Microsoft posted better than expected results from its cloud and AI business, news that helped boost its languishing share price.

Recent earnings statements from major AI players have spooked investors thanks to already heavy capital expenditure being increased further. Last week, Google's shares fell despite record growth and this week Meta saw a similar fall amid concerns about AI spending. By contrast, Microsoft plans to keep its capex spending the same as previously forecast, holding it at $175bn for 2026.

Across the company’s revenue for the quarter was $90 billion, up by 18%, with net income totalling $35.8 billion, climbing by 31%. Revenue from Microsoft cloud was $59.3 billion, up by 27%, with better than expected results at its Azure cloud computing division, which posted revenue growth of 43% for the quarter, above estimates below 40%.

That lifted Microsoft's shares by 8%, rallying after a tough stretch this year that saw it fall more than 18%.

"This year, Azure revenue surpassed $100 billion for the first time, and Microsoft 365 Copilot reached over 30 million paid seats, reflecting the confidence customers are placing in us to power their AI transformation," CEO Satya Nadell said in a statement. The company also reported a $3.2 billion return on its Anthropic investment.

Positive results on AI that are keeping pace with spending are likely what's behind the share price bump, noted Emarketer analyst Gadjo Sevilla. He said the capex figure is likely the most watched line in results right now – and this time that sparked optimism rather than concern.

"Microsoft spent $35.80 billion on property and equipment during fiscal Q4, more than double the $17.08 billion in the year ago quarter, bringing full-year capital expenditures to $115.95 billion – up nearly 80% from $64.55 billion in fiscal 2025," said Sevilla. "Despite that spending pace, the company still generated $55.44 billion in quarterly operating cash flow, up 30% YoY, a positive sign the AI buildout isn't cannibalizing the core business."

Sevilla added: "The company’s diversification strategy, its data center and AI partnerships, and its reliance on its own homegrown AI expansion will continue to stoke confidence to partners and investors while signaling to the rest of the industry how diversifying infrastructure and AI products strikes a balance for growth."

A better way to offer AI?

Alongside that, Microsoft CEO Satya Nadella said the company continues to shift away from a previous focus on OpenAI's models to building its own, saying the aim is to enable customers to pick and choose the best model to meet their needs.

"That's really the enterprise design architecture that we are going to evangelize. We ourselves are using it," Nadella said, according to Reuters, adding that the company's own models are 40% more efficient.

That's a key point amid concerns about the cost of using AI, with Microsoft earlier this week unveiling its own security model that it pitches as half the cost of rival systems.

Not all analysts were convinced, however. Forrester principal analyst Tracy Woo said that the Copilot adoption and strong revenue were good signs that AI investment was paying off "but the results stop short of fully validating the company’s AI strategy”.

"The new partnership with Anthropic helps reduce dependence on OpenAI, yet roughly 45% of commercial RPO [Remaining Performance Obligation] remains tied to that single model provider," she said.

Woo added: "While more AI products are scaling into enterprise‑grade workloads, the unresolved question is whether Microsoft’s infrastructure expansion can ultimately outrun the margin pressure that comes with supporting frontier‑model demand."

Amazon has pledged financial backing for the team behind the Lean programming language as part of a sharpened focus on AI agent development.

In a statement on 26 July, the tech giant revealed it will provide "substantial, long-term” financial support for the Lean Focused Research Organization (FRO).

The FRO leads development of the open source programming language, which Amazon already uses internally in agentic AI development practices.

Lean has been around since 2014 and is a popular programming language across a range of fields including mathematics, physics, and computer science.

For Amazon, the appeal lies in its role in helping develop and fine-tune AI reasoning capabilities. The programming language is used alongside a ‘proof assistant’ - a type of software used to conduct checks of code to identify and sift out errors or flaws.

It’s these ‘correctness proofs’ that make the programming language a go-to option for academic researchers and professionals in scientific fields.

“AI generation of formal proofs in Lean has been a key method for training models with lower error rates, to the point that they are now producing correct solutions to research-level problems,” Amazon explained in a blog post.

Amazon Lean-ing in on agentic safety

Amazon said its support for Lean comes at a critical time both for its own internal AI ambitions and for the industry at large as enterprises ramp up adoption of agents.

Safety has been a key recurring talking point for organizations on this front. As ITPro has previously reported, research shows growing concerns around access control, governance, identity security, and visibility when it comes to agents.

“Coupling generative AI with Lean's mathematical rigor will help enable verified, trustworthy AI agents,” the company said.

Amazon already uses Lean-based verification in its Bedrock AgentCore service, helping to “prove the correctness of the policy language” that ensures agents operate within strict boundaries.

Elsewhere, Lean underpins systems such as SampCert - which provides “mathematical guarantees” for privacy protections in the AWS Clean Rooms analytics platform - and AWS Neuron.

“One scientist recently used an LLM with Lean to prove the correctness of Amazon Aurora's segment repair protocol, our most durability-critical distributed protocol, in a fraction of the time it would have taken manually,” Amazon noted.

“The set of applications is growing fast, and this is just the beginning.”

Peter Van der Putten, assistant professor of AI at Leiden University and director of Pegasystems’ AI Lab, said AWS’ FRO backing is a welcomed move given recurring security-related concerns.

“It is encouraging to see AWS investing in open source technologies such as Lean that have the potential to provide stronger formal verification guarantees for software and AI systems,” he said.

“As agentic AI systems become increasingly autonomous, technologies that can provide stronger correctness and safety guarantees than just traditional testing will become ever more important.”

Van der Putten noted, however, that the inherent complexity of agentic AI development means more robust orchestration and governance is still of paramount importance.

“Enterprise agents operate within complex environments involving workflows, automated processes, policies, regulations, humans in the loop, multiple stakeholders, and countless exceptions and uncertainties that cannot simply be abstracted away but must be dealt with in practice,” he said.

“So even an agent whose behaviour has been verified against a specification must still be able to operate effectively in such a context,” Van der Putten added.

“In practice, the bigger challenge may lie in orchestrating agents, people, data, and systems together in a governed way, while reflecting ambiguity, trade-offs, conflicting objectives, and constantly evolving realities, rather than simply proving that an idealised agent behaves correctly.”

Open source backing

Backing for the FRO serves a broader purpose rather than complementing its own use of Lean, according to Amazon.

“It’s easier to trust a proof when you can evaluate the tools behind it yourself,” the company noted.

“Customers, auditors, and regulators can independently inspect and validate work done in community-governed tools, which is the kind of transparency that safety-critical AI demands.”

The firm said that in the long term, Lean’s growing popularity will benefit the AI industry by providing “more libraries, more tooling, and more formalized proofs for everyone”.

FOLLOW US ON SOCIAL MEDIA

Nvidia CEO Jensen Huang has hailed the capabilities of Chinese open source AI models amidst growing interest in low-cost options for enterprises.

In an interview with Axios this week, the Nvidia chief said competition between open and closed-source models is positive for the broader global AI industry.

“The world needs open models,” he told Axios. “These Chinese models are excellent. Open source models that are excellent should be used”.

Huang’s comments come amidst growing interest in Chinese open source AI models in recent weeks. The Kimi K3 model, developed by Moonshot AI, temporarily paused subscriptions due to skyrocketing demand.

Surging interest in the Kimi K3 model bears similarities to that of DeepSeek, which rocked the US AI industry when it launched in early 2025.

A key advantage of these models lies in both their performance and cost efficiency, the latter of which has become a key focus for enterprises amidst growing concerns over spiralling AI costs in recent months.

As ITPro reported in November 2025, open source AI models often perform on-par with closed source options, and could potentially save enterprises millions in costs each year.

Open source models "routinely achieve 90% or more” of the performance of closed counterparts, the study noted. They also benefit from “significantly lower prices”, with operational costs plunging up to 84% in some cases.

In a research paper published by DeepSeek last year, the company said it spent a paltry amount training its flagship R1 model compared to US rivals who’ve spent billions on training purposes.

Anthropic CEO Dario Amodei suggested building a new AI model could cost over $100 billion in 2024.

Security concerns persist

While the popularity of Chinese AI models continues rising, concerns over security have been flagged repeatedly.

The concerns surrounding Chinese AI models typically focus on areas such as data privacy and national security, with some critics suggesting these tools could be used as a ‘backdoor’ for Chinese intelligence services.

Axios previously reported that the White House could consider imposing restrictions or tight conditions on US firms working with these models.

DeepSeek was subject to the same scrutiny during its rise to prominence across 2025, for example. In August last year, cybersecurity experts told ITPro that using DeepSeek equated to “printing out and handing over your confidential information”.

Huang told Axios that these concerns are a “misconception” and can be used by enterprises safely. On the topic of potential White House restrictions, Huang said this could prove counterproductive and that American firms should consider a breadth of options.

“You can download the models. You could fine-tune it, you can enhance it, you can guardrail it as you desire,” he said.

Huang has a vested interest on this front, however, and noted that increased usage will ultimately benefit Nvidia.

“If there’s great AI, even if it’s open, wherever it comes from, there will be more use,” he told Axios. “Whenever there’s more use, you’ll have to sell a lot more Nvidia computers. We’ll have to build more data centers. We’ll have more services. The technology will diffuse into more industries”.

Bill Conner, president and CEO Jitterbit, said the Kimi K3 launch marks a “clear turning point in accelerating global adoption of Chinese LLMs” but still urged caution with regard to security.

“Enterprises may underestimate the security, accountability, and governance risks associated with adopting new Chinese LLMs,” he said.

“Moonshot AI operates as a cloud service with data stored in China, introducing potential risks for organizations whose data may be shared unknowingly.”

Conner said adoption of Chinese AI models should be treated as a “strategic risk decision, not merely a cost-saving opportunity”.

FOLLOW US ON SOCIAL MEDIA

With AI tools now commonplace in software engineering, nearly two-thirds (60%) of organizations are expected to shrink team sizes by 2029. But that doesn’t necessarily spell bad news for engineers, according to Gartner.

Analysis by the advisory firm suggests the shift toward smaller engineering teams won’t be a cost-cutting exercise, but rather a natural evolution toward more agile, specialized units focusing on specific areas.

Gartner envisages these smaller teams being composed of specialist product managers alongside user experience (UX) - or agent experience (AX) designers, and at least one ‘AI-native’ engineer.

Speaking to ITPro, Gartner principal analyst Aliyah Camacho, said this influx of AI has prompted a rethink of how enterprises can “really make the most of AI and humans working together”.

“What we’re seeing is that organizations are looking at engineers as AI orchestrators,” Camacho told ITPro.

“One aspect of tiny teams is that we’re thinking of them as focused on a product or a set of features for a product, so it’s bringing together more of that product management skills and expertise onto the team.”

The concept of engineers moving toward more of an orchestration-style role has become a recurring talking point over the last 18 months. AWS CTO Werner Vogels told ITPro earlier this year that the traditional image of developers as “code monkeys” is fading.

With AI in the mix, developers and engineers can now focus on other tasks, such as quality assurance and testing, Vogels said at the time.

Gartner’s research echoed this, noting that with the technology handling routine technical tasks, this will ultimately free up engineers to focus on “complex problem-solving and innovation”.

With tiny teams, Camacho said this will essentially remove a layer of friction for engineers. Simply put, the AI does the grunt work, while engineers have time to focus on product development and refining existing software.

These teams will also have their own remit similar to product development teams, meaning they’re staying in their own lane and not getting dragged into other areas.

“What we're predicting to be speed or velocity-type gains with tiny teams is that these small teams are fully accountable for the success of their product or feature,” she explained.

“So removing that layer of having additional approvals and coordination is one type of speed gain,” Camacho added. “Then another is having fewer people on the team means that there's less time spent in that communication and handoff type of activity.”

How tiny are we talking?

Naturally, what constitutes a ‘tiny team’ will vary wildly based on the size of the enterprise. Small teams today, also known as ‘two-pizza teams’, typically have between five and eight people, Camacho said.

Generally speaking, the shift to tiny teams could take this down to five or six. Some, on the other hand, could end up with just two or three, Camacho noted.

“This really varies,” she said. “Some are curious about experimenting with teams of three, and then for others a meaningful reduction in size is down to six.”

Ultimately, these changes will be made on an enterprise-by-enterprise basis, but leaders should be wary of downsizing down too much. These teams should be small enough that they’re agile but also remain effective and have enough diversity of ideas.

Not a cost-cutting exercise

Given that the last two years have seen repeated warnings about AI rendering developers obsolete, some might see a shift to smaller teams and figure this is another excuse to offload staff.

Camacho insisted that this isn’t a cost-cutting exercise, however. Teams will be smaller, but the consultancy predicts there will eventually be more of these tiny units working away in the background building software.

This is where communication from leadership will be vital in fostering change, Camacho noted.

“I think that a huge piece of making this kind of change is communicating really clearly about what it is and is not, and the tiny teams model is not a cost optimization tactic,” she said.

“Rather, it’s a restructuring of teams to best take advantage of AI and human expertise. What we’re seeing with this idea is that team size reduces, but the number of teams may actually stay the same, or may increase, because we’re expecting more demand for complex engineering solutions at organizations.”

Room for juniors

Maintaining robust talent pipelines will also be a key focus with the shift to tiny teams, according to Gartner. If anything, junior engineers will be more crucial than ever to compensate for general attrition and to provide AI-native skills.

The impact of AI on entry-level jobs has been a recurring talking point over the last 18 months, with the need for junior engineers questioned by some industry stakeholders.

This is where the ‘how small is too small’ question comes into play, according to Camacho.

“We absolutely believe that organisations need to continue hiring junior talent to build that pipeline for the future,” she said.

“So the way that fits with tiny teams in this context is reducing team size, but not making it too small because if the team size shrinks too much, that can pose risks.”

Long-term, the solution to developing junior talent could lie in apprenticeship-style models, she added, noting that this “could fit really well with the tiny teams model”.

FOLLOW US ON SOCIAL MEDIA

At the end of June, Apple released the iOS 26.5.2 update, containing a long list of security fixes. The timing of the update differed from Apple’s typical approach, which sees the iPhone maker issue mid-cycle patches for emergency security fixes or urgent bugs only.

Yet when iOS 26.5.2 was released, Apple told Reuters the move was part of an overhaul of its strategy as AI tools find vulnerabilities at scale. Indeed, some of the flaws patched in its update were found using AI, painting a clear picture of what security teams can expect in the future.

Apple is not the only vendor to supercharge its patch release cycle fuelled by AI-enabled vulnerability discovery. This June was Microsoft’s biggest Patch Tuesday ever, fixing over 200 bugs, while a recent Google Chrome patch fixed 400 issues in the browser.

As ITPro has already reported, patching velocity must increase as Anthropic’s frontier AI model Claude Mythos and others like it start to find flaws en masse.

But Apple’s accelerated release schedule highlights the impact on mobile devices – especially when part of a bring your own device (BYOD) policy. What can security leaders do to regain control?

Shrinking attack windows

Experts say shrinking attack windows are making patch management an urgent problem. The time between a flaw being discovered and weaponized is “falling dramatically” as AI tools “accelerate both research and exploitation”, says Tristan Shortland, CTO at Infinity Group.

“Traditional patch cycles that measured response times in weeks are increasingly at odds with a threat environment that moves in hours.”

With this in mind, most industry commentators see the move towards accelerated patch releases as positive. “From a risk perspective, I'd much rather see organizations patch quickly and in a controlled way than wait for monthly cycles and leave vulnerabilities sitting there, waiting to be exploited,” says Nathan Davies-Webb, principal consultant at Acumen Cyber.

Yet rapid patch release cycles add pressure in scenarios where employees use personal devices to access corporate networks. “Apple, Google and Microsoft can remind users to update, but they don’t always enforce it,” points out Jake Moore, global cybersecurity advisor at ESET.

For those that run BYOD policies, the impact of late patching could be vast, agrees Sriram Kakalara, chief product officer at Scalefusion. “Personal iPhones and iPads often access corporate apps and data from outside the IT team's direct control,” he warns.

More updates, less warning

Another challenge is the sheer number of mobile fleets to be updated. The trend towards increasing numbers of mobile device patches could be a problem for larger distributed organizations such as retailers, according to Kakalara.

“These might have thousands of devices running on iOS, and every accelerated release means pushing updates more often and with less warning,” he says.

He points out that many organizations “fail to scale their patching and access strategies as their endpoint estate expands, leaving known vulnerabilities unresolved”.

The onus is now on organizations to operate “faster and more efficiently”, he says.

Beyond simply deploying updates more rapidly, the challenge will be ensuring every endpoint has received them, adds Andy Ward, SVP International at Absolute Security.

“The rise of hybrid working over the last decade has made this increasingly difficult. Remote work and BYOD leave organizations with gaps in visibility that attackers can easily exploit. Every day a critical patch is delayed extends the window of opportunity for cybercriminals.”

While there’s no doubt AI can be beneficial in vulnerability discovery, the pressure on patching as a result of the constant flurry of security fixes is only going to get worse.

Shortland expects more vendors will follow Apple's lead, issuing patches more rapidly in line with vulnerability discovery. “AI is exposing vulnerabilities at a scale we've not seen before, which means the industry will have to move towards more continuous patching and risk-based remediation models, rather than relying on predictable release cadences.”

Security teams should treat Apple's move as “the new normal”, agrees Kakalara. “The precedent means patches can now arrive unexpectedly and without notice, so waiting for a scheduled maintenance window is no longer a viable strategy. Teams need to be on permanent alert, ready to test and deploy at speed.”

No more patch day

It might seem complex, but there are some simple steps security leaders can take to ensure fixes are applied as soon as they’re released, including to BYOD devices.

Rather than banning BYOD, Moore thinks the solution is implementing conditional access controls to ensure outdated devices can’t access company systems. “This means it becomes nearly impossible to have devices running outdated software.”

But at the same time, companies need to avoid treating every new flaw as an emergency. Instead, the focus should be on “what is actually being exploited – rather than what is possible”, Moore advises.

Ian Thornton-Trump, CISO at Inversion6, believes security leaders must make themselves aware of the size of their company’s attack surface, and be able to identify legacy devices “either properly supported by vendors, or unsupported”.

In tandem, Thornton-Trump outlines the importance of firms testing their own defences. “Prioritize red teaming and penetration testing to try and find weaknesses before bad guys do, and before security researchers encourage firms to respond.”

Moore recommends automated patching as an ideal scenario. “Long gone are the days where Tuesday was the patch day,” he says. “Manual processes were built for a far slower time, but as we shift into the AI era, we are going to have to adapt and evolve as quickly as the technology does.”

Davies-Webb concurs. He thinks the point has been reached where not using automatic patching “is becoming harder to justify”.

“There was a time when concerns around stability and functionality made organizations cautious about patching too quickly, but for most, the risk now sits firmly on the other side of the equation,” says Davies-Webb.

“AI is accelerating how quickly vulnerabilities are discovered and weaponized, which means organizations need to be reducing exposure as quickly as they can."

Software developers aren't losing skills because of AI, but using time saved to skill up, according to research from O’Reilly.

Analysis from the learning platform found that rather than the boom in AI coding tools having a negative effect on developer capabilities, many view the technology as a way to streamline everyday tasks to help them focus on learning.

O'Reilly said that use of generative AI content on its own learning platform was up 89% in the UK over the last year, while machine learning grew by 51% and natural language processing was up 117%.

At the same time, O'Reilly noted that more traditional programming topics saw decline over the last year, with "programming fundamentals" down 74%, Agile falling 31%, and Git down 20%.

While that could be seen as software engineers handing off such work to AI and not bothering to study key subjects, the study noted this suggests many are learning such skills on the job and using AI to support learning.

Formal training time, meanwhile, is spent learning about more advanced AI-related topics.

Alexia Pedersen, SVP International at O’Reilly, said the study shows developers are now making AI a “core part of their learning priorities”.

"The UK tech workforce isn’t turning its back on programming," Pedersen said. "It’s building on years of engineering expertise to take advantage of the opportunities AI creates. That’s exactly what we’d expect from experienced developers."

"Many already have years of programming experience, which puts them in a strong position to adopt AI tools confidently and apply them in meaningful ways," she added.

AI isn’t a replacement for core skills

That said, O'Reilly warned that AI should complement, not replace, foundational programming knowledge – especially for newer developers.

As ITPro reported last year, concerns are rising that those entering the workforce are becoming too reliant on the technology. The result is that many could miss out on valuable learning curves in the early stages of their careers.

"The challenge now is making sure the next generation develops those same foundations before relying too heavily on AI," Pedersen commented. "AI will make great developers even better, but it can’t replace the technical judgement that comes from understanding how software really works."

The company suggested that while developers are choosing to learn in different ways, it's worth noting that employers still require specific programming skills.

