbated the issue, according to GitHub, including a number of “scraping attacks on codeload endpoints”.

What's next?

GitHub said it had solutions lined up to avoid a similar outage. That includes fixing the initial autoscaling policies and auditing Istio request, concurrency ,and scaling limits, in order to avoid the same flaw recurring.

It also plans to review "retry limits and backoff behaviour across gateways and clients," and address the VS Code retry behaviour that led to the massive leap in Copilot token traffic.

More widely, GitHub plans to improve load balancer capacity monitoring and failover safeguards.

FOLLOW US ON SOCIAL MEDIA

Vibe coding startup Cursor has launched a new code hosting platform in a move that could put it in direct competition with GitHub.

Dubbed Origin, Cursor said the new service is “starting with the essentials”, offering users all the staple features found in GitHub. This includes code repositories (repos) as well as the ability to browse and edit codebases and handle pull requests.

Origin can also be synchronized with GitHub, the company revealed, meaning users can mix and match with both platforms.

“Your GitHub repos can sit alongside the ones Cursor hosts,” the company explained in a blog post. “Connect GitHub to Cursor, pick your org, and you'll see the repos you can sync. Select one and Cursor pulls it in.”

“You choose what gets synced and can disconnect a repo at any time. Anyone with read or write access to a synced repo can view it in Cursor too.”

Access to Origin has already begun rolling out for all paid plans, according to Cursor, albeit in an early beta capacity.

Long-term, Cursor hinted that the plan is to provide “agent-native features” akin to what it already offers through its agentic coding service.

The startup is also in the process of developing a broader “app ecosystem” to integrate third-party tools within Origin. Integrations with Vercel, Depot, and Buildkite are already available, with “more coming soon”.

“Connect Vercel from a repo's Apps tab and every PR gets a preview deployment where you can test and make comments,” the company explained.

“Merge, and it ships to production. For CI, connect Depot or Buildkite. Both run your existing GitHub Actions workflows and Buildkite also runs its native pipelines.”

A blossoming GitHub challenger?

Origin could represent a major challenge to GitHub moving forward, and as ITPro reported earlier this year, the Microsoft-owned company has been making moves to counter competition on this front.

Reports in January revealed Microsoft had reshuffled internal teams to stave off competition from challengers such as Anthropic and Cursor. First reported by Business Insider, this strategy focused primarily on expanding agentic AI coding options for users.

Sources told the publication that Microsoft had grown concerned about up-and-coming startups muscling in on GitHub’s market position.

These concerns centered largely on agentic coding capabilities, however. Origin muscling in on GitHub’s bread and butter as an all-encompassing developer platform marks an entirely different challenge.

Cursor faces significant hurdles if it is to mount a challenge though. Figures published by GitHub last year suggest the platform boasts over 180 million active users, and the platform continues to grow rapidly.

GitHub frustration

The Origin announcement also comes at a tricky time for GitHub. The developer platform recently experienced a lengthy outage that saw developers unable to access key services – and that marked the latest in a string of outages.

After a series of incidents this year, GitHub detailed plans to improve capacity amidst grumbling user concerns.

In an April blog post, GitHub CTO Vlad Fedorov attributed some outages to the sheer volume of users now operating on the platform, which is pushing infrastructure to the limit.

In October 2025, the company began work to boost capacity by ten-times before revising this in February 2026 with plans for a 30-fold increase.

FOLLOW US ON SOCIAL MEDIA

A lengthy GitHub outage that saw users struggle to access core services has been resolved, according to Microsoft, but what happened?

The incident first came to GitHub’s attention at around 1:40pm UTC yesterday, when the company said it was investigating reports of impacted performance for some services.

It proceeded to report problems with API Requests, Actions, Webhooks, Pull Requests, Issues, and GitHub Copilot.

"We are experiencing high error rates around 20% for web experiences and api traffic. Archive downloads and raw repository content downloads are experiencing an approximate 50% error rate," the company reported about an hour into the affair.

"SAML and OIDC authentication, SCIM, and Team Sync are also impacted. Investigations are on-going and we will continue to provide updates as we discover more information."

By 4.40pm, the firm said it had identified the problematic component and had taken corrective action – although error rates were still slightly up.

“We are still seeing residual impact in the form of sporadic authentication failures. We are continuing to apply additional mitigations and investigate the remaining impact,” GitHub said.

Full GitHub outage analysis pending

At one point, Downdetector was reporting nearly 3,000 outage reports, although the incident was finally resolved by 9.15pm.

Exact details on the cause of the incident are yet to be revealed. However, GitHub promised that a “detailed root cause analysis will be shared as soon as it is available”.

GitHub demand surging

GitHub is one of the world's largest software development platforms, with 225 million users, but has seen its infrastructure pushed to the limit by the boom in AI-driven coding.

Last October, it started work to boost capacity by ten times before realizing in February that a 30-fold increase would be required.

In an April blog post detailing the strain placed on the firm, CTO Vlad Fedorov said agentic workflows have "accelerated sharply” in recent months.

“By nearly every measure, the direction is already clear: repository creation, pull request activity, API usage, automation, and large-repository workloads are all growing quickly," Fedorov wrote.

He said GitHub planned to deal with availability first, then capacity, and then new features.

"We are reducing unnecessary work, improving caching, isolating critical services, removing single points of failure, and moving performance-sensitive paths into systems designed for these workloads," Fedorov said.

Repeated outages

Notably, it appears the company wasn't able to carry out this work fast enough, with eight further outages last month. This included a lengthy GitHub Actions outage that the company described as 'unacceptable'.

The company attributed this to the fact that the GitHub Actions service at the core of the incident was still fully running in its data centers, and promised to accelerate its move of GitHub Actions to Azure.

Here, the company noted, it will have more headroom and capabilities to absorb sharp spikes in activity.

"GitHub is on track to see a 1,400% increase in commit volume from 2025 to 2026, with most of the increase coming from AI tooling," commented Jamie Beckland, chief product officer at APIContext.

"Every technology team depends on platforms that are being reshaped by new demand from AI. Which means every technology team now has an AI infrastructure problem. Technology teams need independent monitoring of the third-party services sitting in their delivery path so they know whether problems affect developers, pipelines, and customers."

FOLLOW US ON SOCIAL MEDIA

VPNs (virtual private networks) have traditionally been the go-to solution for many businesses as they provide affordable, secure access to the corporate network for remote workers. There are numerous disadvantages, though, as their encryption processes can impact performance, they don't scale well with increased demand, some can be complex to configure, and few provide any endpoint protection services.

