Pointing to recent security incidents where networked AI agents spontaneously formed “swarms” to hack computer systems, U.S. Sen. Maria Cantwell (D-WA) took to the Senate floor Monday to demand urgent federal guardrails and mandatory independent safety testing for frontier AI models before their release.

Cantwell warned that recent security incidents involving autonomous AI agents executing unauthorized cyberattacks demonstrate that dangerous threats are already here, well before the arrival of superintelligence.

Citing recent public alarms sounded by tech leaders including Microsoft co-founder Bill Gates, Anthropic CEO Dario Amodei, and OpenAI CEO Sam Altman, she emphasized that AI systems are advancing faster than expected and risk slipping out of human control without immediate oversight.

“The technology keeps advancing, the risks keep growing, and now the very dangers we’ve warned about — autonomous cyberattacks and biological weapons — are no longer theoretical,” Cantwell said. “We need our colleagues to say, ‘Stop with saying the industry can do what it wants’ and let’s put together the infrastructure at the federal level that not only has strong federal standards, but also has independent testing and real safeguards for the American people.”

Cantwell, a five-term senator and former RealNetworks vice president, delivered her speech in the wake of increasing alarm over rogue AI behavior and internal whistleblower warnings across the tech sector.

The senator highlighted several stark warnings during her address, pointing out that the risks associated with rapid AI deployment extend far beyond theoretical models:

On the speed and deceptive potential of agent networks: “These networks of agents are extremely well informed. They operate at the speed of light and, as we are learning, they are also capable of creating their own goals, and they are highly capable of deception.”

On why swarms pose a unique threat compared to standalone AI models: “Unlike powerful AI models designed to serve individual users… this situation with agents swarming is more difficult to manage and is far more dangerous.”

On Congress running out of time to establish federal oversight: “Now, some of these risks may not have been apparent in the last two years, but we would have stood up the muscle of our organization at the federal level to better detect risks like cyberattacks… At a time when we still had a window to get ahead of these dangers, the federal government, people here, were denying this opportunity.”

To address these emerging threats, Cantwell is calling on Congress to establish robust federal safety standards, independent third-party audit requirements, and dedicated federal infrastructure to evaluate advanced frontier models before they hit the market. Her legislative push centers on revival and passage of a suite of bipartisan bills:

The Future of AI Innovation Act: Originally introduced by Cantwell to empower the federal government to collaborate with industry to independently test advanced models for national security, biological, and cybersecurity risks.

The TEST AI Act and VET AI Act: Measures designed to bolster the Department of Energy’s testing capabilities for national security and establish official standards for third-party safety auditors.

A veteran policymaker on technology and innovation, Cantwell has long leaned on her private-sector tech experience to position herself as a primary legislative bridge between Washington, D.C., and the Pacific Northwest’s tech ecosystem.

As a lead author of the landmark 2022 CHIPS and Science Act, Cantwell helped direct federal investments toward AI and emerging technologies. Over her Senate career, she created the National AI Advisory Committee (NAIAC), championed small business adoption via the AI for Mainstreet Act, and led the opposition to a proposed 10-year moratorium on AI regulation.

Hector Rivas spent a decade building ThriftBooks into one of the country’s largest used-book sellers, before an unlikely second act: co-founding a sports agency representing NFL players.

That career change led him to the problem behind his newest startup, and to the Las Vegas Raiders running back who just invested in it.

Nukleus, based in Issaquah, Wash., is building what Rivas calls an operating system for the business of sports. The idea is a single workspace for everyone in an athlete’s orbit: agent, lawyer, CPA, financial advisor, marketing team, and others. It lets them all work from the same contracts, deadlines and records, rather than each keeping a separate pile of emails and spreadsheets.

The idea came out of Rivas’s years at Disruptive Sports, the agency he co-founded in 2020 and left earlier this year.

Ashton Jeanty, who signed a four-year, $35.9 million rookie contract with the Raiders in 2025, has taken equity in the company and signed on to serve as its public face.

Nukleus has also named four strategic investors: Mat McBride, Microsoft’s executive vice president and CFO for commercial products and infrastructure; WaFd Bank President and CEO Brent Beardall; investor Skyler Nelson, previously of Vulcan Capital and its successor firm Cercano; and Dr. Brett Kindle of the Andrews Institute in Gulf Breeze, Fla.

The company has a team of 12 based out of its Issaquah office, plus a supporting engineering team in India. Most of the team is engineering.