React, Node.js and Java skills are still highly sought after while cloud-related knowledge is prevalent in many UK job ads.

Indeed, demand for the Clean Code courses grew 19% over the last year, O'Reilly said, with C# up 17% – showing practical coding capabilities remains important.

"What this data captures is a workforce making active choices about where their time goes," Pedersen said.

"UK tech professionals aren't casually browsing AI content – they're incorporating technical learning into new ways of working, building AI agents, testing different approaches, and exploring how these tools can improve productivity and outcomes.

FOLLOW US ON SOCIAL MEDIA

IBM has announced a series of updates to its IBM Bob software development tool, with a particular focus on better managing token consumption.

The move marks the first big batch of updates for the agentic development tool, which rolled out earlier this year. Bob will now offer multi-agent capabilities, the company said, alongside built-in AI cost and usage analytics features.

According to IBM, the new ‘Bobalytics’ feature will enable developers to monitor AI token consumption, streamline resource management, and improve visibility in terms of how AI tokens are consumed by teams.

Sub-agents and multi-agent capabilities will also play a key role in reducing costs, according to IBM. Sub-agents are those that operate under the direction of another to handle specific tasks within a larger workload.

The advantage here is that these dedicated agents will work in an “isolated context” within broader workloads to complete tasks in a more efficient manner, ultimately reducing costs.

Multi-agent features also contribute on this front, according to Michael Kwok, VP of IBM Bob. In a blog post detailing the updates, Kwok noted that Bob will now call on specific tools based on the underlying model, allocating agents depending on the intensity of tasks and associated costs.

“Parallel tool execution can significantly reduce the time required for complex tasks involving multiple searches, file operations and validation steps,” Kwok explained.

“Subagents improve efficiency by performing specialized work in isolated context before returning only the relevant results, while background tasks allow long-running work to continue without interrupting the developer’s workflow.”

AI cost optimization in the spotlight

The move by IBM comes amidst a sharpened focus on AI token consumption - and spiralling costs - by enterprises globally. As ITPro reported in June, the ‘tokenmaxxing’ trend has landed some organizations with eye-water bills.

Uber, for example, blew through its entire annual AI bill in just four months after incentivizing staff to ramp up use of the technology.

Developer teams are also contending with rising costs on this front, as Gartner told ITPro in late June. The consultancy projects that token costs could exceed engineer salaries by 2028 based on current usage rates.

Speaking to ITPro at the time, Nitish Tyagi, senior principal analyst at Gartner, said engineering teams are adopting a range of cost optimization practices to reduce the impact of token consumption.

New ‘premium packages’ for IBM Bob

IBM also unveiled three new specialized workflows for Bob aimed at driving Java, IBM Z, and IBM i operating system (OS) modernization. These capabilities come in separate ‘premium packages’, according to the firm, offering enterprises domain-specific versions of the tool.

“Modernizing a Java application requires different knowledge, tools and workflows than working with IBM i systems or mission-critical mainframe applications. Each environment carries its own architecture, runtime assumptions, integration patterns, validation needs and operational constraints,” Kwok explained.

“Premium Packages bring domain intelligence and decades of enterprise expertise directly into Bob while maintaining a consistent developer experience.”

The premium package for Java, for example, will help automate migration processes, allowing teams to move to more recent versions of the programming language. Bob will essentially guide users through the process, while also assisting with broader modernization practices.

This includes automated compatibility testing and the ability to identify and remediate vulnerabilities.

The premium package for IBM Z, meanwhile, will provide teams with a helping hand during mainframe modernization projects. The Z Code Mode feature, for example, will help “explain, generate, modify, refactor, and transform mainframe application code”.

Efforts to streamline mainframe modernization by the firm come after a high-profile spat with Anthropic earlier this year.

FOLLOW US ON SOCIAL MEDIA

Researchers at Nebula Security have discovered a Linux kernel flaw dating back to 2011 that lets any logged-in user take full root control of an unpatched machine in just five seconds.

Dubbed GhostLock (CVE-2026-43499), it was introduced in Linux 2.6.39 and fixed in Linux 7.1.

The flaw allows an unprivileged local attacker to get a dangling kernel pointer to kernel stack memory with only regular threading syscalls, write a pointer to an arbitrary address, and hijack a function table to get root access.

GhostLock has been shipped by default in every mainstream distribution since 2011, and requires no special privileges or network access. Nebula, which uncovered the flaw, said its exploit is reportedly 97% reliable and can also escape containers.

This particular flaw is the second part of an attack chain dubbed IonStack, with the first step being CVE-2026-10702, a vulnerability in Firefox that allows code execution within the browser and escapes its sandbox.

The vulnerability is rated high (7.8) as the attacker would already need to have local access to the system.

How the GhostLock flaw works

Nebula researchers said the root cause is a function reused by a caller it was never written for: the helper function remove_waiter(). During certain futex operations, it incorrectly clears a pointer associated with the currently executing task, rather than the actual waiting task.

This leaves the kernel with a dangling pointer that points to a memory location that has already been freed and reused. This allowed the Nebula team to gain full control, tricking the kernel into running their own code as the root user.

Daniel Bechenea, security manager at Pentest Tools, said the flaw is of particular concern because kernel exploits have historically carried a “real operational cost for attackers”.

“An unreliable one crashes the box and burns the access,” he explained. “An exploit that Nebula reports as 97% reliable, with public code anyone can run, changes that math.”

"As GhostLock uses a kernel vulnerability, containers also represent a juicy target for attackers as the exploit escapes the container and obtains code execution as root on the host OS, meaning that: containerised workloads that teams treat as isolated become stepping stones to the host and everything else scheduled on it."

Patch now

Systems running older kernels remain vulnerable to exploitation, according to Nebula. Researchers urged users and administrators to update to patched kernel versions as soon as possible.

"On an unpatched host, treat any code execution as root, and plan containment accordingly," advised Bechenea.

"Prioritize the systems that run untrusted or semi-trusted code by design: CI runners, container platforms, shared development machines, multi-tenant hosts, and verify the fixed kernel package version on each system rather than trusting that the April fix propagated, because with several major LTS releases still lagging in early July, attackers who land a foothold will check your kernel version even if you haven’t."

FOLLOW US ON SOCIAL MEDIA

Open source can't catch a break. As the world of software development marches forward with new tools and capabilities expanding productivity – an evolution driven predominantly by AI – the community endures significant headwinds.

"In the age of AI-driven security threats, protecting customer data has to come first," wrote Bailey Pumfleet, co-founder and CEO of scheduling software maker Cal.com, in April.

After five years as "open source champions", the company announced it would go "closed source". Cal.com is far from the only example, with several organizations and projects including Tailwind, curl, Jazzband, Godot – and even the U.K. National Health Service (NHS) – also struggling in the wake of AI.

Tension has always plagued open source, with concerns around funding, infrastructure, and even expectations management, negating any meaningful green shoots. The threat has even been described as "existential", but the community has nevertheless survived and thrived, celebrating incredible adoption rates in recent years. But things feel different. AI poses an existential threat in many areas — but will it continue to hack away at the beleaguered open source community, or is there a viable path forward for the movement?

Open source is battling AI-centric headwinds

"In the past, exploiting an application required a highly skilled hacker with years of experience and a significant investment of time to find and exploit vulnerabilities," wrote Cal.com's Pumfleet in the blog post. The reality is that humans don’t have the time, attention, or patience to find everything. Today, AI can be pointed at an open source codebase and systematically scan it for vulnerabilities."

Security is just one aspect in an increasingly fraught dynamic. Tailwind, the organization behind a popular CSS framework that web developers incorporate into their projects, announced on 7 January it had slashed its four-person dev team to just one. The reason, CEO Adam Wathan cited, was "the brutal impact AI has had"; web traffic to documentation – which is the only way people can find out about its commercial products – was down 40% from early 2023.

There are also examples of projects struggling to cope with an onslaught of low-quality contributions. Take Godot, the open source game engine that's drowning in AI slop code pull requests (PRs), according to one of the primary maintainers, Rémi Verschelde, who described this as "increasingly draining and demoralizing".

The Jazzband collective, a Python project ecosystem, was sunset this year after ten years of activity due to the "slopocalypse" with floods of PRs and AI-generated spam rendering "Jazzband’s model of open membership and shared push access untenable".

There are plenty of other issues to contend with. They may include the fact that using advanced AI tools may be gated on the need to spend money, and that it's unclear whether you're speaking with a human or an AI agent at any given time.

How open source projects are coping with AI

Amanda Brock, CEO of OpenUK, tells ITPro that the industry is still grappling with AI as a novel force and different projects are handling it in different ways – with some handling it much better than others. "For some projects, they have not been able to manage the scale of it. And for some small companies, they have said they've had to close," she says, but added this isn't a universal experience, with others managing to get a grip on the headwinds.

"I'm skeptical about their business plan," Brock added on Tailwind, "and I could be wrong, and I'm not an authority on this in terms of each company's business and whether they were doing well enough. But I'm a bit skeptical when many are surviving about the few that are closing, and I don't know if that's the most vulnerable or the ones without the right business structures or teams."

However, Brock states the challenges are very real and unlike much else the community has experienced. For example: "When AI comes to Wikipedia, it not only comes at a huge scale by volume of eyes on the site or the pages, it looks at every page, and it does it in an instant. And the overwhelm is huge. And that's the equivalent of what open source projects feel when their repos are scraped; when they suddenly have this inbound volume from AI."

An example of a project that's fared better in wrestling with AI is Homebrew, the package manager. Its project leader Mike McQuaid tells ITPro Homebrew's response was to fight fire with fire. "We have had an increase in low-effort activity, but we respond with low effort," he says. "Our bots automatically close issues, we’ll close without review, we don’t dignify them with a response, et cetera."

McQuaid adds that, despite some notable examples, it's overstated that many projects are going closed source or winding down, and it's not representative of the wider experience. He says projects weather the storm "the same way we always have," with one measure including prioritizing maintainers' time, effort, and enjoyment over contributors, and prioritizing contributors over users. Responding to rudeness is also met with low effort, no effort, or blocking. He also suggested leaning very hard onto guardrails.

Resolving the fate of open source

McQuaid says the notion that AI could lead to the end of open source is "far too dramatic" and that there are plenty of positives to enjoy in a grand trade-off, despite there being an element of entering the unknown. These positive improvements include the way that AI allows some people to go much faster, that there are plenty of free AI tools available, and that many of these can help with code review, fixing bugs and triaging.

"It isn’t making huge negative changes without any positive remediations," he explains. "It’s just resetting people’s expectations of what 'working on open source' might be like for them. Some people won’t enjoy it any more. Many people equally are contributing who didn’t or wouldn’t before."

Despite many positive steps taken in the open source world over the last decade, Brock dwells in a sense of pessimism – but not entirely because of the immediate effects of AI. "I have been very pessimistic in some ways for a long time," she says, "because after lockdown everybody came out seeming to think that 'we'd won'." And what we'd won was, we've got a scale of adoption — but that scale of adoption wasn't matched by a scale of understanding, or funding.

"My worry was that you were going to see it, go full circle and end up back in proprietary because of exactly this kind of thing. I did not imagine AI, but I could see that things might happen, that meant that we were just overwhelmed because we got into a position where people expected an SLA-type delivery and support for free because the code was free."

Building on open source's legacy

"If it hadn't been AI, it would have been something else," Brock reiterates, saying the challenges have been piling up "at a time when people are reeling" one after another in the last few years.

"We've just had a decade since we really saw all this adoption start. We're a small group of experts [and scaling from] the small to the many hasn't worked."

Brock wants to see more gatekeeping, because "good projects have always gatekept". She adds: "There is this sense in the wider world that open source has always been a wild west, and that anybody can contribute – and that's just not the case."

Beyond that, she sees hope in models like the German Sovereign Tech Agency, which brings together dozens of maintainers into standards development. There are calls in the U.K. for a similar system, with a foundation in the model of the Linux Foundation, or China's OpenAtom, that brings together expertise at a national level to work on intellectual property (IP), managing GitHub repos, and other key elements, for public sector open source.

By professionalizing the industry, however, you run the risk of losing projects when things go wrong. CHAOSS, a Linux Foundation project that measures open source health, is an example of a project in dire straits, having just lost its funding. Former director of data science Dawn Foster left her role in March, and the project has returned to the community.

But, Brock says, "it's hard to reignite the volunteers" when they see funded people doing the work. "So it all has to be done in a very careful, measured, and joined-up way across borders," she explains.

When it comes to the future, Brock remains adamant that urgent action is needed or open source will be consigned to history. "We're already seeing eight companies controlling the AI landscape," she says.

"If we allow open source to fail, the only organizations in the world that will be able to manage that are some of those big tech ones that will already have it in place. So I don't think it's in the human and public interest to allow open source to fail."

AI-augmented developer roles have increased nearly six-fold over the last five years, as enterprises move from AI experimentation to implementation, according to new research from Randstad Digital.

While there's been an increase of just 28% for traditional developers, the figure for developers with AI expertise has grown by 597%, with nearly one-in-four developer roles now requiring these skillsets.

Analysis of more than 35 million job postings shows technical professionals who acquire specialized credentials are leapfrogging traditional seniority tiers, with AWS Solutions Architect (Pro) and LangGraph/RAG Architect certifications driving estimated salary increases of 54% and 31%, respectively.

"Enterprise AI is no longer a future investment; it is today's operational reality. Yet the biggest barrier to growth is not access to technology, it is access to the right people," said Michael Morris, global head of platform and talent at Randstad Digital.

"Buying AI is easy. Integrating it safely and securely across a complex enterprise is where the true challenge lies. The specialists who can integrate, govern and scale AI inside complex organizations are in critically short supply."

While foundational roles like prompt engineers are still growing at 174%, demand has rapidly escalated up the skills ladder, with AI trainers now the fastest-growing role globally, up 281%.

As ITPro reported in February, demand for AI trainers has skyrocketed over the last 18 months. Researchers said this reflects a broader market pivot toward roles that turn AI’s potential into real support for business growth.

Demand for AI solutions leads is up 226%, process automation specialists up 196%, and AI architects up 152%, Randstad noted.

Finding talent is harder than it looks

While demand for AI-related skills is there, actually filling these positions is far harder than it appears, Randstad noted. Indeed, enterprises are facing acute challenges in sourcing talent.

AI solutions leads are currently the hardest role to fill globally, for example, with time-to-fill timelines hitting 54 days in key markets and vacancy rates of nearly 27% in the US and 18% in the UK.

Despite having talent pools of roughly 100,000 professionals, machine learning engineers face vacancy rates of 8.2% in the US and 11.2% in India. Japan, meanwhile, is facing some of the sharpest shortages globally, with a 46.8% vacancy rate for AI engineers and 25% for generative AI engineers.

All this is reflected by hiring timelines, according to Randstad. While a standard IT role typically takes 38 days to fill, the recruitment window for advanced AI infrastructure roles has expanded to an average of 54 days in the UK and 53 days in the US.

This stretches to a high of 90 days for Process Automation Specialists in Italy.

The result of this is that salary offers are rising sharply, particularly in the US. Across the Atlantic, large language model (LLM) architects have a vacancy rate of 19%, commanding average salaries of $240,000.

Brazil and Argentina have rapidly emerged as a high-growth corridor for specialized AI services, now representing over 15% of global postings combined. In Europe, the UK, Poland, Spain, and Germany show steady demand, with individual national shares between 1.8% and 2.8%, while China accounts for 7.5% of the global job volume.

"AI talent concentrated in the US and India but fast-growing corridors emerging in Brazil, Argentina and beyond, cross-border hiring is becoming a core enterprise strategy," said Morris.

"Organizations that combine global talent sourcing with deliberate investment in upskilling their existing workforce are best placed to close the gap."

FOLLOW US ON SOCIAL MEDIA

Forward deployed engineers (FDEs) could be the key to driving successful AI deployments, as hyperscalers pledge billions to embed specialists within customer teams.

Last week, Microsoft announced plans to invest $2.5 billion in a new division, the Microsoft Frontier Company. The aim here is to deploy upwards of 6,000 AI experts and engineers inside customer organizations.

These specialists will work with enterprises to co-design and build AI systems in a bid to accelerate adoption rates, according to the tech giant.

The announcement came just days after Amazon Web Services (AWS) announced similar plans with a $1 billion investment in its Forward Deployed Engineering segment, once again aimed at bolstering customer AI capabilities.

With the scale of investment – and sheer number of engineers required – for AWS and Microsoft’s push on this front, FDEs are rapidly emerging as the most sought-after technology professionals globally.

Alastair Williamson‑Pound, CTO at Mercator Digital consultancy, told ITPro that the focus on FDEs is an “exceptionally strong signal” that this could become a key growth area for the industry – and a vital pool of talent to drive AI adoption.

“FDEs have become increasingly critical because they sit inside the client, where they can drop barriers, cut through red tape, and get in front of the decision-makers quickly,” he said.

“It’s perhaps why we’re increasingly seeing them considered as a commercial weapon by cloud providers to secure long-term relationships and spend,” he added.

“Another good aspect is that pricing is fixed and based on outcomes rather than time and materials (T&M), which gives customers greater certainty around delivery.”

Williamson‑Pound noted that this aligns with “what companies are after these days”, mainly support in pushing AI adoption projects from pilot to production.

AWS noted that its FDE strategy aims to “compress timelines from months to days” in terms of AI progress, and is “designed so customers are self-sufficient when a deployment ends”.

“Those organizations that are stuck between piloting and deployment can be given that final push by [an] FDE,” he commented.

“The training and documentation they leave behind also tends to give customers that final confidence boost, helping internal teams continue developing and maintaining the system by themselves.”

The rise of forward deployed engineers

Microsoft and AWS are by no means the first big tech providers to put their faith in FDEs. Palantir somewhat pioneered this approach more than a decade ago, and other companies in the AI space have ramped up activities on this front.

As ITPro reported in May, OpenAI launched a new consultancy arm aimed at embedding engineers within customer organizations.

A key distinction here, however, is that the OpenAI Deployment Company is a standalone entity, while both Microsoft and AWS have their own internal divisions dedicated to FDEs.

Crucially, both moves mark the latest attempt by big tech providers to move the needle with regard to enterprise AI adoption, which research shows has been sluggish and at times underwhelming.

Analysis from PwC in January this year found that executives have become increasingly restless when it comes to returns on investment (ROI). Separate research, meanwhile, shows a significant portion of AI projects fail at the first hurdle.

A key factor in adoption project failure often lies in technical capabilities, or lack thereof, according to research from Dynatrace.

With this in mind, providing enterprises with a helping hand throughout the process could provide a much-needed boost for IT leaders.

Initial feedback on Microsoft’s FDE activities show promise on this front, according to Judson Althoff, CEO of Microsoft’s commercial business. In a blog post last week, Althoff claimed that early results have demonstrated “meaningful impact”.

The tech giant embedded engineers within the London Stock Exchange Group (LSEG), for example, helping accelerate AI adoption and providing finance pros with tools to provide answers to complex queries.

Close collaboration between Microsoft’s FDEs and frontline staff at LSEG helped streamline adoption and essentially create a foundation for future improvements, according to Althoff.

“The solution is underpinned by a foundation that is iteratively refined through client feedback and real-time user testing that accelerates each cycle and steadily improves model quality and scope,” he wrote.

Partnerships with Unilever and Novo Nordisk have also delivered marked improvements in terms of AI adoption, Althoff noted.

How FDEs work

FDEs essentially operate like systems integrators (SI), albeit with a few notable distinctions. An SI, for example, is typically an external contractor used to streamline the adoption of individual solutions.

With FDEs, these engineers act as consultants embedded directly within the enterprise. They also offer technical guidance, but it’s the practical support in terms of custom product development that’s a key differentiator. Simply put, they’re building alongside your own engineers.

“Typically, FDEs work in small pods for a fixed period of time, during which they sit within the engineering and technical teams of the client, writing production grade code,” Williamson-Pound explained.

“They leave the customer with a working system in place supported by full documentation, as opposed to an implementation plan.”

JetBrains CEO Kirill Skrygan told ITPro there are a range of benefits to using FDEs for enterprises, and they’re more than just a temporary boost to engineering capabilities.

“FDEs work closely with customers to translate complex organizational challenges into solutions that technology can actually deliver. Doing that well requires more than coding ability," he said.

“It demands architectural expertise, technical leadership, communication skills, and sound business judgment — all qualities that are difficult to automate.”

FOLLOW US ON SOCIAL MEDIA

The SaaS industry is facing a pending wave of disruption as enterprises shift their focus towards agentic AI solutions, according to new research from Gartner.

With agentic AI adoption continuing at pace globally, the research firm said this poses a significant threat to traditional software revenue models.