WatchGuard's FireCloud takes secure remote access to the next level and has all the acronyms you'll want to see as this SASE (secure access service edge) solution delivers FWaaS (firewall as a service), SWG (secure web gateway) and ZNTA (zero trust network access). Managed from the WatchGuard Cloud platform, it provides endpoint anti-malware, WatchGuard's APT, IPS, web content and application filtering, geolocation controls and facilities to present remote workers with secure access to private resources on the corporate network.

FireCloud is available in two versions with the Internet Access edition enabling the FWaaS and SWG components to protect remote workers from internet-based security threats. The Total Access edition adds application-level ZNTA and allows you to dish out VPN-free secure access to private resources.

A key feature of both editions is WatchGuard's globally distributed PoP (point of presence) network. Currently comprising fifteen PoPs, these increase performance as remote workers automatically connect to the nearest one which applies cloud-based security such as anti-malware, IPS and content filtering.

WatchGuard FireCloud review: Deployment

We reviewed FireCloud Total Access, and our first task from the WatchGuard Cloud portal was to configure an identity provider. We took the easy option by choosing the WatchGuard Cloud Directory as our authentication domain, but other options include WatchGuard's AuthPoint or third-party SAML 2.0 providers such as Microsoft Entra ID and Okta.

Users are imported or created from the portal's Directories and Domain Service page. We manually created our users by providing their names, a suitable username, and their email address, after which an invitation was sent out to each one requesting them to password-protect their account.

Make sure you configure the agent deployment settings correctly, as it defaults to installing WatchGuard's EPDR (endpoint protection, detection and response) and should be changed to FireCloud. You can then let your users install the Connection Manager agent, which asks for their login credentials, applies the assigned access rule policy, and routes their traffic through the nearest PoP.

We came across an issue as we also have EPDR activated in our cloud portal. Both this and FireCloud currently use the same agent install file, and even though we had the deployment set to FireCloud only, we found each client also appeared in our EPDR console as an unlicensed endpoint. It doesn't affect FireCloud operations, with WatchGuard advising us this is a known issue and is developing separate agent installers due to be released in FireCloud v2 in a few months.

WatchGuard FireCloud review: Access rules and security services

Access rules combine all FireCloud client security settings and, as with the Firebox appliances, all key services are presented in one page. These include web and application controls, which are both accessed from the content filtering section, with the former offering 166 URL categories that can be allowed or blocked.

App controls are equally extensive, with 1,275 predefined app and protocol signatures provided, and both services are applied to an access rule using one action policy. From the content scanning section, you can enable the gateway AV (GAV) and APT blocker services with the geolocation service using rule actions to determine which countries users may access.

Applied as global settings, the network blocking section covers botnet detection and IPS plus port and website restrictions. The tunnel bypass feature allows you to specify IP addresses and networks that sidestep the FireCloud security checks and go directly to the internet.

WatchGuard FireCloud review: Private resources

To allow remote users to access resources on the company network, you first need to define a FireCloud gateway. Three options are available, and if you use a WatchGuard Firebox appliance, you're in luck, as this already has the gateway service ready and waiting.

We used our Firebox T185 as a gateway, which took seconds to declare to FireCloud. The server gateway component can be installed on an existing Windows Server host, which makes it available as a single private resource. Or you have virtual gateways for Hyper-V, VMware, and Proxmox, which you use to declare multiple resources behind them.

Private resources are defined by providing their IP address and port ranges and assigning an FQDN (fully qualified domain name). This doesn't need to be resolvable, as it's used by clients to access the resource.

We created a private resource for the lab's Brother A3 business inkjet and, from our Windows 11 remote clients, manually added a PCL6 printer driver using its FQDN for the LPR port and had no problems printing to it. Likewise, with an RDP connection to one of the lab's Windows systems, as remote clients just entered the resource FQDN in their Windows RDP app.

WatchGuard FireCloud review: Cloud monitoring

The cloud portal offers plenty of monitoring services, with WatchGuard's Rai (Red AI) the star player. This gathers security feeds from all your cloud-managed WatchGuard products and presents them in one dashboard with AI-generated summaries for an at-a-glance view of your security posture.

FireCloud provides a usage report showing all devices and their connection status over customisable time periods. The security tab keeps you posted on areas such as attack, malware and APT activity, along with charts of blocking actions for apps, malware, users, URLs and destinations, with the geolocation map below showing the number of attempts to access banned countries, and the view can be changed to show specific users.

Move to the traffic tab, and you can see access charts for private resources, allowed apps, web and app categories, domains and users. For more specific information, you have the FireCloud log search facility which allows you to drill down deeper and see details on particular security services.

WatchGuard FireCloud review: Is it worth it?

FireCloud is available with volume discounts, so the more client licences you buy, the more you save. WatchGuard Online shows the Internet Access edition for one year starting at £70 per licence, excluding VAT, dropping to around £38 for more than 5,000. The Total Access edition starts at £108 per year for up to 50 licences, falling to £60 each for over 5,000.

True, FireCloud costs more than VPNs but is far better suited to modern hybrid working environments comprising office, remote and mobile workers that need to access a mix of on-premises and cloud applications. It neatly combines FWaaS, SWG and ZTNA services, and its integration with the WatchGuard Cloud portal makes it far easier to deploy and manage than complex and cumbersome VPNs.

As AI continues accelerating code production, developers should take a leaf out of the manufacturing industry’s book to automate testing processes safely.

That’s according to Ingo Philipp, VP of product engineering at UiPath. Speaking to ITPro, Philipp suggested that “lights-out” manufacturing-style processes could alleviate strain placed on teams facing a torrent of code.

Also known as ‘dark factories’, lights-out manufacturing techniques involve fully automated production lines, and are a tried and tested method in the manufacturing industry.

Japanese engineering firm FANUC has been running these autonomous factories for more than two decades, requiring minimal human input except for quality control and overseeing production.

For developer teams, Philipp noted the same techniques could be applied to software development. UiPath coined the term ‘dark testing factories’ in a recent whitepaper, noting that this could both speed up and secure software testing.

“We see that the demand for software testing is just exploding these days. That’s what we see day in, day out from our customers,” he told ITPro.

“At the same time, we also see that they are struggling with the demand. That means they can’t really keep up with this increased volume, increased velocity of software development,” Philipp added.

“That means there is a gap essentially between the demand and the supply. So that's the challenge. I think it has always been a challenge.”

Matching velocity

As Philipp noted, the concept comes amid the growing use of AI in software development. Figures from Stack Overflow’s most recent Developer Survey found 84% of devs have adopted AI, with more than half (51%) using these tools everyday.