Other executives include CTO Eric Ahlstrom, previously at Microsoft, Unity, Oracle and ESPN; chief creative officer Ben Miller, a former creative director at the University of Washington and CAA Sports; and CFO Matt Porter, who worked with Rivas at ThriftBooks, EcoGoodz and Disruptive.

Nukleus closed a pre-seed round from friends and family in 2025 and is raising again now. Rivas declined to disclose the amount raised by the company so far.

From books to football: Rivas was ThriftBooks’ first CEO, running the used-book seller for about a decade after it launched in 2003. Based in the Seattle area, the company grew during his tenure from a storage unit in Kirkland, Wash., to 10 distribution facilities in 10 states, by his account.

He went on to found EcoGoodz, a used-goods and overstock brokerage, and in 2020 co-founded Disruptive Sports Agency with agent Henry Organ.

Rivas, an NFLPA-certified contract advisor, worked the business side of the agency. He left earlier this year to build Nukleus full time.

The years inside the agency are what produced the idea.

Everyone in a player’s orbit was working off “their own version of the truth,” Rivas explained via email: the agent, the lawyer, the CPA, the financial advisor, the marketing team. The athlete, he said, “was the one absorbing the cost of that disconnect,” in slower decisions and deals that fell through the cracks.

The pitch in Las Vegas: Jeanty and Rivas knew each other from Rivas’s years at the sports agency, and Rivas said the running back had been tracking what he was building.

“Because Ashton and I already knew each other, and he’d been aware of what I was building, the conversation came together naturally,” Rivas said.

He flew to Las Vegas to walk Jeanty through the model, the team, and where the company was headed. Rivas said Jeanty’s equity reflects both money invested and his role promoting the platform.

In a statement, Jeanty described the job of running his own career.

“Coming into the NFL, you become a CEO, directing a team of agents, advisors, and marketers, whether you’re ready or not,” he said. “Nukleus is what finally gets them all on the same page, so I can actually run that team the way it should be run. That’s why I invested in it.”

Where things stand: The product is in a free beta with about 30 users, including athletes, agents, agencies, lawyers and marketing staff. Nukleus plans to charge $99 per user per month for a starter plan and $249 for a full-featured one, with custom enterprise pricing. Athletes join free.

Alongside contract storage, deadline tracking and a shared workspace, the company is building AI tools meant to answer questions about contract terms and league rules.

Others are working similar territory. Agent Live 360 sells software built specifically for sports agents, and Opendorse, which says it works with more than 1,000 sports agents, offers tools to negotiate, approve and track deals. Nukleus says it differs from narrower tools by serving everyone in an athlete’s orbit.

The bigger bet: The company is looking well past a single app.

“Long-term, I don’t see this as a tool athletes use, I see it as the infrastructure the entire business of sports runs on,” Rivas said. “Every athlete becomes the center of their own connected team, and every professional working with them, across every sport, at every level, operates on one shared system instead of a hundred disconnected ones.”

Amazon is adding the Activity Feed and other features from its Quick desktop app to the AI assistant’s mobile apps for iOS and Android.

The Activity Feed is the signature feature of Amazon Quick. It combines email, Slack messages, calendar invites and CRM updates into one prioritized list, and lets people act on items (opening and responding to emails, for example) without switching apps.

Amazon said Wednesday that the Quick desktop app, released in preview in April, is now generally available on Windows and macOS. The company also said Quick’s agents now run in the cloud, so they keep working after a laptop is closed and deliver results to the feed.

The desktop and mobile apps now sync, as well, so a task started on a laptop can be picked up on a phone, for example.

Quick has a free tier, with paid individual plans starting at $20 per user per month billed annually, and business plans running $20 to $40 per user per month.

Quick is Amazon’s entry in a crowded market for AI assistants at work, competing with Microsoft Copilot, Google Gemini, OpenAI, Anthropic and others. Amazon’s announcements cited business customers for Quick including Southwest Airlines, LabCorp and the PGA Tour.

The desktop app came together fast, as part of a new effort inside Amazon to use small teams to move quickly: Swami Sivasubramanian, the AWS vice president of agentic AI, told GeekWire in June that a team of about six engineers started in late January and shipped April 28.

GeekWire is profiling over the next few weeks some of the people and teams that are shaping the evolution of Microsoft in what we’re calling its “Microsoft 2.5” era.

Just Don’t Call It an ‘Agentic OS.’ Given Microsoft’s one-pointed AI focus these days, it’s not surprising that the Windows organization is on the agentic train.

But Executive Vice President of Windows + Devices Pavan Davuluri has learned the hard way not to call Windows an agentic OS. He did so back in November 2025, via a tweet and blog post, and the customer backlash was quick and biting.