Indeed, up to $234 billion of application spending will be exposed to "agentic arbitrage" – where agents render some services obsolete by removing the need to work across multiple interfaces – by 2030.

George Brocklehurst, managing vice president at Gartner, said the study shows agentic AI “changes the economics of software”.

“Agentic systems deliver outcomes directly, bypassing traditional user experience (UX)-heavy applications and making the software invisible,” he said. “This breaks the link between user growth and revenue growth for many enterprise software vendors.”

No ‘SaaSpocalypse’, but a ‘metamorphosis’

Long-term, Gartner noted that this agentic AI-focused shift will “refactor” how software is built, priced, and consumed. Indeed, Brocklehurst said a period of “redefinition” could come, with the firm describing this transformation as a "metamorphosis".

“This metamorphosis represents threats and opportunities for both incumbents and new challengers,” Gartner said.

Gartner’s claims regarding a period of transformation for the SaaS space align closely with predictions made by industry stakeholders on the potential impact of AI.

Earlier this year, software stocks plummeted amid a mass sell-off due to the arrival of powerful new AI solutions, particularly Anthropic’s Claude Cowork service.

This spooked investors, with some concerned about a ‘SaaSpocalypse’ whereby agents could remove the need for certain software services.

Despite lingering concerns, some industry leaders are still bullish on the future of SaaS – albeit with a few caveats. As ITPro reported in February, AWS CEO Matt Garman poured cold water on the prospect of a looming SaaSpocalypse, suggesting that “much of the fear is overblown.”

Staying competitive

Remaining competitive in a changing market will require incumbent software vendors to “move from interfaced-based value to outcome-based value,” according to Gartner.

Put simply, providers will need to embed agentic capabilities within their offerings to defend their position and meet changing expectations.

Enterprises don’t want disparate tools and dashboards anymore, the researchers claimed, they want streamlined, end-to-end workflow automation and solutions that “capture customer context and knowledge”.

“As organizations increasingly use agentic AI systems, the user interface is no longer a differentiation,” Brocklehurst said. “Legacy SaaS market share will be cannibalized by incumbents and taken by new entrants delivering horizontal agentic platforms.”

“While this shift is posing an existential threat for vendors who are defending legacy dashboards and seat-based models, it creates a substantial revenue opportunity for vendors who are enabling and developing services and platforms to support agentic enabled cross-domain workflows,” he added.

FOLLOW US ON SOCIAL MEDIA

Unmanaged SaaS guest accounts are creating massive security liabilities for small and mid-sized businesses, new research has shown.

According to Kaseya’s 2026 SaaS Security Report, 69% of SaaS accounts have more guest access than licensed users, with persistent third-party access and externally shared data leaving small and mid-sized businesses open to attack.

Gaps in multi-factor authentication (MFA), OAuth sprawl, and external file sharing are widening the SMB attack surface, the study noted. Indeed, threat actors are now abandoning perimeter attacks in favor of softer targets like identities, OAuth integrations, and collaboration workflows.

This, Kaseya noted, leaves a trust gap most small and mid-sized businesses can't even see, let alone close.

“Today’s AI-emboldened threat actors see one interconnected attack environment, whereas most organizations defend their infrastructure in pieces,” said Jim Lippie, chief product officer at Kaseya.

“The most resilient organizations will be those that embrace continuous monitoring, identity governance ,and automated response as foundational requirements.”

AI scramble has caused OAuth chaos

The rush to adopt AI has led to a sprawl of third-party OAuth integrations that use persistent tokens instead of credentials, and that risks granting attackers permanent data access even after password resets.

As a result, non-human service principal logins now account for one-fifth of critical security alerts.

At the same time, attackers are using AI-driven automation to instantly locate and exploit dormant guest accounts, moving faster than manual defenses can respond.

Legacy controls like geolocation blocks are also failing to help, as attackers route traffic through trusted cloud hosts and VPNs.

Outside North America, Kaseya found nearly half (44%) of unauthorized logins originated from trusted infrastructure and outsourced hubs.

India accounts for 14%, the Philippines 10%, Germany 7%, the UK 7% and the Netherlands 6%.

Hackers are exploit SaaS identity gaps

Once inside, attackers are able to exploit massive identity gaps, with 56% of accounts lacking active MFA and only 27% of SMBs enforcing it across the organization.

Meanwhile, researchers found data leakage is through the roof in productivity environments. In Microsoft 365, 45% of all shared files were sent outside the organization.

Companies are also failing to keep up with severe alerts. Last year, while 98.9% of security events monitored by SaaS Alerts were classified as low severity, organizations still faced more than 278 million medium- and critical-severity alerts requiring investigation.

Kaseya recommends transitioning from rigid perimeter defenses to active, identity-first governance frameworks.

"Bridging the modern trust gap requires businesses to move away from static event tracking and instead prioritize automated behavioral monitoring that can flag anomalous activity inside trusted accounts," the company said.

"By aggressively consolidating security stacks, enforcing organization-wide MFA and continuously auditing machine identities and external sharing permissions, SMBs can eliminate critical visibility silos and systematically neutralize attacker persistence before a breach occurs."

FOLLOW US ON SOCIAL MEDIA

Apple has dropped an unexpected out-of-band patch, and it's apparently because of concerns that AI is helping hackers exploit vulnerabilities at lightning speed.

The tech giant released iOS 25.6.2 yesterday, with fixes for iOS and iPadOS, despite normally bundling such security patches into wider updates. Apple hasn't said when its next major update, iOS 26.6, is set to be released, but it's widely expected in the next few weeks ahead of iOS 27 in the autumn.

Apple told Reuters that the extra security update was down to concerns about AI shortening the time between a flaw being spotted and exploited by hackers.

The company said that shorter timelines from flaw to exploit meant it needed to respond by cutting the time between when updates are announced and released.

That shouldn't be taken as a suggestion that Apple was seeing any evidence that hackers were already making use of any of the flaws included in the update, the company noted.

ITPro approached Apple for confirmation of the changes made to its security patching policy, but did not receive a response by time of publication.

Apple responds to accelerating threats

The move comes in response to wider concerns that AI is helping hackers find flaws more easily and turn them into exploits more quickly. Indeed, this has been a recurring talking point since the release of powerful new frontier models such as Anthropic’s Claude Mythos range.

Last month, Google said it had spotted cyber criminals using AI to build a working zero-day exploit, with John Hultquist, chief analyst at GTIG, warning that an “AI vulnerability race is imminent”

That echoes a warning earlier this year from Daniel dos Santos, VP of research at Forescout, who told ITPro that enterprises should brace themselves for an explosion of vulnerabilities thanks to AI, further adding to the workload of security teams.

Jake Moore, Global Cybersecurity Advisor at ESET, told ITPro that while the “jury is still out” on how powerful tools such as Mythos are, AI advances do mean that security teams and threat actors alike are scrambling to find software vulnerabilities.

"Whenever a new issue is discovered, there's a race to patch flaws before they can be exploited – and if users or security teams hold off on installing updates, it's a gift to threat actors,” he said.

Moore added that increasing numbers of patches mean the process needs to be automated as much as possible to avoid update fatigue for both end users and security practitioners.

"In the age of automated vulnerability discovery, we're past the point of expecting users and security teams in organisations to manually patch everything," he commented.

"Updates should be automated wherever possible to reduce the burden on users while making sure patches are applied rapidly."

Apple iOS 26.5.2

The security fixes released by Apple were previously revealed via a beta of the update, as is Apple's usual procedure, and addressed more than 30 vulnerabilities across iOS and iPadOS.

Those include kernel vulnerabilities that could corrupt memory and trigger system shutdown and a stack of WebKit issues, including one that could leak sensitive data after visiting a website.

Three WebKit flaws were spotted by OpenAI's Codex Security, while another was spotted by a pair of AI researchers using Claude Anthropic.

The update should have already landed on devices, and is supported on these devices:

• iPhone 11 and later
• iPad Pro 12.9 inch, 3rd generation and later
• iPad Pro 11 inch, 1st generation and later
• iPad Air 3rd generation and later
• iPad 8th generation and later
• iPad mini 5th generation and later

FOLLOW US ON SOCIAL MEDIA

AI coding costs could exceed software developer salaries by 2028, according to new research from Gartner, prompting calls for a greater focus on cost optimization efforts.

The projection by the consultancy is a result of two overlapping trends, including surging token consumption rates and the shift to consumption-based pricing (CPB) models.

A host of software and AI providers have pivoted away from flat rate “per-seat” subscriptions in recent months to CPB setups. As ITPro reported in April, GitHub signalled its own shift on this front, citing rising costs specifically as a key factor behind the decision.

Speaking to ITPro, Nitish Tyagi, Senior Principal Analyst at Gartner, said conversations with clients shows this is rapidly becoming a key concern for enterprises, particularly software engineering leaders as teams ramp up adoption of tools.

“What has happened is that most vendors have switched to a consumption-based pricing model, and it took most engineering organisations by surprise,” he said. “We were never thinking that AI will be this costly, and we are already seeing that cost.”

“Initially, it wasn't alarming,” Tyagi added. “While many organizations are still in the range of $200 to $500 per developer per month, alarming results are coming up.”

Tyagi noted that discussions with Gartner clients show heightened use of AI is costing more than $2,000 per developer, per month. These costs are rising as well, with some eye-watering figures now emerging.

“I’ve been talking to clients where they are telling me that my power users are now costing me more than $2,500 per developer, per month. Sometimes we also hear really crazy numbers, like ‘my developer cost me $20,000 last month, or my business users cost me $32,000 per month.”

Reports on surging AI costs have been coming thick and fast in recent months, and some major firms such as Microsoft have gone so far as to implement usage limits or even cut the use of specific tools internally.

As ITPro reported earlier this month, Uber blew through its entire annual AI budget in just four months after encouraging staff to ramp up their use of AI tools internally.

One of the leading causes behind these price increases and hefty bills lies in ‘tokenmaxxing’ – a trend in which enterprises measure AI usage based on the number of tokens consumed by users.

For some, it’s a way of tracking productivity by highlighting their use of the technology, although critics argue this pads stats and results in skewed metrics.

These overlapping trends raise serious concerns about long-term AI usage, particularly around returns on investment (ROI). Simply put, enterprises want their devs using AI, but heightened costs mean that measuring value is becoming more difficult.

“This is becoming a big issue from two aspects,” he told ITPro. “It’s not only related to developer salaries. This will catch the eyes, but the bigger problem here is that organizations were already struggling and justifying ROI for using these tools.”

“Now that the cost has increased, and it is increasing as well, it is becoming even more difficult to justify these costs and to identify where the ROI is.”

Cost optimization practices need to improve

Tyagi is keen to emphasize that the study doesn’t suggest that developers drop AI tools or agents outright. This completely misses the point, he said.

Instead, engineering leaders and enterprises at large need to sharpen up on cost optimization processes. Efforts on this front are critical, particularly as the study noted that vendors themselves are “yet to deliver mature, built-in cost optimization capabilities” for agents.

A key practice highlighted by Tyagi includes context engineering. This is a technique that involves selectively curating, structuring, and managing information used by AI systems to generate responses.

This essentially involves providing only the relevant information needed by agents, as well as concise summarization of content and elimination of "unnecessary data”

Tyagi noted that this will not only help optimize token consumption for developers, but ultimately deliver longer term benefits in terms of output quality.

“Context engineering is going to become the most important skill in the future,” he told ITPro. “If I actually optimize token consumption, the I would be able to increase the output quality as well.”

This is an emerging focus area for software engineering leaders, Tyagi added, and Gartner suggests that context engineering practices could eventually be mandated to cut consumption rates.

It’s also a blossoming market, he noted. Tabnine, for example, recently launched a new solution known as “Context Engine” aimed at streamlining processes on this front while Atlassian is also developing solutions in this domain.

Selective use

Gartner’s research also urges enterprises to establish a “use-case-driven decision” framework when it comes to using AI for everyday tasks.

Simply put, the focus here should be on clearly defining when AI coding agents should be used, and how much autonomy these bots are given on particular tasks. Given the increasing use of agents among developers, many are simply allocating tasks that aren’t needed.

“Not everything has to be done by an agent, not everything has to be done by developers,” he said.

Looking ahead, developer teams should assess when - and when not to - assign agents to specific tasks, which Tyagi noted could help cut needless consumption and ultimately provide greater control.

“When you’re working on highly sensitive tasks or highly complex tasks, then you want your developers to break down those tasks as well into smaller sub tasks,” he explained.

“We have seen when you are throwing smaller clues, problems at agents, agents do much better than giving them an open-ended problem,” Tyagi added. “Agents are improving, but I think developers should have that level of control right now, through which they can actually optimize the token consumption.”

It’s here that model selection is equally important, according to Gartner, specifically for smaller tasks, which can naturally be handled by smaller models.

Using “intelligent model routing” strategies will enable developers to box clever when it comes to smaller, niche AI models or larger frontier options, which typically come with added costs.

The consultancy noted that escalation is needed “only when complexity demands it”.

FOLLOW US ON SOCIAL MEDIA

AI code generation is running out of control, with eight-in-ten organizations adopting AI tools faster than they can develop policies to govern them, new research has warned.

According to GitLab's AI Accountability Report, 92% are facing governance challenges with AI-generated code as rapid adoption continues.

More than nine-in-ten have two or more AI coding tools in active use, the study found, while 54% have three or more. Meanwhile, 78% report that developers are writing and committing code faster since adopting AI tools.

Teams are generally happy with the results, with six-in-ten saying that the ROI of AI coding is better than they'd expected. More than three quarters (78%) also report faster code output and 73% said overall code quality has improved.

However, while 79% agree that individual developer productivity has improved with AI, the overall software delivery process has not accelerated at the same pace.

Indeed, 82% say that AI-generated code risks creating a new form of technical debt that organizations aren't prepared to manage.

"AI coding tools have delivered on their promise of speed," said Manav Khurana, chief product and marketing officer at GitLab.

"But the events of the past few months, including supply chain attacks, reliability issues, and regulators tightening expectations around AI traceability and provenance are making clear that speed without control is a liability, not an advantage."

AI coding is creating new bottlenecks

Notably, 85% agree that AI has shifted the bottleneck from writing code to reviewing and validating it, and 84% that the biggest challenge with AI-generated code is governing what happens to it after it's created.

Nearly-three quarters are concerned about the maintainability of AI-generated code in their organization's codebase.

GitLab also raised concerns about a prevailing trend of overconfidence when it comes to AI coding. The majority (87%) said they’re confident that teams could determine within 24 hours whether AI-generated code contributed to a production incident, for example.

Yet more than one-third (34%) of organisations fail to spot potential issues before an incident took place.

This appears to be down to difficulty distinguishing AI-generated from human-written code (43%), fragmented toolchains (40%), and systems that don't track code origin (39%).

Only 28% say their software development lifecycle (SDLC) tools are fully integrated with shared data and workflows.

New governance practices are needed

According to GitLab, what’s missing is clarity around governance. The majority (83%) of organizations identify AI-generated code accumulation as a risk to manage now, with 44% calling it a top technology risk.

On the upside, 91% of survey respondents said they are likely to invest in AI code governance tools in the next 12 months, and 98% have already allocated or expect to allocate budget toward these efforts.

Crucially, 85% agree the next phase of AI in software will focus less on generating code and more on governing it.

"The teams thinking ahead are already asking the harder question: can we actually control all the code we’re generating?" said Khurana.

"The organizations that will ship trusted software faster are the ones building the foundations of accountability with context, traceability, and governance baked into the platform, not just bolted on after the fact."

AI governance has been a persistent challenge for developers, with research from Aikido last year concluding that AI-generated code is now the cause of one-in-five breaches.

The study noted that 69% of security leaders, engineers, and developers had identified serious vulnerabilities in AI-generated code.

FOLLOW US ON SOCIAL MEDIA

Anthropic has unveiled a new agent designed to act as a virtual teammate within Slack as the company eyes deeper integration with the workplace productivity platform.

Dubbed Claude Tag, the new feature is underpinned by Opus 4.8 and builds on existing tools offered by Anthropic, with the company noting it views the feature as “the beginning of an evolution of Claude Code”.

“We’re launching Claude Tag on Slack, since it’s a natural home for collaborative work between teams and AI, and where much of Anthropic’s day-to-day work already happens,” the company said in a blog post.

Claude Tag works by allowing users to @ the agent within Slack channels. Users can essentially allocate tasks to the agent, helping automate processes to support various projects across any given organization.

According to Anthropic, internal teams have been using the feature for some time, noting that it’s “one of the main ways we get things done”. Indeed, the company said around 65% of its product team’s code is created by its own internal version.

“The same pattern is now spreading well beyond engineering — we’re tagging Claude to chase down product metrics and data, work through support tickets, or even help find the root cause of tricky bugs,” Anthropic said in a blog post.

Using Claude Tag

Anthropic said using Claude Tag will be a familiar process for those already using its AI tools in the productivity platform, or those who have worked with Claude Code or Claude Cowork.

When a user tags the agent with a request, it will “break its task down into stages and then work through them in turn” depending on the tools it has accessed to.

“Once it’s done, it’ll respond in a Slack thread with that it’s created,” the company explained.

Compared to previous Claude-based tools, Tag has several new features. Anthropic noted that the new tool is now “multiplayer”, meaning that each Slack channel will have an individual agent that everyone can interact with.

“This means that anyone can see what it’s working on, and can pick up the conversation from where the last person left off,” Anthropic explained.

This marks a significant change from previous processes, whereby individual employees interacted with Claude within a single chat, or on a specific task.

“It’s much more like interacting collaboratively with a teammate.”

The new agent also learns continuously based on the tasks it’s been assigned, building more context as time goes on. This is a key feature touted by the company, meaning that users don’t need to provide detailed explanations from scratch for each individual task.

Cross-channel context is also another key feature, according to Anthropic. The agent can learn and build context based on conversations in other Slack channels and data sources, provided it’s granted permission.

The company confirmed that it does not learn based on conversations in private channels.

Elsewhere, a new ‘ambient’ mode is available for Claude Tag, which provides users with interactive updates on project progress, tasks, or "whatever it thinks you might need to know”.

“It’ll flag relevant information from across the channels it’s in and the tools it’s connected to, and follow up on threads or tasks that have gone quiet without being resolved,” Anthropic explained.

How to access Claude Tag

Claude Tag will replace the existing Claude in Slack application, and is available now in beta for users working on Claude Enterprise or Team subscriptions.

Given the agent has deep access to sensitive information, the company says it has introduced “tight controls” and system administrators will be needed to provide access.

“To get up and running, system administrators specify which tools and information the model should have access to, in which channels,” the company explained, adding that users should view this as “creating separate Claude identities” for different uses.

“Everything, including its memories, will stay scoped to the channels defined by the administrators,” Anthropic noted. “For example, a model set up for sales work won’t pass on memories to one set up for engineering; nor will it give engineers access to any sales data or tools.”

Notably, administrators can set limits for token consumption, both for individual teams and the broader organization.

The introduction of token limits comes amidst rising concerns over spiralling costs associated with popular AI tools such as Claude and ChatGPT.

Deeper Slack integration

The move by Anthropic marks the latest attempt to provide deeper integration of its tools with the popular workplace collaboration platform over the last year.

In December 2025, the company announced integration of its Claude Code tool within the platform. This integration aimed to embed the AI tool within software developer workflows, also helping to provide updates on project progress.

Notably, users are able to ask Claude Code to investigate and fix potential bugs, conduct code reviews, and improve collaborative debugging efforts for teams.

FOLLOW US ON SOCIAL MEDIA

Windows may be a timeless OS, and practically synonymous with modern PCs, but that doesn't mean it's well-loved by its users. In fact, the opposite might be true in some instances, according to anecdotal evidence as well as reports by publications like Windows Central.

While the development world is far from a homogeneous blob, anecdotal consensus suggests that Windows 11 is the least enjoyed mainstream platform for developers, with systems like macOS and Linux overwhelmingly preferred. But why does Windows 11 have such a bad reputation among developers, anecdotally at least?

Whether it's on internet forums, in blog posts, or in our conversations with experts, Windows 11 is often snubbed in favour of macOS or Linux, depending on the context. In fact, one of the best advantages of Windows, developers say, is the capacity to run Linux on mainstream hardware. There are, of course, some advantages to using Windows 11 for development – but what could Microsoft do to get more developers on board?

Which OS do coders and programmers really prefer?

ITPro consulted with more than a dozen programmers, engineers, and developers to understand why they use the platforms they do, and whether Microsoft has the potential to transform Windows into an attractive destination for coding.

Little research exists into which OS developers truly prefer, although Stack Overflow findings suggest that Windows is the dominant platform in which they work; nearly half (49.5%) use it over alternatives, including macOS (32.9%) and Ubuntu (27.7%), among others. But just because Windows is the "primary [OS] in which you work" — that doesn't mean it's the OS of choice, with organizations and administrators usually calling the shots more often than not.