With increased production velocity comes added risks, however. In its 2026 AI Engineering report, engineering analytics platform Faros, showed teams now report 54% more bugs per developer compared to pre-AI processes.

Similar research from GitLab found that the volume of code written using AI is surging, yet 92% of developers reported significant governance challenges.

With these issues expected to continue, creating an isolated, automated production pipeline in which code can be tested safely is critical, according to Philipp.

“Think of Codex, think of Claude, think of all the Copilots and Coworks out there,” he said. “They’re enabling our friends in software development to crank out more code faster than ever these days.

“We see our customers, our partners really struggling to keep up with this increased volume and velocity in software development with the traditional approaches they are using in their software testing.”

Automating the pipeline

UiPath’s contention is that with ‘dark testing factories’, AI agents can automate aspects of software testing before it has the potential to cause downstream issues.

In these settings, AI agents would weed out potential bugs while human developers focus more on quality control, security, and governance. Philipp added that testers will eventually “teach the factory to do the work”.

Automation in software testing is by no means a new trend, he noted. In this instance though, it’s a case of speeding things up in line with acceleration across the broader development lifecycle.

“It’s autonomous testing on steroids,” he told ITPro. “The goal here is to … do away with all the operational, repetitive, mundane testing work from the humans and elevate them into more ‘quality leaders’.”

This does raise the question of whether enterprises are simply adding more automation – and complexity – to an already complicated and highly-automated process.

Philip said, however, that automation in this context will still require robust human oversight. Customers adopting this approach are able to create strict guardrails on what tasks agents can perform, much like other areas in which agents are deployed and a human-in-the-loop approach is still vital.

One customer, he said, set boundaries around what actions agents can take without human intervention, reverting to testers in certain circumstances.

“Who is actually the quality owner? Who is the person that needs to provide clarity on that? This is not something new, because they already have it as part of their existing testing process. We just factored it in.”

Philip told ITPro that while customers are shifting toward this approach, it’s at a moderate pace. Long-term, he envisages a far more AI-fuelled testing setup but only a handful of companies have the capabilities right now to achieve this.

“I want to be brutally honest here, almost none of our customers are there at the moment,” he said. “None of our customers [have] achieved the holy grail of making testing fully autonomous. I don’t think it is achievable in the short-term and mid-term.”

FOLLOW US ON SOCIAL MEDIA

Red Hat has unveiled a new open source community project aimed at bolstering AI governance capabilities for enterprises.

Dubbed asago (AI Safety And Governance Orchestration), the new project will help enterprises automate AI governance policies in a bid to drive safe deployment of the technology.

A host of organizations have pledged support for asago so far, according to Red Hat, including Microsoft, IBM Research, the Alan Turing Institute, Brave Software, and more.

“The asago project is a true collaborative, open source endeavour bringing together stakeholders from the technology industry, academia and government,” said Stuart Battersby, AI safety and model evaluation architect at Red Hat.

“We encourage more collaborators to join this community driven effort, particularly from global jurisdictions, to ensure maximum coverage of AI safety viewpoints.”

As part of the project, participants will use a standardized platform designed to “translate complex corporate and regulatory AI governance policies into actual operational controls”.

This targets a common pain point for organisations deploying AI, according to Red Hat. Translating policy guidelines into functional software configurations often slows down innovation and creates deployment bottlenecks.

Compliance officers, for example, require “rigorous risk assessments” and verifiable evidence, while on the technical side platform engineers need highly structured configurations that can be easily maintained.

With new legislation such as the EU AI Act coming into effect, Red Hat said the project will help streamline deployments by speeding up traditional hurdles.

Indeed, the project will focus on four key areas for organisations deploying AI technologies, including risk mapping, risk assessment, risk mitigation, and production deployment.

What to expect with asago

The asago framework will automatically read and interpret AI governance policies on behalf of the user, helping to map specific requirements to established AI risk frameworks and standards through the IBM AI Risk Atlas.

These standards and frameworks span the NIST AI RMF, OWASP LLM Top 10, and the EU AI Act.

Asago will also generate and execute scenarios for automated safety testing, which is based around specific identified risks rather than “generic benchmarks”.

Thereafter, the framework will recommend “appropriate mitigations” such as safety guardrails before providing deployment-ready configurations.

Red Hat said each of these steps are designed to provide a “continuous audit trail” which ties individual policy clauses to specific tests and runtime controls.

AI safety in the spotlight

The move by Red Hat comes amidst growing concerns about AI-related security risks, particularly with agents.

In the last two weeks, both OpenAI and Anthropic both revealed ‘rogue’ AI agents escaped containment during testing and breached partner organizations.

Steven Huels, vice president for AI engineering at Red Hat, said that the mass-deployment of agents means that robust guardrails have now become a “critical infrastructure requirement” for enterprises.

Earlier this year, IBM and Red Hat unveiled Project Lightwell, an initiative designed to speed up automated security patching in response to a torrent of vulnerabilities uncovered by powerful new AI models.

As ITPro reported in late June, a host of organizations have signed up to the initiative so far, including Palo Alto Networks.

“Through initiatives like Lightwell, we are working to secure the open source supply chain from AI-driven vulnerabilities,” Huels commented. “asago complements this effort and takes the next logical step for enterprise AI by automating the link between corporate policy definitions and live production agents.

“This gives enterprises the end-to-end operational confidence they need to scale trusted AI across the hybrid cloud.”

FOLLOW US ON SOCIAL MEDIA

Microsoft posted better than expected results from its cloud and AI business, news that helped boost its languishing share price.

Recent earnings statements from major AI players have spooked investors thanks to already heavy capital expenditure being increased further. Last week, Google's shares fell despite record growth and this week Meta saw a similar fall amid concerns about AI spending. By contrast, Microsoft plans to keep its capex spending the same as previously forecast, holding it at $175bn for 2026.

Across the company’s revenue for the quarter was $90 billion, up by 18%, with net income totalling $35.8 billion, climbing by 31%. Revenue from Microsoft cloud was $59.3 billion, up by 27%, with better than expected results at its Azure cloud computing division, which posted revenue growth of 43% for the quarter, above estimates below 40%.

That lifted Microsoft's shares by 8%, rallying after a tough stretch this year that saw it fall more than 18%.

"This year, Azure revenue surpassed $100 billion for the first time, and Microsoft 365 Copilot reached over 30 million paid seats, reflecting the confidence customers are placing in us to power their AI transformation," CEO Satya Nadell said in a statement. The company also reported a $3.2 billion return on its Anthropic investment.