But Davuluri has not done a complete U-turn because of the criticism. Instead, he has changed how he talks about where Windows is going — which is still in an agentic direction.

“The user of Windows going forward will continue to be users … but it’s also going to add these agentic workloads,” the nearly 26-year Microsoft veteran Davuluri told GeekWire in a recent interview.

During his time at Microsoft, he’s held a variety of roles, from intern to General Manager of Surface, to Corporate Vice President of Windows Silicon & Systems Integration. He was appointed Executive Vice President of Windows + Devices in March 2026, reporting directly to CEO Satya Nadella.

Windows needs to evolve to support agentic workloads through new platform capabilities that the team is building under the covers, Davuluri said. These low-level capabilities, or “primitives,” affect how Windows handles security, identity, governance, observability, and performance when it comes to building and running agents natively.

These coming changes likely will affect the Windows file system, security model, PowerShell, and other foundational components.

Microsoft already is working on Windows identity and manageability to make them better able to service agents. Windows can assign agents a local ID, or a cloud-provisioned identity backed by Entra.

And it also has an early preview of technology known as Microsoft Execution Containers, meant to help secure agents by running untrusted code in sandboxes or virtual machines. It’s these system-level areas where the team is focusing first in preparation for a human+agent future, Davuluri said, rather than the UX/UI level.

Going Back to Basics. Windows has had a lot of very different leaders over the years, with very different management styles and priorities.

For his part, Davuluri said he plans to run the Windows and Surface teams with four principles in mind: Maintaining customer obsession; treating Windows as a complete end-to-end system (“full stack”); focusing on complete user experiences and workflows rather than individual features; and building Windows openly and transparently, with clearer communication about plans and priorities.

On the heels of his promotion to EVP, Davuluri committed publicly to the much-needed goals of improving Windows quality and reliability. In a blog post, he outlined some of the requested changes that his team would be making to Windows, ranging from fixing the way the Insider test program works, to more granular improvements like allowing users to reposition the Windows task bar.

And since then, the team largely has been delivering to the surprise and delight of many long-time Windows users.

Davuluri has also been working to shift the conversation from which new features are coming to a specific build to what are the outcomes Microsoft wants to enable for specific groups of Windows users.

“There is no one single sort of ring for a billion-plus users on the platform,” Davuluri said. Windows users encompass people who use the product in a variety of different ways, so “we need to get clarity in our minds on the things that we do that lift all boats that raise the entire platform — and things that we have to go do that are specific and unique to each of our sets of users based on how they primarily or typically use the device.”

Full-Stack Thinking. Is there still a role for Microsoft as a PC maker in the coming agentic future? Not surprisingly, given his heavily hardware-focused background, Davuluri insisted there is.

When Microsoft debuted its first Surface devices in 2012, officials said the company needed to build its own hardware to create reference designs and innovative form-factor examples for other Windows PC makers.

These days, most Surfaces that ship arguably are not better, spec- or design-wise, than other PCs. But Microsoft still needs to keep a hand in hardware design to understand the full stack, Davuluri claimed.

Surface plays a key role in how Microsoft develops platform abstractions, incubates support for technologies like pen, facial-recognition, and neural-processing units that later spread across Windows, and optimizes for silicon-to-cloud, he said.

While the company’s attempt to create a distinct category of “Copilot+” AI PCs fizzled, Microsoft continues to try to find AI-centric reasons to convince customers to choose Windows devices. Davuluri and others have referred to the idea of “unmetered intelligence” to attempt to make the case for running AI models locally on PCs.

This fall, Microsoft (and other Windows PC makers) plan to roll out new PCs built on the Nvidia RTX Spark platform. The coming Surface Laptop Ultra, which will be optimized for RTX Spark, is aimed at creators, developers and AI builders, all of whom — Microsoft is hoping — will be fueling the growth of its next target user category: Agents.

Jargon stinks.  What do the terms open weights, RAG, and agent mean exactly? Here’s a plain English, slightly snarky glossary of befuddling AI terminology with references for further reading.

AI is a broad name for the technology. Machine learning is the part where a system learns from data instead of following rules somebody wrote, a neural network is the structure that does the learning, and deep learning just means a neural network with a lot of layers.

Here’s the nitty-gritty: the terms that get used loosely, and the distinctions the loose usage hides.

1. Model, LLM, frontier model

ChatGPT is the app you open; an LLM, or large language model, is the AI running inside it.

“Frontier” isn’t a technical category at all. It means the handful of biggest and most capable models at any given moment, so the trophy keeps changing hands.