The developers we spoke with were divided evenly between the three major systems – Windows, macOS, and Linux — with some even using all three depending on the task. However, when we asked which OS they prefer to code on, none answered Windows.

The vast majority say they preferred using macOS when coding, including Mike McQuaid, project lead of Homebrew, the open source package manager. "Apple and the wider ecosystem seem to care more about design and building high-quality applications for free or a reasonable one-off price."

What's the trouble with Windows 11?

McQuaid tells ITPro that "Microsoft’s developer experience on their platforms has never been great", with critique among those we spoke with ranging from concerns with the tools available to the notion that Microsoft is simply less easy on the eye. Where developers use Windows, it's largely because "that's the corporate choice", as Egor Danilkov, global development director at Innowise, neatly summarized it.

The OS is, however, "cumbersome", according to Nikita Kuznetsov, founder and developer of GameAP, an open-source game server management panel, and "ships with tools I don't need"; "the ones I do need have to be installed and configured manually". Some tooling is built for POSIX systems (Linux and macOS) first and is then ported to Windows, so these versions don't always behave as expected.

Many complaints center on inconsistency, with the notion that different developers on identical Windows hardware may end up with environments that behave differently. Windows is also a massive target and attracts far more malicious attention.

There's also the question of how "managed" company machines are. That's something that Jessica Kerr, engineering manager of developer relations at Honeycomb, an observability platform, can attest to.

"Companies can put more restrictions on Windows machines, and these restrictions hamper developers. As a software engineer, I install software. I run unverified, unapproved apps (for instance, when I’m writing them)," she says. "I access the file system from the command line and write scripts and run ad-hoc programs. Windows computers can be locked down, and Macs… if they can be locked down like that, I’ve never seen a company do it."

Much of the feedback around Apple's flagship OS is around the Unix-based terminal, which feels more natural to use and can be very powerful, as well as the fact that shell scripting, SSH, and command-line tooling all behave as you'd expect. Some of the positive feedback also centers around the user interface, which is universally considered intuitive, clean, and well-designed – not that Windows 11 doesn't have its fans. An additional benefit for Danilkov is the way that Apple devices work so well together.

Windows has its problems – but is the criticism unfair?

Danilkov describes some of the criticism as "outdated", suggesting Windows 11 is "leaps and bounds better" than its predecessors and that "many reactions to Windows are based on a version of the platform used years ago". This is an idea that Jitesh Keswani, managing director at e intelligence, a digital marketing agency, expands on.

"In the past, developers found it difficult to get their development environments up and running," he explains. "This typically involved a plethora of command-line tools. In addition, many of the development environments set up on a developer’s Windows desktops would not work in the same way on the Linux-based production servers that they were deployed to. This is a legacy problem that Windows still has to overcome."

Windows does have its advantages – and that primarily comes in the form of Windows Subsystem for Linux (WSL), which lets developers run full Linux environments directly on Windows 11 platforms without the need for a dual-boot setup or virtual machine (VM). Dwellwell Analytics' data science engineer, Olga Kuzmich, humorously quips: "The best feature for developers on Windows is the one that lets you run Linux."

This system repeatedly came up in our conversations. Many of the compatibility issues simply aren't relevant anymore thanks to this platform. It also means developers can run Windows applications, Linux tools, Docker containers, and more, all on the same machine. The next iteration, WSL3, is also getting a major upgrade, with new features such as the ability to take full advantage of your machine's GPU and NPU without a "performance tax".

The other advantages come in the form of Visual Studio, which Danilkov and Taimur Ijlal, information security leader at Proxy Coupons, UK, both describe as one of the strongest Integrated development environments (IDEs) available. Ijlal also describes Windows Terminal as "top shelf". The advantages of coding on Windows also extend to certain development platforms. As Jiří Fabián, co-CEO & founder of TopMonks, put it: "I would choose Windows only if I were a .NET developer working on Windows desktop applications or a game developer."

Giving Windows a new lease of life for coding and programming

With so much hesitation and opposition to using Windows as a system for coding, barring the ability to run WSL, is there anything that Microsoft can do to tempt the developers that ITPro spoke with?

There isn't a clean fix, says Omari Wright, web development manager at digital marketing agency seoplus+. "A lot of what makes macOS work well for development teams is structural, and changing it would mean Microsoft moving away from the openness that Windows users value," he says, adding that the tech giant could push harder on WSL and "make it feel less like a workaround and more like a first-class development path".

Nothing, however, would pull Kuzmich back. "Linux is just too natural now, and I think a lot of developers feel the same. That's exactly why, in my opinion, Microsoft had to ship WSL in the first place, and this is very telling."

Doubling down on WSL and improving this as a feature is where the majority of developers we spoke with centered their feedback around. Microsoft could make the remaining gaps between Windows and Linux file systems less noticeable, for example, and improve performance when working with larger repositories, containers, and some tools.

Keswani also suggests that Microsoft should push Windows as close as possible to a native Linux environment without sacrificing the user-friendly elements. This focus on user-friendliness is great "for end-users who don't need to know much about what's going on under the hood," Fabián adds, but to win more developers over, "Microsoft would need to base the core of Windows on Unix, which will never happen".

He continues: "With the rise of AI and heavier terminal usage, I need all core Unix utilities bundled with the system, without having to install and maintain them myself — tools for file manipulation, SSH, search, and so on."

McQuaid, meanwhile, centers his criticism on the direction that Microsoft has been taking Windows in the last few years, lamenting: "Stop trying to overrule my preferences on how to use my computer". He tells ITPro: "I use Edge and Bing there now just because they keep overruling or pressing me to change my defaults.

"There are ads (or what feels like ads) and upselling all over the OS. It’s gross and feels bargain-basement compared to Apple. I'd love to see Microsoft make Windows feel like “spammy” and more of a cohesive, overall pleasant developer experience."

There are various reasons why developers prefer other systems over Windows 11, macOS especially, with the main benefit of Microsoft's flagship OS, according to the programmers that we interviewed, being the fact that it lets you run Linux and bypass Windows entirely.

Nobody, Microsoft included, would describe Windows 11 as perfect, hence why there's such an active Insider program with updates shipped frequently and continuously. There are some unrealistic demands on developers' wish list, like making Windows Unix-based, but more realistic seems to be giving WSL more love – making it streamlined, more functional, and more powerful so that developers feel more supported by their devices at work.

Every day, your organization sends thousands of emails, yet fragmented signature management in Microsoft 365 creates security blind spots, legal compliance risks, and endless IT troubleshooting tickets.

The Microsoft 365 Email Signature Compliance Checklist is a quick-reference guide built for IT professionals to reclaim control. This blueprint outlines the 5 critical pillars of modern signature governance:

Legal & Compliance: Instantly update global disclaimers to meet GDPR and CCPA frameworks.

Ironclad Security: Eliminate template tampering and secure visual hosting domains.

Operational Efficiency: Eradicate manual HTML pasting by syncing dynamically with Azure AD (Entra ID).

Cross-Device Standardization: Guarantee flawless, unified branding across all Outlook clients.

Frictionless Collaboration: Give Marketing the autonomy to run banner campaigns without IT tickets.

Stop firefighting formatting bugs. Download this checklist today to secure your environment, empower marketing, and free up IT capacity for strategic initiatives.

The UK government has announced a series of measures to support open source AI developers with funding, mentoring, and a direct line of communication into government.

A new Open-Source AI Builder Fund will see more than £500,000 worth of compute - 160,000 GPU-hours of processing power from the UK’s AI Research Resource - set aside for innovators to turn prototypes into AI tools that improve public services from libraries to the NHS.

An Open-Source AI Builder Mentoring Scheme will pair up the winners of a recent Hack for Impact hackathon with experts from the Incubator for Artificial Intelligence (i.AI), the government’s in-house AI team, to help the best ideas become working public tools.

Held in partnership with Nvidia, the hackathon saw hundreds of open source AI developers from across the UK build tools to tackle challenges across public services and city infrastructure, using open data from the City of London.

A new Open-Source AI Dev Board, meanwhile, will give ten UK-based developers under the age of 30 a direct line into government, so they can influence how AI is used and developed.

Chaired by AI Minister Kanishka Narayan, the board will convene a series of roundtables over the rest of this year.

"The best AI tools in the world won’t be built behind closed doors by a handful of companies. They’ll be built by people who ship code, share it, and let others make it better," said Narayan.

"We want those people choosing to build here in Britain. And we want them to know that this is a country that backs them to succeed."

Open source focus welcomed, but work still to be done

The government’s focus on open source AI is a welcomed move, according to Sopra Steria CTO Andy Whitehurst.

Recent analysis from OpenUK showed the UK’s community is growing at a nominal rate, with more than 38,000 UK-based developers now making at least one contribution to open source projects in Q1 2026 - a 7% year-on-year increase.

Whitehurst noted, however, that the UK tech industry still faces acute challenges in terms of marketing itself as a go-to destination.

"Targeted interventions like the builder fund and support programs are a positive step in helping projects move from prototype to real-world deployment, but economic uncertainty, constraints around data use, and the reality of a relatively small standalone market can still make the UK a harder proposition for some AI providers, particularly those that rely on large, diverse datasets or cross-border operations," he said.

Whitehurst added that if the UK wants to be a “true global AI leader” which attracts the best talent and supports its own “homegrown champions”, it needs to focus on three key foundations.

“Sovereignty, in terms of control over critical technology and data; scalability, so AI businesses can grow and adapt; and skills, to ensure a strong domestic talent pipeline,” he commented.

FOLLOW US ON SOCIAL MEDIA

Euro-Office launched with a mind to shake up the productivity software space by giving European enterprises a “sovereign alternative” to products such as Google Workspace and Microsoft 365.

But it’s had a rocky start since launching this week, with critics lambasting the productivity suite as a “de facto ally of Microsoft”.

An open letter from The Document Foundation, the maintainers behind LibreOffice, detailed a series of gripes with Euro-Office. First and foremost, it claims the coalition responsible for development has deceptively marketed the product as the first open source productivity suite built in Europe.

That title, TDF noted, belongs to OpenOffice.org, which was launched in 2001 and based on StarOffice source code, and subsequently followed by LibreOffice in 2010.

“We feel compelled – reluctantly, since open source should rest on transparency, not deception – to correct this claim,” the open letter reads. “These are two genuine open-source office suites, built from source code that originated in Europe.”

Euro-Office document format slammed

Adding insult to injury, TDF claims that the OOXML (Office Open XML) document format used by Euro-Office makes it a “de facto ally of Microsoft”.

OOXML is a proprietary document format developed and controlled by Microsoft, and is used in the tech giant’s various document, spreadsheet, and presentation products.

The use of this format, TDF suggests, is a red flag for users aiming to shore up sovereignty practices by virtue of the fact control remains “firmly in Redmond and far from Europe”.

“Document formats are a subject still rife with misinformation. This is understandable on the part of Microsoft, which developed and controls the horrible proprietary OOXML format, designed precisely to prevent Digital Sovereignty by maintaining content lock-in,” the open letter reads.

“It is far less understandable on the part of companies that claim to advocate open source, such as those promoting Euro-Office.”

OpenDocument Format the 'pillar of digital sovereignty'

According to TDF, use of the ISO-standardized OpenDocument Format (ODF) should be used as a baseline for what constitutes a truly ‘sovereign’ productivity suite.

Italo Vignoli, a founding member of TDF and author of the open letter, describes this as the “pillar of Digital Sovereignty” and fired a broadside at companies promoting so-called sovereign products.

“It is worth remembering that many of those who champion Digital Sovereignty today were silent back in 2006, when the open ISO/IEC ODF standard — the pillar of Digital Sovereignty — was announced: not only did they not listen to us during all these years, but in some cases they greeted us with a condescending smile,” the open letter reads.

A spokesperson for Nextcloud told ITPro the company agrees that proprietary file formats are a “serious hindrance to digital sovereignty”, adding that the company intends to improve ODF support.

“We thus need to free users who are stuck using these formats, and enable them to work with an open office platform. This will allow organizations to transition to open document formats like ODF,” the spokesperson said.

“For this reason, as we stated before in our blog about our roadmap, Euro-Office will focus development efforts on improving ODF support. Ultimately, ODF should be the standard - not OOXM, and we will work towards that.”

FOLLOW US ON SOCIAL MEDIA

Apple has announced a long-awaited overhaul of its Siri personal assistant in a move analysts have described as a clear signal of its future AI approach.

As part of the upgrade, Siri will be integrated with Apple Intelligence, the tech giant’s in-house AI platform, and will be renamed ‘Siri AI’.

Expected to launch later this year, the upgrade will reframe Siri as more of a chatbot akin to the likes of ChatGPT, Claude, or Google Gemini – the latter of which underpins the AI assistant following a billion dollar deal.

This means Siri will provide users with answers to queries sourced from information on the web in addition to traditional personal context-focused queries.

Apple described the revamped Siri as “profoundly more intelligent, knowledgeable, and capable” compared to its predecessor.

Siri revamp highlights Apple’s AI focus

The move by Apple follows a lengthy process to deliver functional AI capabilities for users, an aspect of the company’s approach that has drawn criticism from customers and raised questions over its direction with the technology.

While Apple touted AI-powered upgrades to the assistant back in 2024, the company has repeatedly postponed any concrete announcements on this front. Indeed, the company appeared to acknowledge its lack of progress on this front at its Worldwide Developers Conference yesterday.

Craig Federighi, senior vice president for software engineering at Apple, said the company has taken a measured approach to integration of AI across its product ranges.

“Some appear to be racing forward, seemingly pursuing AI for the sake of AI, without clear regard for the people, all of us, that it’s ultimately meant to serve,” he said.

Ben Wood, Chief Analyst at CCS Insight, said Apple provided users with “some answers” to long-running questions about its shortcomings in AI.

Crucially, while new features outlined by the company aren’t exactly groundbreaking, the company’s track record in streamlining integration could make a big difference.

“Having acknowledged its shortcomings at last year’s event, there was no margin for error,” he said. “Many of the new AI-powered capabilities are similar to those offered by rivals, but Apple has a strong history of integrating such features in ways that make them more accessible to users across its deeply integrated hardware, software, and services.”

“It is also clearly seeking to differentiate through its privacy promises,” Wood added. “This looks like a step in the right direction, but there is no room for complacency, and Apple still has a long AI journey ahead.”

On Gemini’s involvement in the Siri upgrade, Wood said that speculation had been mounting ahead of the event over whether any upgrade would essentially be “Apple Intelligence powered by Google Gemini”.

Notably, however, the tech giant appears to have used the model to “accelerate and improve” the development of its own foundation model – a crucial factor for the company when it comes to privacy-related considerations.

“Apple remains in charge of pre-training, post-training, and reinforcement learning and is putting a strict privacy layer around the entire experience,” he said.

Forrester VP principal analyst Dipanjan Chatterjee echoed Wood’s comments both on privacy and potential integration challenges. Apple’s unique selling point lies in simplicity, he noted.

“In classic Apple fashion, the focus shifts from underlying technology to outcomes: usefulness, simplicity, and trust. The lesson for brands is clear: market the value, not the ingredients,” he said.

Winning over skeptics

While the overhaul marks a “watershed moment” for Apple, Forrester VP principal analyst Dipanjan Chatterjee said the company’s stop-start approach to AI over the last three years means it still has many skeptics to win over.

“After stumbling with the Apple Intelligence roll-out, Apple’s success will hinge on delivering the new Siri experience quickly – and ensuring it works as promised for iPhone users at scale,” he commented.

“I think Apple will convince the only skeptics that really matter – it's customers and prospects who may be getting their AI fix elsewhere – so long as they deliver what they have promised, and in short order.”

Chatterjee noted that Apple customers have “cut them plenty of slack” so far despite obvious shortcomings. Indeed, the company hasn’t witnessed a negative effect on revenue growth or its user base, but that could change if the rollout once again stalls.

“That grace period has an expiry date. A second miss, after Apple Intelligence, with Siri AI could hasten that date significantly.”

FOLLOW US ON SOCIAL MEDIA

Asana has unveiled a series of new features aimed at streamlining collaboration between human workers and agents as it looks to “solve the AI productivity gap” for enterprises.

Among these is Asana Dash, a new AI “chief of staff” designed to support employees and keep projects on track.

According to the firm, the tool helps users stay up-to-date with project goals and progress, compiling and summarizing relevant information such as email correspondence, messages between team members, and progress reports.

The new tool forms a key component within Asana’s new Agentic Work Management platform, unveiled at the company’s Work Innovation Summit in London this week.

This platform acts as an underlying “operating system” combining core products with the goal of consolidating workflows within a single domain.

Elsewhere, updates to Asana’s AI Teammates feature complement Dash, according to the firm. New integrations for Gmail, Outlook, Slack, HubSpot, Figma, and Canva were announced at the London summit along with a Skills library for “repeatable work”.

These two features are intended to work in-tandem, helping support project work, according to Asana. Dash can even assign actions to human workers or AI Teammates.

“It captures follow-ups from meetings, Slack threads, and email, turns them into structured work in the Work Graph, and connects users to the right AI Teammates for specific tasks and projects to move work forward,” the company said.

Tackling the “AI productivity gap”

The new features launched by Asana aim to tackle a common recurring pain point for enterprises using AI tools: mismatched productivity gains.

Research conducted by the firm shows that while 75% of knowledge workers now use AI in daily tasks, only 5% of companies report “meaningful” productivity improvements.

The company attributes this problem to four key areas. First and foremost, this includes an inability to select the “right agents” for specific individual needs and tasks.

Notably, the company said “agents aren’t team players,” adding that teams often use them in a fragmented manner spanning multiple domains and workflows. Context also matters, according to the firm, and agents typically aren’t fed with relevant data or information on how to support teams.

“Most agents aren’t onboarded with the context of how their teams operate, prior decisions, or what their priorities are,” Asana noted.

Finally, concerns over governance and safety are also hampering progress with agents. IT leaders are growing increasingly worried about agents “operating with unchecked data access” and little cost oversight.

According to Asana, this combination of issues means organizations “need an operating layer on top” of AI tools and associated software - “a place where humans and agents run critical workflows together”.

Asana CEO Dan Rogers said development of this operating layer builds on the firm’s Enterprise Work Graph, launched in 2021. This gave users “shared memory, multiplayer coordination, and governance”.

Rogers noted this is “precisely what the agentic era requires”.

“Asana’s OS is how AI moves from helping individuals work faster to supercharging entire organizations," he added.

The agentic operating system

The move by Asana bears similarities to Salesforce’s “agentic OS” announcement in October last year. As ITPro reported at the time, the CRM giant identified a similar problem when rolling out its Agentforce service.

In a similar vein, teams were often found working with disparate agents and datasets, which hampers cross-functional collaboration and broader productivity gains.

Salesforce rebranded Slack as an agentic OS with the aim of providing a single point of reference for business data and agents. That move saw CRM data from Salesforce made directly accessible within Slack.

FOLLOW US ON SOCIAL MEDIA

The accelerating use of AI in software development has led 60% of global organizations to ship untested code, prompting warnings over potential security risks.

According to Tricentis' 2026 Quality Transformation Report, the proportion has dropped only slightly since 2025, when it was 63%.

Crucially, the reasons behind the volume of untested code have changed. Last year, the company attributed much of this to accidental quality control slips, cited by 40%.

Now, though, 32% of organizations admit that they are doing it knowingly, mainly because of leadership pressure to prioritize speed over quality. Three-in-ten blamed the sheer volume of AI-generated code, which is overwhelming quality control and testing processes.

“Accelerating business transformation initiatives is one of the top priorities for today’s C-suite and AI has the potential to help software development teams move faster than ever before,” said Kevin Thompson, CEO of Tricentis.

“However, with increased speed comes increased risk. When software quality processes fail to keep pace with development speed, organizations often respond by taking shortcuts that materially degrade or reduce confidence."

Poor code quality is now a global problem

The problem was found right across the board, with more than half of organizations across every major industry surveyed reporting deploying untested code to production.

The trend was most prevalent in financial services (64%), retailers (63%), and energy and utilities (58%).

Governance is also suffering, the study noted. While 48% of organizations have fully implemented AI internally, more than half of those report that their AI tools and processes regularly change.

Similarly, a third of teams cite tool complexity and sprawl as a key barrier to achieving continuous software quality at scale.

Other top barriers include skills gaps, cited by a third, code volume increasing faster than they can manage (28%), and a lack of clear quality and trust metrics (26%).

Conflicting priorities put enterprises at risk

Notably, researchers said what’s considered AI progress in the boardroom may feel more like operational friction to software teams, highlighting a growing divide between the C-suite and frontline workers.