Positive results on AI that are keeping pace with spending are likely what's behind the share price bump, noted Emarketer analyst Gadjo Sevilla. He said the capex figure is likely the most watched line in results right now – and this time that sparked optimism rather than concern.

"Microsoft spent $35.80 billion on property and equipment during fiscal Q4, more than double the $17.08 billion in the year ago quarter, bringing full-year capital expenditures to $115.95 billion – up nearly 80% from $64.55 billion in fiscal 2025," said Sevilla. "Despite that spending pace, the company still generated $55.44 billion in quarterly operating cash flow, up 30% YoY, a positive sign the AI buildout isn't cannibalizing the core business."

Sevilla added: "The company’s diversification strategy, its data center and AI partnerships, and its reliance on its own homegrown AI expansion will continue to stoke confidence to partners and investors while signaling to the rest of the industry how diversifying infrastructure and AI products strikes a balance for growth."

A better way to offer AI?

Alongside that, Microsoft CEO Satya Nadella said the company continues to shift away from a previous focus on OpenAI's models to building its own, saying the aim is to enable customers to pick and choose the best model to meet their needs.

"That's really the enterprise design architecture that we are going to evangelize. We ourselves are using it," Nadella said, according to Reuters, adding that the company's own models are 40% more efficient.

That's a key point amid concerns about the cost of using AI, with Microsoft earlier this week unveiling its own security model that it pitches as half the cost of rival systems.

Not all analysts were convinced, however. Forrester principal analyst Tracy Woo said that the Copilot adoption and strong revenue were good signs that AI investment was paying off "but the results stop short of fully validating the company’s AI strategy”.

"The new partnership with Anthropic helps reduce dependence on OpenAI, yet roughly 45% of commercial RPO [Remaining Performance Obligation] remains tied to that single model provider," she said.

Woo added: "While more AI products are scaling into enterprise‑grade workloads, the unresolved question is whether Microsoft’s infrastructure expansion can ultimately outrun the margin pressure that comes with supporting frontier‑model demand."

Amazon has pledged financial backing for the team behind the Lean programming language as part of a sharpened focus on AI agent development.

In a statement on 26 July, the tech giant revealed it will provide "substantial, long-term” financial support for the Lean Focused Research Organization (FRO).

The FRO leads development of the open source programming language, which Amazon already uses internally in agentic AI development practices.

Lean has been around since 2014 and is a popular programming language across a range of fields including mathematics, physics, and computer science.

For Amazon, the appeal lies in its role in helping develop and fine-tune AI reasoning capabilities. The programming language is used alongside a ‘proof assistant’ - a type of software used to conduct checks of code to identify and sift out errors or flaws.

It’s these ‘correctness proofs’ that make the programming language a go-to option for academic researchers and professionals in scientific fields.

“AI generation of formal proofs in Lean has been a key method for training models with lower error rates, to the point that they are now producing correct solutions to research-level problems,” Amazon explained in a blog post.

Amazon Lean-ing in on agentic safety

Amazon said its support for Lean comes at a critical time both for its own internal AI ambitions and for the industry at large as enterprises ramp up adoption of agents.

Safety has been a key recurring talking point for organizations on this front. As ITPro has previously reported, research shows growing concerns around access control, governance, identity security, and visibility when it comes to agents.

“Coupling generative AI with Lean's mathematical rigor will help enable verified, trustworthy AI agents,” the company said.

Amazon already uses Lean-based verification in its Bedrock AgentCore service, helping to “prove the correctness of the policy language” that ensures agents operate within strict boundaries.

Elsewhere, Lean underpins systems such as SampCert - which provides “mathematical guarantees” for privacy protections in the AWS Clean Rooms analytics platform - and AWS Neuron.

“One scientist recently used an LLM with Lean to prove the correctness of Amazon Aurora's segment repair protocol, our most durability-critical distributed protocol, in a fraction of the time it would have taken manually,” Amazon noted.

“The set of applications is growing fast, and this is just the beginning.”

Peter Van der Putten, assistant professor of AI at Leiden University and director of Pegasystems’ AI Lab, said AWS’ FRO backing is a welcomed move given recurring security-related concerns.

“It is encouraging to see AWS investing in open source technologies such as Lean that have the potential to provide stronger formal verification guarantees for software and AI systems,” he said.

“As agentic AI systems become increasingly autonomous, technologies that can provide stronger correctness and safety guarantees than just traditional testing will become ever more important.”

Van der Putten noted, however, that the inherent complexity of agentic AI development means more robust orchestration and governance is still of paramount importance.

“Enterprise agents operate within complex environments involving workflows, automated processes, policies, regulations, humans in the loop, multiple stakeholders, and countless exceptions and uncertainties that cannot simply be abstracted away but must be dealt with in practice,” he said.

“So even an agent whose behaviour has been verified against a specification must still be able to operate effectively in such a context,” Van der Putten added.

“In practice, the bigger challenge may lie in orchestrating agents, people, data, and systems together in a governed way, while reflecting ambiguity, trade-offs, conflicting objectives, and constantly evolving realities, rather than simply proving that an idealised agent behaves correctly.”

Open source backing

Backing for the FRO serves a broader purpose rather than complementing its own use of Lean, according to Amazon.

“It’s easier to trust a proof when you can evaluate the tools behind it yourself,” the company noted.

“Customers, auditors, and regulators can independently inspect and validate work done in community-governed tools, which is the kind of transparency that safety-critical AI demands.”

The firm said that in the long term, Lean’s growing popularity will benefit the AI industry by providing “more libraries, more tooling, and more formalized proofs for everyone”.

FOLLOW US ON SOCIAL MEDIA

Nvidia CEO Jensen Huang has hailed the capabilities of Chinese open source AI models amidst growing interest in low-cost options for enterprises.

In an interview with Axios this week, the Nvidia chief said competition between open and closed-source models is positive for the broader global AI industry.

“The world needs open models,” he told Axios. “These Chinese models are excellent. Open source models that are excellent should be used”.

Huang’s comments come amidst growing interest in Chinese open source AI models in recent weeks. The Kimi K3 model, developed by Moonshot AI, temporarily paused subscriptions due to skyrocketing demand.

Surging interest in the Kimi K3 model bears similarities to that of DeepSeek, which rocked the US AI industry when it launched in early 2025.

A key advantage of these models lies in both their performance and cost efficiency, the latter of which has become a key focus for enterprises amidst growing concerns over spiralling AI costs in recent months.

As ITPro reported in November 2025, open source AI models often perform on-par with closed source options, and could potentially save enterprises millions in costs each year.