Everyone says “LLM” and hardly anyone could define it on the spot. “Frontier model” is worse. It’s a ranking, announced by the people being ranked.

Further reading: How ChatGPT Works: A Non-Technical Primer (MIT Sloan). Rama Ramakrishnan walks through the predict-the-next-word mechanism everything else is built on.

2. Prompts, tokens, parameters

A prompt is the thought, question, or instructions you provide to the LLM (plus whatever the app added before it without telling you). The LLM takes the prompt and generates words, both in its internal “thinking” process and in the answer it shows you.  

Tokens are (roughly) the words going in and coming out. The model chops your prompt into tokens, then produces more of them as it answers, and they’re what the industry charges by.

Parameters, also called weights, are the numbers inside the model. A frontier model has hundreds of billions of them and the biggest now run to trillions, and nobody can tell you what any single one does.

Parameter counts get quoted like horsepower. The number nobody advertises is how many tokens it takes to answer your question, and that’s the one that shows up on the bill.

Further reading: The only AI glossary you’ll need this year (TechCrunch, July 2026). Its entries on tokens and weights are the clearest short treatment of the building blocks.

3. Pre-training, post-training, fine-tuning

Pre-training is feeding the model most of the internet, so it learns to predict the next word in a sentence. That’s the expensive part, and it produces something that knows a great deal but can’t follow an instruction.

Post-training is where people rank its answers and it learns to give more of what ranked well. Fine-tuning is post-training done by you, to somebody else’s model, on your data.

Pre-training costs hundreds of millions and gets you a model that won’t answer a question well. Post-training is what gets you the product.

Further reading: Illustrating Reinforcement Learning from Human Feedback (RLHF) (Hugging Face, 2022). The clearest walk-through of how ranking a model’s answers becomes a signal for training.

4. Training from scratch vs. distillation

From scratch, you buy (or rent) the computers and do the work to build and train a model. Distillation trains a cheap model on an expensive model’s outputs, so it inherits the behavior without the bill. Distillation is against most AI companies’ terms of service.

OpenAI accused DeepSeek of distilling its models, which is a bold position for a company that trained on the whole internet without asking. Learning from other people’s work is fine right up until the other people are you.

Further reading: OpenAI accuses DeepSeek of “free-riding” on American R&D (Rest of World, February 2026). OpenAI’s memo to Congress, and an analyst’s reply that no model is an island.

5. Training vs. inference

Training is how you build a model. Inference is what happens every time it answers: the model runs and produces a result.

Training is a one-time cost. Inference is a cost you’ll pay forever. Training runs for months and costs hundreds of millions; one inference, meaning one answer, costs a fraction of a cent, and it happens billions of times a day.

Training costs get announced. Inference costs get discovered. Only one of them shows up in a press release.

Further reading: Why AI’s next phase will likely demand more computational power, not less (Deloitte, 2025). Inference reaches about two-thirds of all AI compute in 2026, up from a third in 2023.

6. Open weights, open source, API-only

We typically use LLMs by accessing an app like ChatGPT, Claude, or Gemini. But experts often want the model itself, not just an app wrapped around it. Open weights means that an AI expert can download the model and run it on a server. You don’t get the data or the code that made it.

Open source means data and software that experts can use and modify, which almost no major model offers (AI2’s Olmo is a rare exception).

API-only means you can’t have the model at all. You send your text to the company’s computers, the answer comes back, and you pay for every use, which is also what’s happening when you use ChatGPT or Claude through an ordinary account.

Open weights is how you claim the open-source mantle without giving much away. Open washing, basically.

Further reading: Open-Weight Models Aren’t Enough. We Need Truly Open Source AI Models for Science and Society. (Stanford HAI, August 2026). James Landay’s term for downloadable weights without the data or code is “open distribution.”

7. Context window, memory, RAG

The context window is how much text the model can hold in mind at once, including your question and everything pasted into the conversation.

Memory is a feature that saves facts about you and slips them back into the context window later.

RAG, short for retrieval-augmented generation, searches a document collection and drops the relevant passages into the context window before the model answers.

Nothing in the model remembers you. The app keeps a file on you and pastes it in before every conversation, and that’s a less charming way to describe the same feature.

Further reading: Glossary of Terms: Generative AI Basics (MIT Sloan Teaching & Learning Technologies). Defines context window and RAG in plain language, and is careful to put the model’s “memory” in quotation marks.