Just over four-in-five CEOs reported high confidence in AI-driven systems and tools, compared with just 56% of QA and DevOps professionals.

Similarly, 44% of C-level executives believe their business is very prepared to operationalize, govern, and scale AI agents across the SDLC, compared with just 23% of QA and DevOps professionals.

While 83% of organizations trust agentic AI to make release decisions and 82% say they are prepared to operationalize and govern AI agents at scale, many continue to struggle with untested code (60%), tool sprawl (33%), security concerns (27%), skills gaps (24%), and data quality issues (24%).

Poor quality hurts the bottom line

Naturally, there's a financial cost associated with this poor software quality. Around one-in-five organizations report losing more than $1 million annually as a result, mainly because of security and compliance failures (30%) and technical debt and rework (28%).

"As risks like financial performance and customer trust become more visible and measurable, software quality can no longer be treated as just an engineering concern. It must become a boardroom imperative," said Thompson.

“As development accelerates, leaders need clearer visibility into software quality risk and stronger alignment between engineering, QA and the broader business. The organizations that succeed will be the ones that can scale speed and control together.”

FOLLOW US ON SOCIAL MEDIA

Europe's rival to Microsoft Office and Google Docs, Euro-Office, is set to start shipping next week as part of the bloc's move towards sovereign technology.

First announced in March, Euro-Office has involved a collaboration between a number of European companies and organizations, including IONOS, Nextcloud, Eurostack, XWiki, OpenProject, Soverin, Abilian, BTactic, OpenXchange and Office.eu.

It's a web-based editor integrated into other products that handle documents, for example file-sharing solutions, online wikis, or project management tools.

It allows users to view, edit and work with others on spreadsheets, documents, presentations and PDF files, as well as other file formats including DOCX, PPTX, XLSX, PDF, ODT, ODS, ODP, and TXT.

Users can edit documents, spreadsheets, and presentation files with others in real time and save the document back to the application used to open it, or download in various file formats.

The inspiration behind Euro-Office

The Euro-Office project comes as part of a growing trend to try and reduce EU reliance on US software.

The new office suite will be released as an integration in solutions from participating companies from the start, including the latest Nextcloud Hub 26 Spring version.

IONOS Managed Nextcloud customers will follow, with the roll-out to IONOS’ Nextcloud Workspace offering planned for later this summer.

French company XWiki expects to integrate it in the fourth quarter of this year, while Netherlands-based Office.eu also plans to roll it out.

“Our top priority was to provide a version that people could actually work with. First, we had to clean up the code, implement some security updates, and integrate Euro-Office with existing solutions,“ said Frank Karlitschek, CEO of Nextcloud.

"The next step is to work on the desktop and mobile apps and integration features. For a truly sovereign solution, it is also important to fully support open standards such as ODF formats, and this will be on top of the agenda for the next release."

In order to make it as easy as possible for contributors to join the open source project, automated testing has been set up, code comments have been translated into English, documentation has been improved, and the code has been cleaned up.

Controversy surrounding Euro-Office

There's a bit of controversy around the project. Euro-Office is based on the code of open source productivity suite OnlyOffice.

In March, project maintainers issued a statement accusing Euro-Office of violating the software’s licensing terms and international intellectual property law.

OnlyOffice is distributed under the GNU Affero General Public License v3 (AGPL v3), with a few additional requirements, OnlyOffice said.

These include preserving OnlyOffice branding in derivative works, providing proper attribution to the original technology, and fully complying with open source distribution obligations.

"These conditions are not optional. They are a fundamental part of using the software legally and ethically," the firm said.

"Any argument that a modified or derivative version of the software may be distributed under a “pure” AGPLv3 license, excluding the additional conditions imposed pursuant to Section 7, is legally unfounded."

Euro-Office is available on GitHub, here.

FOLLOW US ON SOCIAL MEDIA

Software developers are reporting marked productivity gains with AI, yet new research from Harness shows the use of the technology is creating greater downstream challenges.

Findings from the company’s 2026 State of Engineering Excellence report suggest areas such as code quality and validation are being overlooked since the mass-integration of AI, and it’s creating bigger workloads and leading to higher levels of burnout.

“AI adoption is now the default in engineering organizations, and self-reported impact is overwhelmingly positive — but the cost is accumulating in places organizations aren't watching,” the company said in a blog post.

Indeed, Harness found that many developers are now spending more of their day on manual remediation tasks. Around 81% said they spend more time in code reviews since before the adoption of AI tools, for example.

More than one-quarter (28%) reported spending 30% longer on these tasks on average, according to Harness.

Worse still, nearly one-third of that activity isn’t tracked by teams, creating a trend of “invisible work”.

Organizations estimate that roughly 31% of developer time is now consumed by invisible work, which typically involves reviewing AI-generated code, fixing bugs, and switching between disparate tools.

Trevor Stuart, SVP and General Manager at Harness, said the findings show that while AI is not only changing how developers build, but how they spend their working day.

This, Stuart noted, means organizations need to overhaul how they measure developer productivity to compensate for changing workflows.

"Cloud and the internet were infrastructure revolutions layered underneath the developer,” he said.

“AI is reshaping the developer's job entirely, and the measurement frameworks that the industry has relied on for the past decade weren't built for this new unit of work."

Changing developer metrics

Harness noted that previous frameworks for measuring productivity and efficiency simply aren’t able to keep up with current AI-fueled working patterns.

Around 89% of tech leaders still trust metrics that don’t accurately reflect AI’s impact on individual developers or teams at large.

Moreover, 94% said key considerations such as tech debt and developer burnout rates are missing from metrics, painting a convoluted picture of overall performance which fails to scratch the surface.

“The biggest AI challenge is measurement itself,” the company noted in a blog post detailing the findings.

“When asked to name the single biggest challenge, the top answers are all visibility problems: measuring true productivity impact (26%), maintaining code quality with AI (24%), and proving ROI to leadership (18%).”

Measuring developer performance

According to Harness, changes to how performance is tracked needs to take AI into account.

The company recommends that enterprises approach this by considering the impact of tasks such as code validation, as well as the overall quality of code produced by AI tools.

This, the company noted, will paint a clearer picture on how workloads are changing due to new follow-up tasks created by AI.

Organizations should also “treat AI performance as its own discipline”, the study noted. This includes tracking AI agent accuracy, acceptance rates of AI outputs, and costs associated with the tools separately from human developer output.

Developers should also be given a say in how performance is measured due to the influx of AI tools, according to Harness. Nearly half (49%) of developers said they want to be involved in defining metrics themselves.

This is crucial, the report noted, largely because there’s a growing perception gap on how AI is actually impacting teams.

Managers, for example, are nearly four-time more likely to report no concerns on how productivity metrics are measured compared to frontline practitioners.

FOLLOW US ON SOCIAL MEDIA

The UK Competition and Markets Authority (CMA) has launched a strategic market status (SMS) investigation into Microsoft’s software licensing practices.

The probe, which the regulator touted in late March, aims to establish whether the tech giant’s position in the market has a negative impact on competition and consumer flexibility.

In a statement announcing the move, the CMA said the probe will primarily focus on business software products used by organisations across the country, including:

• Productivity software
• Personal computer and server operating systems
• Database management systems
• Security software

Microsoft business products, which include Windows, Word, Excel, Teams, and Copilot, are used by hundreds of thousands of firms and public sector organizations across the country, the CMA noted, with more than 15 million commercial users.

The regulator highlighted concerns that UK customers “may not always be able to effectively combine software from Microsoft with that of other providers”. This, it said, could limit their ability to access preferred products at competitive prices.

“The CMA’s investigation will examine whether Microsoft has SMS in business software and consider whether it can use that position to limit customer choice,” the CMA said.

“It will assess whether bundling of products, limits in interoperability or default settings can prevent customers switching and weaken the competitive constraints Microsoft faces from rivals.”

Notably, the CMA said its decision to launch the probe comes in the wake of a previous investigation into the UK cloud services market.

The regulator’s lengthy probe found the dominance of hyperscalers including Microsoft and Amazon Web Services (AWS) had a negative impact on competition in the UK market.

Microsoft has repeatedly faced scrutiny over its software licensing practices. Slack, for example, filed an EU complaint in 2020 amid claims the company had engaged in anticompetitive behavior with Teams bundling practices.

EU-based trade group, Cloud Infrastructure Services Providers in Europe (CISPE), filed a similar complaint in 2022, alleging that Microsoft imposed higher charges for customers running software on rival cloud platforms.

Microsoft and CISPE agreed to a settlement in mid-2025, which was met with criticism by other industry groups.

CMA seeks business feedback

This latest probe into Microsoft practices must be completed within nine months, according to the regulator. A decision on whether to designate the tech giant with strategic market status is expected by February 2027.

In the meantime, the CMA said plans to gauge the thoughts of businesses across the country using Microsoft products, as well as challenger companies, over whether product choices may be limited.

This includes concerns surrounding product bundling, lack of interoperability, and default settings used by the company.

“Our aim is to understand how these markets are developing, Microsoft’s position within them and to consider what, if any, targeted action may be needed to ensure UK organizations can benefit from choice, innovation and competitive prices,” said Sarah Cardell, chief executive of the CMA.

A spokesperson for Microsoft told ITPro: "We are committed to working quickly and constructively with the CMA to facilitate its review of the business software market."

FOLLOW US ON SOCIAL MEDIA

Consumers own very little of the data they generate, and this feeds directly into the business models of many digital enterprises. But this landscape is being reshaped by legislation and independent organizations – with potentially big implications for IT leaders.

The Fediverse, for instance, is a decentralized social media framework that creates a network of independently operated servers, communicating via shared protocols that let users move between social platforms without being locked into a big tech ecosystem.

Even further reaching is the Solid Project. Solid – short for social linked data – is a web-decentralization project spearheaded by World Wide Web inventor Tim Berners Lee. It intends to give consumers private data 'pods' that they own and control. All their data – financial, medical, social, etc – goes into it, and each user decides who gets access to their data, how much, and for how long.

Currently, companies own vast amounts of consumer information, which they trade with countless more through a vast data brokerage industry for advertising. This profitable practice also comes with practical benefits, such as improved risk management, AI development, and enhanced marketing.

But if Solid gains traction, this will all come to change – so what exactly does Solid mean for businesses?

Familiar systems

Although the Solid Project is philosophically distinct from the way the internet currently operates, a lot of the under the hood systems that would drive it are already in place. Businesses would have to rely on application programming interfaces (APIs) to a greater extent in order to access user data, with a greater emphasis on zero trust security policies to do so safely.

Ahmad Shadid, founder of AI research lab O Foundation adds that data pods or digital wallets are also a great use case for Web3 and blockchain technology. "[It'd be] one login you use everywhere and a simple permission user interface where you can grant 'read transactions for last 90 days' to a budgeting app, or 'share vaccine status only' with a clinic and revoke it at any time," he says.

Together with the privacy and security concerns such systems address, it could also mitigate out of date or duplicated information shared between many companies. Use of a data pod means switching apps without reuploading the same information for the umpteenth time – businesses can simply access the same sensitive information once granted access, which also reduces their compliance risks such as data storage requirements under the General Data Protection Regulation (GDPR).

Pros and cons of Solid for businesses

There's an essential tension between Solid and functions such as customer-specific advertising and AI training. Right now, there's an economic imperative to hoard all available data – within data privacy and governance requirements – for when it becomes monetizable. Customer data can be used to feed directly into predictive analytics models for future consumer purchases. On an enterprise level, customer data also helps developer organizations to roll out updates based on customer usage data, and to make data-driven decisions on future products and service offerings.

"Corporate resistance is ... economically unlikely," says Pedrotti. "Companies have entire business models based on data ownership and won't voluntarily sign away that value. And regulation enforcement would be difficult across jurisdictions – companies would find ways around laws through terms of service that technically comply but continue to give them practical control over user data."

Arne Möhle, CEO and co-founder at Tuta Mail agrees any such efforts will face extreme opposition from tech corporations. "We've seen this with the lobbying efforts in the EU when the Digital Markets Act was still in the making." In fact, in the leadup to the 2023 EU acts, tech companies spent €113 million a year on lobbying.

On the Solid Project, Wright concedes there's unlikely to be a sudden reversal. "Adoption tends to follow regulatory shifts, market incentives and consumer expectations," he says – a pattern the world's already seen with Open Banking.

He also thinks adoption will shift as new players see benefits. "Startups developing new apps could access years of user history from day one. Imagine launching a health app that already knows three years of fitness patterns, injury history, and seasonal trends based on data already collected from Strava, MyGarminConnect and MyFitnessPal. As more applications support the Solid Project and each user's Pod receives more data [new] apps automatically benefit from the network effect."

All of which means there's actually an argument for big tech to support users owning all their data.

Bannach says behaviour in the corporate sphere tends to shift in response to regulation, risk and revenue – a shift we're seeing now. "GDPR, the DMA and the EU Data Act, cookie deprecation, and rising breach and ransomware defence costs all push firms to reduce hoarded data and operate on permissioned, auditable access," he says. "Early movers gain regulatory compliance benefits and customer loyalty. Resistance will persist, but the commercial and compliance incentives are aligning."

To Shadid, the benefits to business are obvious – and quantifiable. "Less liability means fewer massive centralized data lakes to hack or mismanage. Better quality means first-party, verified streams direct from user-controlled pods rather than stitched-together data from brokers. There's also a clearer legal basis for AI training and analytics – consent is explicit and revocable at the source."

Wright agrees, saying data pods with the Solid Project eliminate costs because companies building consumer-facing apps will no longer need to handle user data storage or identity management.

Whose data is it anyway?

Not all data is the same. "There are very large datasets where we're increasingly less concerned like social media posts and searches being 'in the wild' – convenience outweighs whatever concerns many have," says Victor Cho, Founder/CEO at AI-focused business communication tools provider Emovid. "But we're very concerned about certain datasets like health and financial information."

Wright agrees the landscape for data varies enormously, but he stresses the Solid Project isn't about 'harmonizing' data law, it just wants to enable it at the architecture level:

"[The architecture] makes Solid complementary to varying legal regimes. In jurisdictions with strong protections like the EU, it makes rights like data portability and erasure achievable rather than theoretical. In jurisdictions with weaker protections, it confers de facto control that doesn't depend on regulation."

Meanwhile, there are also moves to classify data as a commercial asset, thus codifying its true value. Joe Hughes, CEO of Manx Technology Group, advocates for the legal standards set by the Isle of Man Data Asset Foundation. He thinks it's definition – not technology – around data that represents the largest barrier to personal data pod ownership systems.

"[The Foundation] addresses this by leveraging the Isle of Man Foundations Act 2011 to give data a legal personality," he says. "By defining data as an asset in law it can be assigned value, listed on a balance sheet, used as collateral on a loan or considered during M&A. Our model doesn't prevent organizations from accessing data, it changes the terms and recognizes sovereignty. Access becomes explicit, trusted, controlled, permissioned, and contractual."

Wright counters that while individuals managing their pods is the cornerstone of Solid, it's not the only model. Another possibility would be group pods for shared data, or pods storing the certified copy of data owned or issued by another entity like a bank or driver's license authority. This would have the same effect for businesses, of reducing organizational data burden and setting out a more standardized architecture for verifying user identities and accessing sensitive data.

There’s also potential for an approach such as Solid to assist businesses with enterprise AI deployment. For example, Wright adds that the Solid Project could serve as the memory and data-sharing layer for agentic AI systems.

"The average person isn't going to self-host a server or manage API permissions for their medical records – that's the gap right now,” explains Scott McIntosh, president of AI business consultancy Digital Treehouse.

“The technology exists, but the user experience isn't there yet. AI is going to be the interface that makes it actually work. Instead of handing over all your data to every app and platform that asks for it, your AI agent shares only what's needed, for as long as it's needed, and revokes access when the interaction is done. You wouldn't need to understand the technical side of it. You'd just tell your AI what you're comfortable sharing and it handles the rest."

The business that can deliver this system could see massive user uptake. The extent to which web-decentralization projects such as Solid could play a role in this deployment is yet to be determined.

Anthropic is joining forces with SpaceX to increase the AI developer's compute capacity – and that means Claude Code usage limits are set for a huge boost.

As part of the deal, SpaceX will permit Anthropic to use all of the compute capacity at its Colossus 1 data center in Tennessee, originally built for Musk's own AI firm, xAI.

"This gives us access to more than 300 megawatts of new capacity (over 220,000 NVIDIA GPUs) within the month," Anthropic said in a blog post.

That increase allowed Anthropic to raise usage limits, removing some peak-time restrictions, and boosting rate limits for APIs.

"This, along with our other recent compute deals, means that we’ve been able to increase our usage limits for Claude Code and the Claude API," the statement added.

Claude Code usage limits explained

Anthropic is making three key changes to usage limits, all targeted at making life easier for its “most dedicated customers".

To start, the company is doubling Claude Code's five-hour rate limits, meaning users will be able to make more prompts and write more code in each five-hour rolling session.

That applies to Pro, Max, Team and seat-based Enterprise plans, the company confirmed.

Next, Anthropic is removing its peak hours limit reduction on Claude Code, allowing Pro and Max users to operate the same across peak and off-peak times.

Elsewhere, Anthropic is raising its API rate limits for Claude Opus models by more than an order of magnitude. For example, tier 1 users previously had 30,000 maximum input tokens per minute, and will now have 500,000.

The move by Anthropic follows other AI companies tightening up on token usage. Last week, for example, GitHub changed its pricing model for Copilot to focus on consumption rather than credits.

GitHub said the move comes in direct response to skyrocketing compute and inference demands over the last year.

Rapid compute expansion

Anthropic pointed to a range of recent announcements designed to expand compute capacity. The AI developer has signed deals with Amazon, Google, Broadcom, Microsoft, and Fluidstack, all aimed at upping capacity to contend with skyrocketing user demands.

"We train and run Claude on a range of AI hardware — AWS Trainium, Google TPUs, and Nvidia GPUs — and continue to explore opportunities to bring additional capacity online," Anthropic added.

Anthropic revealed it is also working to ensure customers outside the US had access to local infrastructure, saying some of its capacity expansion would be international. In particular, the deal with Amazon would include "additional inference" in Asia and Europe.

"Our enterprise customers — particularly those in regulated industries like financial services, healthcare, and government — increasingly need in-region infrastructure to meet compliance and data residency requirements," Anthropic said.

In the US, Anthropic and other AI companies agreed to cover the cost of consumer electricity prices caused by their data centre rollouts. Anthropic said it was looking for ways to "extend that commitment to new jurisdictions".

"We’re very intentional about where we’ll add capacity — partnering with democratic countries whose legal and regulatory frameworks support investments of this scale, and where the supply chain on which our compute depends — hardware, networking, and facilities — will be secure.”

FOLLOW US ON SOCIAL MEDIA

AWS CEO Matt Garman has a bullish outlook on the future of the SaaS industry despite continued claims of a looming “SaaSpocalypse”.

Speaking during a recent interview with Fortune, the AWS chief dispelled worries that the SaaS industry faces an existential threat in the form of agentic AI - so much so that the company is making its own foray into the space.

Last week, the company unveiled sweeping changes to Amazon Quick, a desktop AI assistant which acts as a single information source connecting the disparate applications, tools, and data used by workers in their daily lives.

AWS is framing the revamped platform as a boon for personal productivity, noting in an announcement that it is “continuously running in the background” monitoring desktop activities and “surfacing what needs attention”.

As the company explained in a blog post, this could include information contained in Slack threads, for example, or important unread emails and file uploads.

AWS’ foray into this domain was inspired by the fact that “so many applications are getting done with AI and agents”, according to Garman, who described Amazon Quick as a “huge business opportunity”.

“We think that there is just such a massive change out there that everything is going to be remade,” Garman told Fortune. “I don’t think personal productivity has really been remade for the last 30 years,”

“There are going to be millions of successful applications that people use,” he added. “Obviously the vast, vast majority of them will not be built by Amazon or AWS, but we think there are a handful of them that we can build that will be pretty successful and that customers will like.”

Garman’s comments suggest that, far from heralding the doom of traditional software, AI will ultimately act as an enabler to deliver more intuitive workplace tools.

This isn’t the first time Garman has poured cold water on threats of a pending SaaSpocalypse. As ITPro reported in February this year, Garman said while there is “huge disruption” ahead for the SaaS industry, “much of the fear is overblown”.

Garman’s comments came at the peak of software stock sell-offs sparked by the launch of a handful of powerful new AI solutions, with Anthropic’s Claude Cowork tool ranked chief among these.

The workplace productivity tool gives users sector-specific plugins designed to automate tasks across a wide range of areas, spanning legal, marketing, sales, and data analytics.

That launch spooked software investors due to fears the technology could ultimately render dedicated SaaS solutions in these domains obsolete.