Open source models "routinely achieve 90% or more” of the performance of closed counterparts, the study noted. They also benefit from “significantly lower prices”, with operational costs plunging up to 84% in some cases.

In a research paper published by DeepSeek last year, the company said it spent a paltry amount training its flagship R1 model compared to US rivals who’ve spent billions on training purposes.

Anthropic CEO Dario Amodei suggested building a new AI model could cost over $100 billion in 2024.

Security concerns persist

While the popularity of Chinese AI models continues rising, concerns over security have been flagged repeatedly.

The concerns surrounding Chinese AI models typically focus on areas such as data privacy and national security, with some critics suggesting these tools could be used as a ‘backdoor’ for Chinese intelligence services.

Axios previously reported that the White House could consider imposing restrictions or tight conditions on US firms working with these models.

DeepSeek was subject to the same scrutiny during its rise to prominence across 2025, for example. In August last year, cybersecurity experts told ITPro that using DeepSeek equated to “printing out and handing over your confidential information”.

Huang told Axios that these concerns are a “misconception” and can be used by enterprises safely. On the topic of potential White House restrictions, Huang said this could prove counterproductive and that American firms should consider a breadth of options.

“You can download the models. You could fine-tune it, you can enhance it, you can guardrail it as you desire,” he said.

Huang has a vested interest on this front, however, and noted that increased usage will ultimately benefit Nvidia.

“If there’s great AI, even if it’s open, wherever it comes from, there will be more use,” he told Axios. “Whenever there’s more use, you’ll have to sell a lot more Nvidia computers. We’ll have to build more data centers. We’ll have more services. The technology will diffuse into more industries”.

Bill Conner, president and CEO Jitterbit, said the Kimi K3 launch marks a “clear turning point in accelerating global adoption of Chinese LLMs” but still urged caution with regard to security.

“Enterprises may underestimate the security, accountability, and governance risks associated with adopting new Chinese LLMs,” he said.

“Moonshot AI operates as a cloud service with data stored in China, introducing potential risks for organizations whose data may be shared unknowingly.”

Conner said adoption of Chinese AI models should be treated as a “strategic risk decision, not merely a cost-saving opportunity”.

FOLLOW US ON SOCIAL MEDIA

With AI tools now commonplace in software engineering, nearly two-thirds (60%) of organizations are expected to shrink team sizes by 2029. But that doesn’t necessarily spell bad news for engineers, according to Gartner.

Analysis by the advisory firm suggests the shift toward smaller engineering teams won’t be a cost-cutting exercise, but rather a natural evolution toward more agile, specialized units focusing on specific areas.

Gartner envisages these smaller teams being composed of specialist product managers alongside user experience (UX) - or agent experience (AX) designers, and at least one ‘AI-native’ engineer.

Speaking to ITPro, Gartner principal analyst Aliyah Camacho, said this influx of AI has prompted a rethink of how enterprises can “really make the most of AI and humans working together”.

“What we’re seeing is that organizations are looking at engineers as AI orchestrators,” Camacho told ITPro.

“One aspect of tiny teams is that we’re thinking of them as focused on a product or a set of features for a product, so it’s bringing together more of that product management skills and expertise onto the team.”

The concept of engineers moving toward more of an orchestration-style role has become a recurring talking point over the last 18 months. AWS CTO Werner Vogels told ITPro earlier this year that the traditional image of developers as “code monkeys” is fading.

With AI in the mix, developers and engineers can now focus on other tasks, such as quality assurance and testing, Vogels said at the time.

Gartner’s research echoed this, noting that with the technology handling routine technical tasks, this will ultimately free up engineers to focus on “complex problem-solving and innovation”.

With tiny teams, Camacho said this will essentially remove a layer of friction for engineers. Simply put, the AI does the grunt work, while engineers have time to focus on product development and refining existing software.

These teams will also have their own remit similar to product development teams, meaning they’re staying in their own lane and not getting dragged into other areas.

“What we're predicting to be speed or velocity-type gains with tiny teams is that these small teams are fully accountable for the success of their product or feature,” she explained.

“So removing that layer of having additional approvals and coordination is one type of speed gain,” Camacho added. “Then another is having fewer people on the team means that there's less time spent in that communication and handoff type of activity.”

How tiny are we talking?

Naturally, what constitutes a ‘tiny team’ will vary wildly based on the size of the enterprise. Small teams today, also known as ‘two-pizza teams’, typically have between five and eight people, Camacho said.

Generally speaking, the shift to tiny teams could take this down to five or six. Some, on the other hand, could end up with just two or three, Camacho noted.

“This really varies,” she said. “Some are curious about experimenting with teams of three, and then for others a meaningful reduction in size is down to six.”

Ultimately, these changes will be made on an enterprise-by-enterprise basis, but leaders should be wary of downsizing down too much. These teams should be small enough that they’re agile but also remain effective and have enough diversity of ideas.

Not a cost-cutting exercise

Given that the last two years have seen repeated warnings about AI rendering developers obsolete, some might see a shift to smaller teams and figure this is another excuse to offload staff.

Camacho insisted that this isn’t a cost-cutting exercise, however. Teams will be smaller, but the consultancy predicts there will eventually be more of these tiny units working away in the background building software.

This is where communication from leadership will be vital in fostering change, Camacho noted.

“I think that a huge piece of making this kind of change is communicating really clearly about what it is and is not, and the tiny teams model is not a cost optimization tactic,” she said.

“Rather, it’s a restructuring of teams to best take advantage of AI and human expertise. What we’re seeing with this idea is that team size reduces, but the number of teams may actually stay the same, or may increase, because we’re expecting more demand for complex engineering solutions at organizations.”

Room for juniors

Maintaining robust talent pipelines will also be a key focus with the shift to tiny teams, according to Gartner. If anything, junior engineers will be more crucial than ever to compensate for general attrition and to provide AI-native skills.

The impact of AI on entry-level jobs has been a recurring talking point over the last 18 months, with the need for junior engineers questioned by some industry stakeholders.

This is where the ‘how small is too small’ question comes into play, according to Camacho.

“We absolutely believe that organisations need to continue hiring junior talent to build that pipeline for the future,” she said.

“So the way that fits with tiny teams in this context is reducing team size, but not making it too small because if the team size shrinks too much, that can pose risks.”

Long-term, the solution to developing junior talent could lie in apprenticeship-style models, she added, noting that this “could fit really well with the tiny teams model”.

FOLLOW US ON SOCIAL MEDIA

At the end of June, Apple released the iOS 26.5.2 update, containing a long list of security fixes. The timing of the update differed from Apple’s typical approach, which sees the iPhone maker issue mid-cycle patches for emergency security fixes or urgent bugs only.