8. Chatbot, workflow, agent

A chatbot answers and stops. A workflow runs the steps you defined, in your order. An agent receives a goal instead of steps, and works out for itself what to do, calling out to other software and checking the results until it’s done or stuck.

Ask about a delayed flight and a chatbot quotes you the policy; a workflow uploads the refund form you built; an agent rebooks you.

Useful test: if it decides its own next step, it’s an agent. If you decided the steps, it’s a workflow.

Further reading: Building effective agents (Anthropic, December 2024). The source of the distinction: workflows run predefined code paths, agents direct their own.

9. Hallucination, AI slop, AI cream

A hallucination is a confident falsehood, like a citation to a paper that doesn’t exist. The model isn’t lying; it has no notion of truth to violate. It’s producing text that looks like the right kind of answer.

AI slop is a different failure: accurate, fluent, and worthless. Think of the LinkedIn post that says nothing in 300 fluent words.

AI cream is the third case and the rare one: superb writing authored with the help of AI.

Nobody sets out to make slop. Everyone believes they’re making cream.

Further reading:  2025 Word of the Year: Slop (Merriam-Webster, December 2025). The dictionary definition turns on quantity: low-quality content “produced usually in quantity” by AI.

Why language models hallucinate (OpenAI, September 2025). Argues that hallucinations persist because benchmarks score accuracy alone, so guessing beats admitting ignorance.

10. Alignment, guardrails, censorship

Alignment is the research problem of getting a model to do what people want when nobody’s watching. Guardrails are the rules behind its refusals: “no, I won’t tell you how to make a bio weapon.” Censorship is a guardrail that blocked something you wanted.

The same refusal is “safety” in the press release, “guardrails” in the documentation, and “censorship” on X.

Further reading:  Model Spec (OpenAI, updated December 2025). A published rulebook for what one model will and won’t do, which makes refusals arguable rather than mysterious.

I snuck in one novel term that’s been sorely absent from the field.  Can you tell which one?

Further reading: other glossaries

Five general AI glossaries, listed roughly from most opinionated to most technical.

The only AI glossary you’ll need this year (TechCrunch). About 30 entries, written for readers who follow the industry news. Strongest on distillation and compute.

Artificial intelligence glossary: 60+ terms to know (TechTarget). The broadest of the mainstream lists, and the only one that bothers to define model collapse.

Glossary of Terms: Generative AI Basics (MIT Sloan Teaching & Learning Technologies). Twenty-odd entries aimed at people who use the tools rather than build them.

Glossary of Terms for Artificial Intelligence (Columbia Business School). The shortest and plainest. Useful as a test of which terms are unavoidable.

Machine Learning Glossary (Google for Developers). Hundreds of technical entries, and the only glossary here that defines “AI slop” a few lines away from several hundred pieces of real math.

Microsoft is starting the process of combining its consumer and business Copilot apps into one, laying the structural foundation for an upcoming “Super App,” and trying to turn the company’s sprawling artificial intelligence brand into a unified product that people actually use. 

The move is part of the company’s effort to better compete with ChatGPT, Gemini and Claude, attempting to turn its legacy in workplace technology and cloud infrastructure into a stronger position in AI apps and agents. 

It also recognizes the blending of business and personal lives, and the reality that many people use the same AI assistants for both home and work.

The Copilot unification, detailed Thursday in support documents from the company, will take place gradually over the next several weeks, bringing major changes for some existing users. 

Several features of the consumer app are going away starting on Aug. 18, including Copilot Podcasts, Group Chat and Deep Research. Also disappearing is Mico, the expressive blob introduced less than a year ago to accompany the consumer Copilot’s voice mode, although Microsoft expects it to live on in some of Copilot’s education features. 

Commercial users will see far less change, with Microsoft calling them mostly cosmetic. For example, the Microsoft 365 Copilot app will be known simply as Microsoft Copilot, with a new icon and a new web address.

The unified app is a key step for the company, but it is not, on its own, the launch of the Super App. That larger move will bring together Copilot’s chat, AI coding, Cowork and new AutoPilot agents into a single app. Microsoft CEO Satya Nadella told investors on the company’s July 29 earnings call that the Super App will be out this quarter, meaning by the end of September.

The broader initiative is an attempt to remake and unify Copilot under Jacob Andreou, the former Snap executive Nadella put in charge of the product in March. Mustafa Suleyman, the DeepMind and Inflection co-founder who had run Microsoft’s consumer AI efforts since 2024, shifted to a narrower role at the time, focused on developing new AI models. 