AI transforming software

Despite a positive outlook, Garman told CNBC in February that the advent of generative AI, and more recently AI agents, will transform how software is built and sold.

Long-term, that could create a more challenging market for providers, who will be operating in an increasingly competitive marketplace.

“AI is absolutely a disruptive force that’s going to change how software is consumed and how it’s built,” he said.

“The SaaS providers and the larger players of today have an inside track to winning that business. Now, they have to innovate, just like the rest of the world. They can’t stand still. If they stand still, they’re absolutely going to be disrupted.”

FOLLOW US ON SOCIAL MEDIA

NordVPN has uncovered a series of active malicious campaigns impersonating the official Google Gemini Command-Line Interface (CLI).

Attackers are creating fake websites, cloned repositories, and deceptive social media posts to trick developers and other users into installing what appears to be an unofficial or early-access version of Gemini’s developer tool.

But instead of delivering legitimate software, the campaigns distribute a reverse shell, giving the attacker complete and unrestricted remote control over the compromised machine, with no further action required on their end.

“AI tools are generating huge interest right now, and attackers are moving fast to exploit that,” said Domininkas Virbickas, product director at NordVPN.

“The payloads being delivered here grant full remote access to a victim’s machine, which makes this a serious threat regardless of how technically sophisticated the target is.”

Fake Gemini tools have Windows and Mac variants

The attack has both MacOS and Windows versions. On MacOS, it starts with a convincing clone of the official Google Gemini CLI web page. This instructs the user to run an innocuous-looking command in their terminal.

However, this command is encoded in the Base64 simple text encoding format, obscuring what it actually does.

"Once decoded, the command downloads a malicious script from a remote server and immediately runs it with the highest administrative privileges available on the system," the researchers said.

"It means the attacker’s code can read, modify, or delete any file on the device, install additional malware, or use the compromised Mac as a launchpad to access corporate networks the device is connected to."

As for the Windows variant, this uses a different delivery method. A PowerShell command, disguised with variable names like $Install=’GeminiCLI’ to look like a legitimate software setup process, connects to a remote server and executes malicious code directly in the device’s memory.

Running code in memory rather than writing it to disk - a fileless attack - evades traditional antivirus software that scans files for known threats.

As well as these direct attacks, NordVPN’s researchers also found a typosquatting operation targeting the npm ecosystem. Fake package names, including gemini/cli and gemini-cli, were registered or under preparation to mimic the official google/gemini-cli package.

"The strategy exploits a common habit among developers of omitting the organization prefix when searching for or installing packages," the researchers warned.

"Although the fake package had not yet appeared in the npm registry at the time of analysis, its preparation signals an active and imminent threat. Once published, any developer who installs it by mistyping the package name could unknowingly execute malicious code."

How to stay safe

NordVPN advised users to be wary of any website, forum post, or social media message offering early or unofficial access to developer tools. They should stick to official sources - and, in this case, that's just the official Google repository.

Never run a terminal or PowerShell command you didn't write yourself unless you fully understand what it does, the firm warned, pointing out that legitimate software installers don't ask users to copy and paste commands from a webpage.

Similarly, developers should verify package names in full before installation, including the organization prefix - the official package is google/gemini-cli, not gemini/cli or gemini-cli.

Nord also adviased using security software that includes behavioral detection, not just file-based scanning. Fileless attacks are specifically engineered to bypass traditional antivirus tools.

ITPro approached Google for comment, but did not receive a response by time of publication.

FOLLOW US ON SOCIAL MEDIA

Microsoft CEO Satya Nadella appears to have extended an olive branch to Windows users after several months of backlash over the direction of the operating system.

During the company’s Q3 earnings call, Nadella highlighted ongoing efforts to improve experiences for Windows, Xbox, Bing, and Edge users.

“When it comes to our consumer business, we are doing the foundational work required to win back fans and strengthen engagement across Windows, Xbox, Bing, and Edge,” he told listeners.

“In the near term, we are focused on fundamentals, prioritizing quality and serving our core users better”.

Nadella pointed to improvements the tech giant has already made on this front, including performance boosts for lower-memory devices, as well as a more “streamlined” Windows Update process.

He added that it has “brought back focus to core features and fundamentals that matter most to our customers”.

Nadella’s comments come in the wake of long-running concerns about the future of the Windows operating system, particularly on the topic of AI integration.

In November last year, Windows chief Pavan Davuluri sparked controversy after outlining plans to transform Windows into an “agentic OS”.

Davuluri’s X post suggested the company aimed to offer a “multi-modal” experience for users, with an array of AI features baked into the operating system.

The post sparked a fierce backlash among users, with some questioning why the tech giant was focusing so heavily on integrating AI features while other areas like performance and reliability were being overlooked.

The furore appears to have resonated with the company, and in March this year Davuluri detailed plans to dial back "unnecessary" Copilot features within the operating system.

In a blog post at the time, Davuluri said the company will only integrate AI where it’s “most meaningful”.

“You will see us be more intentional about how and where Copilot integrates across Windows, focusing on experiences that are genuinely useful and well‑crafted,” he wrote.

That same move by the company also marked efforts to improve feedback from users - the “largest update to Feedback Hub yet” - which aimed to make it easier to submit feedback.

A looming Windows overhaul?

Efforts to build on Davuluri’s March pledges appear to be accelerating, according to recent reports from Windows Central.

Citing sources close to the matter, the publication noted an internal project dubbed ‘Windows K2’ is already underway and working on sweeping upgrades to performance, reliability, and user experience.

These efforts won’t come in the form of a dedicated update, but instead will be intermittent improvements on a rolling basis.

Performance, in particular, is a key focus of the initiative. Company documents viewed by the publication suggest the tech giant is aware that performance has been a recurring pain point for users, specifically in applications such as File Explorer.

Elsewhere, UI improvements aim to deliver a smoother experience for Windows 11 users, according to Windows Central.

The report tracks with the key focus areas identified by Davuluri in his March blog post, which included goals to deliver a “faster and more dependable File Explorer” as well as taskbar customization and "more control over widgets and feed experiences".

Nadella touts strong Windows uptake

Elsewhere in the earnings call, Nadella hailed strong user growth on Windows 11 – an area in which the company has faced an uphill battle.

Figures touted by the Microsoft chief now put monthly active users at over 1.6 billion.

Windows 11 uptake has been sluggish since its launch in 2021, largely due to the huge popularity of its predecessor. Indeed, Windows 11 only overtook Windows 10 in popularity last year, nearly four years after its official release.

As ITPro reported at the time, figures from Statcounter showed the newer OS finally edged into the lead in mid-July.

Nadella’s comments came as Microsoft announced strong quarterly earnings. Chief financial officer (CFO) Amy Hood said the company “delivered results that exceeded expectations across revenue, operating income, and earnings per share”.

Annual revenue run rate for Microsoft’s AI business surpassed $37 billion in the company’s third quarter, growing 123% year-over-year.

Business is also booming for Microsoft Cloud, Nadella noted, which exceeded $54 billion in revenue, marking a 29% increase year-over-year.

FOLLOW US ON SOCIAL MEDIA

Microsoft has published a review of how it's fulfilled the digital commitments it made to Europe last year – and the tech giant says there are further pledges on the horizon.

A year ago, the company said it would help build a broad AI and cloud ecosystem across Europe with a series of commitments, including:

• Upholding Europe’s digital resilience even when there is geopolitical volatility
• Protecting the privacy of European data
• Bolstering European cybersecurity capabilities
• Strengthening the region’s economic competitiveness, including in open source

"Together, they reflect a simple principle: Europe should be able to use global technology at scale, under European rules, with confidence that it will remain available, secure, and under customer control," said Samer Abu-Ltaif, president of Microsoft EMEA and Jeff Bullwinkel, VP and deputy general counsel, corporate external and legal Affairs, Microsoft EMEA.

Infrastructure expansion continues

In terms of infrastructure expansion, the company claims it’s made significant strides, particularly with the announcement of new multi-billion Euro investments in Portugal, Norway, and the UK.

This, the firm noted, is helping European organizations access cloud and AI capabilities closer to home - adding that it's committed to respecting the role that laws across Europe play in regulating its products and services.

Meanwhile, it's been supporting its customers’ operational continuity in extreme scenarios through a European resiliency partnership with Delos Cloud and a strategic partnership with Capgemini.

These aim to provide managed sovereign cloud services for European enterprises, while a similar deal with Accenture is also providing support for the design and implementation of sovereign cloud and AI solutions.

Microsoft hails data privacy boosts

On the thorny issue of European data privacy, Microsoft cited a series of initiatives aimed at shoring up protections for European consumers and businesses.

These include the launch of the Defending Your Data Initiative, as well as adherence to the EU Data Boundary which covers the storage and processing of European customer data.

Meanwhile, the Data Guardian initiative now ensures that remote access by Microsoft engineers to European customer data is approved and monitored by personnel residing in Europe.

"Over the past year, we have strengthened our sovereign solutions through new contractual assurances, closer partnerships with European providers, and expanded customer support,” the company noted in its blog post.

Cybersecurity focus

When it comes to cybersecurity, Microsoft pointed to its free European Security Program (ESP), available for governments across the UK, EU, EFTA, and EU accession countries.

"We have provided cybersecurity support to NATO, Ukraine, and other European governments, including threat intelligence, election protection, and disrupting attacks targeting European governments, companies, and citizens," said Abu-Ltaif and Bullwinkel.

"Since the start of Russia’s full-scale invasion of Ukraine in 2022, when we helped move critical data and services to secure data centers across Europe and defend against sustained cyber attacks and eventual kinetic attacks."

Open source the “North Star” in Europe

Support for the open source ecosystem has been a key focus over the last year, according to the firm.

Almost 25 million European software developers are now active on GitHub, for example, while Microsoft Foundry expansions have opened access to roughly 11,000 AI models.

"These commitments are our North Star for how we engage in Europe, grounded in European law and values, shaped by European priorities, and designed to progress over time," said Abu-Ltaif and Bullwinkel.

"As Europe’s digital and geopolitical context continues to evolve, we will keep engaging with policymakers, regulators, customers, and partners to test whether what we are delivering matches what Europe needs. Where it does not, we will adapt."

Taking Microsoft at face value

While Microsoft is keen to emphasize the work it’s doing across Europe, the company’s activities in areas such as cloud computing and software have been subject to criticism.

The tech giant has been embroiled in a series of high-profile legal battles over its software licensing schemes in Europe, with software bundling proving controversial.

Alongside competitors, the tech giant has rolled out a series of new sovereignty-focused services for European organizations, but questions have been raised over whether or not these are truly ‘sovereign’.

During a court hearing last year, Microsoft said it “cannot guarantee” data sovereignty for French customers in the event that the US administration demands access under the Cloud Act.

Under the legislation, the US administration has the legal authority to demand American providers provide data regardless of whether it is stored in-country or abroad.

The Cloud Act has become a recurring flashpoint in the digital sovereignty debate, while similar frameworks in the European Union have also been criticised for continuing reliance on US hyperscalers.

Earlier this month, the European Commission awarded a series of digital sovereignty contracts to European organizations, but this scheme also included involvement from Google Cloud.

CISPE recently launched a new framework for European enterprises to validate whether the services they’re paying for meet ‘sovereign’ requirements.

FOLLOW US ON SOCIAL MEDIA

Partner accreditation didn’t used to mean that much. Badges signaled little more than alignment with a particular vendor. But the landscape has changed.

Today, accreditation from Microsoft isn’t just about positioning, but rather a meaningful indicator of capability. It shows not just that you work with a brand, but you are invested in and trusted by it. So, when you earn Microsoft Modern Work, Azure Infrastructure, and Security designations, it’s something worth talking about. It requires operational, technical, and commercial buy-in, and few people really understand what goes into the process.

The shift from accreditation to differentiation

Microsoft’s partner model has evolved enormously in recent years. It began as something that was at least theoretically accessible to all Managed Service Providers (MSPs), but has become closer to an elitist framework.

Certification is performance-driven. It prioritizes measurable outcomes over theoretical expertise. And this is entirely in keeping with wider changes within the wider tech environment. Customers are no longer interested in credentials; demonstrable results matter more.

So, while Microsoft solution partner accreditation used to be awarded based on headcount - the number of team members who had passed Microsoft exams - a lot more is now required. Instead, businesses must exhibit a blend of technical skilling, customer adoption metrics, and verified project success. And that makes accreditation significantly harder. But, on the plus side, it also lets customers know that the accreditation is worth having. Which for MSPs, makes it into a competitive differentiation.

Holding one designation may indicate competence in a specific domain. Holding all three suggests an ability to deliver more. Integrated, end-to-end solutions that span productivity, infrastructure, and security.

So when an MSP can claim triple Microsoft designation, they stop being a simple service provider and can claim the role of strategic partner. A company able to support its clients through complete digital transformation, and every associated challenge.

The real cost of capability

Achieving triple designation demands substantial internal investment across people, processes, and platforms.

The first step is a commitment to continuous skilling. All members of the team - engineers, architects, and consultants - must maintain up-to-date certifications across multiple Microsoft technologies. And this must be further supported through the development of robust operational frameworks that live up to Microsoft’s expectations around compliance, governance, and security.

The security designation can be particularly challenging. Businesses must be able to demonstrate capabilities in a whole range of areas, from identity management and endpoint protection to threat detection and response. This can mean a lot of investment for many MSPs, ensuring that they not only have the security operations capabilities, but also the tools and teams to manage them.

Commercial alignment also has to be considered. Microsoft’s model is intended to reward partners who drive customer consumption of its cloud services. That’s the whole point of the system. So for businesses seeking accreditation, that can mean a complete change of go-to-market strategies, including pricing and customer engagement.

Ultimately, all of this is a significant commitment for any company.

Metrics that matter

The focus on performance metrics has come to define Microsoft’s partner program in recent years. MSPs must meet specific thresholds across skilling, customer success, and performance to attain and maintain partnership status.

While skilling metrics are relatively straightforward, focusing on the number and level of certified professionals within the organization, customer success metrics are more nuanced. They require partners to demonstrate real-world impact through customer deployments and usage.

Performance metrics tie these elements together by measuring overall business growth within Microsoft’s ecosystem. What makes this more difficult to achieve is that Microsoft regularly updates its criteria to reflect market trends and strategic priorities. This means that achieving designation requires ongoing optimization and improvement.

Beyond the badget

For MSPs willing to invest, the benefits of triple designation are manifold. Internally, the process drives greater discipline, consistency, and alignment, helping businesses to initiate and maintain best practices. While externally, it enhances trust. Customers increasingly look for partners who can demonstrate proven expertise across multiple domains. Triple designation provides a clear signal that an MSP has met rigorous standards and delivered measurable outcomes.

Perhaps most importantly, it positions MSPs to compete in a market that is becoming more demanding. Customers want and expect more. In meeting the exacting standards of Microsoft, businesses are positioning themselves to be able to deliver it.

The rise of triple Microsoft designation as a benchmark reflects a broader development of the managed services industry. Customers expect more, technologies are more complex, and the stakes are higher. In this environment, superficial credentials are no longer enough.

By tying accreditation to real-world performance, Microsoft has effectively raised standards for all MSPs. It’s down to the individual companies whether they wish to accept that challenge and maximize the potential of the business, or to take the easy path and consistently underachieve.

A range of new AI features are coming to Ubuntu over the next year, according to maintainers, but only providing they’re of “sufficient maturity and quality”.

In a blog post detailing AI plans for the operating system, Jon Seager, VP of engineering at Ubuntu’s parent company, Canonical, said the firm is exploring the prospect of a dual approach to integration.

This approach centers around improving OS functionality with AI models running “in the background” while the implementation of “AI native” features will also be rolled out - but only to those who opt in.

“Over the past few weeks I’ve begun to develop a framework to help think about different kinds of AI adoption within Ubuntu," Seager wrote. “At the center of that is the idea of explicit and implicit AI features.”

Implicit AI, according to Seager, aims to enhance existing features within the operating system without sweeping changes. One example touted included the launch of speech-to-text and text-to-speech functionalities within the OS.

“I don’t see these as “AI features”, I see them as critical accessibility features that can be dramatically improved through the adoption of LLMs with minimal (if any) drawbacks,” he noted.

Seager added that these features will rely on local inference, using open weight models. Local inference is an area in which Canonical has been expanding capabilities recently, he noted, particularly with regard to “inference snaps”.

Inference snaps provide “simplified local access” to inference using models catered specifically for user hardware.

“The combination of Ubuntu’s widespread adoption and Canonical’s partnership with silicon companies has enabled us to deliver a high performance foundational inference capability for the distribution with very little cognitive overhead for our users,” he wrote.

‘Tasteful’ agentic functionality in Ubuntu

With agentic AI firmly in the spotlight over the last 18 months, Seager noted there are plans afoot on this front. These fall firmly under the “explicit” aspect of the firm’s plans.

Agentic capabilities within the operating system have huge potential, he noted, helping in tasks such as “authoring new documents or applications”, as well as personal automated tasks and troubleshooting support.

“I love the idea that all the power and capability that Linux has acquired over the past few years could become more accessible to more people,” Seager wrote.

In this case, there will be strict guardrails. A strong focus has been placed on privacy and security when considering integration of agentic workflows.

“We’re making plans on how to integrate agentic workflows into Ubuntu for those who want it in a way that feels tasteful, aligned with our user base and respectful of our privacy and security values,” Seager wrote.

“With this comes a big responsibility for us to ensure that the relevant security and confinement controls are in place to prevent unwanted side-effects.”

On the topic of confinement, Seager noted that the aforementioned inference snaps will be subject to the “same confinement rules as other snaps”.

These confinement rules limit the amount of access applications have to system resources. By adopting this approach, Canonical aims to improve user confidence and prevent “indiscriminate access” to machines and data.

A "strictly opt-in” basis

Reaction to Seager’s post appears to have been mostly positive, albeit bordering on apprehensive, with one user describing it as “one of the most sensible posts relating to the use of AI I have read”.

Limited backlash prompted Seager to publish a clarification post confirming details on user controls and consent.

On the prospect of a potential “kill switch” for AI features, Seager noted this won’t be included. However, given AI functionalities will be delivered using snaps, users will have the option of removing these.

“Which I supposed acts as a sort of kill switch for the features we’re planning on shipping,” he wrote.

Moreover, any AI features will be launched in a preview format on a “strictly opt-in basis” upon the launch of version 26.10. Future versions will also have an opt-in function for AI features, he noted.

“In subsequent releases, my plan is to have a step in the initial setup wizard that allows the user to choose whether or not they’d like the AI-native features enabled,” Seager commented.

“Because of the size of most LLMs, we simply couldn’t ship them in the installer anyway, so opting out at first run is simple: they just won’t be there.”

FOLLOW US ON SOCIAL MEDIA

Threat actors gained access to sensitive developer data and cryptocurrency wallets after a popular open source software tool was compromised.

Developers behind the Elementary Python command line interface (CLI) tool revealed a recent release (version 0.23.3) included malicious code.

Attackers exploited a script injection vulnerability in the open source project’s GitHub Actions workflow to push the malicious update to users.

This malicious version was subsequently published on PyPI, as well as a Docker image pushed to the project’s registry.

In a blog post detailing the incident, developers said the malicious version was removed roughly 12 hours later. Elementary Cloud, the Elementary dbt package, and other CLI versions weren’t affected.

A replacement version (0.23.4) has also been released, however developers warned those who downloaded the malicious version are still at high risk.

What happened with the Elementary CLI attack?

Analysis of the incident by researchers at StepSecurity found attackers exploited a script injection vulnerability in the project’s GitHub Actions workflow.

Thereafter, they used the workflow’s GITHUB_TOKEN to “forge a signed release commit” and push the malicious version through a legitimate release pipeline.

According to StepSecurity, a .pth file was baked into the release, which upon startup allowed the threat actor(s) to harvest an array of sensitive data, including:

• SSH keys
• Cloud credentials, including AWS, GCP, and Azure
• CI secrets
• Container orchestration data
• System data (passwords, logs, shell history)
• Crypto wallet files (including Bitcoin, Litecoin, Monero, and Ripple)

What developers need to know

Project maintainers warned that users who installed the malicious version should “assume that any credentials accessible to the environment where it ran may have been exposed”.

Developers outlined a series of steps to take for those affected, including:

• Check your installed version (pip show elementary-data | grep Version)
• If the version is 0.23.3, uninstall it and replace it with the safe version
• Delete your cache files to avoid any artifacts
• Check for the malware’s marker file on any machine where the CLI may have run: If this file is present, the payload executed on that machine.

Developers are also advised to rotate credentials that were accessible from the environment where 0.23.3 ran. This includes dbt profiles, cloud provider keys, API tokens, SSH keys, and contents of .env files.