Yet when iOS 26.5.2 was released, Apple told Reuters the move was part of an overhaul of its strategy as AI tools find vulnerabilities at scale. Indeed, some of the flaws patched in its update were found using AI, painting a clear picture of what security teams can expect in the future.

Apple is not the only vendor to supercharge its patch release cycle fuelled by AI-enabled vulnerability discovery. This June was Microsoft’s biggest Patch Tuesday ever, fixing over 200 bugs, while a recent Google Chrome patch fixed 400 issues in the browser.

As ITPro has already reported, patching velocity must increase as Anthropic’s frontier AI model Claude Mythos and others like it start to find flaws en masse.

But Apple’s accelerated release schedule highlights the impact on mobile devices – especially when part of a bring your own device (BYOD) policy. What can security leaders do to regain control?

Shrinking attack windows

Experts say shrinking attack windows are making patch management an urgent problem. The time between a flaw being discovered and weaponized is “falling dramatically” as AI tools “accelerate both research and exploitation”, says Tristan Shortland, CTO at Infinity Group.

“Traditional patch cycles that measured response times in weeks are increasingly at odds with a threat environment that moves in hours.”

With this in mind, most industry commentators see the move towards accelerated patch releases as positive. “From a risk perspective, I'd much rather see organizations patch quickly and in a controlled way than wait for monthly cycles and leave vulnerabilities sitting there, waiting to be exploited,” says Nathan Davies-Webb, principal consultant at Acumen Cyber.

Yet rapid patch release cycles add pressure in scenarios where employees use personal devices to access corporate networks. “Apple, Google and Microsoft can remind users to update, but they don’t always enforce it,” points out Jake Moore, global cybersecurity advisor at ESET.

For those that run BYOD policies, the impact of late patching could be vast, agrees Sriram Kakalara, chief product officer at Scalefusion. “Personal iPhones and iPads often access corporate apps and data from outside the IT team's direct control,” he warns.

More updates, less warning

Another challenge is the sheer number of mobile fleets to be updated. The trend towards increasing numbers of mobile device patches could be a problem for larger distributed organizations such as retailers, according to Kakalara.

“These might have thousands of devices running on iOS, and every accelerated release means pushing updates more often and with less warning,” he says.

He points out that many organizations “fail to scale their patching and access strategies as their endpoint estate expands, leaving known vulnerabilities unresolved”.

The onus is now on organizations to operate “faster and more efficiently”, he says.

Beyond simply deploying updates more rapidly, the challenge will be ensuring every endpoint has received them, adds Andy Ward, SVP International at Absolute Security.

“The rise of hybrid working over the last decade has made this increasingly difficult. Remote work and BYOD leave organizations with gaps in visibility that attackers can easily exploit. Every day a critical patch is delayed extends the window of opportunity for cybercriminals.”

While there’s no doubt AI can be beneficial in vulnerability discovery, the pressure on patching as a result of the constant flurry of security fixes is only going to get worse.

Shortland expects more vendors will follow Apple's lead, issuing patches more rapidly in line with vulnerability discovery. “AI is exposing vulnerabilities at a scale we've not seen before, which means the industry will have to move towards more continuous patching and risk-based remediation models, rather than relying on predictable release cadences.”

Security teams should treat Apple's move as “the new normal”, agrees Kakalara. “The precedent means patches can now arrive unexpectedly and without notice, so waiting for a scheduled maintenance window is no longer a viable strategy. Teams need to be on permanent alert, ready to test and deploy at speed.”

No more patch day

It might seem complex, but there are some simple steps security leaders can take to ensure fixes are applied as soon as they’re released, including to BYOD devices.

Rather than banning BYOD, Moore thinks the solution is implementing conditional access controls to ensure outdated devices can’t access company systems. “This means it becomes nearly impossible to have devices running outdated software.”

But at the same time, companies need to avoid treating every new flaw as an emergency. Instead, the focus should be on “what is actually being exploited – rather than what is possible”, Moore advises.

Ian Thornton-Trump, CISO at Inversion6, believes security leaders must make themselves aware of the size of their company’s attack surface, and be able to identify legacy devices “either properly supported by vendors, or unsupported”.

In tandem, Thornton-Trump outlines the importance of firms testing their own defences. “Prioritize red teaming and penetration testing to try and find weaknesses before bad guys do, and before security researchers encourage firms to respond.”

Moore recommends automated patching as an ideal scenario. “Long gone are the days where Tuesday was the patch day,” he says. “Manual processes were built for a far slower time, but as we shift into the AI era, we are going to have to adapt and evolve as quickly as the technology does.”

Davies-Webb concurs. He thinks the point has been reached where not using automatic patching “is becoming harder to justify”.

“There was a time when concerns around stability and functionality made organizations cautious about patching too quickly, but for most, the risk now sits firmly on the other side of the equation,” says Davies-Webb.

“AI is accelerating how quickly vulnerabilities are discovered and weaponized, which means organizations need to be reducing exposure as quickly as they can."

Software developers aren't losing skills because of AI, but using time saved to skill up, according to research from O’Reilly.

Analysis from the learning platform found that rather than the boom in AI coding tools having a negative effect on developer capabilities, many view the technology as a way to streamline everyday tasks to help them focus on learning.

O'Reilly said that use of generative AI content on its own learning platform was up 89% in the UK over the last year, while machine learning grew by 51% and natural language processing was up 117%.

At the same time, O'Reilly noted that more traditional programming topics saw decline over the last year, with "programming fundamentals" down 74%, Agile falling 31%, and Git down 20%.

While that could be seen as software engineers handing off such work to AI and not bothering to study key subjects, the study noted this suggests many are learning such skills on the job and using AI to support learning.

Formal training time, meanwhile, is spent learning about more advanced AI-related topics.

Alexia Pedersen, SVP International at O’Reilly, said the study shows developers are now making AI a “core part of their learning priorities”.

"The UK tech workforce isn’t turning its back on programming," Pedersen said. "It’s building on years of engineering expertise to take advantage of the opportunities AI creates. That’s exactly what we’d expect from experienced developers."

"Many already have years of programming experience, which puts them in a strong position to adopt AI tools confidently and apply them in meaningful ways," she added.

AI isn’t a replacement for core skills

That said, O'Reilly warned that AI should complement, not replace, foundational programming knowledge – especially for newer developers.

As ITPro reported last year, concerns are rising that those entering the workforce are becoming too reliant on the technology. The result is that many could miss out on valuable learning curves in the early stages of their careers.