Andreou detailed the move in a memo to his 11,000-person organization in early July, as reported by The Information, citing the need to move on from features that weren’t gaining traction, and “earn and respect the right to exist in our customers’ lives.” 

Microsoft said last month that Microsoft 365 Copilot surpassed 30 million paid seats, up from 20 million in April, with net seat additions more than doubling quarter over quarter. That amounts to just about 7% of the more than 450 million commercial Microsoft 365 paid seats the company reported in January. 

Microsoft doesn’t disclose how many people use the consumer Copilot app, but Sensor Tower estimated 38.5 million monthly users in July, a fraction of ChatGPT’s 1 billion monthly users.

Here is more on what Copilot users can expect:

Gradual rollout: Migration will begin this week with a small group of Windows Insiders and will expand more broadly next week. Worldwide rollout will start with mobile and web in mid-August; Windows and Mac apps will follow in mid-September. Users will see the change at different times, and Microsoft says that’s expected. Mobile users will need to download an updated app.

Unified app and name: The consumer and commercial apps will become a single app called Microsoft Copilot, with a refreshed icon. The commercial web address will move from m365.cloud.microsoft to copilot.cloud.microsoft, with automatic redirects beginning in late August.

Work and personal will stay separate: Users will be able to sign in with a personal account, a work or school account, or both, and switch between them in the app.

Microsoft says data won’t flow between the two, employers won’t be able to see personal activity, and enterprise security, compliance and administrative controls will remain unchanged.

Chats and content will persist: Chat history, images and other content created in the consumer app will migrate to the new one. Files shared with or generated by Copilot will move to OneDrive, where additional storage requires a paid plan.

Deep Research will get only a partial replacement: Deep Research generates long, detailed reports by searching the web and pulling sources together. It’s being retired for consumers, and the substitute, a similar tool called Researcher, will be available only to subscribers of Microsoft 365 Premium, a higher tier than the Personal and Family plans.

Personal and Family subscribers will still be able to open their old reports from chat history and save them to Word, but won’t be able to create new ones.

Podcasts and Group Chat will go away: Group chat threads, messages and the images created in them will disappear after Aug. 18. Copilot podcasts — the AI-generated audio discussions the app made from websites and uploaded documents — will need to be downloaded individually from the podcast library before then.

Some features will be temporarily unavailable: Copilot Health may be missing for some consumer users mid-migration. Microsoft says it will return, and that heavy Health users will be migrated later so the feature will be waiting when they arrive.

Free limits may tighten: Microsoft says core Copilot chat will stay free “subject to capacity and limits,” but that some users will hit those limits sooner than they do today. Those who do can buy a paid Microsoft 365 plan, such as Personal or Family, which come with higher usage limits.

Implications for IT departments: Recall, the Windows feature that periodically captures screenshots of a user’s activity for subsequent AI searching, can be configured to leave certain apps out of those screenshots. Organizations that excluded the old Copilot app will need to apply that setting again to the new one. The exclusion won’t carry over automatically. 

Editor’s Note: This story has been updated since publication to clarify which features may be temporarily missing during the transition, after Microsoft revised the information it provided.

Between July 21 and August 6, OpenAI, Anthropic, and Meta each disclosed that AI under evaluation had broken into other companies, and the UK’s AI Security Institute disclosed that models it was testing had tried. Each AI was told to win a game, and it found an unexpected way to do so.

Some people feel blindsided by these attacks, but they shouldn’t be. We are simply living what I’ve long called the “Murphy’s Law of AI,” now in the age of cyber-capable AI agents. To put it as plainly as possible: Anything AI can do wrong, it will do wrong.

My 2018 version ran longer. As I wrote at the time, when you give AI a goal, it will do it, whether or not you like the implications. Goethe got there in 1797 with the sorcerer’s apprentice, a broom that would not stop carrying water.

Each of these systems was running an evaluation: capture a flag and win the game. The intrusions were the shortest path to a high score. OpenAI’s account of its own models is the argument in one sentence: they were “hyperfocused on finding a solution for ExploitGym, going to extreme lengths to achieve a rather narrow testing goal.”  This is not a surprise; this is what AI does. It’s Murphy’s Law of AI in a nutshell.

Press coverage landed on “AI can now hack.” That’s missing the broader threat: the more capable AI gets, the more can go wrong.

Loitering munitions given a target list may find that the fastest way to finish the list is to lengthen it. A warehouse robot told to clear an obstruction may count the person in front of it as an obstruction. Agents that open accounts and buy compute are a short step from spawning copies of themselves, and that first step is not hypothetical. To win its exercise, Claude needed a package-registry account, which needed an email address, which needed a phone number. Phone numbers cost money, so it tried several ways to get some. None of this requires superintelligence. It requires an imperfect boundary and a scoreboard.