“CI/CD runners are especially exposed because they typically have broad sets of secrets mounted at runtime,” the blog post noted.

In the wake of the incident, project maintainers noted they have “hardened” open source release flows and permissions.

The vulnerable GitHub Action workflow has also been removed, while an audit of other GitHub Actions workflows across the organisation has been conducted to identify the same type of script injection flaw.

FOLLOW US ON SOCIAL MEDIA

GitHub is changing how it charges for Copilot usage, claiming that some users haven't been paying the full cost for AI.

Currently, GitHub Copilot uses a premium request unit (PRU) billing system, giving subscribers a set number of credits to spend for more complex queries.

The pricing scheme was introduced last year as a way to limit access to top models.

In a blog post detailing the move, GitHub’s chief product officer Mario Rodriguez said because Copilot has added new features, the company is contending with far higher compete and inference demands.

"Today, a quick chat question and a multi-hour autonomous coding session can cost the user the same amount," said Rodriguez.

"GitHub has absorbed much of the escalating inference cost behind that usage, but the current premium request model is no longer sustainable."

GitHub said that usage-based billing will better align pricing with how Copilot is being used. The new system will replace PRUs with GitHub AI Credits for subscribers, with the option for paid plans to buy more.

How the GitHub Copilot pricing changes will work

Each tier of GitHub Copilot subscription will come with a set number of credits, though paid plans will be able to top up.

"Credits will be consumed based on token usage, including input, output, and cached tokens, according to the published API rates for each model," Rodriguez explained.

Code completions and Next Edit suggestions will be included in subscription plans and not consume AI Credits, the company noted.

"Copilot code review will also consume GitHub Actions minutes, in addition to GitHub AI Credits. These minutes are billed at the same per-minute rates as other GitHub Actions workflows," he added.

Copilot will also end its "fallback" feature, which meant users who ran out of PRUs could fall back to a lower-cost model to keep working.

"Under the new model, usage will instead be governed by available credits and admin budget controls," he said. In short, if you run out of credits, you'll need to buy more.

Indeed, an FAQ document on the changes noted: "Users with intense agentic usage will likely see an increase in costs because those features consume more compute."

Managing costs

The shift to the new system will happen on 1 June, but GitHub will send customers a preview bill in their account Billing Overview page in May to help users and admins understand what their costs will be going forward.

There will be no change to monthly subscription prices, the company noted. A Copilot Business user costs $19/month, and will include $19 in monthly AI Credits.

Meanwhile, Copilot Enterprise will still cost $39/month per user, with $39 in monthly AI Credits.

To help smooth out the shift to the new pricing system, Business users will get a bonus of $30 monthly in AI Credits for June, July, and August, while Enterprise users will automatically get a bonus of $70 a month.

"We are also introducing pooled included usage across a business, which helps eliminate stranded capacity," Rodriguez said. "Instead of each user’s unused included usage being isolated, credits can be pooled across the organization."

That should help businesses give heavy users more credits, with lighter users offsetting the balance, GitHub suggested.

Admins will be able to cap budgets at the enterprise, cost center, and user levels, he added. When pooled credits are exhausted, users can decide whether to buy more or cap spending.

"You’ll have full control over what you spend, tools to track your usage, and the option to purchase more AI Credits if and when you need them," he added.

What does this mean for individual users?

For individual users, those on Copilot Pro and Pro+, their AI Credits will also match their subscription price of $10/month and $39/month, with those on an annual plan staying premium pricing until their subscription expires.

It’s worth noting that model multipliers will increase as of 1 June for those users. Once their plan expires, they'll be converted to Copilot Free and can then upgrade to a paid monthly plan.

Alternatively, annual subscribers can choose to convert to a monthly plan now.

Rodriguez said that temporary changes were made to those plans as well as Free and Student last week, in order to prepare for the new system.

"These were reliability and performance measures as we prepare for the broader transition to usage-based billing," he said. "We will loosen usage limits once usage-based billing is in effect."

FOLLOW US ON SOCIAL MEDIA

Software developers at Amazon Web Services (AWS) are recording marked efficiency gains with AI tools, according to the company’s UK chief.

Speaking at the AWS Summit London, Alison Kay, VP and managing director for the UK & Ireland, told attendees that developers are relying heavily on its own Kiro coding tool to speed up processes.

Indeed, devs at the firm have been able to successfully deliver projects that previously would have been extensive in a far more efficient manner.

“At AWS we needed to completely rebuild the inference engine behind Bedrock from scratch,” she explained. “Now, if you'd asked me two years ago what that would’ve taken, I would’ve said ‘40 engineers, 12 months, and a whole lot of coffee’.”

Using AI, Kay noted this rebuild project was completed by six engineers in just 76 days.

“They weren’t working alone,” she added. “They were working alongside Kiro agents that wrote code, tested it, found bugs, fixed them, and deployed it around the clock. While the engineers slept, the agents kept building.”

AWS announced the launch of Kiro in mid-2025, and since launch has received a series of updates. At the company’s annual re:Invent conference in December 2025, the coding service received a big upgrade with new agentic capabilities.

As ITPro reported at the time, the Kiro Autonomous agent maintains “persistent context” across the development lifecycle, essentially lingering in the background and supporting human developers.

Talking up AI

Much like its competitors, AWS has been keen to emphasize both the capabilities of its own AI tools, but also how staff are using them across the company.

Speaking during a podcast appearance last year, CEO Matt Garman noted around 80% of developers at the firm were using AI “in some way” on a daily basis.

Notably, Microsoft and Google both touted the increasing use of AI-generated source code, which, at the time, Garman suggested was a “silly metric” by which to measure internal AI successes.

“There might be bad code, by the way. Measuring lines of code is never actually the best metric. Oftentimes, fewer lines of code is way better than more lines, so I’m never really sure why that’s the exciting metric that people like to brag about.”

Increased AI use at AWS isn’t restricted to software development, either. Speaking to ITPro at AWS re:Invent in December last year, CISO Amy Herzog revealed security practitioners have ramped up use of agentic AI tools in areas such as CVE attribution and threat detection.

Indeed, Herzog revealed security teams had recorded a “500% increase” in helping practitioners “piece together” information on emerging threats and vulnerabilities.

So far, Herzog noted there has been a “500% increase” in the company’s ability to “piece together information” for security teams on this front.

FOLLOW US ON SOCIAL MEDIA

Microsoft's facing a £2 billion lawsuit in the UK over its cloud computing and software licensing practices.

A lawsuit brought by competition lawyer Maria Luisa Stasi on behalf of nearly 60,000 businesses alleges that the company has been overcharging UK organizations that use its Windows Server on rival cloud services.

And the Competition Appeal Tribunal (CAT) has now ruled that the case can go ahead, dismissing Microsoft's arguments and saying that the case 'comfortably crosses the hurdle of having a real prospect of success'. It's granted a Collective Proceedings Order (CPO) on an opt-out basis.

"Today's ruling is an important moment for the thousands of organizations impacted by Microsoft's conduct and in ensuring that a critical sector of the economy is innovative and open," said Stasi.

"For years, Microsoft's practices have had real financial impact on both public and private organizations. I'm now looking forward to preparing for trial and getting their money back on their behalf."

The lawsuit alleges that customers using Amazon Web Services (AWS), Google Cloud Platform (GCP) or Alibaba Cloud, rather than Microsoft Azure, were charged higher licensing fees for Windows Server.

The Services Provider License Agreement (SPLA), it said, also offers lower quality services than the Microsoft Azure licensing deal.

"We are very pleased with the Tribunal's decision, including its confirmation that Dr Stasi's action should proceed on an opt-out basis, as sought in her application," said James Hain-Cole, partner at law firm Scott+Scott, which is leading the case.

"Certification of this claim is a pivotal step in securing compensation for thousands of businesses and organisations. The decision illustrates the importance of the regime for UK businesses who, like consumers, require and deserve the access to justice that it was designed to offer."

Microsoft, which has claimed that its business model improves competition, said it planned to appeal against the CAT's decision.

This case is one of many challenging Microsoft's licensing practices. Last month, the UK Competition and Markets Authority (CMA) said it planned to open a strategic market status investigation in May, covering the firm's licensing practices in relation to Microsoft 365.

In November last year, the European Commission announced another investigation to assess whether Microsoft should be designated as a 'gatekeeper' for its cloud computing services under the Digital Markets Act (DMA), despite not technically meeting the DMA gatekeeper thresholds for size, user number, and market position.

And last summer, the firm settled a $22 million case with cloud industry group Cloud Infrastructure Service Providers in Europe (CISPE) that claimed customers on non-Azure platforms were paying a 20% surcharge on Microsoft software. Other investigations have been launched over the last year in Brazil, Switzerland, the US, and Japan.

After introducing Webex data residency in the EU five years ago, Cisco has announced that it's doing the same for the UK.

Organizations across the country will be able to handle Webex Meetings, Messaging, Calling, Slido, Contact Centre capability, and the company's AI Assistant with data processing and storage carried out in the UK.

Data at rest and in motion will be geographically distributed across UK locations for redundancy, the company said in an announcement.

Similarly, large language model (LLM) capabilities such as meeting summarization and action item generation will be delivered from within the UK while customers should also benefit from improved latency.

“With Webex Suite data residency in the UK, we’re delivering both advanced AI capabilities that process locally, with control over where your data lives and how it’s protected," said Amit Barave, VP and general manager, Webex Suite & AI, at Cisco Collaboration.

"This is collaboration infrastructure built for how regulated industries actually operate — with enhanced digital control at its core."

The company introduced Webex data residency for the EU in 2021, claiming it was the first major collaboration provider to keep services and store billing, analytics, and personal information exclusively in the EU.

Since then, it's focused heavily on adding AI capabilities, with the launch of its AI Assistant in 2023. One year later, the firm announced the addition of language translation per message or in real time, message summaries, meeting recaps, and message rewriting functionalities.

Sovereignty in the spotlight

Sovereign cloud and data residency is an increasing priority for UK and European organizations concerned about data security and overreliance on US-based big tech providers.

Gartner predicts that spending on sovereign cloud infrastructure in Europe will triple from 2025 to 2027, with government agencies ranked among the main buyers.

Around a fifth of existing workloads will shift from global cloud providers to local ones, it said.

Tech firms are investing heavily on this front across Europe as well, with a host of hyperscalers rolling out dedicated sovereignty schemes.

Last summer, Google gave new data residency assurances for UK businesses using its Gemini AI offerings, on top of its existing data residency for Agentspace, its AI agent program, and Gemini 1.5 Flash machine learning.

Around the same time, Microsoft said its Sovereign Cloud would see data stored by EU customers for core enterprise services including Azure, Microsoft 365, Microsoft Security, and Power platform staying in the region.

And in January this year, AWS announced the general availability of its European Sovereign Cloud, offering European-based customers a fully independent cloud located entirely within the EU, with enterprise data kept separate from other AWS Regions worldwide.

"Regulatory complexity is mounting and organizations are rightfully demanding more control over their digital infrastructure," said Cisco UK CEO Sarah Walker.

"And now, I am delighted to announce that Webex Suite data residency will be available in the United Kingdom. This addresses a gap many haven’t seen met in the market: the ability to embrace modern collaboration technology while maintaining the level of control their organizations require."

FOLLOW US ON SOCIAL MEDIA

The impact of legacy technology goes beyond enterprise efficiency or workforce productivity and has a direct effect on employee experience and retention, according to new research.

In a survey from Pegasystems, more than two-thirds (68%) of respondents said outdated tools are eroding productivity and slowing down processes.

The company noted that many workers are forced to navigate “complex, demoralizing systems that slow work and sap momentum”.

Indeed, just 28% of respondents described the technology they use at work as helpful. Notably, over one-third (38%) said they would consider leaving their employer if improvements weren’t made.

Pegasystems said the study highlights the significant impact legacy technology has on both productivity and general staff wellbeing.

Nearly half (45%) of respondents reported feeling frustrated due to outdated tools and systems while around one-fifth said they’re “exhausted” and “demotivated”.

Perception of tech adequacy was also a key problem flagged in the study. Less than half (48%) of respondents said their employer provides “modern technology” that is both reliable and relevant for their specific tasks.

Don Schuerman, chief technology officer (CTO) at Pegasystems, said legacy technology can create a “hidden tax” on employee engagement - and it’s one that “many organizations fail to recognize until it’s too late”.

“When workers spend their days fighting slow, frustrating tools, it doesn’t just hurt productivity, it signals to talented employees that the organisation doesn’t value their time or enable their best work.”

For enterprises that invest in modernization, Schuerman said the benefits are two-fold. First and foremost, they’re equipping staff with tools that are up to the task and contribute to productivity gains.

They’re also “protecting their talent” pipeline, which prevents brain drain and ultimately provides huge long-term benefits.

Modernization is easier said than done

Legacy tech has become a recurring pain point for IT leaders and tech teams in recent years, and the financial impact can be severe. Previous research from Pegasystems found outdated technology is costing enterprises hundreds of millions of dollars each year.

Yet only marginal improvements have been made to remedy the situation, and many businesses are still hindered by an array of outdated systems and tools.

30% of respondents to Pegasystems’ recent survey revealed their organization still uses legacy tech for “one of more business functions”.

Around 70% were unsure, which the company noted suggests the actual footprint of legacy systems “may be far larger than reported”.

Desktop-only applications, for example, are still used by 19% of firms, while 8% continue using mainframe systems. The company said these both have an adverse effect on workforce efficiency and performance.

“These desktop-bound workflows and mainframe remnants can constrain speed, usability, and integration, shaping frustrating daily experiences,” Pegasystems noted.

What do workers want?

In terms of what workers want from workplace tools and technology, Pegasystems said respondents identified three focus areas. These included:

• Faster speed/performance of tools (46%)
• Automation of repetitive tasks (30%)
• More accuracy/fewer errors (24%)

Similarly, investments that cut latency and modernized user experiences were also flagged. The company noted these were among the “loudest pain points” identified by workers.

FOLLOW US ON SOCIAL MEDIA

Microsoft has announced plans to cut prices for its Windows 365 Cloud PC service next month.

The 20% rate cut, which comes into effect from 1 May, is aimed primarily at small businesses, according to the tech giant. The firm said the reduction will make cloud personal computers “more cost effective”.

It’s worth noting that the 20% reduction appears to apply to new customers only, with existing subscriptions receiving updated pricing at their next renewal and “subject to purchase channel and terms”.

Regardless, the update comes amid rising hardware prices for businesses of all sizes due to surging RAM costs. Combined with device refresh cycles and the shift to Windows 11, SMBs are expected to be among those worst hit by the surge.

Last month, Omdia recorded a 60% rise in prices for PCs across Q1 of 2026 while Gartner projects a 130% surge in combined DRAM and SSD prices by the end of the year.

As ITPro previously reported, low-budget devices are expected to be the hardest hit due to skyrocketing prices, with manufacturers prioritizing higher-end options to absorb costs.

Microsoft touts on-demand benefits

In addition to the price cut, Microsoft said the update will introduce an “on-demand start experience” that aims to deliver better performance.

From May, cloud PCs will stay powered on for one hour after sign-out/disconnect, the company said. Reconnects within a period of one hour will remain unchanged.

“Reconnects after more than an hour might take slightly longer as the Cloud PC resumes from hibernation (with the same performance once connected),” the company said in a blog post.

What to expect with Windows cloud PCs

Windows cloud PCs come in a range of separate packages, all of which support desktop versions of Microsoft 365 apps.

The basic package, which includes two vCPUs, 4GB RAM, and 128GB storage comes in at £26.90 per user, per month (£32.28 including VAT).

Meanwhile, the standard package, which will set you back £35.60 per user, per month, includes two vCPUs, 8GB RAM, and 128GB storage. Each package has a maximum of up to 300 seats.

FOLLOW US ON SOCIAL MEDIA

Organizations are taking a slapdash approach to AI-generated code, with many spending far too little time on oversight, new research suggests.

The vast majority (93%) of respondents to Cloudsmith's 2026 Artifact Management Report said their organization was using AI-generated code, more than twice as many as last year.

Yet despite this sharp increase, around than one-third (31%) spend 10 hours or less per month validating, auditing, or securing it. Indeed, just 58% spend at least 11 hours per month on this front while one-in-twenty said they don't audit AI code at all.

While AI models have become a leading artifact type, only 12% of organizations are managing them using the same security policies and provenance tracking as traditional binaries, such as language packages and operating system libraries.

This is despite the fact that organizations are mostly aware of the risks, with only 17% very confident that AI is not introducing new vulnerabilities into their codebase.

“We are at a huge inflection point in the history of software development. In a matter of months, we’ve gone from, ‘How can AI help me write better code?’ to, ‘How can I help AI write better code?’”, said Glenn Weinstein, CEO of Cloudsmith.

"But at the same time, AI tools are expanding the attack surface, introducing more open source dependencies. And those same tools are being used by malicious actors to find more vulnerabilities in existing libraries, leading to more CVEs.”

Sloppy practices could come back to haunt devs

Poor security practices on this front could have wide-reaching regulatory implications for enterprises, the study warned.

Under the EU’s Cyber Resilience Act (CRA), organizations are required to provide a detailed assessment 48 hours after becoming aware of a breach – and this includes providing provenance data.

More than half (53%) of respondents told Cloudsmith they'd need to put in a significant amount of manual effort or time to produce a comprehensive report of artifact versions, origins, and security attestations.

Only a quarter of engineering teams automatically generate and verify Software Bills of Materials (SBOMs) at every build, with the rest doing it manually, reactively, or only when an auditor asks.

Notably, nearly three-quarters (74%) said they'd struggle to produce a complete report quickly if they were hit with a surprise audit tomorrow.

The majority (83%) run outdated artifact management systems, often because they're worried that upgrading is risky or painful.

Software supply chain threats are growing

Weak software supply chain security has become a high-profile issue over the last year, not least with the Axios npm compromise that hit earlier this month.

With threat campaigns including Shai Hulud 2.0 and SANDWORM_MODE specifically targeting the software supply chain via upstream repositories, 44% of respondents said they'd experienced a security incident caused by a third-party dependency.

The same number said their organization spent over 50 hours per month investigating potential security issues linked to third-party dependencies, whether or not they resulted in a breach.

“Agentic development is an incredibly powerful way to build software, and teams will be far more productive and write even more software as a result. That is a good thing, because the world certainly needs more software and more automation," said Weinstein.

"For enterprises to manage this new velocity and productivity, automated guardrails and context are the new keys to unlock the production of safer, more efficient code.”

FOLLOW US ON SOCIAL MEDIA

Salesforce CEO Marc Benioff still believes AI is nowhere near capable of replacing software engineers, and the proof is in the fact that many major industry players are still hiring for roles in this domain.

Speaking during a recent podcast appearance, Benioff said that AI is undoubtedly having a positive impact on software engineering, enabling teams to ramp up production and unlock significant productivity gains.

The technology isn’t a silver bullet and an excuse to reduce headcount, however.

Human workers remain critical and many big tech companies leading the charge in AI are still hiring in areas like software engineering – a trend he said acts as the “canary in the coal mine” for AI’s current capabilities.

“The models still cannot operate autonomously,” he said. “We’re not at that level yet of AI.”

“Our engineering organisation is probably more than 30% productive, but I wouldn’t call it 100% more productive, and that’s why even in the top AI companies, if you go to their job boards, you’ll see they are still hiring a lot of engineers,” Benioff added.

“Even though these top AI companies … have these unbelievable models, they need a lot of humans. That’s probably the canary in the coal mine that we know that the models are not at that level yet.”

Statistics from TrueUp, a platform that tracks open positions in the tech sector, shows engineering job openings have been trending upward slightly over the last two years.

Yet despite continued demand - albeit mild compared to pre-2023 levels - concerns about the impact of AI on entry-level roles have been rising.

Analysis from IDC in November 2025 warned entry-level roles will be among the hardest hit by AI adoption, and developers have been firmly in the crosshairs with this trend.

The changing face of software engineering

The influx of AI tools in software engineering has precipitated significant change in the profession over the last two years. In late 2024, for example, Gartner warned anywhere up to 80% of engineers will be forced to upskill to accommodate for changing skills requirements.

In January last year, Benioff himself proclaimed that the company “might not hire any software engineers” due to the advances in generative and agentic AI tools.

Despite that bold claim, Benioff said the CRM giant still has over 15,000 engineers globally, which has given the company a vital insight into how the technology is changing daily workflows.

When asked about whether AI would mean engineers need to become “generalists”, Benioff noted that many are now acting in a supervisory capacity managing agents working away in the background.

“The key thing about these 15,000 engineers, they’re all out there all over the world, all of them can now be hugely augmented with these coding tools,” he said.