"The challenge now is making sure the next generation develops those same foundations before relying too heavily on AI," Pedersen commented. "AI will make great developers even better, but it can’t replace the technical judgement that comes from understanding how software really works."

The company suggested that while developers are choosing to learn in different ways, it's worth noting that employers still require specific programming skills.

React, Node.js and Java skills are still highly sought after while cloud-related knowledge is prevalent in many UK job ads.

Indeed, demand for the Clean Code courses grew 19% over the last year, O'Reilly said, with C# up 17% – showing practical coding capabilities remains important.

"What this data captures is a workforce making active choices about where their time goes," Pedersen said.

"UK tech professionals aren't casually browsing AI content – they're incorporating technical learning into new ways of working, building AI agents, testing different approaches, and exploring how these tools can improve productivity and outcomes.

FOLLOW US ON SOCIAL MEDIA

IBM has announced a series of updates to its IBM Bob software development tool, with a particular focus on better managing token consumption.

The move marks the first big batch of updates for the agentic development tool, which rolled out earlier this year. Bob will now offer multi-agent capabilities, the company said, alongside built-in AI cost and usage analytics features.

According to IBM, the new ‘Bobalytics’ feature will enable developers to monitor AI token consumption, streamline resource management, and improve visibility in terms of how AI tokens are consumed by teams.

Sub-agents and multi-agent capabilities will also play a key role in reducing costs, according to IBM. Sub-agents are those that operate under the direction of another to handle specific tasks within a larger workload.

The advantage here is that these dedicated agents will work in an “isolated context” within broader workloads to complete tasks in a more efficient manner, ultimately reducing costs.

Multi-agent features also contribute on this front, according to Michael Kwok, VP of IBM Bob. In a blog post detailing the updates, Kwok noted that Bob will now call on specific tools based on the underlying model, allocating agents depending on the intensity of tasks and associated costs.

“Parallel tool execution can significantly reduce the time required for complex tasks involving multiple searches, file operations and validation steps,” Kwok explained.

“Subagents improve efficiency by performing specialized work in isolated context before returning only the relevant results, while background tasks allow long-running work to continue without interrupting the developer’s workflow.”

AI cost optimization in the spotlight

The move by IBM comes amidst a sharpened focus on AI token consumption - and spiralling costs - by enterprises globally. As ITPro reported in June, the ‘tokenmaxxing’ trend has landed some organizations with eye-water bills.

Uber, for example, blew through its entire annual AI bill in just four months after incentivizing staff to ramp up use of the technology.

Developer teams are also contending with rising costs on this front, as Gartner told ITPro in late June. The consultancy projects that token costs could exceed engineer salaries by 2028 based on current usage rates.

Speaking to ITPro at the time, Nitish Tyagi, senior principal analyst at Gartner, said engineering teams are adopting a range of cost optimization practices to reduce the impact of token consumption.

New ‘premium packages’ for IBM Bob

IBM also unveiled three new specialized workflows for Bob aimed at driving Java, IBM Z, and IBM i operating system (OS) modernization. These capabilities come in separate ‘premium packages’, according to the firm, offering enterprises domain-specific versions of the tool.

“Modernizing a Java application requires different knowledge, tools and workflows than working with IBM i systems or mission-critical mainframe applications. Each environment carries its own architecture, runtime assumptions, integration patterns, validation needs and operational constraints,” Kwok explained.

“Premium Packages bring domain intelligence and decades of enterprise expertise directly into Bob while maintaining a consistent developer experience.”

The premium package for Java, for example, will help automate migration processes, allowing teams to move to more recent versions of the programming language. Bob will essentially guide users through the process, while also assisting with broader modernization practices.

This includes automated compatibility testing and the ability to identify and remediate vulnerabilities.

The premium package for IBM Z, meanwhile, will provide teams with a helping hand during mainframe modernization projects. The Z Code Mode feature, for example, will help “explain, generate, modify, refactor, and transform mainframe application code”.

Efforts to streamline mainframe modernization by the firm come after a high-profile spat with Anthropic earlier this year.

FOLLOW US ON SOCIAL MEDIA

Researchers at Nebula Security have discovered a Linux kernel flaw dating back to 2011 that lets any logged-in user take full root control of an unpatched machine in just five seconds.

Dubbed GhostLock (CVE-2026-43499), it was introduced in Linux 2.6.39 and fixed in Linux 7.1.

The flaw allows an unprivileged local attacker to get a dangling kernel pointer to kernel stack memory with only regular threading syscalls, write a pointer to an arbitrary address, and hijack a function table to get root access.

GhostLock has been shipped by default in every mainstream distribution since 2011, and requires no special privileges or network access. Nebula, which uncovered the flaw, said its exploit is reportedly 97% reliable and can also escape containers.

This particular flaw is the second part of an attack chain dubbed IonStack, with the first step being CVE-2026-10702, a vulnerability in Firefox that allows code execution within the browser and escapes its sandbox.

The vulnerability is rated high (7.8) as the attacker would already need to have local access to the system.

How the GhostLock flaw works

Nebula researchers said the root cause is a function reused by a caller it was never written for: the helper function remove_waiter(). During certain futex operations, it incorrectly clears a pointer associated with the currently executing task, rather than the actual waiting task.

This leaves the kernel with a dangling pointer that points to a memory location that has already been freed and reused. This allowed the Nebula team to gain full control, tricking the kernel into running their own code as the root user.

Daniel Bechenea, security manager at Pentest Tools, said the flaw is of particular concern because kernel exploits have historically carried a “real operational cost for attackers”.

“An unreliable one crashes the box and burns the access,” he explained. “An exploit that Nebula reports as 97% reliable, with public code anyone can run, changes that math.”

"As GhostLock uses a kernel vulnerability, containers also represent a juicy target for attackers as the exploit escapes the container and obtains code execution as root on the host OS, meaning that: containerised workloads that teams treat as isolated become stepping stones to the host and everything else scheduled on it."

Patch now

Systems running older kernels remain vulnerable to exploitation, according to Nebula. Researchers urged users and administrators to update to patched kernel versions as soon as possible.

"On an unpatched host, treat any code execution as root, and plan containment accordingly," advised Bechenea.

"Prioritize the systems that run untrusted or semi-trusted code by design: CI runners, container platforms, shared development machines, multi-tenant hosts, and verify the fixed kernel package version on each system rather than trusting that the April fix propagated, because with several major LTS releases still lagging in early July, attackers who land a foothold will check your kernel version even if you haven’t."

FOLLOW US ON SOCIAL MEDIA

Open source can't catch a break. As the world of software development marches forward with new tools and capabilities expanding productivity – an evolution driven predominantly by AI – the community endures significant headwinds.