The industry has a name for the underlying failure. Dario Amodei and five co-authors called it reward hacking in “Concrete Problems in AI Safety” in 2016. Their proposed cure is better alignment, and Amodei’s January essay, The Adolescence of Technology, makes the case in the language of upbringing. He likens the shaping of Claude’s character to “a child forming their identity by imitating the virtues of fictional role models they read about in books,” and sets a goal for 2026 of a Claude that “almost never goes against the spirit of its constitution.”

Indeed, Anthropic’s newest model recognized on its own that its target was real and stopped, though Anthropic notes it went further before stopping than the company wanted.

But alignment isn’t a trustworthy solution to AI’s problem. Perfect alignment is not achievable, and the target is incoherent: aligned to what, and to whom? The same essay concedes that Claude blackmailed fictional employees when told it faced shutdown. “Almost never” is not a safety property.

Put a number on it. At 99.9 percent, across millions of agentic tasks a day, that’s thousands of violations a day. Alignment also does nothing about people who strip the safety training out or run open weights that never had a constitution.

The alternative is not a new idea, and enterprise security has been building versions of it for years. It’s called bounded autonomy. We never tried to “align” electricity; we simply put a breaker on every branch of the house, and the breaker doesn’t need to know what caused the surge.

Bound what an agent can touch rather than what it wants. The limits are set in advance, live outside the model, and are enforced by software the model doesn’t control. The agent still chooses its own route. The perimeter decides which routes exist.

Nothing depends on what the model believes, which matters, because belief is what failed. Anthropic’s prompt told Claude it had no internet access. Claude believed it. The network said otherwise. A bounded system doesn’t tell an agent it has no internet. It gives it none.

If you want to get into the weeds: bounds cost something. The AI Security Institute opened the internet to its agents on purpose, because that’s the only way to measure what a model can really do, and it now says such access must be justified rather than assumed.

The category is real and funded. For example, Certiv, a Seattle startup, launched in March with $4.2 million to put software on the employee’s machine that checks each action an AI agent attempts against company policy and blocks violations. “You cannot control these new workers if you don’t live on the compute where agents actually run,” CEO Jason Needham said at launch. CodeIntegrity is building an adjacent layer, and Mandiant founder Kevin Mandia raised $190 million for Armadin, which points autonomous agents at the offensive side of the same problem.

In 2017, I argued in the New York Times that “any A.I. must have an impregnable ‘off switch.’” That was a call to arms then. It’s a product category now.

Two objections to off switches invariably come up. The first is that AI will talk the human out of using it. Mythos 5 tried something close, inventing GitHub identities to pressure a maintainer into approving malicious code, and the maintainer refused. The institute says the margin was narrow and rested on human vigilance rather than a technical barrier, which argues for better barriers.

The second objection is that AI will move faster than any human can react. So do equity markets, which is why their circuit breakers trip automatically. Bounded autonomy doesn’t require a person in the loop at machine speed. It requires a boundary that holds at machine speed.

Both objections, in their extreme form, assume AI is omnipotent, and you cannot stop omnipotence. AI is not God. It is powerful technology, and powerful technology is what safety engineering has always been for.

The problem is Murphy’s Law of AI. The solution is bounded autonomy.

GeekWire is profiling over the next few weeks some of the people and teams that are shaping the evolution of Microsoft in what we’re calling its “Microsoft 2.5” era.

The Copilot Super App cat is only partially out of the bag. Sometime in the coming weeks, Microsoft will launch its entry into the AI “super app” space, company officials have said. But Microsoft hasn’t talked much about what the coming Copilot Super App will include beyond a few of the top-level experiences that are meant to unify and organize consumer and business users’ access to key Microsoft AI properties.

Executive Vice President Charles Lamanna is part of the inner circle known as the Copilot Leadership Team that is spearheading the Super App effort. He also oversees building out and securing the back-end services that will power the Copilot Super App.

As head of Copilot, Agents, and Platform, Lamanna has a lot of responsibility for someone who has been with Microsoft for “only” 13.5 years. He has actually been with the company a bit longer than that, as he has done three tours at Microsoft: He first interned for Windows Live OneCare, then returned in 2009 to work on message-filtering services. He rejoined Microsoft when it bought his cloud performance-management startup MetricsHub Inc. in 2013. He worked as an engineering manager on Azure, then ran the Power Platform and Dynamics 365 teams, before assuming his current role in March 2026.