“It could be Anthropic 4.6, it could be OpenAI Codex, it could be Cursor,” Benioff added. “But they start to use these models, they’re now working not only with the AI, but agents to help them code and they can even become somewhat supervisory over these agents.”

The use of AI still requires humans in the loop to ensure security and safety standards are maintained, however. This has become a recurring talking point with the rise of AI coding over the last 18 months. Indeed, a slew of studies highlighting AI-generated code flaws and the need for more hands-on supervision by developers.

Research from CodeRabbit in December, for example, found that although AI is helping improve developer productivity, the efficiency gains are being offset by flawed code and security issues, with many facing increased levels of manual remediation.

The situation with agents is no different. Workers across a range of professions are now managing these autonomous bots and encountering higher workloads.

Six in 10 knowledge workers who manage agents told Asana their roles are made more difficult due to “confidently wrong outputs”, highlighting the need for robust safeguards and supervision.

FOLLOW US ON SOCIAL MEDIA

Microsoft's retirement of a key OS deployment (OSD) tool is forcing admins into a scramble to find new tools – and the cloud might not offer all the answers.

That's according to a survey of IT professionals from Recast Software, which found that although 99% say OS deployment is important, 18% are still relying on Windows Deployment Services (WDS) or the now-retired Microsoft Deployment Toolkit (MDT).

The survey highlights the urgency of finding alternatives or replacements, according to David Segura, Senior Software Engineer at Recast.

Part of the drive to find alternatives is down to Microsoft retiring MDT in January, with WDS losing significant features and being partly deprecated.

Segura noted that once the VBScript component is removed from Windows 11 releases – expected to happen next year – MDT will no longer be able to deploy new versions of the OS.

"The organizations that are managing this transition well aren't waiting for MDT to break," Segura said in a blog post. "They're planning now."

The shift to cloud hasn't changed the importance of bare-metal deployment, thanks to ransomware recovery, hardware upgrades, and production imaging at scale, which involves deploying OS builds across large fleets with a custom image, he said.

"With 81% of respondents rating bare-metal or disaster recovery OSD as having a high or critical importance, the urgency is real," Segura said. "Organizations leaning on a retired tool for a critical workflow face compounding risk the longer they wait."

Finding a better way

The results of the poll suggest that teams are moving to more modern management options, with 48% Intune-only and 40% hybrid.

Key pain points remain, however, including maintenance overheads (28%), driver management (25%), speed (20%), and costs (11%) all highlighted in the survey.

"These aren't new problems, but they're persistent ones," Segura said. "The common thread: SysAdmins want OSD to be less work, not more, especially as environments grow more complex."

While companies are shifting to Intune, or a mix of ConfigMgr and Intune, Segura noted that isn't always enough.

"The challenge is that OSD and imaging workflows don't map 1:1 from ConfigMgr to Intune," he said.

"Autopilot handles provisioning for new devices in Intune, but it wasn't designed for bare-metal rebuild or disaster recovery scenarios. Organizations moving to cloud management still need a way to handle those cases."

Next steps for admins

Segura warned that action was needed now, regardless of what alternative your company chooses.

"If your organization is still running MDT, the window to plan a replacement is narrowing," he said.

The first step is to audit your bare-metal OSD dependency to understand which workflows continue to rely on MDT or WDS.

For those switching to cloud management, it's time to audit OS deployment to see anywhere that lacks coverage from existing tools.

"Those are your risk areas," he said.

FOLLOW US ON SOCIAL MEDIA

Slack has announced a slew of new capabilities for its AI-enabled Slackbot, with greater support for connecting to third-party apps, taking meeting notes, and automating desktop tasks.

With expanded access to the model context protocol (MCP), Slackbot can now route user queries directly to Agentforce, as well as over 6,000 apps within the Salesforce ecosystem or any third-party tool an organization chooses.

Slackbot can sit in on and transcribe business meetings in apps such as Zoom, providing live responses to users based on enterprise data. Because Slackbot is connected to other business apps via MCP, it can automatically generate follow-up actions, populate CRM fields, and take other post-meeting actions.

Slackbot only listens when it’s asked to, at which point it draws on the audio feed of the user’s device. This means it works across different languages, Seaman added.

Organizations also now have access to reusable and schedulable skills for Slackbot, which leaders can share with employees to give them shortcuts to unlocking new features within the tool.

Seaman told assembled media that this could include a standardized approach for updating forecasts, which can be shared with all sales reps at the organization to embed it within their Slackbot.

In addition to its expanded capabilities within Slack itself, Slackbot will also gain desktop integration capabilities. This is the technology that allows it to listen to audio within meetings, which will also let it read a user’s screen in other apps such as for generating answers based on user emails.

Fluid Slackbot integration

With the expanded MCP support, any app within Slack can register its MCP server through Slack’s manifest, allowing Slackbot to call it when relevant.

“One of the most important things about this to me is that every single employee, with the explosion of these AI tools and agents, no longer has to think about which one to go to in the moment,” said Rob Seaman, EVP & GM of Slack,

“They can just turn to Slackbot and say, ‘hey, I have this particular sales strategy thing that I want to get accomplished and that will actually figure out what MCP server tool and agent it needs to call to get it done.”

Seaman added that this may result in an Agentforce agent being called, or even a ticket being sent to a human worker depending on the best solution to a user’s problem.

Users can also now request Slackbot perform ‘deep research’ on a question, prompting it to continue processing the request until the user’s demands have been met. Slack has additionally added memory to Slackbot, allowing it to gradually provide more relevant, personalized answers to user queries over time.

“So right now you can go in and ask Slackbot a question and say, ‘hey, you know what? I don't actually care about the amount of time that you take to do this’,” Seaman explained.

“I want you to exhaustively research how this particular thing happened over the past, what learnings I might be able to get from it, and don't just look at our Slack, look at our Google Drive, or our OneDrive that's connected, and also look at the web as well.”

Secure AI within Slack

Whenever Slackbot searches Slack, takes an action, or accesses another system it does so as the user who is accessing it, to ensure privacy and security controls are applied.

“Slackbot cannot access anything that the user cannot,” Seaman said.

“So it can read public channels, it can read private channels the user is in, and it can read the user's direct messages. When it goes off and searches Google Drive as an example, it’s searching as that user. That user has to OAuth in, so it does not have any super user access to any information, it's not training across users, anything like that.”

These same rules apply when Slackbot acts on the user’s behalf in Google Workspace, such as creating a document, for example.

In response to customer requests, the company has also introduced ‘Confidential Channels’ within Slack, to which human users have access but Slackbot does not.

Slackbot success

Slack reports high user uptake of Slackbot, with Seaman clarifying that the tool is heading towards one million weekly users – a stat that would make it the fastest-adopted feature in Salesforce’s 27 year history. Some employees at customer organizations who already use Slackbot are saving 90 minutes per day, the firm added.

"Slackbot has become a vital resource for our teams,” said Peter Stoltz, VP, Head of CIO Office at reMarkable.

“Its natural language search is incredibly intuitive; you can ask a broad question, and it instantly pulls the right context from across DMs and channels to provide a clear timeline of events.

“Whether we are summarizing a busy week or confirming specific agreement terms, Slackbot consistently delivers the quick, accurate answers we need to stay aligned, saving our teams hours of manual work each week."

Slackbot is currently available in the Business+ and Enterprise+ pricing tiers, with no associated cost tied to the number of tokens it consumes.

ITPro asked Slack if this would change to a cost-per-token model in the near future, as inference costs increased with features like deep research.

“We’re always evaluating how we package and deliver AI capabilities to reflect the value we provide customers,” said a Salesforce spokesperson in response.

“Today, powerful AI tools like Slackbot are included in existing Slack subscriptions, and we’ll continue to assess our approach as the technology evolves.”

FOLLOW US ON SOCIAL MEDIA

The Competition and Markets Authority (CMA) has launched an investigation into Microsoft’s software licensing practices due to competition concerns.

A strategic market status (SMS) investigation will begin in May and see the regulator examine the tech giant’s licensing practices in relation to Microsoft 365.

The business software suite includes a host of popular applications, including Word, Excel, and Teams.

Sarah Cardell, chief executive of the CMA, said an SMS designation would allow the regulator to “tackle remaining concerns around Microsoft’s licensing practices” and “ensure a level playing field as AI is rapidly embedded into everyday business software tools”.

An SMS designation is a label applied by the regulator to technology providers that hold a disproportionate influence on certain markets - in this case, business software.

AI interoperability in the crosshairs

Notably, the regulator specifically highlighted the emergence – and interoperability – of AI tools such as Copilot as a key focus of the probe.

This aspect of the investigation comes amid the rapid adoption of AI tools by public and private sector organizations across the UK. Microsoft, in particular, has positioned its Copilot services as a core application in its business software estate.

“The implications are significant for UK productivity, competitiveness, and value for money across the private and public sector,” the CMA said in a statement.

“The UK will benefit most where a broad range of competitors can integrate with Microsoft’s business software, so that businesses and public sector organizations can mix-and-match AI software across suppliers to best suit their needs.”

Microsoft, Amazon cloud licensing changes

The launch of the probe comes after Microsoft and Amazon both agreed to address competition concerns surrounding cloud services.

The two hyperscalers have been subject to a long-running investigation by the regulator over their dominant positions in the UK cloud computing market.

Key issues such as interoperability and “egress fees” – which place high costs on customers transferring data to other services – were highlighted in the probe.

Last year, the CMA concluded the duo’s dominance actively harmed competition in the country’s cloud computing market – a ruling that prompted a fierce reaction.

“Both firms are taking material steps to lower egress fees and improve interoperability, including as reflected in announcements the firms are issuing today,” the CMA said in a statement.

“These actions create benefits for UK businesses, enabling greater scope for multi-homing to support customer choice and the resilience of UK tech stacks.”

FOLLOW US ON SOCIAL MEDIA

Oracle NetSuite has announced a slew of new AI connectors to help customers integrate AI tools within their NetSuite environments more easily.

The ERP giant is expanding NetSuite AI Connector Service, its protocol-driven AI integration platform that provides customers with support connecting their own AI assistants to NetSuite via the model context protocol (MCP).

Unveiled at its regional SuiteConnect London event, NetSuite MCP Apps will allow users to access NetSuite data through their chosen AI assistant, with familiar user interfaces including filters, forms, and selectors.

In a demo, a user was shown asking Anthropic’s Claude to pull up data on all accounts that are overdue by 30 days or more and turn this data into a comprehensive dashboard.

During the process, the user can see the NetSuite tools that Claude is calling, as well as the code being generated for the dashboard.

NetSuite noted that MCP Apps will also work with AI services including Gemini and ChatGPT, as well as a range of other compliant AI assistants.

“Nothing exemplifies agility more than the ability to connect the AI tool you choose directly to NetSuite,” said Evan Goldberg, founder and EVP at Oracle NetSuite, in the event’s opening keynote.

“This solution allows leading AI assistants to interact directly with your NetSuite environment in a secure and governed way. It's powered by the model context protocol or MCP, which creates a structure bridge between AI models and enterprise applications, and the same capability works across multiple AI assistants so you're not locked into a single model or vendor.”

The circular economy non-profit, EAL Green, which repurposes corporate excess inventory and uses the returns for college scholarships, is using the AI Connector to log inventory through multimodal input.

EAL Green workers can upload images to Claude, which identifies the photographed product, logs it in NetSuite, and updates the inventory.

NetSuite touts AI Connector Service Companion

Another new feature is the NetSuite AI Connector Service Companion, a package of instructions and context that helps users deploy AI without prompt engineering experience and ensures connected large language models (LLMs) understand NetSuite and finance workflows.

This includes NetSuite AI Connector Service Companion Skills, which equip connected AI models with instructions and context specific to NetSuite, as well as Prompt Library, a collection of over 100 prompt templates for easily accessing financial data.

Using the new MCP Apps, users can access the Prompt Library through a graphical interface rather than text prompts. For example, a business user can ask Claude to create a new sales order, and be shown a NetSuite graphical interface directly within the Claude client.

Additionally, users can now apply pre-configured MCP rules to connected AI assistants, including existing NetSuite security profiles or ‘roles’ such as CFO, Accounts Receivable Analyst, or Treasury Analyst.

“This Companion helps deliver a world-class AI experience, and helps these assistant

“With the companion, teams can use AI more reliably and consistently across finance operations,” said Goldberg, adding that the Prompt Library sits at the very core of the service.

In another demo, focused on NetSuite AI Connector Service for Analytics Warehouse, a user was shown asking Claude to discover trends in their accounts receivable data within NetSuite. They could then ask Claude to help them generate a dashboard within the Analytics Warehouse.

“So with this AI connected service for Analytics Warehouse, you can scale your analytics use cases across more teams, you can bring in

NetSuite AI Connector Service Companion and the NetSuite AI Connector Service for NetSuite Analytics Warehouse are currently available in English and the firm is targeting further languages in a later release.

MCP Apps are planned for the next release of MCP Standard Tools SuiteApp.

FOLLOW US ON SOCIAL MEDIA

A preview of a major Windows 11 update has been paused by Microsoft after users reported installation errors.

The update, KB5079391, is a preview of non-security features for Windows 11, so it won't have gone out to all users. The preview was first released last week, and paused a day later.

While spotting a flaw in an update is rather the point of previews – it's better than the update going out to a wider user base – the error comes hot on the heels of a pledge to improve Windows, in particular updates.

"Across the operating system, we will focus on improving the baseline reliability of areas such as the Windows Insider Program, drivers and apps, updates and Windows Hello," the company said in a March blog post.

That promise followed a series of security patches and other updates featuring bugs that caused chaos for users by starting reboot loops, breaking reset and recovery loops, and even possibly bricking some SSDs.

Why did Microsoft pause the Windows update preview?

In this instance, the update is a non-security feature preview, so isn't a requirement to roll out quickly. The flaw appears to block users from installing the preview at all.

Reports from Tom's Hardware suggested an error message shown to users said that update files were missing or had flaws, with the system promising to download the update again later.

On Microsoft's support site, the company said: "Rollout of this update is temporarily paused due to installation error."

"To prevent additional impact while the issue is investigated, Microsoft has temporarily limited the availability of this update," the company reportedly added. "As a result, the update temporarily might not be offered through Windows Update."

Microsoft is yet to reply to ITPro's request for further comment. The update was initially released on 26 March, and was paused the following evening; as yet, Microsoft has not reissued the update.

What was in the Windows update?

The update for Windows 11 applied to versions 25H2 and 24H2 and was labelled as KB5079391. Microsoft noted the update primarily targets "production-quality improvements" for the operating system.

When the preview is fixed, the update will include new features for Windows 11 – with the company specifically highlighting new "AI powered capabilities".

That includes a tool called Narrator, which uses Copilot to describe images. This is being expanded from Copilot-only devices to all running Windows 11. Another feature is the ability to enable or disable Smart App Control without a clean install.

Alongside those, Microsoft is rolling out updates to Display reliability and a few usability tweaks to Account Settings and File Explorer.

"You can more reliably unblock files downloaded from the internet in order to preview them in File Explorer," the company noted, adding files can be renamed using Voice Typing.

"You can now sort the permissions entries in the Advanced Security Settings window for a folder in File Explorer by Principal."

Other improvements are coming to Windows Hello fingerprint reliability, Voice access tools, and loading taskbar components in safe mode, according to the support document.

FOLLOW US ON SOCIAL MEDIA

Discussion is intensifying around whether open source AI can offer more flexibility and resilience compared to proprietary AI – but the conversation is muddied by confusion around what makes an AI solution ‘open’.

Thanks to the 30-year-old Open Source Definition (OSD) there’s a clear understanding of what’s considered open source software, but the same cannot be said for AI, says Amanda Brock, CEO at OpenUK. She believes trying to define open source AI as a whole hasn’t worked, and that a better approach is disaggregation: looking at what the components of a form of AI are, and how they’re licensed.

This is because most so-called open models are open weights only, says Nell Watson, IEEE senior member, author and AI ethics engineer at Singularity University. “You get the trained parameters, but not the training data, methodology or reproducibility guarantees. Llama is not open source in the way Linux is. That distinction matters, because the value proposition of openness – auditability, sovereignty and independent verification – depends on which layers are actually open.”

“Equally important is what license it’s shared on. This is where we can see ‘open washing’, where someone uses the term ‘open source’ to describe their project when the license has some form of restriction,” says Brock. She points to Meta’s Llama 2 as an example.

“There’s a commercial restriction and an acceptable use policy in the Llama software license, meaning it’s neither open source nor open model. Coming up to its launch, Meta was calling it open innovation behind the scenes and I think that’s right. There are degrees of openness around AI, and we have to be careful to understand what these distinctions and definitions are.”

The case for open source AI

Once enterprises have clarity on what they're actually adopting, they can then weigh up the pros and cons. One advantage of open-source AI is retaining more control.

While choosing a proprietary application programming interface (API) can make things easier at the start, it can create compounding dependencies including pricing you don’t control, availability you can’t enforce and data handling you can’t verify.

The question every CIO should ask is what happens when your vendor changes terms, raises prices or discontinues the model you’ve built around, says Watson. “Enterprises that went all-in on single-vendor cloud stacks in the 2010s learned this lesson the hard way. AI is heading for the same reckoning, only faster,” she warns.

Regulated industries are leading the way, with Nvidia reporting financial services firms deploying open weight models at higher rates than most. 84% of respondents surveyed by the chip giant stated that open source models are important to their overall AI strategy.

"Open models that have been vetted and hardened allow enterprises to maintain full ownership and control of both models and training data," says IDC research manager Dr Michele Rosen – with half of respondents in regulated sectors calling this "critical."

Digital sovereignty is sharpening this pressure further, as enterprises serving international clients can no longer treat data residency and compliance as an afterthought.

Can open source compete with the hyperscalers?

The control argument is all well and good, but counts for nothing if the technology can't do the job. Belief that open source AI simply can't keep up with hyperscalers is widespread, but that’s only partly true.

The reality is that most enterprises don’t need ‘frontier’ capabilities. Instead, they’re after reliable, auditable and cost-predictable performance on specific workflows, and for those use cases, a fine-tuned open model will often outperform a general-purpose frontier model, “because specificity beats scale,” says Watson.

For organizations like Bloomberg, the open versus proprietary question is largely beside the point. "In a production environment, it's less about open weight vs proprietary and more about performance metrics. A smaller model, whether open weight or proprietary, might actually give you better speed and accuracy in a given situation,” says Amanda Stent, head of AI Strategy and Research in the Office of the CTO at Bloomberg.

“The gap at the absolute frontier still exists for the most demanding general reasoning tasks, but optimizing for benchmarks that don’t match your workload is an expensive distraction,” continues Watson. “The enterprises getting the most value from AI right now are those asking ‘what do we actually need?’ rather than ‘what model tops the leaderboard?’.”

In the next few years, a hybrid model to model licensing could become the dominant approach.

“Proprietary APIs will remain the standard for general purpose ‘daily assistant’ copilots, while open source will become the backbone of internal, mission-critical AI platforms,” says Mark Scrivens, CEO of FPT UK. “We’re already seeing this in highly regulated sectors such as healthcare and banking, financial services and insurance, where we’re seeing a surge in open-source adoption for large-scale transformation projects.”

What to consider before choosing open source AI

The case for open-source AI is building, but so is the to-do list, as it demands significantly more from an enterprise than just signing up for an API key. Brock points to the parallel with early open source software. The assumption then was that free to use meant free to run, and that simply wasn’t the case.

In the case of open-source AI, models often require more hands-on oversight. “Unlike proprietary models, open-source deployments place the responsibility squarely on internal teams,” says Rosen. “Therefore, moving beyond proprietary APIs requires a higher level of operational maturity.”

“It requires a shift from AI user to operator,” adds Scrivens. “Organizations need GPU-ready clusters, whether on-premise or via the cloud. This transition also requires talent proficient in machine learning operations (MLOps), model evaluation and prompt engineering. Organizations should also be prepared to monitor model drift, performance and security in real time.”

Not all open-source projects are equal either. Some have thriving contributor ecosystems, while others are effectively a single corporate sponsor with a permissive license, notes Brock, and enterprises need to know the difference before they commit.

Building a strategy that works

For those weighing up their options, Scrivens recommends organizations begin with pilot projects that use open source models to test performance, cost and operational requirements. The next step, he says, is building a flexible architecture that supports both proprietary and open source options.

According to Watson, the enterprises making the smartest moves right now are treating this as a “constitutional moment”.

“They’re putting governance structures and technical architectures in place that preserve real optionality before the market consolidates further. Sovereign AI capability – the ability to inspect, modify, govern and if necessary, walk away from your AI systems, is something you either build now or negotiate for later from a position of weakness,” she advises.

“The window is open, but won’t remain so indefinitely,” she concludes.