"In the age of AI-driven security threats, protecting customer data has to come first," wrote Bailey Pumfleet, co-founder and CEO of scheduling software maker Cal.com, in April.

After five years as "open source champions", the company announced it would go "closed source". Cal.com is far from the only example, with several organizations and projects including Tailwind, curl, Jazzband, Godot – and even the U.K. National Health Service (NHS) – also struggling in the wake of AI.

Tension has always plagued open source, with concerns around funding, infrastructure, and even expectations management, negating any meaningful green shoots. The threat has even been described as "existential", but the community has nevertheless survived and thrived, celebrating incredible adoption rates in recent years. But things feel different. AI poses an existential threat in many areas — but will it continue to hack away at the beleaguered open source community, or is there a viable path forward for the movement?

Open source is battling AI-centric headwinds

"In the past, exploiting an application required a highly skilled hacker with years of experience and a significant investment of time to find and exploit vulnerabilities," wrote Cal.com's Pumfleet in the blog post. The reality is that humans don’t have the time, attention, or patience to find everything. Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities."

Security is just one aspect in an increasingly fraught dynamic. Tailwind, the organization behind a popular CSS framework that web developers incorporate into their projects, announced on 7 January it had slashed its four-person dev team to just one. The reason, CEO Adam Wathan cited, was "the brutal impact AI has had"; web traffic to documentation – which is the only way people can find out about its commercial products – was down 40% from early 2023.

There are also examples of projects struggling to cope with an onslaught of low-quality contributions. Take Godot, the open source game engine that's drowning in AI slop code pull requests (PRs), according to one of the primary maintainers, Rémi Verschelde, who described this as "increasingly draining and demoralizing".

The Jazzband collective, a Python project ecosystem, was sunset this year after ten years of activity due to the "slopocalypse" with floods of PRs and AI-generated spam rendering "Jazzband’s model of open membership and shared push access untenable".

There are plenty of other issues to contend with. They may include the fact that using advanced AI tools may be gated on the need to spend money, and that it's unclear whether you're speaking with a human or an AI agent at any given time.

How open source projects are coping with AI

Amanda Brock, CEO of OpenUK, tells ITPro that the industry is still grappling with AI as a novel force and different projects are handling it in different ways – with some handling it much better than others. "For some projects, they have not been able to manage the scale of it. And for some small companies, they have said they've had to close," she says, but added this isn't a universal experience, with others managing to get a grip on the headwinds.

"I'm skeptical about their business plan," Brock added on Tailwind, "and I could be wrong, and I'm not an authority on this in terms of each company's business and whether they were doing well enough. But I'm a bit skeptical when many are surviving about the few that are closing, and I don't know if that's the most vulnerable or the ones without the right business structures or teams."

However, Brock states the challenges are very real and unlike much else the community has experienced. For example: "When AI comes to Wikipedia, it not only comes at a huge scale by volume of eyes on the site or the pages, it looks at every page, and it does it in an instant. And the overwhelm is huge. And that's the equivalent of what open source projects feel when their repos are scraped; when they suddenly have this inbound volume from AI."

An example of a project that's fared better in wrestling with AI is Homebrew, the package manager. Its project leader Mike McQuaid tells ITPro Homebrew's response was to fight fire with fire. "We have had an increase in low-effort activity, but we respond with low effort," he says. "Our bots automatically close issues, we’ll close without review, we don’t dignify them with a response, et cetera."

McQuaid adds that, despite some notable examples, it's overstated that many projects are going closed source or winding down, and it's not representative of the wider experience. He says projects weather the storm "the same way we always have," with one measure including prioritizing maintainers' time, effort, and enjoyment over contributors, and prioritizing contributors over users. Responding to rudeness is also met with low effort, no effort, or blocking. He also suggested leaning very hard onto guardrails.

Resolving the fate of open source

McQuaid says the notion that AI could lead to the end of open source is "far too dramatic" and that there are plenty of positives to enjoy in a grand trade-off, despite there being an element of entering the unknown. These positive improvements include the way that AI allows some people to go much faster, that there are plenty of free AI tools available, and that many of these can help with code review, fixing bugs and triaging.

"It isn’t making huge negative changes without any positive remediations," he explains. "It’s just resetting people’s expectations of what 'working on open source' might be like for them. Some people won’t enjoy it any more. Many people equally are contributing who didn’t or wouldn’t before."

Despite many positive steps taken in the open source world over the last decade, Brock dwells in a sense of pessimism – but not entirely because of the immediate effects of AI. "I have been very pessimistic in some ways for a long time," she says, "because after lockdown everybody came out seeming to think that 'we'd won'." And what we'd won was, we've got a scale of adoption — but that scale of adoption wasn't matched by a scale of understanding, or funding.

"My worry was that you were going to see it, go full circle and end up back in proprietary because of exactly this kind of thing. I did not imagine AI, but I could see that things might happen, that meant that we were just overwhelmed because we got into a position where people expected an SLA-type delivery and support for free because the code was free."

Building on open source's legacy

"If it hadn't been AI, it would have been something else," Brock reiterates, saying the challenges have been piling up "at a time when people are reeling" one after another in the last few years.

"We've just had a decade since we really saw all this adoption start. We're a small group of experts [and scaling from] the small to the many hasn't worked."

Brock wants to see more gatekeeping, because "good projects have always gatekept". She adds: "There is this sense in the wider world that open source has always been a wild west, and that anybody can contribute – and that's just not the case."

Beyond that, she sees hope in models like the German Sovereign Tech Agency, which brings together dozens of maintainers into standards development. There are calls in the U.K. for a similar system, with a foundation in the model of the Linux Foundation, or China's OpenAtom, that brings together expertise at a national level to work on intellectual property (IP), managing GitHub repos, and other key elements, for public sector open source.

By professionalizing the industry, however, you run the risk of losing projects when things go wrong. CHAOSS, a Linux Foundation project that measures open source health, is an example of a project in dire straits, having just lost its funding. Former director of data science Dawn Foster left her role in March, and the project has returned to the community.

But, Brock says, "it's hard to reignite the volunteers" when they see funded people doing the work. "So it all has to be done in a very careful, measured, and joined-up way across borders," she explains.

When it comes to the future, Brock remains adamant that urgent action is needed or open source will be consigned to history. "We're already seeing eight companies controlling the AI landscape," she says.

"If we allow open source to fail, the only organizations in the world that will be able to manage that are some of those big tech ones that will already have it in place. So I don't think it's in the human and public interest to allow open source to fail."