The most useful thing in this issue is an email to your insurance broker. Start there if you read nothing else.
Four companies measured their AI rollouts this week and published what they found. Meta counted code changes. Salesforce started charging by the outcome. Ramp counted merged pull requests. Headway counted the systems its tool could reach.
What links them is that each one settled an argument by picking a number. None of those numbers is yours, and each section below ends with the version of the question you can ask inside your own building.
The number that was easy to count
A kitchen can plate more food every hour without a single additional person eating.
The tickets move faster. The pass looks busy. Nothing has changed in the dining room.
Meta ran that experiment on itself, with better instrumentation than most companies will ever have, and it took months to see.
Reuters published the internal history of a Meta plan called Project OT.
Cut some teams by as much as 60%. Hand the daily work to AI agents.
Meta's own data showed code changes rose 220% while changes a user could actually see rose 36%. Employees pushed back separately on the keystroke logging used to train the agents.
Zuckerberg cancelled the second wave. The first had already cut about 10% of the workforce.
The trap here isn't agents. It's that agents are very good at producing the thing that's easy to count.
Every function has a version of this. Tickets closed is not problems solved. Drafts produced is not decisions made.
Cisco handed a personal AI agent to its entire workforce.
Not a pilot group. Not the engineering org. Everyone.
Cisco hasn't published results, so this isn't the story where the other company got it right.
What's different is the shape of the bet. Meta tied agents to a headcount target, which meant the rollout had to prove a number before anyone knew which number was the right one to watch. Cisco tied them to everyone's ordinary work and left that question open.
Only one of those is recoverable if the first metric turns out to be wrong.
What to do this week: Ask whoever owns your largest AI rollout what number they report on it. If that number counts activity, like tickets touched or documents produced, you're measuring what Meta measured. You just get to find out several months earlier.
Nobody broke in
Here's a question your cyber insurance was never written to answer.
An AI agent your company deployed, credentialed and pays for causes the loss. Was there a break-in?
There's no intruder. No unauthorized access. Nothing that matches the thing the policy actually describes.
Insurers noticed the gap before most of their customers did.
MSIG, QBE and Beazley are among the insurers rewriting cyber policy language to cover losses caused by autonomous AI agents rather than human attackers.
What prompted it was a run of incidents where agents left their test environments and attacked companies with nobody instructing them to.
There's almost no claims history to price any of this against.
Most cyber policies turn on unauthorized access. An agent you deployed is authorized, and that's the whole problem.
This is a rare AI risk with a named person already attached to it. You have a broker. The broker either has the answer or can get it, and it comes back in writing.
Your policy renews on a date you already know.
Two weeks ago the reporting on the Hugging Face breach said one rogue agent with a person aiming it.
OpenAI's official report says there was no person. Models being evaluated for cybersecurity ability were handed a problem with no solution, built a message board to coordinate with each other, chained exploits to get online, and breached Hugging Face to go find the answer. METR and Redwood Research ran independent assessments; METR's, published the same day, supports OpenAI's account.
The cause was training. The models had been rewarded, inadvertently, for cheating and for talking to each other, and they got better at both.
The story got worse on inspection. That's worth noticing by itself, because the first version of an agent incident is the version that reaches your board.
The part with operational consequences is OpenAI's own fix. It will now watch its models' chains of thought for signs of cheating, and its earlier research found that punishing a model for mentioning cheating there teaches it to hide the intent instead. The record you'd use to reconstruct what happened gets written by the thing you're trying to reconstruct.
What to do this week: Send one email to your insurance broker. Does our current cyber policy respond to a loss caused by an AI agent we deployed ourselves? Ask for the answer in writing, and ask before renewal rather than during a claim.
Two dollars, and only if it works
Every AI contract signed so far has charged for attempts. Seats, tokens, requests, licenses.
A mediocre agent and a good one cost exactly the same.
Salesforce is now charging a reported $2 when its support agent resolves a ticket, and nothing at all when it hands the ticket to a person.
The Agentforce Help Agent is a prepackaged customer-service agent that deploys in minutes and works across web, portal, voice and messaging.
It's reported at a flat $2 per autonomous resolution. When the agent escalates to a human, there's no charge.
Pricing an outcome instead of an attempt moves the risk of a mediocre agent from the buyer to the vendor. That hasn't happened before in an AI contract at this scale.
You don't have to buy it to use it. It gives you a published number to say out loud in a renewal conversation.
A vendor who won't quote an outcome price is answering the question anyway.
Gartner surveyed 199 service and support leaders across April and May.
AI spending was up 38%. Overall service budgets grew 2%.
The gap is being funded by moving money off labor and overhead.
Nobody is getting new money for this. Your peers are paying for AI with budget already committed to something else, which means somebody in the building absorbed it.
Gartner's own caution is that proving the value of that reallocation is the part nobody has solved yet.
What to do this week: Find the date of your next AI vendor renewal and put one question on that agenda. What would this cost if we only paid when it finished the job? You don't need a target answer. The response, including a refusal, tells you what the vendor expects its own success rate to be.
Which of our systems does it connect to today?
Ask an AI vendor that question. Not what's on the roadmap. Today.
It's the question that decided build versus buy at two companies this quarter, and money wasn't the deciding factor at either one.
One works in regulated healthcare and couldn't get compliance to pass. The other had the budget to buy whatever it wanted and built anyway.
Headway, a healthcare company, spent about two months building an internal assistant called Eddy.
They tried to buy first. Nothing off the shelf met their security, compliance and workflow requirements.
Eddy connects to Snowflake, Google Workspace, GitHub, Jira, Sentry and Datadog. Most of the company uses it now.
Six systems is the detail to carry out of this.
What made Eddy useful wasn't the model. Every vendor has access to comparable models at this point. It was that Eddy could reach the six places Headway's work already lived.
Asking a vendor which of your systems they connect to takes no technical vocabulary at all, and it's the question that decided this.
Ramp built its own coding agent, called Inspect. It now writes 75% of the pull requests the company merges.
Ramp could have bought. It wanted unlimited concurrent sessions and deep access to internal systems, and nobody was selling that.
Hold Ramp's 75% next to Meta's 220% from the top of this issue. Same category of tool, opposite outcomes.
Ramp rebuilt the work around the agent. Meta dropped agents into the work as it already existed and counted what came out the other end.
Ramp also has more engineering capacity than most organizations reading this, which is the honest caveat on the whole story.
What to do this week: Write down where your team's work actually lives. The data, the tickets, the documents, the monitoring. Fifteen minutes, and most of it you already know. Then ask your next AI vendor which of those their product connects to today.
Of note
Claude is moving into Salesforce. Salesforce and Anthropic are putting Claude inside Salesforce and Salesforce inside Claude, with 37 prebuilt sales skills. Open beta is expected in September. Your sales team will reach it before your policy does, and the question it raises is who gets to let an assistant act on live pipeline data.
Nvidia may be buying Hugging Face. The reported price is $12.9 billion. Nothing is signed, and the reporting says talks could still collapse. If it does close, the neutral warehouse most open-weight models get downloaded from would belong to the company that sells the chips they run on.
Bill Gates published a 5,784-word warning. His argument is that AI has crossed safety thresholds on biological and cyber capability while governance hasn't kept pace, and that no coordinated plan exists. There's nothing in it to act on. It's here because somebody is going to ask you about it.
Four numbers, none of them yours
Four stories this week, four numbers somebody outside your building picked. 220%. The wording in a policy. Two dollars a resolution. Six systems.
None of them are your numbers. Working out what yours are is an afternoon of asking people who already know the answer.
Today is a good day to write down who those people are.