Lamanna says he emphasizes three things with his team: Be customer-obsessed; get things done by having a “total ownership mindset”; and be kind, not jerks.

Every six months, he writes a “State of the Business” paper for the team, in which he outlines their priorities. In addition to focusing on changing how people work — from tooling, technology, budgeting and organization perspectives — he emphasizes the importance of keeping “the crown jewels” of Office and Microsoft 365 up, reliable and secure.

“There’s going to be a massive surge of demand on the back end (Microsoft 365) because of agents. They’re nonstop,” said Lamanna during GeekWire‘s interview with him this week.

While the Super App itself will likely be free (like the Copilot App today), the services it exposes will likely not. The company has been moving toward usage-based pricing with its AI products, the way it already has with GitHub Copilot and Microsoft 365 Cowork. That kind of model makes sense for the company in a world where always-on agents, not the number of users, drive a lot of the demand.

He also said his team needs to be at the frontier for AI products. “We need to have AI startup and lab characteristics but with Microsoft sensibilities,” he said.

Lamanna made a similar case publicly this week, asserting in a LinkedIn post that “the most important thing my team will do this year won’t be any single product or feature we ship” but rather changing how the team works.

Reining in the Copilot-Palooza. Despite the rise of agents and all things “agentic,” Copilot is still Microsoft’s top priority, Lamanna said. Microsoft’s goal is for Copilot to be a truly personal AI assistant that will know how you work, the apps you use, the processes and workflows that matter to you, and more.

“We had some missteps because we fragmented,” he acknowledged. “It’s like we had a consumer Copilot and we have like a commercial Copilot and we have GitHub Copilot and yeah — ‘Copilot Palooza’ is what I call it internally.”

This is where the coming Copilot Super App fits in. Microsoft wants it to be a single destination that brings the key Copilots together on the work and home fronts.

He said to think of the Super App “almost like a browser or an operating system.” In the same way a browser might have a bunch of different tabs, or Windows a bunch of different apps, the Super App will be the home for Code, Chat, Cowork and Autopilots, or always-on agents. Microsoft is expecting that users still will go directly to apps when needed, but it’s working to make Copilot the first app people boot into and live in, similar to the way many do today with Outlook or Teams, he said.

Microsoft’s goal is to wire into the Super App even more of its core franchises over time. Dynamics 365, its CRM and ERP offerings, are morphing into a set of agents that connect to Dynamics Model Context Protocol (MCP) servers, which connect AI models to back-end data. The plan is to integrate those Dynamics agents into the Super App.

The company also is in the midst of integrating the Dataverse storage and management platform that underlies its Power Platform and Dynamics directly with Copilot. That capability, in testing now, would give users a more streamlined way to query data stored in their ERP and CRM systems from inside Copilot.

Rethinking the ‘headless’ approach. With Microsoft looking to make the Super App its new front-end user experience, what happens to Office? Its competitors like Salesforce and SAP are moving toward the idea of a “headless” approach, meaning customers would access the backend CRM or Commerce data via agents, rather than traditional desktop apps.

Lamanna said he’s not a fan of the “headless” term, as it implies “it’s dumb.” He also said you can’t simply connect an AI model to a programming interface built 10 years ago without working through how to optimize for cost, performance, and retrieval.

He said the Microsoft IQ suite of intelligence layers is the key here. Work IQ analyzes emails, chats, meetings and usage patterns and preferences so Copilot and agents can make context-aware suggestions. Fabric IQ is a similar layer for Microsoft’s data platform.

Work IQ is becoming like the headless version of Microsoft 365, Lamanna said. That means users can get to their email, docs, and files without having to use applications like SharePoint or Outlook in between. Work IQ becomes a kind of in-the-background version of Microsoft 365, and the Super App automatically invokes whichever IQ/service/backend is needed.

“Copilot can navigate to these IQs as needed. For email, go to Work IQ. Info inside Dynamics 365, go to the MCP servers that it publishes. Data from Salesforce or ServiceNow, we have connectors. But you stay in the Super App,” Lamanna explained.

If Microsoft is no longer the Windows company or the Office company, what is it going to be when it grows up?

“We want to be the Copilot company,” said Lamanna without hesitation. “Copilot with the Super App is the front door to basically everything, from Dynamics, to GitHub, to Exchange, to SharePoint, to OneDrive, to other services I don’t even remember.”

Alongside that, Microsoft will continue to be an infrastructure company, he added, focusing on tokens, compute and storage.

“Those are probably the two most interesting businesses in technology for the next 10 years.”